@objectstack/plugin-approvals 17.0.0-rc.3 → 17.0.0-rc.4

package/dist/index.mjs

@@ -2013,6 +2013,7 @@ var SysApprovalDelegation = ObjectSchema4.create({
 import { createHash, randomBytes } from "crypto";
 import {
   APPROVAL_BRANCH_LABELS,
+  APPROVAL_REVISE_NODE_TYPE,
   approverTypeIsOrgScoped,
   canonicalApproverType,
   normalizeDecisionOutputs
@@ -3431,6 +3432,47 @@ var _ApprovalService = class _ApprovalService {
       );
     }
   }
+  /**
+   * The run named by a recorded outcome cannot be advanced at all, because no
+   * automation engine in THIS process implements the capability it needs
+   * (#4420). Returns the reason, or `undefined` when the capability is there
+   * and the caller should proceed.
+   *
+   * **Why this is not simply "not our problem".** Approvals is legitimately
+   * usable with no engine attached, and {@link assertRunResumable} deliberately
+   * stays out of the way for that reason. But "no engine is attached" and "no
+   * run is waiting" are different facts, and only the second is benign: a
+   * `flow_run_id` on the row is the request's OWN declaration that a run is
+   * parked on this decision. Deciding it in a process that cannot resume it
+   * reproduces #4420's reported half-state exactly — a durable decision, a
+   * mirrored status field frozen mid-workflow, a flow parked forever — while
+   * the caller is answered HTTP 200. The engine-less composition is the one
+   * path the #4420 fix left silent, because every guard it added hangs off an
+   * engine that is not there.
+   *
+   * **So the outcome stands, but it is never silent.** Rolling the decision
+   * back is not on the table (a human really did decide, and the row is
+   * already durable), and refusing every such call would break the standalone
+   * compositions the pre-flight protects. What is owed is the report: `error`
+   * level per AGENTS.md's durability rule — persisted state and runtime state
+   * disagree and nothing looks broken from the outside — plus a `resumeError`
+   * on the response, so `resumed: false` carries its reason instead of leaving
+   * the caller to guess whether a resume was even attempted.
+   *
+   * Reuses the registered `RESUME_FAILED` code (ADR-0112 ledger) and
+   * {@link serviceResume}'s message shape: the fact being reported — an
+   * outcome recorded whose run did not advance — is the same one, and this
+   * needs no new vocabulary of its own.
+   */
+  missingRunCapability(runId, requestId, what, capability) {
+    const fn = capability === "resume" ? this.automation?.resume : this.automation?.cancelRun;
+    if (typeof fn === "function") return void 0;
+    this.logger?.error?.(
+      "[approvals] no automation engine to advance the recorded outcome \u2014 the run is stranded",
+      { request: requestId, run: runId, outcome: what, capability }
+    );
+    return `${capability} of run '${runId}' failed [RESUME_FAILED]: ${what} was recorded on request ${requestId}, but no automation engine in this process can ${capability} its flow run \u2014 the run stays parked and the record's mirrored status will not advance. Compose the automation service in this host, or recall the request to release the record.`;
+  }
   /**
    * Resume the run behind an outcome that has ALREADY been written down, and
    * fail loudly when it cannot be (#4420).
@@ -3442,12 +3484,17 @@ var _ApprovalService = class _ApprovalService {
    * everything it catches never reaches a write.
    *
    * `RESUME_IN_PROGRESS` is the exception — a concurrent resume is already
-   * advancing the run, so the outcome stands and only `resumed` is false.
+   * advancing the run, so the outcome stands and only `resumed` is false. So
+   * is a composition with no engine at all ({@link missingRunCapability}),
+   * which cannot throw without breaking every standalone deployment — it
+   * reports through `resumeError` instead.
    *
    * @param what - how the recorded outcome reads in the error, e.g.
    *   `"the approve decision"`.
    */
   async resumeRecordedOutcome(runId, requestId, what, signal) {
+    const missing = this.missingRunCapability(runId, requestId, what, "resume");
+    if (missing) return { resumed: false, resumeError: missing };
     try {
       await this.serviceResume(runId, signal);
       return { resumed: true };
@@ -3490,7 +3537,7 @@ var _ApprovalService = class _ApprovalService {
     const result = await this.decideNode(requestId, input, context);
     let resumed = false;
     let resumeError;
-    if (result.finalized && result.runId && typeof this.automation?.resume === "function") {
+    if (result.finalized && result.runId) {
       const branchLabel = result.decision === "approve" ? APPROVAL_BRANCH_LABELS.approve : APPROVAL_BRANCH_LABELS.reject;
       const outcome = await this.resumeRecordedOutcome(
         result.runId,
@@ -3527,7 +3574,7 @@ var _ApprovalService = class _ApprovalService {
    *
    * ADR-0044: also valid on the LATEST `returned` request of its run — the
    * submitter abandons the revision window instead of resubmitting. The run
-   * is then paused at the revise wait node (no reject edge), so it is
+   * is then paused at the revise-window node (no reject edge), so it is
    * terminally cancelled via {@link ApprovalResumeSurface.cancelRun} rather
    * than resumed.
    */
@@ -3585,33 +3632,39 @@ var _ApprovalService = class _ApprovalService {
     let resumed = false;
     let resumeError;
     if (inReviseWindow) {
-      if (runId && typeof this.automation?.cancelRun === "function") {
+      if (runId) {
+        resumeError = this.missingRunCapability(runId, requestId, "the recall", "cancelRun");
+        if (!resumeError) {
+          try {
+            await this.automation.cancelRun(runId, `approval request ${requestId} recalled during revision`);
+          } catch (err) {
+            resumeError = err?.message ?? String(err);
+            this.logger?.error?.("[approvals] cancelRun after revise-window recall failed \u2014 the run may be stranded", {
+              request: requestId,
+              run: runId,
+              error: resumeError
+            });
+          }
+        }
+      }
+    } else if (runId) {
+      resumeError = this.missingRunCapability(runId, requestId, "the recall", "resume");
+      if (!resumeError) {
         try {
-          await this.automation.cancelRun(runId, `approval request ${requestId} recalled during revision`);
+          await this.serviceResume(runId, {
+            branchLabel: APPROVAL_BRANCH_LABELS.reject,
+            output: { decision: "recall", requestId }
+          });
+          resumed = true;
         } catch (err) {
           resumeError = err?.message ?? String(err);
-          this.logger?.error?.("[approvals] cancelRun after revise-window recall failed \u2014 the run may be stranded", {
+          this.logger?.error?.("[approvals] resume after recall failed \u2014 the run may be stranded", {
             request: requestId,
             run: runId,
             error: resumeError
           });
         }
       }
-    } else if (runId && typeof this.automation?.resume === "function") {
-      try {
-        await this.serviceResume(runId, {
-          branchLabel: APPROVAL_BRANCH_LABELS.reject,
-          output: { decision: "recall", requestId }
-        });
-        resumed = true;
-      } catch (err) {
-        resumeError = err?.message ?? String(err);
-        this.logger?.error?.("[approvals] resume after recall failed \u2014 the run may be stranded", {
-          request: requestId,
-          run: runId,
-          error: resumeError
-        });
-      }
     }
     const fresh = await this.readBackRequest(requestId, context);
     return { request: fresh, runId, resumed, ...resumeError ? { resumeError } : {} };
@@ -3621,7 +3674,7 @@ var _ApprovalService = class _ApprovalService {
    * ADR-0044 send back for revision. Finalises the pending request as
    * `returned` (a third terminal state — approver-initiated rework, distinct
    * from submitter-initiated `recalled`) and resumes the owning flow run down
-   * its `revise` edge to a wait point: the record lock (keyed on `pending`)
+   * its `revise` edge to the revise window: the record lock (keyed on `pending`)
    * releases, the submitter reworks the data, then {@link resubmit}s.
    *
    * Requires the approval node to declare a `revise` out-edge — validated
@@ -3696,7 +3749,7 @@ var _ApprovalService = class _ApprovalService {
       }
       let resumed2 = false;
       let resumeError2;
-      if (runId && typeof this.automation?.resume === "function") {
+      if (runId) {
         const outcome = await this.resumeRecordedOutcome(
           runId,
           requestId,
@@ -3744,7 +3797,7 @@ var _ApprovalService = class _ApprovalService {
     }
     let resumed = false;
     let resumeError;
-    if (runId && typeof this.automation?.resume === "function") {
+    if (runId) {
       const outcome = await this.resumeRecordedOutcome(
         runId,
         requestId,
@@ -3776,7 +3829,7 @@ var _ApprovalService = class _ApprovalService {
   /**
    * ADR-0044 resubmit after rework. Valid on the LATEST `returned` request of
    * its run, submitter-only. Audits `resubmit` on the returned (round-N)
-   * request and resumes the run from the revise wait node; traversal walks
+   * request and resumes the run from the revise-window node; traversal walks
    * the declared back-edge into the approval node, whose executor opens the
    * round-N+1 request — fresh approver slate, record re-locks.
    */
@@ -3824,7 +3877,7 @@ var _ApprovalService = class _ApprovalService {
     }, { context: SYSTEM_CTX2 });
     let resumed = false;
     let resumeError;
-    if (runId && typeof this.automation?.resume === "function") {
+    if (runId) {
       const outcome = await this.resumeRecordedOutcome(
         runId,
         requestId,
@@ -3845,6 +3898,21 @@ var _ApprovalService = class _ApprovalService {
    * out-edge before send-back is allowed — the engine's branch-label fallback
    * (no matching label ⇒ ALL out-edges) must never be reachable from a user
    * action.
+   *
+   * Since #3823 it also checks WHAT that edge targets: the revise window must
+   * be an `approval_revise` node, the pause this service owns. ADR-0044 D3
+   * pointed the edge at an ordinary `wait`, which is `resumeAuthority: 'any'`,
+   * so a raw engine resume walked the resubmit back-edge with no submitter
+   * check, no `resubmit` audit row, and — with a pending request colliding on
+   * the record — destroyed the run by consuming the suspension before the
+   * re-entry failed. Refused HERE, before any mutation, for the same reason the
+   * missing-edge check is: a run must never be parked in a revise window that
+   * something other than {@link resubmit} can advance.
+   *
+   * Also refused at authoring time — `flow-approval-revise-target-not-service-owned`
+   * in `@objectstack/lint` gates `os build` / `os validate` / `os lint` and the
+   * runtime metadata publish path — so a flow reaching this check at all is one
+   * published before that gate existed.
    */
   async assertReviseEdge(raw, nodeId) {
     const processName = String(raw.process_name ?? "");
@@ -3853,12 +3921,23 @@ var _ApprovalService = class _ApprovalService {
       throw new Error("VALIDATION_FAILED: send-back requires the owning flow definition (automation engine unavailable)");
     }
     const flow = await this.automation.getFlow(flowName);
-    const hasRevise = Array.isArray(flow?.edges) && flow.edges.some((e) => e?.source === nodeId && e?.label === APPROVAL_BRANCH_LABELS.revise);
-    if (!hasRevise) {
+    const reviseEdges = Array.isArray(flow?.edges) ? flow.edges.filter((e) => e?.source === nodeId && e?.label === APPROVAL_BRANCH_LABELS.revise) : [];
+    if (reviseEdges.length === 0) {
       throw new Error(
         `VALIDATION_FAILED: approval node '${nodeId}' has no '${APPROVAL_BRANCH_LABELS.revise}' out-edge \u2014 the flow does not support send-back for revision`
       );
     }
+    const nodeTypeById = new Map(
+      (Array.isArray(flow?.nodes) ? flow.nodes : []).filter((n) => typeof n?.id === "string").map((n) => [n.id, typeof n.type === "string" ? n.type : ""])
+    );
+    for (const edge of reviseEdges) {
+      const target = typeof edge?.target === "string" ? edge.target : "";
+      const targetType = nodeTypeById.get(target);
+      if (targetType === APPROVAL_REVISE_NODE_TYPE) continue;
+      throw new Error(
+        `VALIDATION_FAILED: approval node '${nodeId}' has a '${APPROVAL_BRANCH_LABELS.revise}' out-edge into node '${target || "(unknown)"}'` + (targetType === void 0 ? " which the flow does not declare" : ` of type '${targetType || "(untyped)"}'`) + `, but the revise window must be an '${APPROVAL_REVISE_NODE_TYPE}' node \u2014 that pause continues only through this service (submitter-only, audited, and refusing a colliding pending request), and any other node type there is resumable by anyone with the run id (amended ADR-0044, #3823). Fix the flow: set node '${target || "<revise target>"}' to type '${APPROVAL_REVISE_NODE_TYPE}'.`
+      );
+    }
   }
   /**
    * ADR-0044 guard: a `returned` request is only actionable (resubmit /
@@ -5590,8 +5669,6 @@ function bindApprovalLockHook(engine, logger) {
     const changedFields = Object.keys(data).filter((k) => k !== "id" && k !== "updated_at");
     if (changedFields.length === 0) return;
     if (ctx?.session?.isSystem) return;
-    const roles = ctx?.session?.roles ?? [];
-    if (Array.isArray(roles) && roles.includes("admin")) return;
     const gating = await gatingRequests(engine, ctx, object);
     if (gating.length === 0) return;
     const writerRun = ctx?.provenance?.flowRunId;
@@ -5613,8 +5690,6 @@ function bindDelegationWriteGuard(engine, logger) {
   const makeGuard = (isInsert) => async (ctx) => {
     const session = ctx?.session ?? {};
     if (session.isSystem) return;
-    const roles = session.roles ?? [];
-    if (Array.isArray(roles) && roles.includes("admin")) return;
     const userId = session.userId != null ? String(session.userId) : "";
     const data = ctx?.input?.data;
     const rows = Array.isArray(data) ? data : data && typeof data === "object" ? [data] : [];
@@ -5648,11 +5723,53 @@ function unbindAllHooks(engine) {
 
 // src/approval-node.ts
 import {
-  defineActionDescriptor,
+  defineActionDescriptor as defineActionDescriptor2,
   ApprovalNodeConfigSchema,
   getApprovalNodeConfigJsonSchema,
   APPROVAL_NODE_TYPE
 } from "@objectstack/spec/automation";
+
+// src/approval-revise-node.ts
+import {
+  defineActionDescriptor,
+  APPROVAL_REVISE_NODE_TYPE as APPROVAL_REVISE_NODE_TYPE2
+} from "@objectstack/spec/automation";
+var APPROVAL_REVISE_CORRELATION_PREFIX = "approval_revise:";
+function registerApprovalReviseNode(automation, logger) {
+  automation.registerNodeExecutor({
+    type: APPROVAL_REVISE_NODE_TYPE2,
+    descriptor: defineActionDescriptor({
+      type: APPROVAL_REVISE_NODE_TYPE2,
+      version: "1.0.0",
+      name: "Revise Window",
+      description: "Durable pause an approval send-back parks the run on while the submitter reworks the record. Continues only through the approvals service (resubmit), which re-enters the approval node over the declared back-edge.",
+      icon: "pencil",
+      // Waits on a human — the same category as `approval` and `screen`.
+      category: "human",
+      paradigms: ["flow"],
+      source: "plugin",
+      supportsPause: true,
+      isAsync: true,
+      // #3823 / amended ADR-0044: THE point of this node type. The revise
+      // window is a service-owned continuation, so the #3801 gate must refuse
+      // a raw resume of it — which it does for any node type declaring this.
+      resumeAuthority: "service"
+      // No config: the window is pure position in the graph. Left schemaless
+      // (like `wait` / `subflow` / `decision`) rather than declaring an empty
+      // object, so nothing invents an authorable surface that has no reader.
+    }),
+    async execute(node) {
+      return {
+        success: true,
+        suspend: true,
+        correlation: `${APPROVAL_REVISE_CORRELATION_PREFIX}${node.id}`
+      };
+    }
+  });
+  logger?.info?.("[approvals] approval revise-window node executor registered");
+}
+
+// src/approval-node.ts
 var SYSTEM_CTX4 = { isSystem: true, positions: [], permissions: [] };
 function nestVariables(variables) {
   const vars = {};
@@ -5670,9 +5787,10 @@ function nestVariables(variables) {
   return vars;
 }
 function registerApprovalNode(automation, service, logger) {
+  registerApprovalReviseNode(automation, logger);
   automation.registerNodeExecutor({
     type: APPROVAL_NODE_TYPE,
-    descriptor: defineActionDescriptor({
+    descriptor: defineActionDescriptor2({
       type: APPROVAL_NODE_TYPE,
       version: "1.0.0",
       name: "Approval",
@@ -5990,12 +6108,14 @@ var ApprovalsServicePlugin = class {
   }
 };
 export {
+  APPROVAL_REVISE_CORRELATION_PREFIX,
   ApprovalService,
   ApprovalsServicePlugin,
   SysApprovalAction,
   SysApprovalApprover,
   SysApprovalDelegation,
   SysApprovalRequest,
-  registerApprovalNode
+  registerApprovalNode,
+  registerApprovalReviseNode
 };
 //# sourceMappingURL=index.mjs.map