@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/flows-actors/services/context-curation.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-curation.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/services/context-curation.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAE/B;;GAEG;AACH,KAAK,cAAc,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;AAE/D;;;;;;;;GAQG;AACH,qBACa,6BAA6B;IAKH,OAAO,CAAC,QAAQ,CAAC,MAAM;IAH5D,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa;IAQ3E;;;;;;OAMG;IACG,MAAM,CACV,KAAK,EAAE,oBAAoB,EAAE,EAC7B,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwElC;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IAkBhC;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAazB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;;;;OAKG;IACH,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAIvC;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM;CAG3D"}
+{"version":3,"file":"context-curation.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/services/context-curation.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAE/B;;GAEG;AACH,KAAK,cAAc,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;AAE/D;;;;;;;;GAQG;AACH,qBACa,6BAA6B;IAKH,OAAO,CAAC,QAAQ,CAAC,MAAM;IAH5D,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAG3B,MAAM,EAAE,aAAa;IAQ3E;;;;;;OAMG;IACG,MAAM,CACV,KAAK,EAAE,oBAAoB,EAAE,EAC7B,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwElC;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IAkBhC;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAazB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;;;;OAKG;IACH,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAIvC;;OAEG;IACH,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM;CAG3D"}

package/dist/esm/flows-actors/services/conversational-execution.backend.service.d.ts

@@ -5,6 +5,9 @@ import { ServicesRegistryHandlerBackendService } from '../../base-classes/servic
 import { SystemAccessBackendService } from '../../base-classes/services/services/system-access.backend.service';
 import { ExecutionContextCreatorBackendService } from '../../runtime/services/execution-context-creator.backend.service';
 import type { SocketAuthResult } from '../../runtime/models/execution-context.backend.schemas';
+import type { AuditLogsBackendService } from '../../compliance/audit-trails/services/audit-logs.backend.service';
+import type { RateLimitBackendService } from '../../errors/services/rate-limit.backend.service';
+import type { AuthorizationsBackendService } from '../../security/authorizations/services/authorizations.backend.service';
 import { FlowsActorsRegistryService } from './flows-actors-registry.service';
 import { AgentsBackendService } from './agents.backend.service';
 import { CoreResourceType, CoreWebSocketEvent, FlowsActors_Status, type ExecutionContext_InitiatorIds, type FlowActorExecution_Message } from '@wildo-ai/saas-models';
@@ -143,7 +146,23 @@ export declare class ConversationalExecutionBackendService {
     private readonly servicesRegistryHandler;
     private readonly executionContextCreator;
     private readonly systemAccess;
-    constructor(logger: LoggerService, flowsActorsRegistry: FlowsActorsRegistryService, agentsBackend: AgentsBackendService, resourcesRegistry: ResourcesRegistryBackendService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, executionContextCreator: ExecutionContextCreatorBackendService, systemAccess: SystemAccessBackendService);
+    private readonly rateLimitService;
+    private readonly authorizer;
+    /**
+     * The trail an approve-with-modifications decision leaves. `@optional` and feature-detected at
+     * every use, for the reason the MCP emitter already records: an absent or failing audit sink
+     * must never fail the act it was going to observe, and this service is constructed positionally
+     * by hand in several test doubles.
+     */
+    private readonly auditLogs?;
+    constructor(logger: LoggerService, flowsActorsRegistry: FlowsActorsRegistryService, agentsBackend: AgentsBackendService, resourcesRegistry: ResourcesRegistryBackendService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, executionContextCreator: ExecutionContextCreatorBackendService, systemAccess: SystemAccessBackendService, rateLimitService: RateLimitBackendService, authorizer: AuthorizationsBackendService, 
+    /**
+     * The trail an approve-with-modifications decision leaves. `@optional` and feature-detected at
+     * every use, for the reason the MCP emitter already records: an absent or failing audit sink
+     * must never fail the act it was going to observe, and this service is constructed positionally
+     * by hand in several test doubles.
+     */
+    auditLogs?: AuditLogsBackendService);
     /**
      * Resolve the owner scope to its persisted polymorphic variant: the concrete
      * `CoreResourceType`, the single owner FK to write on create, and the `*AsSystem`
@@ -257,6 +276,15 @@ export declare class ConversationalExecutionBackendService {
         resourceServerInstanceRef?: string;
         reason?: string;
         emitter?: FlowsActorsExecutionEmitter;
+        /**
+         * APPROVE-WITH-MODIFICATIONS (#566): arguments the approver authored, replacing the model's.
+         *
+         * Honoured only on an APPROVAL. On a denial there is no call to run, so arguments attached to
+         * one are meaningless rather than dangerous — they are ignored, silently, because refusing a
+         * denial over a field that cannot affect anything would block the one decision that must always
+         * be available.
+         */
+        modifiedToolArgs?: Record<string, unknown>;
     }): Promise<void>;
     /**
      * Re-invoke the agent with the human's decision appended, and finish the turn.
@@ -266,6 +294,27 @@ export declare class ConversationalExecutionBackendService {
      * array is opaque to us by contract, and rebuilding it would silently change what the model sees.
      */
     private resumeAfterApproval;
+    /**
+     * A modification that survived every server-side check and is ready to resume.
+     *
+     * Carries the rewritten array AND what the audit trail needs, because both are produced by the
+     * same walk of the SDK's message array — recomputing either afterwards would mean walking it a
+     * second time and could disagree with the version that was signed.
+     */
+    private prepareApprovedToolCallModification;
+    /**
+     * Put one approve-with-modifications decision on the audit trail.
+     *
+     * Fire-and-forget and feature-detected, the same contract as every other emitter in this codebase:
+     * an absent or failing sink must never fail the act it was going to observe. A decision a person
+     * made must not be undone because the trail could not be written — the observation is evidence,
+     * not a gate.
+     *
+     * Emitted AFTER the pause is cleared and BEFORE the model is re-invoked, so the row records the
+     * DECISION rather than its outcome. A resume that then fails does not make it untrue that a human
+     * authored those arguments and authorized the call.
+     */
+    private recordApprovalModification;
     /**
      * Resolve the target system as an ACTOR system. If it is a FLOW system, fail
      * closed with a typed "not implemented" (v1 has no flow conversational

package/dist/esm/flows-actors/services/conversational-execution.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conversational-execution.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/services/conversational-execution.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACpJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAC7H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAgE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAEL,gBAAgB,EAChB,kBAAkB,EASlB,kBAAkB,EAGlB,KAAK,6BAA6B,EAElC,KAAK,0BAA0B,EAEhC,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;AAEhG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9B,2FAA2F;AAC3F,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,gBAAgB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,YAAY,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpF;AAED,2EAA2E;AAC3E,MAAM,WAAW,kCAAkC;IACjD;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,qEAAqE;IACrE,SAAS,EAAE,6BAA6B,CAAC;IACzC;;;;;OAKG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB,+EAA+E;IAC/E,YAAY,EAAE,wBAAwB,CAAC;IACvC,2DAA2D;IAC3D,OAAO,EAAE,2BAA2B,CAAC;IACrC;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,SAAS,0BAA0B,EAAE,GAC9C,0BAA0B,EAAE,CAE9B;AAwBD,qBACa,qCAAqC;IAEX,OAAO,CAAC,QAAQ,CAAC,MAAM;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC3B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACjC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY;gBANzB,MAAM,EAAE,aAAa,EACD,mBAAmB,EAAE,0BAA0B,EACrD,aAAa,EAAE,oBAAoB,EAChC,iBAAiB,EAAE,+BAA+B,EAC3C,uBAAuB,EAAE,qCAAqC,EACvD,uBAAuB,EAAE,qCAAqC,EAChF,YAAY,EAAE,0BAA0B;IAG3G;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;;;OAIG;IACU,4BAA4B,CAAC,MAAM,EAAE,kCAAkC,GAAG,OAAO,CAAC,IAAI,CAAC;IA8XpG;;;;;OAKG;IACH;;;;;;;OAOG;YACW,gBAAgB;IAyB9B;;;;;;;;;;;;;;OAcG;YACW,yBAAyB;IA0EvC;;;;;;;;;;;;;;;OAeG;IACH;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,yBAAyB;IAejC;;;;;;;;;;;;;;;;;;OAkBG;IACU,mBAAmB,CAAC,MAAM,EAAE;QACvC,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,wBAAwB,CAAC;QACvC,IAAI,CAAC,EAAE,gBAAgB,CAAC;QACxB,yBAAyB,CAAC,EAAE,MAAM,CAAC;KACpC,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IA8B9B,iBAAiB,CAAC,MAAM,EAAE;QACrC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,YAAY,EAAE,wBAAwB,CAAC;QACvC,IAAI,CAAC,EAAE,gBAAgB,CAAC;QACxB,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,2BAA2B,CAAC;KACvC,GAAG,OAAO,CAAC,IAAI,CAAC;IA2EjB;;;;;;OAMG;YACW,mBAAmB;IAiHjC;;;;OAIG;IACH,OAAO,CAAC,gCAAgC;IAgBxC,2FAA2F;IAC3F,OAAO,CAAC,mBAAmB;IAO3B,mFAAmF;IACnF,OAAO,CAAC,eAAe;IAOvB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAanB,4FAA4F;IAC5F,OAAO,CAAC,oBAAoB;IAa5B,2CAA2C;IAC3C,OAAO,CAAC,SAAS;CAelB"}
+{"version":3,"file":"conversational-execution.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/services/conversational-execution.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAC3H,OAAO,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACpJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAC7H,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAG5G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAG9H,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AAC7G,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AACvI,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAgE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAEL,gBAAgB,EAChB,kBAAkB,EAUlB,kBAAkB,EAGlB,KAAK,6BAA6B,EAElC,KAAK,0BAA0B,EAGhC,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;AAEhG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAoC9B,2FAA2F;AAC3F,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,gBAAgB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,YAAY,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpF;AAED,2EAA2E;AAC3E,MAAM,WAAW,kCAAkC;IACjD;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,qEAAqE;IACrE,SAAS,EAAE,6BAA6B,CAAC;IACzC;;;;;OAKG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB,+EAA+E;IAC/E,YAAY,EAAE,wBAAwB,CAAC;IACvC,2DAA2D;IAC3D,OAAO,EAAE,2BAA2B,CAAC;IACrC;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,SAAS,0BAA0B,EAAE,GAC9C,0BAA0B,EAAE,CAE9B;AAwBD,qBACa,qCAAqC;IAEX,OAAO,CAAC,QAAQ,CAAC,MAAM;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC3B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACjC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAInC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC7E;;;;;OAKG;IACsD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAlBhC,MAAM,EAAE,aAAa,EACD,mBAAmB,EAAE,0BAA0B,EACrD,aAAa,EAAE,oBAAoB,EAChC,iBAAiB,EAAE,+BAA+B,EAC3C,uBAAuB,EAAE,qCAAqC,EACvD,uBAAuB,EAAE,qCAAqC,EAChF,YAAY,EAAE,0BAA0B,EACpC,gBAAgB,EAAE,uBAAuB,EAI3C,UAAU,EAAE,4BAA4B;IAC3G;;;;;OAKG;IACuE,SAAS,CAAC,EAAE,uBAAuB;IAG/G;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;;;OAIG;IACU,4BAA4B,CAAC,MAAM,EAAE,kCAAkC,GAAG,OAAO,CAAC,IAAI,CAAC;IA8XpG;;;;;OAKG;IACH;;;;;;;OAOG;YACW,gBAAgB;IAyB9B;;;;;;;;;;;;;;OAcG;YACW,yBAAyB;IA8FvC;;;;;;;;;;;;;;;OAeG;IACH;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,yBAAyB;IAuBjC;;;;;;;;;;;;;;;;;;OAkBG;IACU,mBAAmB,CAAC,MAAM,EAAE;QACvC,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,wBAAwB,CAAC;QACvC,IAAI,CAAC,EAAE,gBAAgB,CAAC;QACxB,yBAAyB,CAAC,EAAE,MAAM,CAAC;KACpC,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IA8B9B,iBAAiB,CAAC,MAAM,EAAE;QACrC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,YAAY,EAAE,wBAAwB,CAAC;QACvC,IAAI,CAAC,EAAE,gBAAgB,CAAC;QACxB,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,2BAA2B,CAAC;QACtC;;;;;;;WAOG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC5C,GAAG,OAAO,CAAC,IAAI,CAAC;IAmJjB;;;;;;OAMG;YACW,mBAAmB;IA2HjC;;;;;;OAMG;IACH,OAAO,CAAC,mCAAmC;IAwG3C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,0BAA0B;IA6BlC;;;;OAIG;IACH,OAAO,CAAC,gCAAgC;IAgBxC,2FAA2F;IAC3F,OAAO,CAAC,mBAAmB;IAO3B,mFAAmF;IACnF,OAAO,CAAC,eAAe;IAOvB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAanB,4FAA4F;IAC5F,OAAO,CAAC,oBAAoB;IAa5B,2CAA2C;IAC3C,OAAO,CAAC,SAAS;CAwBlB"}

package/dist/esm/flows-actors/services/conversational-execution.backend.service.js

@@ -11,7 +11,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import 'reflect-metadata';
-import { injectable, inject } from 'inversify';
+import { injectable, inject, optional } from 'inversify';
 import { randomUUID } from 'crypto';
 import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
 import { LoggerService } from '../../monitoring/logger/services/logger.service.js';
@@ -20,9 +20,12 @@ import { ResourcesRegistryBackendService } from '../../resources/services/resour
 import { ServicesRegistryHandlerBackendService } from '../../base-classes/services/services/services-registry-handler.backend.service.js';
 import { SystemAccessBackendService } from '../../base-classes/services/services/system-access.backend.service.js';
 import { ExecutionContextCreatorBackendService } from '../../runtime/services/execution-context-creator.backend.service.js';
+import { modelToolNameForFunctionRef } from '../../flows-actors/models/function-tools.backend.definitions.js';
+import { hashToolApprovalInput } from '../../flows-actors/utils/tool-approval-signing.backend.utils.js';
+import { applyModifiedToolApprovalInput, ToolApprovalModificationOutcomeKind } from '../../flows-actors/utils/tool-approval-modification.backend.utils.js';
 import { FlowsActorsRegistryService } from './flows-actors-registry.service.js';
 import { AgentsBackendService, AgentStreamingUnsupportedError } from './agents.backend.service.js';
-import { Actor_ExecutionMode, CoreResourceType, CoreWebSocketEvent, FlowActorSystem_Kind, FlowsActors_ConversationRole, FlowsActors_MessageContentType, FLOWS_ACTORS_DEFAULT_AGENT_INSTANCE, parseFlowActorPausedApproval, serializeFlowActorPausedApproval, FLOWS_ACTORS_NO_MACHINE_CREDENTIAL, FlowsActors_Status, } from '@wildo-ai/saas-models';
+import { Actor_ExecutionMode, CoreResourceType, CoreWebSocketEvent, FlowActorSystem_Kind, FlowsActors_ConversationRole, FlowsActors_MessageContentType, FLOWS_ACTORS_DEFAULT_AGENT_INSTANCE, FLOW_ACTOR_APPROVAL_DEFAULT_TIMEOUT_MS, parseFlowActorPausedApproval, serializeFlowActorPausedApproval, FLOWS_ACTORS_NO_MACHINE_CREDENTIAL, FlowsActors_Status, } from '@wildo-ai/saas-models';
 /**
  * Drives a **conversational execution** of a flows-actors system: resolve the
  * system, find its chat actor's agent, stream the agent's token-by-token answer
@@ -95,7 +98,10 @@ let ConversationalExecutionBackendService = class ConversationalExecutionBackend
     servicesRegistryHandler;
     executionContextCreator;
     systemAccess;
-    constructor(logger, flowsActorsRegistry, agentsBackend, resourcesRegistry, servicesRegistryHandler, executionContextCreator, systemAccess) {
+    rateLimitService;
+    authorizer;
+    auditLogs;
+    constructor(logger, flowsActorsRegistry, agentsBackend, resourcesRegistry, servicesRegistryHandler, executionContextCreator, systemAccess, rateLimitService, authorizer, auditLogs) {
         this.logger = logger;
         this.flowsActorsRegistry = flowsActorsRegistry;
         this.agentsBackend = agentsBackend;
@@ -103,6 +109,9 @@ let ConversationalExecutionBackendService = class ConversationalExecutionBackend
         this.servicesRegistryHandler = servicesRegistryHandler;
         this.executionContextCreator = executionContextCreator;
         this.systemAccess = systemAccess;
+        this.rateLimitService = rateLimitService;
+        this.authorizer = authorizer;
+        this.auditLogs = auditLogs;
     }
     /**
      * Resolve the owner scope to its persisted polymorphic variant: the concrete
@@ -551,12 +560,19 @@ let ConversationalExecutionBackendService = class ConversationalExecutionBackend
     async persistApprovalSuspension(params) {
         const { systemRef, executionId, owner, suspension, emitter } = params;
         const requestedAt = new Date().toISOString();
+        const pausedApprovalExpiresAt = new Date(Date.now() + FLOW_ACTOR_APPROVAL_DEFAULT_TIMEOUT_MS).toISOString();
         const pausedApproval = serializeFlowActorPausedApproval({
             approvalId: suspension.approvalId,
             sdkModelMessages: suspension.sdkModelMessages,
             pendingToolName: suspension.toolName,
             pendingToolArgs: suspension.toolArgs,
             requestedAt,
+            // #465: the suspension carries its own expiry. The field was declared, sent to the browser and
+            // read there, and never written — so a pending approval never expired.
+            //
+            // Computed ONCE, above, and shared with the announcement below: two `Date.now()` calls would
+            // let the row and the message a client is shown disagree about when the pause lapses.
+            expiresAt: pausedApprovalExpiresAt,
         });
         try {
             const paused = await this.systemAccess.updateAsSystem(owner.resourceType, {
@@ -584,24 +600,36 @@ let ConversationalExecutionBackendService = class ConversationalExecutionBackend
         }
         // Only announce a pause that was actually RECORDED. Emitting first would invite a client to
         // answer a decision no row can accept.
+        /*
+         * Built through the NAMED schema rather than as an anonymous `data` bag. The bag is
+         * `Record<string, unknown>` on the wire, so nothing typed this announcement and the browser
+         * ended up listening on `FLOWS_ACTORS_APPROVAL_REQUEST` — an event no code has ever emitted
+         * — which meant no shipped screen could observe a paused turn at all (#528). Typing the
+         * producer is what lets the consumer parse it instead of guessing at keys.
+         *
+         * `expiresAt` travels here and nowhere else: since #465 the suspension genuinely carries an
+         * expiry, and this block is the only path by which a client can learn it.
+         */
+        const announcement = {
+            approvalRequested: true,
+            approvalId: suspension.approvalId,
+            toolName: suspension.toolName,
+            toolArgs: suspension.toolArgs,
+            requestedAt,
+            expiresAt: pausedApprovalExpiresAt,
+            // The isolation axis the DECISION must carry back. Without it a responder can only be
+            // filtered against the default-instance sentinel, so an approval raised on a named agent
+            // instance is unresumable — the read matches no row and the decision is dropped silently.
+            // Emitted even when it is the default, so a client echoes one field unconditionally rather
+            // than branching on whether the value is meaningful.
+            resourceServerInstanceRef: agentInstanceOf(params.resourceServerInstanceRef),
+        };
         emitter(CoreWebSocketEvent.FLOWS_ACTORS_MESSAGE, {
             systemRef,
             executionId,
             messageType: FlowsActors_MessageContentType.PROGRESS,
             content: `Waiting for approval to run "${suspension.toolName}".`,
-            data: {
-                approvalRequested: true,
-                approvalId: suspension.approvalId,
-                toolName: suspension.toolName,
-                toolArgs: suspension.toolArgs,
-                requestedAt,
-                // The isolation axis the DECISION must carry back. Without it a responder can only be
-                // filtered against the default-instance sentinel, so an approval raised on a named agent
-                // instance is unresumable — the read matches no row and the decision is dropped silently.
-                // Emitted even when it is the default, so a client echoes one field unconditionally rather
-                // than branching on whether the value is meaningful.
-                resourceServerInstanceRef: agentInstanceOf(params.resourceServerInstanceRef),
-            },
+            data: announcement,
             timestamp: new Date(),
         });
     }
@@ -647,6 +675,14 @@ let ConversationalExecutionBackendService = class ConversationalExecutionBackend
                 resourcesRegistry: this.resourcesRegistry,
                 servicesRegistryHandler: this.servicesRegistryHandler,
                 executionContextCreator: this.executionContextCreator,
+                // A tool dispatches a resource operation while bypassing Express, so the operation's own
+                // authored `rateLimit?` — whose other consumers are the HTTP controller pre-flight and the
+                // MCP tool plane — has no enforcer on this plane unless one is supplied here.
+                rateLimitService: this.rateLimitService,
+                // Same reason, for the operation's `roles` ACL: bypassing Express also bypasses the
+                // CONTROLLER tier, which is the only place that ACL is read. Supplying the authorizer here
+                // is what lets the tool factories apply it themselves.
+                authorizer: this.authorizer,
             },
         };
     }
@@ -736,8 +772,69 @@ let ConversationalExecutionBackendService = class ConversationalExecutionBackend
             });
             return;
         }
+        /*
+         * #465: an EXPIRED approval is refused, and the turn becomes terminal.
+         *
+         * This is the half that matters for safety rather than hygiene: honouring a decision on a tool
+         * call raised days ago would execute it against a conversation, a world and an intent that have
+         * all moved on, and the person answering has no memory of the question. `FAILED` is the terminal
+         * state the status vocabulary already named for expiry — nothing new was invented.
+         *
+         * Placed AFTER the approvalId match so a mismatched id keeps its own diagnosis; an expired
+         * approval and a wrong one are different facts and an operator reading the log needs both.
+         *
+         * KNOWN GAP, stated rather than implied: nothing sweeps. A turn nobody answers stays
+         * `AWAITING_APPROVAL` until a late decision arrives and is refused here, rather than lapsing on
+         * its own. That makes this a guard at USE, not the unattended auto-fail the schema describes —
+         * closing it needs a scheduled sweep, which is deliberately not built here.
+         */
+        if (paused.expiresAt !== undefined && new Date(paused.expiresAt).getTime() <= Date.now()) {
+            this.logger.warn('[ConversationalExecution] Approval decision arrived after the pause expired; refusing and failing the turn', {
+                systemRef, executionId, approvalId, expiresAt: paused.expiresAt, toolName: paused.pendingToolName,
+            });
+            await this.systemAccess.updateAsSystem(owner.resourceType, ownerFilter, {
+                status: FlowsActors_Status.FAILED,
+                pausedApproval: null,
+            }, { scopeContext: owner.scopeContext }).catch((error) => {
+                this.logger.error('[ConversationalExecution] Could not fail an expired approval pause', {
+                    systemRef, executionId, ...projectCaughtErrorLogFields(error),
+                });
+            });
+            return;
+        }
+        /*
+         * APPROVE-WITH-MODIFICATIONS (#566) — resolved BEFORE the pause is cleared, and that ordering is
+         * the whole point rather than a detail.
+         *
+         * The next statement flips the row to PROCESSING and drops `pausedApproval`, after which there
+         * is no approval left to answer: a modification refused one line later would leave the approver
+         * with a turn that is neither paused nor resumable, having told them nothing. Refusing HERE
+         * costs them an error message and leaves the decision exactly where it was — they can correct
+         * the arguments, or approve the call as the model proposed it.
+         *
+         * Only on an approval. A denial resumes so the model can respond; there is no call to edit.
+         */
+        let modifiedResume;
+        if (approved && params.modifiedToolArgs) {
+            const prepared = this.prepareApprovedToolCallModification({
+                systemRef, executionId, paused, modifiedToolArgs: params.modifiedToolArgs,
+            });
+            if (prepared.kind === ToolApprovalModificationOutcomeKind.REFUSED) {
+                this.logger.warn('[ConversationalExecution] Refusing an approval whose modified arguments could not be applied; the pause stands', {
+                    systemRef, executionId, approvalId, toolName: paused.pendingToolName, reason: prepared.message,
+                });
+                if (params.emitter) {
+                    // `recoverable: true` — the approval is still pending and still answerable. Every other
+                    // caller of this helper is ending the attempt; this one is not.
+                    this.emitError(params.emitter, systemRef, executionId, 'APPROVAL_MODIFICATION_REJECTED', prepared.message, true);
+                }
+                return;
+            }
+            modifiedResume = prepared.kind === ToolApprovalModificationOutcomeKind.MODIFIED ? prepared.modification : undefined;
+        }
         this.logger.info('[ConversationalExecution] Resuming a suspended turn on a human decision', {
             systemRef, executionId, approvalId, approved, toolName: paused.pendingToolName,
+            modifiedArgumentKeys: modifiedResume?.modifiedArgumentKeys,
         });
         // Back to PROCESSING before the model call: the row must not read `awaiting_approval` while the
         // turn is actually running, or a second decision could be accepted for a turn already resumed.
@@ -749,9 +846,17 @@ let ConversationalExecutionBackendService = class ConversationalExecutionBackend
                 systemRef, executionId, ...projectCaughtErrorLogFields(error),
             });
         });
+        if (modifiedResume) {
+            this.recordApprovalModification({
+                systemRef, executionId, approvalId, prepared: modifiedResume, auth: params.auth,
+            });
+        }
         await this.resumeAfterApproval({
             systemRef, executionId, owner, paused, approved,
             reason: params.reason,
+            // The rewritten, re-signed SDK array when the approver authored the arguments; otherwise the
+            // resume reads `paused.sdkModelMessages` exactly as before.
+            modifiedSdkModelMessages: modifiedResume?.sdkModelMessages,
             auth: params.auth,
             resourceServerInstanceRef: params.resourceServerInstanceRef,
             emitter: params.emitter,
@@ -770,7 +875,7 @@ let ConversationalExecutionBackendService = class ConversationalExecutionBackend
     async resumeAfterApproval(params) {
         const { systemRef, executionId, owner, paused, approved } = params;
         const resumeMessages = [
-            ...paused.sdkModelMessages,
+            ...(params.modifiedSdkModelMessages ?? paused.sdkModelMessages),
             {
                 role: 'tool',
                 content: [{
@@ -855,6 +960,138 @@ let ConversationalExecutionBackendService = class ConversationalExecutionBackend
             await this.finalizeTerminal(systemRef, executionId, owner, [], FlowsActors_Status.FAILED, machineCredentialIdOf(params.auth), agentInstanceOf(params.resourceServerInstanceRef));
         }
     }
+    // ── Approve-with-modifications (#566) ──────────────────────────────────────
+    /**
+     * A modification that survived every server-side check and is ready to resume.
+     *
+     * Carries the rewritten array AND what the audit trail needs, because both are produced by the
+     * same walk of the SDK's message array — recomputing either afterwards would mean walking it a
+     * second time and could disagree with the version that was signed.
+     */
+    prepareApprovedToolCallModification(params) {
+        const { paused, modifiedToolArgs } = params;
+        /*
+         * The agent, and the FunctionTool behind the name the model was shown.
+         *
+         * A gated tool is always a FunctionTool: `requiresHumanApproval` is declared on that interface
+         * and nothing else contributes to the approval-gated set — an MCP tool is discovered from a
+         * server at turn start and no author can gate one. So a pending approval whose tool this cannot
+         * find is a disagreement between the paused row and the live registry, not an unsupported case.
+         */
+        const actorSystem = this.flowsActorsRegistry.getSystem(params.systemRef, FlowActorSystem_Kind.ACTOR);
+        const agentRef = actorSystem ? this.resolveChatAgentRef(actorSystem) : undefined;
+        const agent = agentRef ? this.flowsActorsRegistry.getAgent(agentRef) : undefined;
+        if (!agent || !agentRef) {
+            return { kind: ToolApprovalModificationOutcomeKind.REFUSED, message: 'The agent that raised this approval is no longer registered, so its arguments cannot be checked. Approve the call as proposed, or deny it.' };
+        }
+        const functionRef = (agent.capabilities?.tools?.functionRefs ?? [])
+            .find((ref) => modelToolNameForFunctionRef(ref) === paused.pendingToolName);
+        const functionTool = functionRef ? this.flowsActorsRegistry.getFunctionTool(functionRef) : undefined;
+        if (!functionTool) {
+            return { kind: ToolApprovalModificationOutcomeKind.REFUSED, message: `The agent no longer declares the tool "${paused.pendingToolName}", so modified arguments cannot be validated against it. Approve the call as proposed, or deny it.` };
+        }
+        if (!functionTool.requiresHumanApproval) {
+            // Not pedantry: it means the registry no longer gates this tool, so the resumed turn would run
+            // arguments a human authored under a gate that has since been removed.
+            return { kind: ToolApprovalModificationOutcomeKind.REFUSED, message: `The tool "${paused.pendingToolName}" no longer requires approval, so this pending decision is stale. Deny it and ask again.` };
+        }
+        /*
+         * Step 2 of the issue's order: the SERVER validates, against the tool's OWN schema.
+         *
+         * The browser's validation is a convenience — an approver editing a call is authoring a call the
+         * agent never proposed, and the only schema that can judge it is the one the tool declares. The
+         * SDK re-validates too (`validate-tool-approvals.ts` throws `InvalidToolInputError`), so this is
+         * not what makes it SAFE; it is what makes it USABLE. Its refusal arrives while the pause is
+         * still standing and names the offending argument, whereas the SDK's arrives mid-resume as an
+         * exception, which reaches a person as a turn that died.
+         *
+         * The RAW edit is what gets validated, written and signed — never the parse OUTPUT. A schema
+         * with a transform would otherwise make the persisted arguments something the approver did not
+         * type, and it keeps an approver's input treated exactly like a model's.
+         */
+        const validation = functionTool.inputSchema.safeParse(modifiedToolArgs);
+        if (!validation.success) {
+            const detail = validation.error.issues
+                .map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`)
+                .join('; ');
+            return { kind: ToolApprovalModificationOutcomeKind.REFUSED, message: `Those arguments are not valid for "${paused.pendingToolName}" — ${detail}. The approval is still pending: correct them, or approve the call as proposed.` };
+        }
+        const signingKey = this.agentsBackend.resolveToolApprovalSigningKey();
+        if (!signingKey) {
+            // Unreachable while the turn is running — a turn with an approval-gated tool is refused
+            // outright when the key cannot be derived — but stated rather than assumed, because signing
+            // with nothing would silently produce an approval the SDK refuses at resume.
+            return { kind: ToolApprovalModificationOutcomeKind.REFUSED, message: 'The approval-signing key is not configured, so a modified call cannot be re-bound to this approval. Approve the call as proposed, or deny it.' };
+        }
+        const applied = applyModifiedToolApprovalInput({
+            sdkModelMessages: paused.sdkModelMessages,
+            approvalId: paused.approvalId,
+            modifiedInput: modifiedToolArgs,
+            signingKey,
+        });
+        if (applied.kind === ToolApprovalModificationOutcomeKind.REFUSED) {
+            this.logger.error('[ConversationalExecution] A paused turn\'s resume payload does not contain the call its approval names', {
+                systemRef: params.systemRef, executionId: params.executionId,
+                approvalId: paused.approvalId, refusal: applied.refusal, detail: applied.detail,
+            });
+            return { kind: ToolApprovalModificationOutcomeKind.REFUSED, message: 'This pending call could not be rewritten with your arguments. Approve it as proposed, or deny it.' };
+        }
+        /*
+         * Nothing changed, so nothing is a modification.
+         *
+         * An approver who opens the editor, changes their mind and approves has approved the call as
+         * proposed — resuming through the rewritten array would still be correct (the signature is over
+         * identical bytes), but it would put a row on the audit trail claiming a person authored
+         * arguments they did not, which is the one thing this event exists to mean.
+         */
+        if (applied.modifiedArgumentKeys.length === 0) {
+            return { kind: ToolApprovalModificationOutcomeKind.UNCHANGED };
+        }
+        return {
+            kind: ToolApprovalModificationOutcomeKind.MODIFIED,
+            modification: {
+                agentRef,
+                sdkModelMessages: applied.sdkModelMessages,
+                toolName: applied.toolName,
+                modifiedArgumentKeys: applied.modifiedArgumentKeys,
+                proposedInputDigest: hashToolApprovalInput(applied.proposedInput),
+                executedInputDigest: hashToolApprovalInput(modifiedToolArgs),
+            },
+        };
+    }
+    /**
+     * Put one approve-with-modifications decision on the audit trail.
+     *
+     * Fire-and-forget and feature-detected, the same contract as every other emitter in this codebase:
+     * an absent or failing sink must never fail the act it was going to observe. A decision a person
+     * made must not be undone because the trail could not be written — the observation is evidence,
+     * not a gate.
+     *
+     * Emitted AFTER the pause is cleared and BEFORE the model is re-invoked, so the row records the
+     * DECISION rather than its outcome. A resume that then fails does not make it untrue that a human
+     * authored those arguments and authorized the call.
+     */
+    recordApprovalModification(params) {
+        if (!this.auditLogs)
+            return;
+        void this.auditLogs.logAgentToolApprovalModified({
+            executionId: params.executionId,
+            approvalId: params.approvalId,
+            systemRef: params.systemRef,
+            agentRef: params.prepared.agentRef,
+            toolName: params.prepared.toolName,
+            proposedInputDigest: params.prepared.proposedInputDigest,
+            executedInputDigest: params.prepared.executedInputDigest,
+            modifiedArgumentKeys: params.prepared.modifiedArgumentKeys,
+            approverUserId: params.auth?.initiatorIds?.userId,
+            organizationId: params.auth?.initiatorIds?.organizationId,
+        }).catch((error) => {
+            this.logger.warn('[ConversationalExecution] Could not record an approve-with-modifications decision on the audit trail; the turn is unaffected', {
+                systemRef: params.systemRef, executionId: params.executionId, approvalId: params.approvalId,
+                ...projectCaughtErrorLogFields(error),
+            });
+        });
+    }
     // ── Internals ──────────────────────────────────────────────────────────────
     /**
      * Resolve the target system as an ACTOR system. If it is a FLOW system, fail
@@ -937,13 +1174,22 @@ let ConversationalExecutionBackendService = class ConversationalExecutionBackend
         return typeof output === 'undefined' ? '' : JSON.stringify(output);
     }
     /** Emit a `FLOWS_ACTORS_ERROR` payload. */
-    emitError(emitter, systemRef, executionId, errorCode, errorMessage) {
+    emitError(emitter, systemRef, executionId, errorCode, errorMessage, 
+    /**
+     * `true` when the turn is still answerable — the caller may fix the input and try again.
+     *
+     * Defaults to `false`, which is what every pre-existing caller means: a missing system, a flow
+     * system, an empty input all end the attempt. A REFUSED ARGUMENT EDIT does not: the pause is
+     * deliberately left standing, so telling the client otherwise would make the surface hide the
+     * decision that is still waiting for it.
+     */
+    recoverable = false) {
         emitter(CoreWebSocketEvent.FLOWS_ACTORS_ERROR, {
             systemRef,
             executionId,
             errorCode,
             errorMessage,
-            recoverable: false,
+            recoverable,
         });
     }
 };
@@ -956,13 +1202,17 @@ ConversationalExecutionBackendService = __decorate([
     __param(4, inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService)),
     __param(5, inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService)),
     __param(6, inject(SAAS_SERVICE_TYPES.SystemAccessService)),
+    __param(7, inject(SAAS_SERVICE_TYPES.RateLimitBackendService)),
+    __param(8, inject(SAAS_SERVICE_TYPES.AuthorizationsService)),
+    __param(9, inject(SAAS_SERVICE_TYPES.AuditLogsService)),
+    __param(9, optional()),
     __metadata("design:paramtypes", [LoggerService,
         FlowsActorsRegistryService,
         AgentsBackendService,
         ResourcesRegistryBackendService,
         ServicesRegistryHandlerBackendService,
         ExecutionContextCreatorBackendService,
-        SystemAccessBackendService])
+        SystemAccessBackendService, Function, Function, Function])
 ], ConversationalExecutionBackendService);
 export { ConversationalExecutionBackendService };
 //# sourceMappingURL=conversational-execution.backend.service.js.map