volcano-sdk 0.32.7 → 0.34.0

data/lib/volcano/sandbox_request.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require 'securerandom'
+require 'time'
+
+module Volcano
+  # Immutable addressing and payload for a generated Sandbox operation.
+  class SandboxRequest
+    def initialize(options)
+      @options = options.dup
+      body = options[:body]
+      @options[:body] = ImmutableRequestValue.capture(body) if body
+      @options.freeze
+      freeze
+    end
+
+    def operation = @options.fetch(:operation)
+    def resource_id = @options[:resource_id]
+    def subject_id = @options[:subject_id]
+    def body = @options[:body]
+    def request_id = @options[:request_id]
+    def deployment_id = @options[:deployment_id]
+    def archive = @options.fetch(:archive)
+    def deployment_body = @options.fetch(:body)
+    def cursor = @options[:cursor]
+    def region = @options[:region]
+    def limit = @options[:limit]
+    def timeout = @options.fetch(:timeout, 0)
+  end
+
+  # Shared validation and credentials for Sandbox facade operations.
+  class SandboxRequests
+    UUID = /\A[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}\z/i
+    USER_OPERATIONS = %i[get_sandbox_session execute_sandbox_session read_sandbox_session_file
+                         write_sandbox_session_file create_sandbox_session_access].freeze
+    private_constant :UUID, :USER_OPERATIONS
+
+    def initialize(client, transport, service_only: false)
+      @client = client
+      @transport = transport
+      @service_only = service_only
+    end
+
+    def service_scope = SandboxRequests.new(@client, @transport, service_only: true)
+
+    def call(request, status: 200)
+      response = if request.operation == :list_sandbox_presets
+                   dispatch(request, '')
+                 elsif user_request?(request)
+                   @client.session_request { |token| dispatch(request, token) }
+                 else
+                   dispatch(request, @client.service_token)
+                 end
+      Transport.body(response, status)
+    end
+
+    def self.expiry(value)
+      parsed = value.is_a?(Time) ? value : Time.iso8601(value)
+      parsed.getutc.iso8601
+    rescue ArgumentError
+      raise Error::ValidationError, 'Sandbox grant expiry must be a Time or ISO8601 timestamp'
+    end
+
+    def self.identifier(value)
+      return value.dup.freeze if value.is_a?(String) && UUID.match?(value)
+
+      raise Error::ValidationError, 'Sandbox resource and request IDs must be UUIDs'
+    end
+
+    def self.request_id(options)
+      identifier(options.fetch(:request_id) { SecureRandom.uuid })
+    end
+
+    def self.selector(options)
+      if options.key?(:preset) == options.key?(:sandbox_id)
+        raise Error::ValidationError, 'Choose exactly one preset or sandbox_id'
+      end
+
+      result = options.slice(:region, :preset, :sandbox_id, :memory_mb)
+      result[:sandbox_id] = identifier(result[:sandbox_id]) if result.key?(:sandbox_id)
+      result
+    end
+
+    def self.command(command, options)
+      options.slice(:timeout_seconds, :environment).merge(command: command)
+    end
+
+    private
+
+    def user_request?(request)
+      !@service_only && USER_OPERATIONS.include?(request.operation) && !@client.current_session.nil?
+    end
+
+    def dispatch(request, token)
+      Transport.invoke { @transport.sandbox_request(authorization: token, request: request) }
+    end
+  end
+end

data/lib/volcano/sandbox_response.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module Volcano
+  # Validate wire values before exposing language-native Sandbox results.
+  module SandboxResponse
+    STATES = %w[starting running suspending suspended resuming terminating terminated unknown].freeze
+    private_constant :STATES
+
+    def self.text(value)
+      return value if value.is_a?(String)
+
+      raise TypeError, 'Invalid Sandbox text field'
+    end
+
+    def self.timestamp(value)
+      Time.iso8601(text(value)).freeze
+    rescue ArgumentError
+      raise TypeError, 'Invalid Sandbox timestamp'
+    end
+
+    def self.integer(value)
+      return value if value.is_a?(Integer)
+
+      raise TypeError, 'Invalid Sandbox integer field'
+    end
+
+    def self.flag(value)
+      return value if value.is_a?(TrueClass) || value.is_a?(FalseClass)
+
+      raise TypeError, 'Invalid Sandbox flag'
+    end
+
+    def self.state(value)
+      result = text(value)
+      return result.dup.freeze if STATES.include?(result)
+
+      raise TypeError, 'Invalid Sandbox state'
+    end
+
+    def self.command(value)
+      data = Transport.json_object(value)
+      SandboxCommandResult.new(
+        stdout: text(data['stdout']), stderr: text(data['stderr']), exit_code: integer(data['exit_code']),
+        timed_out: flag(data['timed_out']), stdout_truncated: flag(data['stdout_truncated']),
+        stderr_truncated: flag(data['stderr_truncated'])
+      )
+    end
+
+    def self.execution(value)
+      data = Transport.json_object(value)
+      SandboxExecutionResult.new(
+        **command(data).to_h, session_id: text(data['session_id']),
+                              region: text(data['region']), duration_ms: integer(data['duration_ms'])
+      )
+    end
+
+    def self.access(value)
+      data = Transport.json_object(value)
+      SandboxAccess.new(url: text(data['url']), token: text(data['token']), expires_at: timestamp(data['expires_at']))
+    end
+
+    def self.preset(value)
+      data = Transport.json_object(value)
+      regions = array(data['regions']).map { |region| text(region) }.freeze
+      SandboxPreset.new(id: text(data['id']), memory_mb: integer(data['memory_mb']), regions: regions)
+    end
+
+    def self.array(value)
+      return value if value.is_a?(Array)
+
+      raise TypeError, 'Invalid Sandbox list'
+    end
+  end
+end

data/lib/volcano/sandbox_session.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module Volcano
+  # A session handle whose observed state changes only after validated responses.
+  class SandboxSession
+    attr_reader :id, :project_id, :region, :state, :expires_at, :files
+
+    def initialize(requests, value)
+      data = Transport.json_object(value)
+      @requests = requests
+      @id = SandboxRequests.identifier(data['id'])
+      @project_id = SandboxRequests.identifier(data['project_id'])
+      @region = SandboxResponse.text(data['region'])
+      assign_state(data)
+      @files = SandboxFiles.new(requests, @id)
+    end
+
+    def refresh = update(:get_sandbox_session)
+    def suspend = update(:suspend_sandbox_session, status: 202)
+    def resume = update(:resume_sandbox_session, status: 202)
+    def terminate = update(:terminate_sandbox_session, status: 202)
+
+    def inspect
+      "#<Volcano::SandboxSession id=#{@id.inspect} project_id=#{@project_id.inspect} " \
+        "region=#{@region.inspect} state=#{@state.inspect}>"
+    end
+
+    def exec(command, timeout_seconds: 60, environment: nil, request_id: nil)
+      options = { timeout_seconds: timeout_seconds, environment: environment, request_id: request_id }.compact
+      request = SandboxRequest.new(operation: :execute_sandbox_session, resource_id: @id,
+                                   body: SandboxRequests.command(command, options),
+                                   request_id: SandboxRequests.request_id(options),
+                                   timeout: SandboxResponse.integer(options.fetch(:timeout_seconds, 60)) + 120)
+      SandboxResponse.command(@requests.call(request))
+    end
+
+    def access(port)
+      request = SandboxRequest.new(operation: :create_sandbox_session_access, resource_id: @id, body: { port: port })
+      SandboxResponse.access(@requests.call(request))
+    end
+
+    def use
+      # @type var unwinding: bool
+      unwinding = true
+      result = yield self
+      unwinding = false
+      result
+    ensure
+      cleanup(unwinding) unless %w[terminating terminated].include?(@state)
+    end
+
+    private
+
+    def cleanup(unwinding)
+      terminate
+    rescue Error::NotFoundError
+      nil
+    rescue StandardError
+      raise unless unwinding
+    end
+
+    def update(operation, status: 200)
+      response = @requests.call(SandboxRequest.new(operation: operation, resource_id: @id), status: status)
+      data = Transport.json_object(response)
+      raise TypeError, 'Sandbox session identity changed' unless data['id'] == @id
+
+      assign_state(data)
+      self
+    end
+
+    def assign_state(data)
+      next_state = SandboxResponse.state(data['state'])
+      expiry = SandboxResponse.timestamp(data['expires_at'])
+      @state = next_state
+      @expires_at = expiry
+    end
+  end
+end

data/lib/volcano/sandboxes.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Volcano
+  # Create isolated sessions or execute a command to completion.
+  class Sandboxes
+    include SandboxDeployments
+
+    def initialize(client, transport)
+      @requests = SandboxRequests.new(client, transport)
+    end
+
+    def presets
+      response = @requests.call(SandboxRequest.new(operation: :list_sandbox_presets))
+      SandboxResponse.array(Transport.json_object(response)['data']).map { |value| SandboxResponse.preset(value) }
+    end
+
+    def inspect = '#<Volcano::Sandboxes>'
+
+    def create( # rubocop:disable Metrics/ParameterLists -- Preserve explicit typed facade keywords.
+      project_id, region:, preset: nil, sandbox_id: nil, memory_mb: nil,
+      max_duration_seconds: nil, idle_timeout_seconds: nil, request_id: nil
+    )
+      options = { region: region, preset: preset, sandbox_id: sandbox_id, memory_mb: memory_mb,
+                  max_duration_seconds: max_duration_seconds, idle_timeout_seconds: idle_timeout_seconds,
+                  request_id: request_id }.compact
+      body = SandboxRequests.selector(options).merge(options.slice(:max_duration_seconds, :idle_timeout_seconds))
+      request = SandboxRequest.new(operation: :create_sandbox_session,
+                                   resource_id: SandboxRequests.identifier(project_id), body: body,
+                                   request_id: SandboxRequests.request_id(options))
+      requests = @requests.service_scope
+      SandboxSession.new(requests, requests.call(request, status: 201))
+    end
+
+    def get(session_id)
+      request = SandboxRequest.new(operation: :get_sandbox_session, resource_id: SandboxRequests.identifier(session_id))
+      SandboxSession.new(@requests, @requests.call(request))
+    end
+
+    def exec( # rubocop:disable Metrics/ParameterLists -- Preserve explicit typed facade keywords.
+      project_id, command, region:, preset: nil, sandbox_id: nil, memory_mb: nil,
+      timeout_seconds: 60, environment: nil, request_id: nil
+    )
+      options = { region: region, preset: preset, sandbox_id: sandbox_id, memory_mb: memory_mb,
+                  timeout_seconds: timeout_seconds, environment: environment, request_id: request_id }.compact
+      body = SandboxRequests.selector(options).merge(SandboxRequests.command(command, options))
+      request = SandboxRequest.new(operation: :execute_sandbox, resource_id: SandboxRequests.identifier(project_id),
+                                   body: body, request_id: SandboxRequests.request_id(options),
+                                   timeout: SandboxResponse.integer(options.fetch(:timeout_seconds, 60)) + 120)
+      SandboxResponse.execution(@requests.call(request))
+    end
+
+    def grant(session_id, auth_user_id, expires_at:)
+      request = SandboxRequest.new(operation: :grant_sandbox_session,
+                                   resource_id: SandboxRequests.identifier(session_id),
+                                   subject_id: SandboxRequests.identifier(auth_user_id),
+                                   body: { expires_at: SandboxRequests.expiry(expires_at) })
+      @requests.call(request, status: 204)
+      nil
+    end
+
+    def revoke(session_id, auth_user_id)
+      request = SandboxRequest.new(operation: :revoke_sandbox_session,
+                                   resource_id: SandboxRequests.identifier(session_id),
+                                   subject_id: SandboxRequests.identifier(auth_user_id))
+      @requests.call(request, status: 204)
+      nil
+    end
+  end
+end

data/lib/volcano/storage_mutations.rb

@@ -79,8 +79,8 @@ module Volcano
     end
 
     def visibility_value(value)
-      return true if value == true
-      return false if value == false
+      return true if value.equal?(true)
+      return false if value.equal?(false)
 
       raise ArgumentError, 'public must be true or false'
     end

data/lib/volcano/storage_object_response.rb

@@ -50,8 +50,8 @@ module Volcano
     end
 
     def storage_boolean(value)
-      return true if value == true
-      return false if value == false
+      return true if value.equal?(true)
+      return false if value.equal?(false)
 
       raise Error::TransportError, 'invalid storage boolean'
     end

data/lib/volcano/transport.rb

@@ -11,7 +11,7 @@ module Volcano
     ERROR_TYPES = {
       400 => Error::ValidationError,
       401 => Error::AuthenticationError,
-      403 => Error::AuthenticationError,
+      403 => Error::PermissionDeniedError,
       404 => Error::NotFoundError,
       409 => Error::ConflictError,
       422 => Error::ValidationError,

data/lib/volcano/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Volcano
-  VERSION = '0.32.7'
+  VERSION = '0.34.0'
 end

data/lib/volcano.rb

@@ -8,6 +8,7 @@ require_relative 'volcano/session'
 require_relative 'volcano/session_credentials'
 require_relative 'volcano/function_response'
 require_relative 'volcano/durable_models'
+require_relative 'volcano/durable_approval_models'
 require_relative 'volcano/log_responses'
 require_relative 'volcano/storage_models'
 require_relative 'volcano/storage_upload_models'
@@ -44,6 +45,9 @@ require_relative 'volcano/auth_reset_password'
 require_relative 'volcano/database'
 require_relative 'volcano/function_resolution'
 require_relative 'volcano/functions'
+require_relative 'volcano/durable_arguments'
+require_relative 'volcano/durable_approval_responses'
+require_relative 'volcano/durable_approvals'
 require_relative 'volcano/durable'
 require_relative 'volcano/logs'
 require_relative 'volcano/storage_session_adapter'
@@ -64,10 +68,19 @@ require_relative 'volcano/lock_response'
 require_relative 'volcano/locks'
 require_relative 'volcano/realtime/protocol'
 require_relative 'volcano/realtime'
+require_relative 'volcano/sandbox_models'
+require_relative 'volcano/sandbox_request'
+require_relative 'volcano/sandbox_response'
+require_relative 'volcano/sandbox_files'
+require_relative 'volcano/sandbox_session'
+require_relative 'volcano/sandbox_deployment_response'
+require_relative 'volcano/sandbox_deployments'
+require_relative 'volcano/sandboxes'
 require_relative 'volcano/client'
 
 # Public namespace for the Volcano Ruby SDK.
 module Volcano
+  private_constant :SandboxRequest, :SandboxRequests, :SandboxResponse
   private_constant :AuthRefresh, :AuthSignOut, :AuthProfile, :AuthProfileFields, :AuthUpdateUser, :AuthEmailChange,
                    :AuthSessions, :AuthSessionConstruction,
                    :GeneratedTransport, :LockAutoRenewal, :LockLeaseClock, :LockRenewer,

data/sig/client.rbs

@@ -1,5 +1,6 @@
 module Volcano
   class Client
+    attr_reader sandboxes: Sandboxes
     attr_reader auth: Auth
     attr_reader functions: Functions
     attr_reader durable: Durable

data/sig/core_facades.rbs

@@ -1,6 +1,7 @@
 module Volcano
   type sdk_json = nil | bool | Integer | Float | String | Time | Array[sdk_json] | Hash[String | Symbol, sdk_json]
   type sdk_payload = Hash[String | Symbol, sdk_json]
+  type durable_approval_filters = { ?status: String?, ?function: String?, ?execution_id: String?, ?from: (Time | String)?, ?to: (Time | String)?, ?page: Integer?, ?limit: Integer? }
   type database_rows = Array[Hash[String, json_value]]
 
   class Database
@@ -67,7 +68,20 @@ module Volcano
     def invoke: (String name, ?sdk_payload payload) -> FunctionResponse
   end
 
+  class DurableApprovals
+    MAX_FUNCTION_LENGTH: Integer
+    MAX_COMMENT_LENGTH: Integer
+
+    def list: (String project_id, ?durable_approval_filters filters) -> DurableApprovalPage
+    def get: (String project_id, String approval_id) -> DurableApproval
+    def stats: (String project_id, ?function: String?, ?from: (Time | String)?, ?to: (Time | String)?) -> DurableApprovalStats
+    def approve: (String project_id, String approval_id, ?comment: String?) -> DurableApproval
+    def deny: (String project_id, String approval_id, ?comment: String?) -> DurableApproval
+  end
+
   class Durable
+    attr_reader approvals: DurableApprovals
+
     def start: (String function_name, ?sdk_payload payload, ?execution_name: String?) -> DurableExecution
     def get: (String project_id, String function_name, String execution_id) -> DurableExecution
     def list: (String project_id, String function_name, ?status: String?, ?page: Integer?, ?limit: Integer?) -> DurableExecutionPage

data/sig/durable_approval_records.rbs

@@ -0,0 +1,218 @@
+module Volcano
+  class DurableApprovalFunction < Data
+    attr_reader id: String?
+    attr_reader name: String
+
+    def self.new: (String? id, String name) -> DurableApprovalFunction
+                | (id: String?, name: String) -> DurableApprovalFunction
+    def self.[]: (String? id, String name) -> DurableApprovalFunction
+               | (id: String?, name: String) -> DurableApprovalFunction
+    def self.members: () -> [:id, :name]
+
+    def initialize: (id: String?, name: String) -> void
+    def members: () -> [:id, :name]
+    def with: (?id: String?, ?name: String) -> DurableApprovalFunction
+    def to_h: () -> { id: String?, name: String }
+            | [K, V] () { (Symbol, String?) -> [K, V] } -> Hash[K, V]
+    def deconstruct: () -> [String?, String]
+    def deconstruct_keys: (Array[Symbol]?) -> Hash[Symbol, String?]
+  end
+
+  class DurableApprovalExecution < Data
+    attr_reader id: String?
+    attr_reader name: String
+    attr_reader status: String?
+
+    def self.new: (String? id, String name, String? status) -> DurableApprovalExecution
+                | (id: String?, name: String, status: String?) -> DurableApprovalExecution
+    def self.[]: (String? id, String name, String? status) -> DurableApprovalExecution
+               | (id: String?, name: String, status: String?) -> DurableApprovalExecution
+    def self.members: () -> [:id, :name, :status]
+
+    def initialize: (id: String?, name: String, status: String?) -> void
+    def members: () -> [:id, :name, :status]
+    def with: (?id: String?, ?name: String, ?status: String?) -> DurableApprovalExecution
+    def to_h: () -> { id: String?, name: String, status: String? }
+            | [K, V] () { (Symbol, String?) -> [K, V] } -> Hash[K, V]
+    def deconstruct: () -> [String?, String, String?]
+    def deconstruct_keys: (Array[Symbol]?) -> Hash[Symbol, String?]
+  end
+
+  class DurableApprovalDecider < Data
+    attr_reader id: String
+    attr_reader email: String
+
+    def self.new: (String id, String email) -> DurableApprovalDecider
+                | (id: String, email: String) -> DurableApprovalDecider
+    def self.[]: (String id, String email) -> DurableApprovalDecider
+               | (id: String, email: String) -> DurableApprovalDecider
+    def self.members: () -> [:id, :email]
+
+    def initialize: (id: String, email: String) -> void
+    def members: () -> [:id, :email]
+    def with: (?id: String, ?email: String) -> DurableApprovalDecider
+    def to_h: () -> { id: String, email: String }
+            | [K, V] () { (Symbol, String) -> [K, V] } -> Hash[K, V]
+    def deconstruct: () -> [String, String]
+    def deconstruct_keys: (Array[Symbol]?) -> Hash[Symbol, String]
+  end
+
+  class DurableApprovalDecision < Data
+    attr_reader comment: String
+    attr_reader decided_by: DurableApprovalDecider?
+    attr_reader decided_at: Time
+
+    def self.new: (String comment, DurableApprovalDecider? decided_by, Time decided_at) -> DurableApprovalDecision
+                | (comment: String, decided_by: DurableApprovalDecider?, decided_at: Time) -> DurableApprovalDecision
+    def self.[]: (String comment, DurableApprovalDecider? decided_by, Time decided_at) -> DurableApprovalDecision
+               | (comment: String, decided_by: DurableApprovalDecider?, decided_at: Time) -> DurableApprovalDecision
+    def self.members: () -> [:comment, :decided_by, :decided_at]
+
+    def initialize: (comment: String, decided_by: DurableApprovalDecider?, decided_at: Time) -> void
+    def members: () -> [:comment, :decided_by, :decided_at]
+    def with: (?comment: String, ?decided_by: DurableApprovalDecider?, ?decided_at: Time) -> DurableApprovalDecision
+    def to_h: () -> { comment: String, decided_by: DurableApprovalDecider?, decided_at: Time }
+            | [K, V] () { (Symbol, String | DurableApprovalDecider | Time | nil) -> [K, V] } -> Hash[K, V]
+    def deconstruct: () -> [String, DurableApprovalDecider?, Time]
+    def deconstruct_keys: (Array[Symbol]?) -> Hash[Symbol, String | DurableApprovalDecider | Time | nil]
+  end
+
+  class DurableApproval < Data
+    type field = String | json_value | DurableApprovalFunction | DurableApprovalExecution | Time | DurableApprovalDecision | nil
+
+    attr_reader id: String
+    attr_reader status: String
+    attr_reader name: String
+    attr_reader title: String
+    attr_reader description: String
+    attr_reader details: json_value
+    attr_reader function: DurableApprovalFunction
+    attr_reader execution: DurableApprovalExecution
+    attr_reader requested_at: Time
+    attr_reader expires_at: Time?
+    attr_reader decision: DurableApprovalDecision?
+
+    def self.new: (String id, String status, String name, String title, String description, json_value details, DurableApprovalFunction function, DurableApprovalExecution execution, Time requested_at, ?Time? expires_at, ?DurableApprovalDecision? decision) -> DurableApproval
+                | (id: String, status: String, name: String, title: String, description: String, ?details: json_value, function: DurableApprovalFunction, execution: DurableApprovalExecution, requested_at: Time, ?expires_at: Time?, ?decision: DurableApprovalDecision?) -> DurableApproval
+    def self.[]: (String id, String status, String name, String title, String description, json_value details, DurableApprovalFunction function, DurableApprovalExecution execution, Time requested_at, ?Time? expires_at, ?DurableApprovalDecision? decision) -> DurableApproval
+               | (id: String, status: String, name: String, title: String, description: String, ?details: json_value, function: DurableApprovalFunction, execution: DurableApprovalExecution, requested_at: Time, ?expires_at: Time?, ?decision: DurableApprovalDecision?) -> DurableApproval
+    def self.members: () -> [:id, :status, :name, :title, :description, :details, :function, :execution, :requested_at, :expires_at, :decision]
+
+    private def initialize: (**field attributes) -> void
+    def members: () -> [:id, :status, :name, :title, :description, :details, :function, :execution, :requested_at, :expires_at, :decision]
+    def with: (?id: String, ?status: String, ?name: String, ?title: String, ?description: String, ?details: json_value, ?function: DurableApprovalFunction, ?execution: DurableApprovalExecution, ?requested_at: Time, ?expires_at: Time?, ?decision: DurableApprovalDecision?) -> DurableApproval
+    def to_h: () -> { id: String, status: String, name: String, title: String, description: String, details: json_value, function: DurableApprovalFunction, execution: DurableApprovalExecution, requested_at: Time, expires_at: Time?, decision: DurableApprovalDecision? }
+            | [K, V] () { (Symbol, field) -> [K, V] } -> Hash[K, V]
+    def deconstruct: () -> [String, String, String, String, String, json_value, DurableApprovalFunction, DurableApprovalExecution, Time, Time?, DurableApprovalDecision?]
+    def deconstruct_keys: (Array[Symbol]?) -> Hash[Symbol, field]
+  end
+
+  class DurableApprovalPage < Data
+    attr_reader approvals: Array[DurableApproval]
+    attr_reader page: Integer
+    attr_reader limit: Integer
+    attr_reader total: Integer
+    attr_reader has_more: bool
+
+    def self.new: (Enumerable[DurableApproval] approvals, Integer page, Integer limit, Integer total, bool has_more) -> DurableApprovalPage
+                | (approvals: Enumerable[DurableApproval], page: Integer, limit: Integer, total: Integer, has_more: bool) -> DurableApprovalPage
+    def self.[]: (Enumerable[DurableApproval] approvals, Integer page, Integer limit, Integer total, bool has_more) -> DurableApprovalPage
+               | (approvals: Enumerable[DurableApproval], page: Integer, limit: Integer, total: Integer, has_more: bool) -> DurableApprovalPage
+    def self.members: () -> [:approvals, :page, :limit, :total, :has_more]
+
+    def initialize: (approvals: Enumerable[DurableApproval], page: Integer, limit: Integer, total: Integer, has_more: bool) -> void
+    def members: () -> [:approvals, :page, :limit, :total, :has_more]
+    def with: (?approvals: Enumerable[DurableApproval], ?page: Integer, ?limit: Integer, ?total: Integer, ?has_more: bool) -> DurableApprovalPage
+    def to_h: () -> { approvals: Array[DurableApproval], page: Integer, limit: Integer, total: Integer, has_more: bool }
+            | [K, V] () { (Symbol, Array[DurableApproval] | Integer | bool) -> [K, V] } -> Hash[K, V]
+    def deconstruct: () -> [Array[DurableApproval], Integer, Integer, Integer, bool]
+    def deconstruct_keys: (Array[Symbol]?) -> Hash[Symbol, Array[DurableApproval] | Integer | bool]
+  end
+
+  class DurableApprovalCounts < Data
+    attr_reader requested: Integer
+    attr_reader pending: Integer
+    attr_reader approved: Integer
+    attr_reader denied: Integer
+    attr_reader expired: Integer
+    attr_reader cancelled: Integer
+
+    def self.new: (Integer requested, Integer pending, Integer approved, Integer denied, Integer expired, Integer cancelled) -> DurableApprovalCounts
+                | (requested: Integer, pending: Integer, approved: Integer, denied: Integer, expired: Integer, cancelled: Integer) -> DurableApprovalCounts
+    def self.[]: (Integer requested, Integer pending, Integer approved, Integer denied, Integer expired, Integer cancelled) -> DurableApprovalCounts
+               | (requested: Integer, pending: Integer, approved: Integer, denied: Integer, expired: Integer, cancelled: Integer) -> DurableApprovalCounts
+    def self.members: () -> [:requested, :pending, :approved, :denied, :expired, :cancelled]
+
+    def members: () -> [:requested, :pending, :approved, :denied, :expired, :cancelled]
+    def with: (?requested: Integer, ?pending: Integer, ?approved: Integer, ?denied: Integer, ?expired: Integer, ?cancelled: Integer) -> DurableApprovalCounts
+    def to_h: () -> { requested: Integer, pending: Integer, approved: Integer, denied: Integer, expired: Integer, cancelled: Integer }
+            | [K, V] () { (Symbol, Integer) -> [K, V] } -> Hash[K, V]
+    def deconstruct: () -> [Integer, Integer, Integer, Integer, Integer, Integer]
+    def deconstruct_keys: (Array[Symbol]?) -> Hash[Symbol, Integer]
+  end
+
+  class DurableApprovalFunctionCounts < Data
+    attr_reader function: DurableApprovalFunction
+    attr_reader counts: DurableApprovalCounts
+
+    def self.new: (DurableApprovalFunction function, DurableApprovalCounts counts) -> DurableApprovalFunctionCounts
+                | (function: DurableApprovalFunction, counts: DurableApprovalCounts) -> DurableApprovalFunctionCounts
+    def self.[]: (DurableApprovalFunction function, DurableApprovalCounts counts) -> DurableApprovalFunctionCounts
+               | (function: DurableApprovalFunction, counts: DurableApprovalCounts) -> DurableApprovalFunctionCounts
+    def self.members: () -> [:function, :counts]
+
+    def members: () -> [:function, :counts]
+    def with: (?function: DurableApprovalFunction, ?counts: DurableApprovalCounts) -> DurableApprovalFunctionCounts
+    def to_h: () -> { function: DurableApprovalFunction, counts: DurableApprovalCounts }
+            | [K, V] () { (Symbol, DurableApprovalFunction | DurableApprovalCounts) -> [K, V] } -> Hash[K, V]
+    def deconstruct: () -> [DurableApprovalFunction, DurableApprovalCounts]
+    def deconstruct_keys: (Array[Symbol]?) -> Hash[Symbol, DurableApprovalFunction | DurableApprovalCounts]
+  end
+
+  class DurableApprovalDailyCounts < Data
+    attr_reader date: String
+    attr_reader counts: DurableApprovalCounts
+
+    def self.new: (String date, DurableApprovalCounts counts) -> DurableApprovalDailyCounts
+                | (date: String, counts: DurableApprovalCounts) -> DurableApprovalDailyCounts
+    def self.[]: (String date, DurableApprovalCounts counts) -> DurableApprovalDailyCounts
+               | (date: String, counts: DurableApprovalCounts) -> DurableApprovalDailyCounts
+    def self.members: () -> [:date, :counts]
+
+    def initialize: (date: String, counts: DurableApprovalCounts) -> void
+    def members: () -> [:date, :counts]
+    def with: (?date: String, ?counts: DurableApprovalCounts) -> DurableApprovalDailyCounts
+    def to_h: () -> { date: String, counts: DurableApprovalCounts }
+            | [K, V] () { (Symbol, String | DurableApprovalCounts) -> [K, V] } -> Hash[K, V]
+    def deconstruct: () -> [String, DurableApprovalCounts]
+    def deconstruct_keys: (Array[Symbol]?) -> Hash[Symbol, String | DurableApprovalCounts]
+  end
+
+  class DurableApprovalStats < Data
+    type field = Time | DurableApprovalCounts | Float | Array[DurableApprovalFunctionCounts] | Array[DurableApprovalDailyCounts] | nil
+
+    attr_reader from: Time
+    attr_reader to: Time
+    attr_reader counts: DurableApprovalCounts
+    attr_reader approval_rate: Float?
+    attr_reader median_seconds_to_decision: Float?
+    attr_reader p90_seconds_to_decision: Float?
+    attr_reader functions: Array[DurableApprovalFunctionCounts]
+    attr_reader other_functions: DurableApprovalCounts
+    attr_reader daily: Array[DurableApprovalDailyCounts]
+
+    def self.new: (Time from, Time to, DurableApprovalCounts counts, Float? approval_rate, Float? median_seconds_to_decision, Float? p90_seconds_to_decision, Array[DurableApprovalFunctionCounts] functions, DurableApprovalCounts other_functions, Array[DurableApprovalDailyCounts] daily) -> DurableApprovalStats
+                | (from: Time, to: Time, counts: DurableApprovalCounts, ?approval_rate: Float?, ?median_seconds_to_decision: Float?, ?p90_seconds_to_decision: Float?, functions: Array[DurableApprovalFunctionCounts], other_functions: DurableApprovalCounts, daily: Array[DurableApprovalDailyCounts]) -> DurableApprovalStats
+    def self.[]: (Time from, Time to, DurableApprovalCounts counts, Float? approval_rate, Float? median_seconds_to_decision, Float? p90_seconds_to_decision, Array[DurableApprovalFunctionCounts] functions, DurableApprovalCounts other_functions, Array[DurableApprovalDailyCounts] daily) -> DurableApprovalStats
+               | (from: Time, to: Time, counts: DurableApprovalCounts, ?approval_rate: Float?, ?median_seconds_to_decision: Float?, ?p90_seconds_to_decision: Float?, functions: Array[DurableApprovalFunctionCounts], other_functions: DurableApprovalCounts, daily: Array[DurableApprovalDailyCounts]) -> DurableApprovalStats
+    def self.members: () -> [:from, :to, :counts, :approval_rate, :median_seconds_to_decision, :p90_seconds_to_decision, :functions, :other_functions, :daily]
+
+    private def initialize: (**field attributes) -> void
+    def members: () -> [:from, :to, :counts, :approval_rate, :median_seconds_to_decision, :p90_seconds_to_decision, :functions, :other_functions, :daily]
+    def with: (?from: Time, ?to: Time, ?counts: DurableApprovalCounts, ?approval_rate: Float?, ?median_seconds_to_decision: Float?, ?p90_seconds_to_decision: Float?, ?functions: Array[DurableApprovalFunctionCounts], ?other_functions: DurableApprovalCounts, ?daily: Array[DurableApprovalDailyCounts]) -> DurableApprovalStats
+    def to_h: () -> { from: Time, to: Time, counts: DurableApprovalCounts, approval_rate: Float?, median_seconds_to_decision: Float?, p90_seconds_to_decision: Float?, functions: Array[DurableApprovalFunctionCounts], other_functions: DurableApprovalCounts, daily: Array[DurableApprovalDailyCounts] }
+            | [K, V] () { (Symbol, field) -> [K, V] } -> Hash[K, V]
+    def deconstruct: () -> [Time, Time, DurableApprovalCounts, Float?, Float?, Float?, Array[DurableApprovalFunctionCounts], DurableApprovalCounts, Array[DurableApprovalDailyCounts]]
+    def deconstruct_keys: (Array[Symbol]?) -> Hash[Symbol, field]
+  end
+end

data/sig/errors.rbs

@@ -11,6 +11,9 @@ module Volcano
     class AuthenticationError < VolcanoError
     end
 
+    class PermissionDeniedError < AuthenticationError
+    end
+
     class ValidationError < VolcanoError
     end