@fungi.computer/approvals 0.0.0-stage → 0.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jamstack Consulting LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,180 @@
-# Temporary Holding Version
+# Approvals
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+One durable approval record, many renderers. Mycelium owns operation admission;
+this package owns the decision lifecycle beside it. Team storage on the Hub and
+the Oyster host supply the homes. Bonsai is not a ledger home.
+
+## Install
+
+```sh
+npm install @fungi.computer/approvals @fungi.computer/watchdog
+```
+
+Approvals ships ESM and TypeScript declarations from its root entrypoint. The
+example below uses Node.js 24's native SQLite adapter from Watchdog. Your host
+owns the database, requester identity, current grants and dispatch.
+
+## Quick start
+
+Stage a proposed write without executing it. This disposable in-memory example
+prints `pending`; use a persistent, host-owned database for real requests.
+
+```ts
+import { DatabaseSync } from "node:sqlite";
+import { fromNodeSqlite } from "@fungi.computer/watchdog/node-sqlite";
+import { ApprovalLedger } from "@fungi.computer/approvals";
+
+const database = new DatabaseSync(":memory:");
+try {
+  const ledger = new ApprovalLedger({
+    owner: fromNodeSqlite(database),
+    home: { kind: "team", id: "example-team" },
+    now: Date.now,
+  });
+  const staged = await ledger.request({
+    requester: {
+      principalId: "agent:example",
+      agentId: "example-agent",
+      sessionId: "example-session",
+      displayName: "Example",
+    },
+    module: "notes",
+    operation: "saveNote",
+    access: "write",
+    reversibility: "reversible",
+    authorityFence: "grant-generation:1",
+    idempotencyKey: "turn:1/tool:1/operation:0",
+    inputJson: '{"text":"hello"}',
+  });
+  if (staged.kind !== "record") throw new Error(staged.reason);
+  console.log(staged.record.state); // "pending"
+} finally {
+  database.close();
+}
+```
+
+The identities and fence here are illustrative host-attested values, not fields
+to trust from an Agent or browser. Keep the same idempotency key when retrying
+the same operation. `request` stages a record and records the home's
+auto-approve decision without dispatching. `submit` additionally applies a newly
+policy-approved request inline through the authority recheck.
+
+## Examples
+
+The home example stages one pending write using native SQLite. The packed
+consumer in `test/stranger/runtime.mjs` continues through a human answer,
+application and result handoff. It observes one dispatch and one send across
+sequential successful retries; it is not a real Agent transport proof.
+
+To integrate those steps, pass `answer` a freshly resolved human member and the
+record's expected revision. Supply `apply` with an `ApprovalApplyHost`:
+`recheck` reads the requester's current authority and fence, and `dispatch`
+calls your existing operation door. Approval does not grant missing authority.
+Finally, `handoff` sends the result through your ordinary message API and
+records its command receipt. Use the notice's stable `deliveryId` for recipient
+deduplication.
+
+## Contract model
+
+A write needing approval returns a typed pending_approval tool result
+immediately with its recordId and description. It does not run and does not
+suspend the Agent turn. On approval the ledger durably claims, rechecks the
+exact fence and requester's current Mycelium authority, dispatches the existing
+host operation at most once, and stores applied/denied/outcome_unknown. Deferred
+results use the existing ordinary Agent new-message path. Auto-approve applies
+inline through the same record. No MuleTool.resume, Watchdog park/wake, stored
+tool suspension, or unsafe execute replay belongs to this model.
+
+The member-bound capability exposes approvals.list/get/answer/setAutoApprove.
+Actors and live grants come from the host, never from request bodies. Reads are
+bounded and project current answer/policy rights. Answering never grants the
+requester authority over an operation.
+
+Auto-approve matches a module (or all modules) and access class write/external,
+optionally for one Agent. ON includes irreversible actions, still records the
+decision, and never overrides revoked authority. Local and the solo Oyster owner
+default ON; Teams default OFF. Only the Oyster owner answers on an Oyster.
+Pending approval expires after 24 hours by default; owner/admin configuration
+may change that duration. Expiry never approves.
+
+## Current implementation boundary
+
+ApprovalLedger uses a host-supplied native SQLite owner. It stages a stable
+intended effect, snapshots metadata before hashing yields, stores private
+input/output separately, serializes answers and claims, and records typed
+completion or unknown outcome without blindly redispatching. A known host
+refusal is distinct from App JSON. recoverClaims transitions orphan claims in
+bounded batches; the native host must call it only at boot, never during a live
+dispatch.
+
+ledger.capability({ actor, decision }) binds the four public methods. The host
+must supply fresh member/operation facts on every call and actual durable
+apply/handoff work after a decision; there is no success-shaped default hook.
+List reads are bounded to at most 100 records with a continuation cursor.
+Request bodies cannot select their actor. Policy is persisted by home and
+Agent/module/access family.
+
+Deferred, Agent-Session-linked requests also create their result-delivery intent
+in the request transaction. pendingHandoffs returns at most 100 home-local,
+terminal notices (including requests whose deadline has passed). handoff sends
+with one stable recipient-side request identity and stores the real Session
+command receipt. A lost acknowledgement retries that message identity, not the
+effect; inline policy approval creates no extra Agent turn. Private input bytes
+are never notification cargo. The host owns current recipient admission and safe
+ordinary-message presentation of the result.
+
+The consumer test uses the public Shiitake memory host with borrowed native
+SQLite owners, loses an acknowledgement after session.send accepts, reopens both
+databases and owners, and observes one new-message turn with the same command
+identity. This is real Session/storage component proof, not a deployed home,
+transport-loss drill or a full-host security law.
+
+Host integration is still in progress: the native Team/Oyster compositions,
+ordinary new-message handoff and configurable expiry are not yet wired. The
+current store uses the 24-hour default. Store tests and the page/RPC consumer
+fixture do not establish those production behaviors or the ten full-host laws.
+
+## Host admission policy read
+
+The runtime calls ledger.selectAutoApprove({ agentId, module, access }) to read
+one effective boolean. This is the same selection request/submit uses: persisted
+Agent rules win over home rules, then a module rule wins over all modules.
+setAutoApprove persists the single enabled field in approval_rules; the read
+neither stages an action nor dispatches it. A true policy value does not attest
+to current grants, the authority fence, or containment.
+
+Local is an explicit ledger home with default ON, like Oyster; Team defaults
+OFF. The Local adapter supplies its native SQLite owner. Containment is owned by
+the Local sandbox integration, not this policy read: use a sandbox whenever one
+is available; its absence does not turn auto-approve OFF. An explicit
+requirement for sandboxed execution is a containment choice, not another
+approval switch. This package does not choose a Local database path, start a
+sandbox, display the one-time uncontained notice, or replace the runtime's
+current-authority check.
+
+## Capability-attached visual evidence
+
+ApprovalRecord optionally carries evidence: an array of at most 4 descriptors,
+each with kind artifact, ref sha256:<64 lowercase hex>, mediaType image/png and
+bytes (integer 1 through 5 MiB). ApprovalEvidenceSchema is the maintained Effect
+Schema decoder. These are defensive display ceilings, not execution authority.
+The ref is a content address, not a URL or a release's opaque artifact: name.
+
+Only the submitting capability supplies ApprovalSubmitHost.evidence to
+ledger.submit(request, host). The host-only staging API request(request,
+evidence?) uses the same decoder. ApprovalRequest and tool arguments do not gain
+an evidence field. Never spread Agent/tool input into the host adapter. Metadata
+is snapshotted before hashing yields and persisted with the record; get/list and
+ApprovalView carry it. The immediate pending tool result remains unchanged.
+
+Image content is untrusted display-only data, even when capture was performed by
+a capability. Never OCR it into instructions, inject it as Agent text or treat
+it as authority. This package stores metadata only: it does not capture, fetch
+or validate PNG bytes. Producers/store adapters and display renderers own actual
+bounded artifact reads, digest/length verification and maintained image
+decoding. Screenshot capture, workflow result cards, Grove display and the TUI's
+interactive open-screenshot link are separate owner work, not implemented by
+this contract. An idempotent retry retains its original evidence: substituting,
+adding or removing descriptors under the same effect identity returns
+identity-conflict, never silently changes the reviewed image. Omitted and empty
+lists both mean no evidence.

package/dist/contract.d.ts

@@ -0,0 +1,198 @@
+import * as Schema from "effect/Schema";
+/** The effect class is independent of reversibility; ON includes both. */
+export declare const ApprovalAccessSchema: Schema.Literals<readonly ["write", "external"]>;
+/** One operation module, or every module when module is null. */
+export declare const ApprovalFamilySchema: Schema.Struct<{
+    readonly module: Schema.NullOr<Schema.String>;
+    readonly access: Schema.Literals<readonly ["write", "external"]>;
+}>;
+/** One requesting Agent, or the entire home when agentId is null. */
+export declare const ApprovalScopeSchema: Schema.Struct<{
+    readonly agentId: Schema.NullOr<Schema.String>;
+}>;
+/** Stable requester identity supplied by the host, never by tool arguments. */
+export declare const ApprovalRequesterSchema: Schema.Struct<{
+    readonly principalId: Schema.String;
+    readonly agentId: Schema.NullOr<Schema.String>;
+    readonly sessionId: Schema.NullOr<Schema.String>;
+    readonly displayName: Schema.String;
+}>;
+/** A renderer sees metadata and a byte digest, never the proposed input. */
+export declare const ApprovalDescriptionSchema: Schema.Struct<{
+    readonly title: Schema.String;
+    readonly inputBytes: Schema.Int;
+    readonly inputSha256: Schema.String;
+}>;
+/** Immediate normal tool result: no effect ran and no Agent turn is suspended. */
+export declare const PendingApprovalSchema: Schema.Struct<{
+    readonly kind: Schema.Literal<"pending_approval">;
+    readonly recordId: Schema.String;
+    readonly description: Schema.Struct<{
+        readonly title: Schema.String;
+        readonly inputBytes: Schema.Int;
+        readonly inputSha256: Schema.String;
+    }>;
+}>;
+/** Deferred apply is delivered later through the existing Agent new-message path. */
+export type PendingApproval = typeof PendingApprovalSchema.Type;
+/** All renderers use these same durable lifecycle states. */
+export declare const ApprovalStateSchema: Schema.Literals<readonly ["requested", "pending", "approved", "claimed", "applied", "denied", "expired", "outcome_unknown"]>;
+/** Why a decision or apply was refused; unknown dispatch is never a denial. */
+export declare const ApprovalRefusalReasonSchema: Schema.Literals<readonly ["not-found", "not-eligible", "already-answered", "stale-revision", "expired", "declined", "fenced", "not-granted", "read-only", "pending", "in-flight", "outcome-unknown", "identity-conflict"]>;
+/** Defensive display limits, not authority to fetch or interpret image content. */
+export declare const MAX_APPROVAL_EVIDENCE = 4;
+/** Maximum attested PNG byte length in one evidence descriptor. */
+export declare const MAX_APPROVAL_EVIDENCE_BYTES: number;
+/** Capability-attested content address; image bytes remain untrusted display-only data. */
+export declare const ApprovalEvidenceSchema: Schema.$Array<Schema.Struct<{
+    readonly kind: Schema.Literal<"artifact">;
+    readonly ref: Schema.String;
+    readonly mediaType: Schema.Literal<"image/png">;
+    readonly bytes: Schema.Int;
+}>>;
+/** Metadata only: never raw image bytes, prose, URLs or executable content. */
+export type ApprovalEvidence = typeof ApprovalEvidenceSchema.Type;
+/** Public record. Effect input, output and executable continuations stay host-private. */
+export declare const ApprovalRecordSchema: Schema.Struct<{
+    readonly recordId: Schema.String;
+    readonly requester: Schema.Struct<{
+        readonly principalId: Schema.String;
+        readonly agentId: Schema.NullOr<Schema.String>;
+        readonly sessionId: Schema.NullOr<Schema.String>;
+        readonly displayName: Schema.String;
+    }>;
+    readonly module: Schema.String;
+    readonly operation: Schema.String;
+    readonly access: Schema.Literals<readonly ["write", "external"]>;
+    readonly description: Schema.Struct<{
+        readonly title: Schema.String;
+        readonly inputBytes: Schema.Int;
+        readonly inputSha256: Schema.String;
+    }>;
+    readonly evidence: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly kind: Schema.Literal<"artifact">;
+        readonly ref: Schema.String;
+        readonly mediaType: Schema.Literal<"image/png">;
+        readonly bytes: Schema.Int;
+    }>>>;
+    readonly authorityFence: Schema.String;
+    readonly reversibility: Schema.Literals<readonly ["reversible", "irreversible-external"]>;
+    readonly state: Schema.Literals<readonly ["requested", "pending", "approved", "claimed", "applied", "denied", "expired", "outcome_unknown"]>;
+    readonly by: Schema.NullOr<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"human">;
+        readonly memberId: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"policy">;
+    }>]>>;
+    readonly reason: Schema.NullOr<Schema.Literals<readonly ["not-found", "not-eligible", "already-answered", "stale-revision", "expired", "declined", "fenced", "not-granted", "read-only", "pending", "in-flight", "outcome-unknown", "identity-conflict"]>>;
+    readonly requestedAt: Schema.Int;
+    readonly expiresAt: Schema.Int;
+    readonly updatedAt: Schema.Int;
+    readonly revision: Schema.Int;
+}>;
+/** Rights are recomputed for the holder on each read, not persisted on the record. */
+export declare const ApprovalViewSchema: Schema.Struct<{
+    readonly record: Schema.Struct<{
+        readonly recordId: Schema.String;
+        readonly requester: Schema.Struct<{
+            readonly principalId: Schema.String;
+            readonly agentId: Schema.NullOr<Schema.String>;
+            readonly sessionId: Schema.NullOr<Schema.String>;
+            readonly displayName: Schema.String;
+        }>;
+        readonly module: Schema.String;
+        readonly operation: Schema.String;
+        readonly access: Schema.Literals<readonly ["write", "external"]>;
+        readonly description: Schema.Struct<{
+            readonly title: Schema.String;
+            readonly inputBytes: Schema.Int;
+            readonly inputSha256: Schema.String;
+        }>;
+        readonly evidence: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly kind: Schema.Literal<"artifact">;
+            readonly ref: Schema.String;
+            readonly mediaType: Schema.Literal<"image/png">;
+            readonly bytes: Schema.Int;
+        }>>>;
+        readonly authorityFence: Schema.String;
+        readonly reversibility: Schema.Literals<readonly ["reversible", "irreversible-external"]>;
+        readonly state: Schema.Literals<readonly ["requested", "pending", "approved", "claimed", "applied", "denied", "expired", "outcome_unknown"]>;
+        readonly by: Schema.NullOr<Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"human">;
+            readonly memberId: Schema.String;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"policy">;
+        }>]>>;
+        readonly reason: Schema.NullOr<Schema.Literals<readonly ["not-found", "not-eligible", "already-answered", "stale-revision", "expired", "declined", "fenced", "not-granted", "read-only", "pending", "in-flight", "outcome-unknown", "identity-conflict"]>>;
+        readonly requestedAt: Schema.Int;
+        readonly expiresAt: Schema.Int;
+        readonly updatedAt: Schema.Int;
+        readonly revision: Schema.Int;
+    }>;
+    readonly canAnswer: Schema.Boolean;
+    readonly canSetAutoApprove: Schema.Boolean;
+}>;
+/** Bounded reads with an opaque storage cursor. */
+export declare const ApprovalListInputSchema: Schema.Struct<{
+    readonly state: Schema.optionalKey<Schema.Literals<readonly ["requested", "pending", "approved", "claimed", "applied", "denied", "expired", "outcome_unknown"]>>;
+    readonly cursor: Schema.optionalKey<Schema.String>;
+    readonly limit: Schema.optionalKey<Schema.Int>;
+}>;
+/** Locate one public view without carrying actor identity in request data. */
+export declare const ApprovalGetInputSchema: Schema.Struct<{
+    readonly recordId: Schema.String;
+}>;
+/** An answer is a decision, never a confirm-labelled write itself. */
+export declare const ApprovalAnswerInputSchema: Schema.Struct<{
+    readonly recordId: Schema.String;
+    readonly decision: Schema.Literals<readonly ["approve", "deny"]>;
+    readonly expectedRevision: Schema.Int;
+}>;
+/** Explicit policy mutation. A false rule narrows a broader true rule. */
+export declare const AutoApproveInputSchema: Schema.Struct<{
+    readonly scope: Schema.Struct<{
+        readonly agentId: Schema.NullOr<Schema.String>;
+    }>;
+    readonly family: Schema.Struct<{
+        readonly module: Schema.NullOr<Schema.String>;
+        readonly access: Schema.Literals<readonly ["write", "external"]>;
+    }>;
+    readonly enabled: Schema.Boolean;
+}>;
+/** Durable approval visible to every renderer. */
+export type ApprovalRecord = typeof ApprovalRecordSchema.Type;
+/** Current holder's projection. A disabled button is not an authorization check. */
+export type ApprovalView = typeof ApprovalViewSchema.Type;
+/** Bounded listing request. */
+export type ApprovalListInput = typeof ApprovalListInputSchema.Type;
+/** Revision-pinned answer. No actor identity is accepted on the wire. */
+export type ApprovalAnswerInput = typeof ApprovalAnswerInputSchema.Type;
+/** One per-home or per-Agent module/access rule. */
+export type AutoApproveInput = typeof AutoApproveInputSchema.Type;
+/** One typed refusal shared by answer/apply/policy entrypoints. */
+export type ApprovalRefusal = Readonly<{
+    kind: "refused";
+    reason: typeof ApprovalRefusalReasonSchema.Type;
+}>;
+/** The member-bound capability. Host authentication supplies the actor. */
+export type Approvals = Readonly<{
+    /** List a bounded page of this home's records for the current member. */
+    list(input: ApprovalListInput): Promise<Readonly<{
+        items: readonly ApprovalView[];
+        nextCursor: string | null;
+    }>>;
+    /** Read a member-scoped record view, or null when inaccessible. */
+    get(input: Readonly<{
+        recordId: string;
+    }>): Promise<ApprovalView | null>;
+    /** Record one current-member decision against the supplied record revision. */
+    answer(input: ApprovalAnswerInput): Promise<Readonly<{
+        kind: "answered";
+        view: ApprovalView;
+    }> | ApprovalRefusal>;
+    /** Update family policy without granting operation authority. */
+    setAutoApprove(input: AutoApproveInput): Promise<Readonly<{
+        kind: "updated";
+        rule: AutoApproveInput;
+    }> | ApprovalRefusal>;
+}>;

package/dist/contract.js

@@ -0,0 +1,120 @@
+import * as Schema from "effect/Schema";
+const Identity = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256));
+const Revision = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER));
+const Timestamp = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER));
+/** The effect class is independent of reversibility; ON includes both. */
+export const ApprovalAccessSchema = Schema.Literals(["write", "external"]);
+/** One operation module, or every module when module is null. */
+export const ApprovalFamilySchema = Schema.Struct({
+    module: Schema.NullOr(Identity),
+    access: ApprovalAccessSchema,
+});
+/** One requesting Agent, or the entire home when agentId is null. */
+export const ApprovalScopeSchema = Schema.Struct({
+    agentId: Schema.NullOr(Identity),
+});
+/** Stable requester identity supplied by the host, never by tool arguments. */
+export const ApprovalRequesterSchema = Schema.Struct({
+    principalId: Identity,
+    agentId: Schema.NullOr(Identity),
+    sessionId: Schema.NullOr(Identity),
+    displayName: Identity,
+});
+/** A renderer sees metadata and a byte digest, never the proposed input. */
+export const ApprovalDescriptionSchema = Schema.Struct({
+    title: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(512)),
+    inputBytes: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+    inputSha256: Schema.String.check(Schema.isPattern(/^[a-f0-9]{64}$/)),
+});
+/** Immediate normal tool result: no effect ran and no Agent turn is suspended. */
+export const PendingApprovalSchema = Schema.Struct({
+    kind: Schema.Literal("pending_approval"),
+    recordId: Identity,
+    description: ApprovalDescriptionSchema,
+});
+/** All renderers use these same durable lifecycle states. */
+export const ApprovalStateSchema = Schema.Literals([
+    "requested",
+    "pending",
+    "approved",
+    "claimed",
+    "applied",
+    "denied",
+    "expired",
+    "outcome_unknown",
+]);
+/** Why a decision or apply was refused; unknown dispatch is never a denial. */
+export const ApprovalRefusalReasonSchema = Schema.Literals([
+    "not-found",
+    "not-eligible",
+    "already-answered",
+    "stale-revision",
+    "expired",
+    "declined",
+    "fenced",
+    "not-granted",
+    "read-only",
+    "pending",
+    "in-flight",
+    "outcome-unknown",
+    "identity-conflict",
+]);
+/** Defensive display limits, not authority to fetch or interpret image content. */
+export const MAX_APPROVAL_EVIDENCE = 4;
+/** Maximum attested PNG byte length in one evidence descriptor. */
+export const MAX_APPROVAL_EVIDENCE_BYTES = 5 * 1024 * 1024;
+/** Capability-attested content address; image bytes remain untrusted display-only data. */
+export const ApprovalEvidenceSchema = Schema.Array(Schema.Struct({
+    kind: Schema.Literal("artifact"),
+    ref: Schema.String.check(Schema.isPattern(/^sha256:[a-f0-9]{64}$/)),
+    mediaType: Schema.Literal("image/png"),
+    bytes: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(MAX_APPROVAL_EVIDENCE_BYTES)),
+})).check(Schema.isMaxLength(MAX_APPROVAL_EVIDENCE));
+/** Public record. Effect input, output and executable continuations stay host-private. */
+export const ApprovalRecordSchema = Schema.Struct({
+    recordId: Identity,
+    requester: ApprovalRequesterSchema,
+    module: Identity,
+    operation: Identity,
+    access: ApprovalAccessSchema,
+    description: ApprovalDescriptionSchema,
+    evidence: Schema.optionalKey(ApprovalEvidenceSchema),
+    authorityFence: Identity,
+    reversibility: Schema.Literals(["reversible", "irreversible-external"]),
+    state: ApprovalStateSchema,
+    by: Schema.NullOr(Schema.Union([
+        Schema.Struct({ kind: Schema.Literal("human"), memberId: Identity }),
+        Schema.Struct({ kind: Schema.Literal("policy") }),
+    ])),
+    reason: Schema.NullOr(ApprovalRefusalReasonSchema),
+    requestedAt: Timestamp,
+    expiresAt: Timestamp,
+    updatedAt: Timestamp,
+    revision: Revision,
+});
+/** Rights are recomputed for the holder on each read, not persisted on the record. */
+export const ApprovalViewSchema = Schema.Struct({
+    record: ApprovalRecordSchema,
+    canAnswer: Schema.Boolean,
+    canSetAutoApprove: Schema.Boolean,
+});
+/** Bounded reads with an opaque storage cursor. */
+export const ApprovalListInputSchema = Schema.Struct({
+    state: Schema.optionalKey(ApprovalStateSchema),
+    cursor: Schema.optionalKey(Identity),
+    limit: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(100))),
+});
+/** Locate one public view without carrying actor identity in request data. */
+export const ApprovalGetInputSchema = Schema.Struct({ recordId: Identity });
+/** An answer is a decision, never a confirm-labelled write itself. */
+export const ApprovalAnswerInputSchema = Schema.Struct({
+    recordId: Identity,
+    decision: Schema.Literals(["approve", "deny"]),
+    expectedRevision: Revision,
+});
+/** Explicit policy mutation. A false rule narrows a broader true rule. */
+export const AutoApproveInputSchema = Schema.Struct({
+    scope: ApprovalScopeSchema,
+    family: ApprovalFamilySchema,
+    enabled: Schema.Boolean,
+});

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./contract.js";
+export { ApprovalLedger, ApprovalRefusalSchema, DEFAULT_APPROVAL_EXPIRY_MS, type AutoApproveQuery, type ApprovalHome, type ApprovalRequest, type ApprovalAnswerer, type ApprovalAdmission, type ApprovalRuleSetter, type ApprovalApplyHost, type ApprovalSubmitHost, type ApprovalDispatchCompletion, type ApprovalApplyResult, type ApprovalResultNotice, type ApprovalHandoffResult, } from "./ledger.js";

package/dist/index.js

@@ -0,0 +1,2 @@
+export * from "./contract.js";
+export { ApprovalLedger, ApprovalRefusalSchema, DEFAULT_APPROVAL_EXPIRY_MS, } from "./ledger.js";