@intx/hub-sessions 0.3.0 → 0.4.0

package/dist/workflow-dispatch-service.d.ts

@@ -26,15 +26,17 @@ export type WorkflowDispatchServiceDeps = {
     /** Resolve the deployment anchor's durable routing address. */
     readonly resolveAnchorAddress: (anchorRunId: string) => Promise<string | null>;
     readonly leaseDurationMs?: number;
+    /** Bounds pending claims and unfinished deliveries across all drains. */
+    readonly maxConcurrentDispatches?: number;
     readonly retryDelayMs?: (attempt: number) => number;
     readonly now?: () => Date;
     readonly createLeaseId?: () => string;
 };
 /**
- * Drives Hub-owned workflow triggers onto exclusive sidecars. The database
+ * Drives Hub-owned workflow triggers onto provisioned sidecars. The database
  * row is the delivery authority: websocket acceptance never deletes the raw
  * payload, and a generation replacement requeues every row that has not been
  * settled by the workflow-run Git claim-check.
  */
-export declare function createWorkflowDispatchService({ dispatchStore, allocationStore, router, resolveAnchorAddress, leaseDurationMs, retryDelayMs, now, createLeaseId, }: WorkflowDispatchServiceDeps): WorkflowDispatchService;
+export declare function createWorkflowDispatchService({ dispatchStore, allocationStore, router, resolveAnchorAddress, leaseDurationMs, maxConcurrentDispatches, retryDelayMs, now, createLeaseId, }: WorkflowDispatchServiceDeps): WorkflowDispatchService;
 export {};

package/dist/workflow-dispatch-service.js

@@ -1,8 +1,10 @@
 import { getLogger } from "@intx/log";
-import { base64Encode, hexEncode } from "@intx/types";
+import { base64Encode, deriveWorkflowRunId, hexEncode } from "@intx/types";
 import { SignalDeliverFrame } from "@intx/types/sidecar";
+import { runSidecarOperation, SidecarOperationTimeoutError, } from "./sidecar-allocation/operation.js";
 const logger = getLogger(["hub", "workflow-dispatch"]);
 const DEFAULT_LEASE_DURATION_MS = 30_000;
+const DEFAULT_MAX_CONCURRENT_DISPATCHES = 8;
 function defaultRetryDelay(attempt) {
     return Math.min(500 * 2 ** Math.min(attempt, 6), 30_000);
 }
@@ -12,6 +14,7 @@ function randomLeaseId() {
 function targetForReadyAllocation(allocation) {
     if (allocation.status !== "allocated" ||
         allocation.ensureAcceptedGeneration !== allocation.generation ||
+        allocation.initializationLeaseId !== undefined ||
         allocation.connectDeadline !== undefined) {
         return null;
     }
@@ -21,16 +24,22 @@ function targetForReadyAllocation(allocation) {
     };
 }
 /**
- * Drives Hub-owned workflow triggers onto exclusive sidecars. The database
+ * Drives Hub-owned workflow triggers onto provisioned sidecars. The database
  * row is the delivery authority: websocket acceptance never deletes the raw
  * payload, and a generation replacement requeues every row that has not been
  * settled by the workflow-run Git claim-check.
  */
-export function createWorkflowDispatchService({ dispatchStore, allocationStore, router, resolveAnchorAddress, leaseDurationMs = DEFAULT_LEASE_DURATION_MS, retryDelayMs = defaultRetryDelay, now = () => new Date(), createLeaseId = randomLeaseId, }) {
-    if (leaseDurationMs <= 0) {
-        throw new Error("leaseDurationMs must be positive");
+export function createWorkflowDispatchService({ dispatchStore, allocationStore, router, resolveAnchorAddress, leaseDurationMs = DEFAULT_LEASE_DURATION_MS, maxConcurrentDispatches = DEFAULT_MAX_CONCURRENT_DISPATCHES, retryDelayMs = defaultRetryDelay, now = () => new Date(), createLeaseId = randomLeaseId, }) {
+    if (!Number.isSafeInteger(leaseDurationMs) || leaseDurationMs <= 0) {
+        throw new Error("leaseDurationMs must be a positive integer");
+    }
+    if (!Number.isSafeInteger(maxConcurrentDispatches) ||
+        maxConcurrentDispatches <= 0) {
+        throw new Error("maxConcurrentDispatches must be a positive integer");
     }
     let drainPromise = null;
+    let admittedDispatches = 0;
+    const activeDispatches = new Set();
     function retryAt(attempt) {
         return new Date(now().getTime() + retryDelayMs(attempt));
     }
@@ -45,53 +54,107 @@ export function createWorkflowDispatchService({ dispatchStore, allocationStore,
         });
     }
     async function reconcileNext() {
-        const leaseId = createLeaseId();
-        const dispatch = await dispatchStore.claimNextPending({
-            leaseId,
-            leaseDurationMs,
-        });
-        if (dispatch === null)
+        if (admittedDispatches >= maxConcurrentDispatches)
             return false;
+        admittedDispatches += 1;
+        let delivery;
+        let activeDispatchId;
+        try {
+            const leaseId = createLeaseId();
+            const claimStartedAt = performance.now();
+            const dispatch = await dispatchStore.claimNextPending({
+                leaseId,
+                leaseDurationMs,
+                excludedDispatchIds: [...activeDispatches],
+            });
+            if (dispatch === null)
+                return false;
+            // A concurrent claim can outlive both its exclusion snapshot and the old
+            // lease. Do not start another delivery while its original I/O is pending.
+            if (activeDispatches.has(dispatch.id))
+                return true;
+            const remaining = leaseDurationMs - (performance.now() - claimStartedAt);
+            if (remaining <= 0)
+                return true;
+            activeDispatchId = dispatch.id;
+            activeDispatches.add(dispatch.id);
+            try {
+                await runSidecarOperation("Workflow dispatch", Math.ceil(remaining), (signal) => {
+                    delivery = deliver(dispatch, leaseId, signal);
+                    return delivery;
+                });
+            }
+            catch (error) {
+                if (!(error instanceof SidecarOperationTimeoutError))
+                    throw error;
+                // The durable lease expires independently. Do not start another database
+                // write here: a stuck retry write must not occupy the freed drain either.
+                logger.warn `Dispatch ${dispatch.id} stopped at its delivery deadline`;
+            }
+            return true;
+        }
+        finally {
+            const release = () => {
+                admittedDispatches -= 1;
+                if (activeDispatchId !== undefined)
+                    activeDispatches.delete(activeDispatchId);
+            };
+            // Timeouts free the drain, but the underlying I/O retains its admission
+            // reservation and dispatch exclusion until it actually settles.
+            if (delivery === undefined)
+                release();
+            else
+                void delivery.then(release, release);
+        }
+    }
+    async function deliver(dispatch, leaseId, signal) {
         const allocation = await allocationStore.findByAnchorRunId(dispatch.anchorRunId);
+        signal.throwIfAborted();
         if (allocation === null) {
             await retry(dispatch, leaseId, "allocation_missing", `No sidecar allocation exists for workflow anchor ${dispatch.anchorRunId}`);
-            return true;
+            return;
         }
         const target = targetForReadyAllocation(allocation);
         if (target === null) {
             await retry(dispatch, leaseId, "allocation_not_ready", `Sidecar allocation ${allocation.id} is not ready for delivery`);
-            return true;
+            return;
         }
         const agentAddress = await resolveAnchorAddress(dispatch.anchorRunId);
+        signal.throwIfAborted();
         if (agentAddress === null) {
             await retry(dispatch, leaseId, "anchor_address_missing", `Workflow anchor ${dispatch.anchorRunId} has no routing address`);
-            return true;
+            return;
         }
         try {
             if (dispatch.kind === "signal") {
-                const signal = SignalDeliverFrame.assert(JSON.parse(new TextDecoder().decode(dispatch.rawMessage)));
+                const frame = SignalDeliverFrame.assert(JSON.parse(new TextDecoder().decode(dispatch.rawMessage)));
                 await router.sendSignalDeliverToAllocation(target, {
-                    agentAddress: signal.agentAddress,
-                    runId: signal.runId,
-                    signalName: signal.signalName,
-                    signalId: signal.signalId,
-                    payload: signal.payload,
-                });
+                    agentAddress: frame.agentAddress,
+                    runId: frame.runId,
+                    signalName: frame.signalName,
+                    signalId: frame.signalId,
+                    payload: frame.payload,
+                }, signal);
             }
             else {
-                await router.sendWorkflowRunDispatchToAllocation(target, agentAddress, 
-                // Every trigger of a deployment uses its stable mail address as the
-                // supervisor run id.
-                agentAddress, dispatch.stepGrants, base64Encode(dispatch.rawMessage), dispatch.messageId);
+                // A deliverable mail dispatch always carries the sender persisted at
+                // enqueue (the workflow_run_dispatch mail-sender check enforces it).
+                // A null here means the row bypassed that invariant, so fail loudly
+                // rather than deliver with no authenticated sender or fall back to the
+                // MIME From.
+                if (dispatch.senderAddress === null) {
+                    throw new Error(`mail dispatch ${dispatch.id} has no persisted authenticated sender`);
+                }
+                await router.sendWorkflowRunDispatchToAllocation(target, agentAddress, deriveWorkflowRunId(agentAddress), dispatch.stepGrants, base64Encode(dispatch.rawMessage), dispatch.senderAddress, dispatch.messageId, signal);
             }
             // Keep the delivery lease until the sidecar acknowledges its durable
             // inbox write. If that ack never arrives, lease expiry makes the same
             // immutable payload claimable again.
         }
         catch (error) {
+            signal.throwIfAborted();
             await retry(dispatch, leaseId, "dispatch_unroutable", error instanceof Error ? error.message : String(error));
         }
-        return true;
     }
     async function reconcileUntilIdle(maxIterations = 100) {
         let reconciled = 0;

package/dist/workflow-kind.d.ts

@@ -32,6 +32,18 @@ export declare const workflowDefinitionEnvelopeSchema: import("arktype/internal/
         locator: "tenant";
         name?: string;
     }[];
+    sidecarPlacement?: {
+        capabilities?: {
+            capability: string;
+            effect: "require" | "block";
+        }[];
+    };
+    inboundMailPolicy?: {
+        untrustedFrom?: "reject" | "admit";
+        invalid?: "reject" | "admit";
+        missing?: "reject" | "admit";
+        unknown?: "reject" | "admit";
+    };
 }, {}>;
 export declare const workflowKindHandler: KindHandler;
 export declare const workflowAuthorize: AuthorizeFn;

package/dist/workflow-kind.js

@@ -23,10 +23,10 @@
 //     used by skill assets.
 import { type } from "arktype";
 import { getLogger } from "@intx/log";
-import { CredentialBinding, GrantRequirement } from "@intx/types";
+import { CredentialBinding, GrantRequirement, SidecarCapabilityPolicy, } from "@intx/types";
+import { InboundMailPolicy } from "@intx/types/runtime";
 import { PackageJSON, isContainedEntryPath } from "@intx/types/package-json";
-import { glob, repoActionToGrantVerb } from "@intx/hub-common";
-import { UserPrincipal, } from "./repo-store/index.js";
+import { authorizeUserPrincipal, } from "./repo-store/index.js";
 const logger = getLogger(["hub-sessions", "workflow-kind"]);
 export const WORKFLOW_JSON_PATH = "workflow.json";
 export const CAPABILITY_DECLARATIONS_JSON_PATH = "capability-declarations.json";
@@ -78,6 +78,13 @@ export const workflowDefinitionEnvelopeSchema = type({
     // authority, or handle) is rejected at the deploy boundary rather than
     // passed through to launch-time resolution unchecked.
     "credentialBindings?": CredentialBinding.array(),
+    "sidecarPlacement?": SidecarCapabilityPolicy,
+    // `inboundMailPolicy` is validated here too -- same defense-in-depth
+    // rationale as credentialBindings above: a malformed policy (an unknown
+    // outcome key or a value that is not reject/admit) is rejected at the deploy
+    // boundary rather than passed through to later admission resolution
+    // unchecked.
+    "inboundMailPolicy?": InboundMailPolicy,
 }).onUndeclaredKey("ignore");
 const SidecarPrincipal = type({
     kind: "'sidecar'",
@@ -241,63 +248,13 @@ export const workflowAuthorize = (principal, repoId, ref, action) => {
         }
     }
     if (principal.kind === "user") {
-        // The route layer has already pre-resolved the grant verdict and
-        // attached it as `authz`. The substrate does NOT re-query the
-        // grant store here; it (a) checks the bearer-token's claims
-        // bound the requested (ref, action) and have not expired, and
-        // (b) sanity-checks that the pre-resolved verdict targets this
-        // exact resource and grant verb. Both gates must pass before the
-        // verdict's `effect` is honoured.
-        const parsed = UserPrincipal(principal);
-        if (parsed instanceof type.errors) {
-            return {
-                allowed: false,
-                reason: `user principal is malformed: ${parsed.summary}`,
-            };
-        }
-        if (!parsed.tokenClaims.actions.includes(action)) {
-            return {
-                allowed: false,
-                reason: `token does not grant action ${action}`,
-            };
-        }
-        // `ref === "*"` is the substrate's sentinel for the bulk read
-        // performed by `listRefs`. Per-ref filtering is the advertise-refs
-        // layer's responsibility, so the bulk read is gated on action and
-        // expiry alone.
-        if (ref !== "*" && !glob.match(parsed.tokenClaims.refPattern, ref)) {
-            return {
-                allowed: false,
-                reason: `token refPattern ${parsed.tokenClaims.refPattern} does not match ${ref}`,
-            };
-        }
-        if (Date.now() >= parsed.tokenClaims.expiresAt) {
-            return {
-                allowed: false,
-                reason: `token expired at ${parsed.tokenClaims.expiresAt}`,
-            };
-        }
-        const expectedResource = `asset:${repoId.id}`;
-        if (parsed.authz.resource !== expectedResource) {
-            return {
-                allowed: false,
-                reason: `authz verdict resource ${parsed.authz.resource} does not match ${expectedResource}`,
-            };
-        }
-        const expectedGrantVerb = repoActionToGrantVerb(action);
-        if (parsed.authz.grantVerb !== expectedGrantVerb) {
-            return {
-                allowed: false,
-                reason: `authz verdict grantVerb ${parsed.authz.grantVerb} does not match ${expectedGrantVerb}`,
-            };
-        }
-        if (parsed.authz.effect === "allow") {
-            return { allowed: true };
-        }
-        return {
-            allowed: false,
-            reason: `authz verdict denied for ${expectedResource} ${expectedGrantVerb}`,
-        };
+        return authorizeUserPrincipal({
+            principal,
+            repoId,
+            ref,
+            action,
+            resourcePrefix: "asset",
+        });
     }
     // Fail closed on any kind not handled above. The tenant-level
     // `workflow` principal kind (`@intx/types` principalKinds) is a

package/dist/workflow-probe-gate.d.ts

@@ -1,26 +1,37 @@
 import type { DBExecutor } from "@intx/db";
-import type { GrantWalkSnapshot } from "@intx/types";
+import type { ApprovalItem, GrantRequirement, GrantWalkSnapshot } from "@intx/types";
 import type { PackumentFetcher, RegistryConfig } from "@intx/tool-packaging";
 import type { WorkflowProjectionDefinition } from "@intx/types/sidecar";
 import type { ToolPackageManifest } from "@intx/types/tool-packages";
 import type { WorkflowDefinitionAssetSource, WorkflowDefinitionRegistrySource } from "@intx/types/workflow-sources";
-import type { ApprovalSet } from "@intx/workflow-deploy";
+import { type ApprovalSet } from "@intx/workflow-deploy";
 import { type ResolveAssetAttachmentFn } from "./workflow-closure-resolution.js";
 import type { SourceTreeReads } from "./workflow-source-closure.js";
-import type { SidecarRouter, WorkflowProbeResult } from "./ws/sidecar-handler.js";
+import type { SendProbeArgs, WorkflowProbeResult } from "./ws/sidecar-handler.js";
+type WorkflowProbeRouter = {
+    sendProbe(args: SendProbeArgs): Promise<WorkflowProbeResult>;
+};
 /**
  * The frozen record an approval writes: the definition's asset selector, the
- * approved wire hash (the freeze anchor), the approved grant set, and the
- * grant-walk snapshot the run path materializes grants from. The grant set is a
- * deterministic projection of the content the hash addresses and rides the
- * deploy hand-off in memory; the snapshot is persisted onto the version row so a
- * run derives its grants from the frozen walk without re-reading and re-walking
- * the workflow's `workflow.json`.
+ * approved wire hash (the freeze anchor), the approved surface, and the
+ * grant-walk snapshot the run path materializes grants from. The approved
+ * surface is a deterministic projection of the content the hash addresses and
+ * rides the deploy hand-off in memory; the snapshot is persisted onto the
+ * version row so a run derives its grants from the frozen walk without
+ * re-reading and re-walking the workflow's `workflow.json`.
+ *
+ * `approvedGrants` carries both kinds of approved item: the walk's grant-shape
+ * strings and the definition's declared grant requirements. The requirements
+ * belong in the same record because the run path mints real grant rows from
+ * them, so an account of the approval that listed only the walk strings would
+ * under-report the authority the definition will actually carry. It is the flat
+ * `ApprovalItem` list rather than the gate's partitioned `ApprovalSet` because
+ * this record is the input to persistence, and the persisted form is flat.
  */
 export type FrozenApproval = {
     readonly assetId: string;
     readonly approvedWireHash: string;
-    readonly approvedGrants: readonly string[];
+    readonly approvedGrants: readonly ApprovalItem[];
     readonly grantSnapshot: GrantWalkSnapshot;
 };
 /**
@@ -33,15 +44,17 @@ export type PersistFrozenApprovalFn = (approval: FrozenApproval) => Promise<{
 }>;
 /**
  * The outcome of gating and freezing a probe result. `ok: true` is the frozen
- * approval the deploy hand-off consumes. The `ok: false` arms name the two
+ * approval the deploy hand-off consumes. The `ok: false` arms name the five
  * fail-closed paths: a shipped hash that does not match the hub recompute
- * (tamper-evidence), and advisory grants the operator did not approve.
+ * (tamper-evidence), advisory grants the operator did not approve, declared
+ * grant requirements the operator did not approve, a trigger type the runtime
+ * does not implement, and an executable step the grant walk left no record for.
  */
 export type ProbeGateResult = {
     readonly ok: true;
     readonly definitionId: string;
     readonly approvedWireHash: string;
-    readonly approvedGrants: ReadonlySet<string>;
+    readonly approvedSurface: ApprovalSet;
     /**
      * The inert wire projection the freeze hashed. Rides the ok-arm so the
      * deploy hand-off carries the exact content the frozen hash addresses,
@@ -57,6 +70,54 @@ export type ProbeGateResult = {
     readonly ok: false;
     readonly reason: "grants_not_approved";
     readonly unapprovedGrants: readonly string[];
+} | {
+    readonly ok: false;
+    readonly reason: "grant_requirements_not_approved";
+    /**
+     * The declared requirements the operator's approval does not cover, in
+     * the order the probe declared them. Named in full so the operator can
+     * see exactly which authority the definition asked to delegate.
+     */
+    readonly unapprovedGrantRequirements: readonly GrantRequirement[];
+} | {
+    readonly ok: false;
+    readonly reason: "unimplemented_trigger";
+    /** The distinct reserved-but-unimplemented trigger types the projection declared. */
+    readonly unimplementedTriggerTypes: readonly string[];
+} | {
+    readonly ok: false;
+    readonly reason: "steps_without_grant_record";
+    /** Every executable step the grant-walk snapshot accounts for nothing at. */
+    readonly stepsWithoutGrantRecord: readonly StepWithoutGrantRecord[];
+    /**
+     * One sentence naming every miss. A deploy that trips this is a defect in
+     * the deploy path rather than in the author's workflow, so the sentence
+     * carries what whoever maintains that path needs: the step, the position,
+     * and the record that was absent.
+     */
+    readonly message: string;
+};
+/**
+ * One step the deployment can execute that the probe's grant-walk snapshot
+ * carries no record for.
+ */
+export type StepWithoutGrantRecord = {
+    /** The executable step id with no approved grants behind it. */
+    readonly stepId: string;
+    /**
+     * The chain of step ids the executable walk reached `stepId` through,
+     * outermost first and `stepId` itself last. Two nested bodies may
+     * legitimately carry the same step id, so the chain -- not the id alone --
+     * is what names the position in the closure.
+     */
+    readonly reachedThrough: readonly string[];
+    /**
+     * The top-level step whose snapshot record was supposed to account for
+     * `stepId`. The capability walk folds every nested body's grants into the
+     * record of the top-level step that carries the body, so this names the
+     * `perStep` key the absent record would have had.
+     */
+    readonly recordStepId: string;
 };
 /**
  * Build the production persistence step of the freeze. Records identity through
@@ -71,7 +132,8 @@ export declare function createDbFrozenApprovalWriter(db: DBExecutor): PersistFro
 /**
  * Approve exactly the grant surface the probe reports, without a pre-walked
  * operator `ApprovalSet` to gate against. Under this mode the gate skips the
- * per-grant membership check and freezes exactly what the probe advertised.
+ * per-grant and per-requirement membership checks and freezes exactly what the
+ * probe advertised.
  *
  * This is the code-sourced analogue of the live-authored self-approve: the hub
  * has no live definition to pre-walk, so the probe's advertised grants ARE the
@@ -79,13 +141,13 @@ export declare function createDbFrozenApprovalWriter(db: DBExecutor): PersistFro
  * still runs and can still fail closed.
  */
 export type ApproveProbedGrants = {
-    readonly mode: "approve-probed";
+    readonly kind: "approve-probed";
 };
 /**
- * How the gate turns the probe's advisory grant set into an approved set.
- * Either an explicit operator `ApprovalSet` -- every advertised grant must
- * appear in it or the gate fails closed -- or `approve-probed`, which approves
- * exactly the surface the probe reported.
+ * How the gate turns the probe's advertised surface into an approved one.
+ * Either an explicit operator `ApprovalSet` -- every advertised grant and every
+ * declared grant requirement must appear in it or the gate fails closed -- or
+ * `approve-probed`, which approves exactly the surface the probe reported.
  */
 export type ProbeApprovalPolicy = ApprovalSet | ApproveProbedGrants;
 export type GateAndFreezeArgs = {
@@ -94,9 +156,9 @@ export type GateAndFreezeArgs = {
     /** The sidecar's inert probe answer: projection, advisory grants, shipped hash. */
     readonly probeResult: WorkflowProbeResult;
     /**
-     * The approval policy. An `ApprovalSet` gates the advisory set against the
-     * operator-approved grant-shape strings; `approve-probed` approves exactly
-     * the surface the probe reported.
+     * The approval policy. An `ApprovalSet` gates the advisory set and the
+     * declared grant requirements against the operator-approved items;
+     * `approve-probed` approves exactly the surface the probe reported.
      */
     readonly approvals: ProbeApprovalPolicy;
     /** Persistence step for the freeze; `createDbFrozenApprovalWriter` in production. */
@@ -107,11 +169,19 @@ export type GateAndFreezeArgs = {
  * inert projection and grant set -- no author code runs here and the capability
  * walk is never re-run.
  *
- * Fails closed on the two security-load-bearing checks before it writes
+ * Fails closed on the three security-load-bearing checks before it writes
  * anything: the recomputed wire hash must match the hash the sidecar shipped
- * (tamper-evidence), and every advisory grant must be operator-approved. Only
- * then does it freeze the recomputed hash onto the version row and return the
- * approved grant set.
+ * (tamper-evidence), every advisory grant must be operator-approved, and every
+ * declared grant requirement must be operator-approved. It also refuses a
+ * projection whose triggers include a reserved-but-unimplemented type -- not a
+ * security check, but the layer a pinned closure cannot carry a stale copy of,
+ * so it is where a workflow that could only sit inert is caught -- and one
+ * whose executable closure reaches a step the grant walk left no record for --
+ * the layer holding both halves of the probe answer at once, and a presence
+ * check on those records rather than a check that any record's contents are
+ * sufficient.
+ * Only then does it freeze the recomputed hash onto the version row and return
+ * the approved grant set.
  */
 export declare function gateAndFreezeProbeResult(args: GateAndFreezeArgs): Promise<ProbeGateResult>;
 type InstallAndApproveCommonArgs = {
@@ -126,9 +196,11 @@ type InstallAndApproveCommonArgs = {
      */
     readonly approvals: ProbeApprovalPolicy;
     /** The sidecar router carrying the probe transport. */
-    readonly router: Pick<SidecarRouter, "sendProbe">;
+    readonly router: WorkflowProbeRouter;
     /** Executor the freeze writes through. */
     readonly db: DBExecutor;
+    /** Optional durable handoff invoked before the approval gate writes. */
+    readonly onProbeResult?: (result: WorkflowProbeResult) => Promise<void>;
 };
 /** Install a definition published to an npm registry. */
 export type InstallAndApproveRegistryArgs = InstallAndApproveCommonArgs & {