@vellumai/assistant 0.4.17 → 0.4.19

package/src/__tests__/approval-primitive.test.ts

@@ -1,26 +1,25 @@
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-import { afterAll, beforeEach, describe, expect, mock, test } from 'bun:test';
+const testDir = mkdtempSync(join(tmpdir(), "approval-primitive-test-"));
 
-const testDir = mkdtempSync(join(tmpdir(), 'approval-primitive-test-'));
-
-mock.module('../util/platform.js', () => ({
+mock.module("../util/platform.js", () => ({
   getDataDir: () => testDir,
-  isMacOS: () => process.platform === 'darwin',
-  isLinux: () => process.platform === 'linux',
-  isWindows: () => process.platform === 'win32',
-  getSocketPath: () => join(testDir, 'test.sock'),
-  getPidPath: () => join(testDir, 'test.pid'),
-  getDbPath: () => join(testDir, 'test.db'),
-  getLogPath: () => join(testDir, 'test.log'),
+  isMacOS: () => process.platform === "darwin",
+  isLinux: () => process.platform === "linux",
+  isWindows: () => process.platform === "win32",
+  getSocketPath: () => join(testDir, "test.sock"),
+  getPidPath: () => join(testDir, "test.pid"),
+  getDbPath: () => join(testDir, "test.db"),
+  getLogPath: () => join(testDir, "test.log"),
   ensureDataDir: () => {},
   migrateToDataLayout: () => {},
   migrateToWorkspaceLayout: () => {},
 }));
 
-mock.module('../util/logger.js', () => ({
+mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
       get: () => () => {},
@@ -33,10 +32,10 @@ import {
   consumeGrantForInvocation,
   mintGrantFromDecision,
   type MintGrantParams,
-} from '../approvals/approval-primitive.js';
-import { getDb, initializeDb, resetDb } from '../memory/db.js';
-import { scopedApprovalGrants } from '../memory/schema.js';
-import { computeToolApprovalDigest } from '../security/tool-approval-digest.js';
+} from "../approvals/approval-primitive.js";
+import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { scopedApprovalGrants } from "../memory/schema.js";
+import { computeToolApprovalDigest } from "../security/tool-approval-digest.js";
 
 initializeDb();
 
@@ -61,10 +60,10 @@ afterAll(() => {
 function mintParams(overrides: Partial<MintGrantParams> = {}): MintGrantParams {
   const futureExpiry = new Date(Date.now() + 60_000).toISOString();
   return {
-    assistantId: 'self',
-    scopeMode: 'request_id',
-    requestChannel: 'telegram',
-    decisionChannel: 'telegram',
+    assistantId: "self",
+    scopeMode: "request_id",
+    requestChannel: "telegram",
+    decisionChannel: "telegram",
     expiresAt: futureExpiry,
     ...overrides,
   };
@@ -74,90 +73,90 @@ function mintParams(overrides: Partial<MintGrantParams> = {}): MintGrantParams {
 // MINT TESTS
 // ===========================================================================
 
-describe('approval-primitive / mintGrantFromDecision', () => {
+describe("approval-primitive / mintGrantFromDecision", () => {
   beforeEach(() => clearTables());
 
-  test('mints a request_id scoped grant successfully', () => {
+  test("mints a request_id scoped grant successfully", () => {
     const result = mintGrantFromDecision(
-      mintParams({ scopeMode: 'request_id', requestId: 'req-1' }),
+      mintParams({ scopeMode: "request_id", requestId: "req-1" }),
     );
     expect(result.ok).toBe(true);
     if (!result.ok) return;
-    expect(result.grant.status).toBe('active');
-    expect(result.grant.requestId).toBe('req-1');
-    expect(result.grant.scopeMode).toBe('request_id');
+    expect(result.grant.status).toBe("active");
+    expect(result.grant.requestId).toBe("req-1");
+    expect(result.grant.scopeMode).toBe("request_id");
   });
 
-  test('mints a tool_signature scoped grant successfully', () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'ls' });
+  test("mints a tool_signature scoped grant successfully", () => {
+    const digest = computeToolApprovalDigest("shell", { command: "ls" });
     const result = mintGrantFromDecision(
       mintParams({
-        scopeMode: 'tool_signature',
-        toolName: 'shell',
+        scopeMode: "tool_signature",
+        toolName: "shell",
         inputDigest: digest,
       }),
     );
     expect(result.ok).toBe(true);
     if (!result.ok) return;
-    expect(result.grant.toolName).toBe('shell');
+    expect(result.grant.toolName).toBe("shell");
     expect(result.grant.inputDigest).toBe(digest);
-    expect(result.grant.scopeMode).toBe('tool_signature');
+    expect(result.grant.scopeMode).toBe("tool_signature");
   });
 
-  test('rejects request_id scope when requestId is missing', () => {
+  test("rejects request_id scope when requestId is missing", () => {
     const result = mintGrantFromDecision(
-      mintParams({ scopeMode: 'request_id', requestId: null }),
+      mintParams({ scopeMode: "request_id", requestId: null }),
     );
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('missing_request_id');
+    expect(result.reason).toBe("missing_request_id");
   });
 
-  test('rejects tool_signature scope when toolName is missing', () => {
+  test("rejects tool_signature scope when toolName is missing", () => {
     const result = mintGrantFromDecision(
       mintParams({
-        scopeMode: 'tool_signature',
+        scopeMode: "tool_signature",
         toolName: null,
-        inputDigest: 'abc123',
+        inputDigest: "abc123",
       }),
     );
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('missing_tool_fields');
+    expect(result.reason).toBe("missing_tool_fields");
   });
 
-  test('rejects tool_signature scope when inputDigest is missing', () => {
+  test("rejects tool_signature scope when inputDigest is missing", () => {
     const result = mintGrantFromDecision(
       mintParams({
-        scopeMode: 'tool_signature',
-        toolName: 'shell',
+        scopeMode: "tool_signature",
+        toolName: "shell",
         inputDigest: null,
       }),
     );
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('missing_tool_fields');
+    expect(result.reason).toBe("missing_tool_fields");
   });
 
-  test('mints grant with full scope context fields', () => {
+  test("mints grant with full scope context fields", () => {
     const result = mintGrantFromDecision(
       mintParams({
-        scopeMode: 'request_id',
-        requestId: 'req-full',
-        conversationId: 'conv-1',
-        callSessionId: 'call-1',
-        requesterExternalUserId: 'user-1',
-        guardianExternalUserId: 'guardian-1',
-        executionChannel: 'voice',
+        scopeMode: "request_id",
+        requestId: "req-full",
+        conversationId: "conv-1",
+        callSessionId: "call-1",
+        requesterExternalUserId: "user-1",
+        guardianExternalUserId: "guardian-1",
+        executionChannel: "voice",
       }),
     );
     expect(result.ok).toBe(true);
     if (!result.ok) return;
-    expect(result.grant.conversationId).toBe('conv-1');
-    expect(result.grant.callSessionId).toBe('call-1');
-    expect(result.grant.requesterExternalUserId).toBe('user-1');
-    expect(result.grant.guardianExternalUserId).toBe('guardian-1');
-    expect(result.grant.executionChannel).toBe('voice');
+    expect(result.grant.conversationId).toBe("conv-1");
+    expect(result.grant.callSessionId).toBe("call-1");
+    expect(result.grant.requesterExternalUserId).toBe("user-1");
+    expect(result.grant.guardianExternalUserId).toBe("guardian-1");
+    expect(result.grant.executionChannel).toBe("voice");
   });
 });
 
@@ -165,286 +164,314 @@ describe('approval-primitive / mintGrantFromDecision', () => {
 // CONSUME TESTS
 // ===========================================================================
 
-describe('approval-primitive / consumeGrantForInvocation', () => {
+describe("approval-primitive / consumeGrantForInvocation", () => {
   beforeEach(() => clearTables());
 
-  test('consumes a request_id grant when requestId matches', async () => {
-    mintGrantFromDecision(mintParams({ scopeMode: 'request_id', requestId: 'req-100' }));
+  test("consumes a request_id grant when requestId matches", async () => {
+    mintGrantFromDecision(
+      mintParams({ scopeMode: "request_id", requestId: "req-100" }),
+    );
 
     const result = await consumeGrantForInvocation({
-      requestId: 'req-100',
-      toolName: 'shell',
-      inputDigest: computeToolApprovalDigest('shell', { command: 'ls' }),
-      consumingRequestId: 'consumer-1',
-      assistantId: 'self',
+      requestId: "req-100",
+      toolName: "shell",
+      inputDigest: computeToolApprovalDigest("shell", { command: "ls" }),
+      consumingRequestId: "consumer-1",
+      assistantId: "self",
     });
 
     expect(result.ok).toBe(true);
     if (!result.ok) return;
-    expect(result.grant.status).toBe('consumed');
-    expect(result.grant.consumedByRequestId).toBe('consumer-1');
+    expect(result.grant.status).toBe("consumed");
+    expect(result.grant.consumedByRequestId).toBe("consumer-1");
   });
 
-  test('consumes a tool_signature grant when tool+input matches', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'ls' });
+  test("consumes a tool_signature grant when tool+input matches", async () => {
+    const digest = computeToolApprovalDigest("shell", { command: "ls" });
     mintGrantFromDecision(
       mintParams({
-        scopeMode: 'tool_signature',
-        toolName: 'shell',
+        scopeMode: "tool_signature",
+        toolName: "shell",
         inputDigest: digest,
       }),
     );
 
     const result = await consumeGrantForInvocation({
-      toolName: 'shell',
+      toolName: "shell",
       inputDigest: digest,
-      consumingRequestId: 'consumer-2',
-      assistantId: 'self',
+      consumingRequestId: "consumer-2",
+      assistantId: "self",
     });
 
     expect(result.ok).toBe(true);
     if (!result.ok) return;
-    expect(result.grant.status).toBe('consumed');
+    expect(result.grant.status).toBe("consumed");
   });
 
-  test('falls back to tool_signature when request_id does not match', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'ls' });
+  test("falls back to tool_signature when request_id does not match", async () => {
+    const digest = computeToolApprovalDigest("shell", { command: "ls" });
     // Mint a tool_signature grant (not request_id)
     mintGrantFromDecision(
       mintParams({
-        scopeMode: 'tool_signature',
-        toolName: 'shell',
+        scopeMode: "tool_signature",
+        toolName: "shell",
         inputDigest: digest,
       }),
     );
 
     const result = await consumeGrantForInvocation({
-      requestId: 'nonexistent-req',
-      toolName: 'shell',
+      requestId: "nonexistent-req",
+      toolName: "shell",
       inputDigest: digest,
-      consumingRequestId: 'consumer-3',
-      assistantId: 'self',
+      consumingRequestId: "consumer-3",
+      assistantId: "self",
     });
 
     expect(result.ok).toBe(true);
     if (!result.ok) return;
-    expect(result.grant.scopeMode).toBe('tool_signature');
+    expect(result.grant.scopeMode).toBe("tool_signature");
   });
 
   // ---------------------------------------------------------------------------
   // Consume miss scenarios
   // ---------------------------------------------------------------------------
 
-  test('miss: no grants exist at all', async () => {
-    const result = await consumeGrantForInvocation({
-      toolName: 'shell',
-      inputDigest: computeToolApprovalDigest('shell', { command: 'ls' }),
-      consumingRequestId: 'consumer-miss',
-      assistantId: 'self',
-    }, { maxWaitMs: 0 });
+  test("miss: no grants exist at all", async () => {
+    const result = await consumeGrantForInvocation(
+      {
+        toolName: "shell",
+        inputDigest: computeToolApprovalDigest("shell", { command: "ls" }),
+        consumingRequestId: "consumer-miss",
+        assistantId: "self",
+      },
+      { maxWaitMs: 0 },
+    );
 
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('no_match');
+    expect(result.reason).toBe("no_match");
   });
 
-  test('miss: tool name mismatch', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'ls' });
+  test("miss: tool name mismatch", async () => {
+    const digest = computeToolApprovalDigest("shell", { command: "ls" });
     mintGrantFromDecision(
       mintParams({
-        scopeMode: 'tool_signature',
-        toolName: 'shell',
+        scopeMode: "tool_signature",
+        toolName: "shell",
         inputDigest: digest,
       }),
     );
 
-    const result = await consumeGrantForInvocation({
-      toolName: 'file_write',
-      inputDigest: digest,
-      consumingRequestId: 'consumer-mismatch-tool',
-      assistantId: 'self',
-    }, { maxWaitMs: 0 });
+    const result = await consumeGrantForInvocation(
+      {
+        toolName: "file_write",
+        inputDigest: digest,
+        consumingRequestId: "consumer-mismatch-tool",
+        assistantId: "self",
+      },
+      { maxWaitMs: 0 },
+    );
 
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('no_match');
+    expect(result.reason).toBe("no_match");
   });
 
-  test('miss: input digest mismatch', async () => {
+  test("miss: input digest mismatch", async () => {
     mintGrantFromDecision(
       mintParams({
-        scopeMode: 'tool_signature',
-        toolName: 'shell',
-        inputDigest: computeToolApprovalDigest('shell', { command: 'ls' }),
+        scopeMode: "tool_signature",
+        toolName: "shell",
+        inputDigest: computeToolApprovalDigest("shell", { command: "ls" }),
       }),
     );
 
-    const result = await consumeGrantForInvocation({
-      toolName: 'shell',
-      inputDigest: computeToolApprovalDigest('shell', { command: 'rm -rf /' }),
-      consumingRequestId: 'consumer-mismatch-input',
-      assistantId: 'self',
-    }, { maxWaitMs: 0 });
+    const result = await consumeGrantForInvocation(
+      {
+        toolName: "shell",
+        inputDigest: computeToolApprovalDigest("shell", {
+          command: "rm -rf /",
+        }),
+        consumingRequestId: "consumer-mismatch-input",
+        assistantId: "self",
+      },
+      { maxWaitMs: 0 },
+    );
 
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('no_match');
+    expect(result.reason).toBe("no_match");
   });
 
-  test('miss: assistant ID mismatch', async () => {
+  test("miss: assistant ID mismatch", async () => {
     mintGrantFromDecision(
       mintParams({
-        scopeMode: 'request_id',
-        requestId: 'req-assist',
-        assistantId: 'assistant-A',
+        scopeMode: "request_id",
+        requestId: "req-assist",
+        assistantId: "assistant-A",
       }),
     );
 
-    const result = await consumeGrantForInvocation({
-      requestId: 'req-assist',
-      toolName: 'shell',
-      inputDigest: computeToolApprovalDigest('shell', {}),
-      consumingRequestId: 'consumer-assist-mismatch',
-      assistantId: 'assistant-B',
-    }, { maxWaitMs: 0 });
+    const result = await consumeGrantForInvocation(
+      {
+        requestId: "req-assist",
+        toolName: "shell",
+        inputDigest: computeToolApprovalDigest("shell", {}),
+        consumingRequestId: "consumer-assist-mismatch",
+        assistantId: "assistant-B",
+      },
+      { maxWaitMs: 0 },
+    );
 
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('no_match');
+    expect(result.reason).toBe("no_match");
   });
 
-  test('miss: grant expired', async () => {
+  test("miss: grant expired", async () => {
     const pastExpiry = new Date(Date.now() - 60_000).toISOString();
     mintGrantFromDecision(
       mintParams({
-        scopeMode: 'request_id',
-        requestId: 'req-expired',
+        scopeMode: "request_id",
+        requestId: "req-expired",
         expiresAt: pastExpiry,
       }),
     );
 
-    const result = await consumeGrantForInvocation({
-      requestId: 'req-expired',
-      toolName: 'shell',
-      inputDigest: computeToolApprovalDigest('shell', {}),
-      consumingRequestId: 'consumer-expired',
-      assistantId: 'self',
-    }, { maxWaitMs: 0 });
+    const result = await consumeGrantForInvocation(
+      {
+        requestId: "req-expired",
+        toolName: "shell",
+        inputDigest: computeToolApprovalDigest("shell", {}),
+        consumingRequestId: "consumer-expired",
+        assistantId: "self",
+      },
+      { maxWaitMs: 0 },
+    );
 
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('no_match');
+    expect(result.reason).toBe("no_match");
   });
 
   // ---------------------------------------------------------------------------
   // One-time consume semantics
   // ---------------------------------------------------------------------------
 
-  test('one-time consume: second consume of the same grant fails', async () => {
+  test("one-time consume: second consume of the same grant fails", async () => {
     mintGrantFromDecision(
-      mintParams({ scopeMode: 'request_id', requestId: 'req-once' }),
+      mintParams({ scopeMode: "request_id", requestId: "req-once" }),
     );
 
     const first = await consumeGrantForInvocation({
-      requestId: 'req-once',
-      toolName: 'shell',
-      inputDigest: computeToolApprovalDigest('shell', {}),
-      consumingRequestId: 'consumer-first',
-      assistantId: 'self',
+      requestId: "req-once",
+      toolName: "shell",
+      inputDigest: computeToolApprovalDigest("shell", {}),
+      consumingRequestId: "consumer-first",
+      assistantId: "self",
     });
     expect(first.ok).toBe(true);
 
-    const second = await consumeGrantForInvocation({
-      requestId: 'req-once',
-      toolName: 'shell',
-      inputDigest: computeToolApprovalDigest('shell', {}),
-      consumingRequestId: 'consumer-second',
-      assistantId: 'self',
-    }, { maxWaitMs: 0 });
+    const second = await consumeGrantForInvocation(
+      {
+        requestId: "req-once",
+        toolName: "shell",
+        inputDigest: computeToolApprovalDigest("shell", {}),
+        consumingRequestId: "consumer-second",
+        assistantId: "self",
+      },
+      { maxWaitMs: 0 },
+    );
     expect(second.ok).toBe(false);
     if (second.ok) return;
-    expect(second.reason).toBe('no_match');
+    expect(second.reason).toBe("no_match");
   });
 
-  test('one-time consume: tool_signature grant is consumed only once', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'deploy' });
+  test("one-time consume: tool_signature grant is consumed only once", async () => {
+    const digest = computeToolApprovalDigest("shell", { command: "deploy" });
     mintGrantFromDecision(
       mintParams({
-        scopeMode: 'tool_signature',
-        toolName: 'shell',
+        scopeMode: "tool_signature",
+        toolName: "shell",
         inputDigest: digest,
       }),
     );
 
     const first = await consumeGrantForInvocation({
-      toolName: 'shell',
+      toolName: "shell",
       inputDigest: digest,
-      consumingRequestId: 'consumer-sig-first',
-      assistantId: 'self',
+      consumingRequestId: "consumer-sig-first",
+      assistantId: "self",
     });
     expect(first.ok).toBe(true);
 
-    const second = await consumeGrantForInvocation({
-      toolName: 'shell',
-      inputDigest: digest,
-      consumingRequestId: 'consumer-sig-second',
-      assistantId: 'self',
-    }, { maxWaitMs: 0 });
+    const second = await consumeGrantForInvocation(
+      {
+        toolName: "shell",
+        inputDigest: digest,
+        consumingRequestId: "consumer-sig-second",
+        assistantId: "self",
+      },
+      { maxWaitMs: 0 },
+    );
     expect(second.ok).toBe(false);
     if (second.ok) return;
-    expect(second.reason).toBe('no_match');
+    expect(second.reason).toBe("no_match");
   });
 
   // ---------------------------------------------------------------------------
   // Context-scoped consume
   // ---------------------------------------------------------------------------
 
-  test('consumes tool_signature grant with matching conversation context', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'test' });
+  test("consumes tool_signature grant with matching conversation context", async () => {
+    const digest = computeToolApprovalDigest("shell", { command: "test" });
     mintGrantFromDecision(
       mintParams({
-        scopeMode: 'tool_signature',
-        toolName: 'shell',
+        scopeMode: "tool_signature",
+        toolName: "shell",
         inputDigest: digest,
-        conversationId: 'conv-ctx',
-        callSessionId: 'call-ctx',
+        conversationId: "conv-ctx",
+        callSessionId: "call-ctx",
       }),
     );
 
     const result = await consumeGrantForInvocation({
-      toolName: 'shell',
+      toolName: "shell",
       inputDigest: digest,
-      consumingRequestId: 'consumer-ctx',
-      assistantId: 'self',
-      conversationId: 'conv-ctx',
-      callSessionId: 'call-ctx',
+      consumingRequestId: "consumer-ctx",
+      assistantId: "self",
+      conversationId: "conv-ctx",
+      callSessionId: "call-ctx",
     });
 
     expect(result.ok).toBe(true);
   });
 
-  test('miss: conversation context mismatch on tool_signature grant', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'test' });
+  test("miss: conversation context mismatch on tool_signature grant", async () => {
+    const digest = computeToolApprovalDigest("shell", { command: "test" });
     mintGrantFromDecision(
       mintParams({
-        scopeMode: 'tool_signature',
-        toolName: 'shell',
+        scopeMode: "tool_signature",
+        toolName: "shell",
         inputDigest: digest,
-        conversationId: 'conv-A',
+        conversationId: "conv-A",
       }),
     );
 
-    const result = await consumeGrantForInvocation({
-      toolName: 'shell',
-      inputDigest: digest,
-      consumingRequestId: 'consumer-ctx-mismatch',
-      assistantId: 'self',
-      conversationId: 'conv-B',
-    }, { maxWaitMs: 0 });
+    const result = await consumeGrantForInvocation(
+      {
+        toolName: "shell",
+        inputDigest: digest,
+        consumingRequestId: "consumer-ctx-mismatch",
+        assistantId: "self",
+        conversationId: "conv-B",
+      },
+      { maxWaitMs: 0 },
+    );
 
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('no_match');
+    expect(result.reason).toBe("no_match");
   });
 });
 
@@ -452,44 +479,44 @@ describe('approval-primitive / consumeGrantForInvocation', () => {
 // RETRY POLLING TESTS
 // ===========================================================================
 
-describe('approval-primitive / consumeGrantForInvocation retry', () => {
+describe("approval-primitive / consumeGrantForInvocation retry", () => {
   beforeEach(() => clearTables());
 
-  test('succeeds immediately when grant already exists (no retry needed)', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'ls' });
+  test("succeeds immediately when grant already exists (no retry needed)", async () => {
+    const digest = computeToolApprovalDigest("shell", { command: "ls" });
     mintGrantFromDecision(
       mintParams({
-        scopeMode: 'tool_signature',
-        toolName: 'shell',
+        scopeMode: "tool_signature",
+        toolName: "shell",
         inputDigest: digest,
       }),
     );
 
     const start = Date.now();
     const result = await consumeGrantForInvocation({
-      toolName: 'shell',
+      toolName: "shell",
       inputDigest: digest,
-      consumingRequestId: 'consumer-async-immediate',
-      assistantId: 'self',
+      consumingRequestId: "consumer-async-immediate",
+      assistantId: "self",
     });
     const elapsed = Date.now() - start;
 
     expect(result.ok).toBe(true);
     if (!result.ok) return;
-    expect(result.grant.status).toBe('consumed');
+    expect(result.grant.status).toBe("consumed");
     // Should return nearly instantly — well under the retry interval
     expect(elapsed).toBeLessThan(200);
   });
 
-  test('retries and succeeds when grant appears after a delay', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'delayed' });
+  test("retries and succeeds when grant appears after a delay", async () => {
+    const digest = computeToolApprovalDigest("shell", { command: "delayed" });
 
     // Mint the grant after 300ms — the async consumer should retry and find it
     setTimeout(() => {
       mintGrantFromDecision(
         mintParams({
-          scopeMode: 'tool_signature',
-          toolName: 'shell',
+          scopeMode: "tool_signature",
+          toolName: "shell",
           inputDigest: digest,
         }),
       );
@@ -498,10 +525,10 @@ describe('approval-primitive / consumeGrantForInvocation retry', () => {
     const start = Date.now();
     const result = await consumeGrantForInvocation(
       {
-        toolName: 'shell',
+        toolName: "shell",
         inputDigest: digest,
-        consumingRequestId: 'consumer-async-delayed',
-        assistantId: 'self',
+        consumingRequestId: "consumer-async-delayed",
+        assistantId: "self",
       },
       { maxWaitMs: 5_000, intervalMs: 100 },
     );
@@ -509,22 +536,24 @@ describe('approval-primitive / consumeGrantForInvocation retry', () => {
 
     expect(result.ok).toBe(true);
     if (!result.ok) return;
-    expect(result.grant.status).toBe('consumed');
+    expect(result.grant.status).toBe("consumed");
     // Should have taken at least ~300ms (the delay) but less than the max wait
     expect(elapsed).toBeGreaterThanOrEqual(250);
     expect(elapsed).toBeLessThan(5_000);
   });
 
-  test('returns failure after timeout when no grant appears', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'never-minted' });
+  test("returns failure after timeout when no grant appears", async () => {
+    const digest = computeToolApprovalDigest("shell", {
+      command: "never-minted",
+    });
 
     const start = Date.now();
     const result = await consumeGrantForInvocation(
       {
-        toolName: 'shell',
+        toolName: "shell",
         inputDigest: digest,
-        consumingRequestId: 'consumer-async-timeout',
-        assistantId: 'self',
+        consumingRequestId: "consumer-async-timeout",
+        assistantId: "self",
       },
       { maxWaitMs: 500, intervalMs: 100 },
     );
@@ -532,14 +561,14 @@ describe('approval-primitive / consumeGrantForInvocation retry', () => {
 
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('no_match');
+    expect(result.reason).toBe("no_match");
     // Should have waited approximately the max wait time
     expect(elapsed).toBeGreaterThanOrEqual(450);
     expect(elapsed).toBeLessThan(1_500);
   });
 
-  test('returns aborted when signal fires during retry polling', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'aborted' });
+  test("returns aborted when signal fires during retry polling", async () => {
+    const digest = computeToolApprovalDigest("shell", { command: "aborted" });
     const controller = new AbortController();
 
     // Abort after 200ms — well before the 2s max wait
@@ -548,10 +577,10 @@ describe('approval-primitive / consumeGrantForInvocation retry', () => {
     const start = Date.now();
     const result = await consumeGrantForInvocation(
       {
-        toolName: 'shell',
+        toolName: "shell",
         inputDigest: digest,
-        consumingRequestId: 'consumer-aborted',
-        assistantId: 'self',
+        consumingRequestId: "consumer-aborted",
+        assistantId: "self",
       },
       { maxWaitMs: 2_000, intervalMs: 50, signal: controller.signal },
     );
@@ -559,23 +588,25 @@ describe('approval-primitive / consumeGrantForInvocation retry', () => {
 
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('aborted');
+    expect(result.reason).toBe("aborted");
     // Should have exited shortly after the abort (200ms), not waited the full 2s
     expect(elapsed).toBeLessThan(1_000);
   });
 
-  test('returns aborted immediately when signal is already aborted', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'pre-aborted' });
+  test("returns aborted immediately when signal is already aborted", async () => {
+    const digest = computeToolApprovalDigest("shell", {
+      command: "pre-aborted",
+    });
     const controller = new AbortController();
     controller.abort();
 
     const start = Date.now();
     const result = await consumeGrantForInvocation(
       {
-        toolName: 'shell',
+        toolName: "shell",
         inputDigest: digest,
-        consumingRequestId: 'consumer-pre-aborted',
-        assistantId: 'self',
+        consumingRequestId: "consumer-pre-aborted",
+        assistantId: "self",
       },
       { maxWaitMs: 2_000, intervalMs: 50, signal: controller.signal },
     );
@@ -583,21 +614,21 @@ describe('approval-primitive / consumeGrantForInvocation retry', () => {
 
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('aborted');
+    expect(result.reason).toBe("aborted");
     // Should return nearly instantly since signal was already aborted
     expect(elapsed).toBeLessThan(200);
   });
 
-  test('skips retry entirely when maxWaitMs is 0', async () => {
-    const digest = computeToolApprovalDigest('shell', { command: 'no-retry' });
+  test("skips retry entirely when maxWaitMs is 0", async () => {
+    const digest = computeToolApprovalDigest("shell", { command: "no-retry" });
 
     const start = Date.now();
     const result = await consumeGrantForInvocation(
       {
-        toolName: 'shell',
+        toolName: "shell",
         inputDigest: digest,
-        consumingRequestId: 'consumer-no-retry',
-        assistantId: 'self',
+        consumingRequestId: "consumer-no-retry",
+        assistantId: "self",
       },
       { maxWaitMs: 0 },
     );
@@ -605,7 +636,7 @@ describe('approval-primitive / consumeGrantForInvocation retry', () => {
 
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toBe('no_match');
+    expect(result.reason).toBe("no_match");
     // Should return nearly instantly — no retry loop
     expect(elapsed).toBeLessThan(100);
   });