Interface HostApprovalServiceOptions

Separation-of-duties exemption, forwarded to ApprovalServiceOptions.allowSelfDecision (ENFORCEMENT). Default OFF (SoD on): the requester can never decide their own request. { roles: ['admin'] } lets a single-operator deployment self-approve as admin. Pass the IDENTICAL value to createTenantResolver's allowSelfDecision so the tenant's canSelfDecide display hint matches what this actually enforces.

Applied when CreateApprovalInput.slaSeconds is absent.

Notification transport (email/Slack/pager adapter) for newly-created approval requests — threaded to ApprovalServiceOptions.notify. Transports needing to outlive the response wrap themselves in the host's waitUntil.

Optional audit export queue (wrangler queues producer binding).

The host's resume topology — createDoRunTopology(...).resumeRecord for a DO host, resumeViaRuntime(runtime) for an in-process one. Wrapped in resumeRunWithRequeue here, so a run that re-suspends at a later gate auto-queues its next approval(s) with SoD intact (the deciding reviewer becomes the next gate's requester).

Live-stream fan-out sink (ApprovalServiceOptions.stream) — fired once per successful approval mutation for the tenant's hub Durable Object. The host supplies a sink that forwards each event to env.HUB.idFromName(record.tenantId) (createHubTopology), wrapping the transport keepalive in ctx.waitUntil at fetch scope. Undefined means no live fan-out (a poll-only host).

Id for system-created records (the bridge's record creator). Must differ from human actor ids or the separation-of-duties check can never fire.

ctx.waitUntil — keeps audit queue sends alive past the response.