Interface HostApprovalServiceOptions

Separation-of-duties exemption, forwarded to ApprovalServiceOptions.allowSelfDecision (ENFORCEMENT). Default OFF (SoD on): the requester can never decide their own request. { roles: ['admin'] } lets a single-operator deployment self-approve as admin. Pass the IDENTICAL value to createActorResolver's allowSelfDecision so the context's canSelfDecide display hint matches what this actually enforces.

Applied when CreateApprovalInput.slaSeconds is absent.

Infrastructure-verified deployment tag for audit attribution.

The deployment execution fence (do-runner/execution-fence.ts), forwarded to ApprovalServiceOptions.executionFence, or 'none' for a service with no database behind it.

REQUIRED, and the 'none' branch is genuinely dangerous rather than merely unusual: 'none' makes decide() unfenced, and decide COMMITS the decision and only then resumes. A migration-locked deployment would durably record a decision — with its audit trail and its notification — whose resume then 503s, and the deployment taking over inherits a decided approval with nothing behind it. Write it only for a service that has no database to fence against at all.

This function receives an ApprovalStore rather than a database, so it cannot build the store itself the way init({ DB }) can — which is exactly why the option is required rather than optional: the host is the only place the wiring can happen, so the type has to make it name one.

Notification transport (email/Slack/pager adapter) for newly-created approval requests — threaded to ApprovalServiceOptions.notify. Transports needing to outlive the response wrap themselves in the host's waitUntil.

Optional audit export queue (wrangler queues producer binding).

The host's resume topology — createDoRunTopology(...).resumeRecord for a DO host, resumeViaRuntime(runtime) for an in-process one. Wrapped in resumeRunWithRequeue here, so a run that re-suspends at a later gate auto-queues its next approval(s) with SoD intact (the deciding reviewer becomes the next gate's requester).

Live-stream fan-out sink (ApprovalServiceOptions.stream) — fired once per successful approval mutation for the deployment hub Durable Object. The host supplies a sink through createHubTopology, wrapping the transport keepalive in ctx.waitUntil at fetch scope. Undefined means no live fan-out (a poll-only host).

System-principal id used to authorize bridge bookkeeping. Requester kind is persisted separately, so ids may overlap across principal kinds.

ctx.waitUntil — keeps audit queue sends alive past the response.