Interface ApprovalServiceOptions

Permit the requester to decide their own request. Off by default — separation of duties is the safe enterprise default. true exempts every decider; { roles } exempts only those roles (a single-operator deployment sets e.g. { roles: ['admin'] }). A permitted self-decision is audited with detail.selfDecision: true.

Structural match for breakwater AuditLogger.record — wire (event) => auditLogger.record(event). Must not throw; failures are contained anyway (availability over export reliability, matching AuditLogger's own sink policy).

Applied when CreateApprovalInput.slaSeconds is absent.

Notification transport seam — fired once per record actually CREATED (created: true; the idempotent re-observation of an already-open step never re-notifies). Fire-and-forget: a throwing or rejecting sink is contained and recorded to the audit sink as approval.notify/'error', never failing the create. See ApprovalNotificationSink (contract.ts) for the ctx.waitUntil convention on Workers hosts.

Injectable clock (tests, deterministic SLA math).

Resumes the run after a decision (approve AND reject — the workflow learns the outcome via resumeData). Same-Worker deployments use resumeViaRuntime(runtime); cross-Worker ones fetch the run's DO.

Must be tenant-bound: the service asserts every acting principal's tenant against this binding, and the store's predicates are what scope reads/writes. Obtain via a store factory's forTenant().

Live-stream fan-out seam — fired once per SUCCESSFUL mutation (create with created: true, claim, decide, delegate, supersede) with the POST-transition record. Distinct from notify (reviewer transport, created/escalated only): this is the same-trust intra-tenant feed a per-tenant hub relays to open dashboards. Fire-and-forget with the same containment as notify: a throwing or rejecting sink is audited as approval.stream/'error' and never fails the mutation. See ApprovalStreamSink (contract.ts) for the ctx.waitUntil convention.