Function approval_binding_from_governed 

pub fn approval_binding_from_governed(
    token: &GovernedApprovalToken,
    rail: &RailBinding,
    amount_minor_units: u128,
    approval_expires_at: u64,
) -> Result<ApprovalBinding, SettlementError>

Bridge a verified GovernedApprovalToken and a resolved RailBinding into an ApprovalBinding suitable for prepare_transfer_with_authorization.

The caller is the trust boundary: it resolves the rail from the operator config and independently supplies the amount and approval expiry that the verified token authorizes. The token is consulted for its decision and its expires_at; the discrete rail fields (chain, token contract, payee, symbol) come from the operator-configured RailBinding the caller resolved and the caller-supplied amount_minor_units and approval_expires_at.

The effective binding expiry is clamped to min(approval_expires_at, token.expires_at). The signed approval cannot justify any spend after it lapses, so the binding must never outlive token.expires_at. A caller may legitimately request a tighter (shorter) window for a specific dispatch and that shorter value is preserved; a value later than the token’s own expiry is narrowed to the token expiry. Clamping only shrinks the window, so no caller input can produce a binding whose ApprovalBinding::approval_expires_at outlives the approval token, and the invariant prepare_transfer_with_authorization enforces (validBefore <= approval_expires_at) holds structurally at this bridge.

Fails closed when:

• token.decision is not GovernedApprovalDecision::Approved.
• Any required rail field is empty.
• amount_minor_units is zero.