Struct ApprovalsBundle 

pub struct ApprovalsBundle {
    pub grants: Vec<(String, Vec<u8>)>,
    pub uses: Vec<ApprovalUse>,
    pub checkpoints: Vec<JournalCheckpoint>,
    pub revocations: Vec<ApprovalRevocation>,
    pub action_envelopes: Vec<(String, Vec<u8>)>,
    pub sealed_envelopes: Vec<(String, Vec<u8>)>,
    pub signer_keys: Vec<(String, String)>,
}

Optional approval evidence to embed in the package alongside the receipt + artifacts. None means “no approvals consumed during this session, or none worth exporting.” Empty vectors mean “we looked and found nothing”; the resulting package omits the approvals/ dir entirely so absence is unambiguous.

Ownership of the evidence stays with the caller: session::close gathers the grant envelopes from the chain, the uses from the local journal, and any covering checkpoints, then hands them off here.

Fields

grants: Vec<(String, Vec<u8>)>

Bytes of the signed ApprovalStatement envelopes that authorized any consumed uses. Each entry is (grant_id, raw_envelope_json). Stored verbatim so the package’s verifier can re-check the signature without re-serializing.

uses: Vec<ApprovalUse>

ApprovalUse records pulled from the local journal at close time. action_artifact_id should be backfilled before passing to build_package (see commands/session.rs).

checkpoints: Vec<JournalCheckpoint>

JournalCheckpoints that cover the included uses. Optional; may be empty even when uses are present (PR 6 fills these in).

revocations: Vec<ApprovalRevocation>

Explicit revocations we wanted to surface (e.g. a use whose grant was revoked after consumption – the package should still show the consumed evidence and the revocation alongside). Empty in PR 4; reserved.

action_envelopes: Vec<(String, Vec<u8>)>

Bytes of each action artifact’s signed envelope that consumed an approval. Each entry is (action_artifact_id, raw_envelope_json). v0.9.10 PR A: shipped to close the action↔use binding gap. The verifier extracts meta.approval_use_id from each envelope and cross-checks it against the package’s use records. Empty in pre-v0.9.10 packages; readers must treat absence as “binding not asserted by package” rather than “binding present and OK.”

sealed_envelopes: Vec<(String, Vec<u8>)>

Every sealed artifact’s signed envelope, (artifact_id, raw_envelope_json), so the package verifies its own signatures instead of asking the reader to trust the sealed set (audit 2026-09, AUD-31). Written to artifacts/<id>.json, the same directory the consuming actions above already use. Empty in pre-0.31.2 packages.

signer_keys: Vec<(String, String)>

The public half of every key that signed a sealed envelope, (key_id, "ed25519:<base64url>"), written to keys.json. A verifier checks each signature against the key the package names, then separately reports whether that key is one it has pinned.

Trait Implementations

impl Clone for ApprovalsBundle

fn clone(&self) -> ApprovalsBundle

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ApprovalsBundle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ApprovalsBundle

fn default() -> ApprovalsBundle

Returns the “default value” for a type.