fix: expose causal approval evidence failures

build/api/index.js

@@ -5152,6 +5152,7 @@ var _ApplicationError_cause;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ApplicationError = exports.APPLICATION_ERROR_METADATA = exports.APPLICATION_ERROR_RECOVERY_IDS = void 0;
 exports.isApplicationErrorCorrelationId = isApplicationErrorCorrelationId;
+const approval_evidence_diagnostic_1 = __nccwpck_require__(8205);
 const branch_sync_validation_1 = __nccwpck_require__(981);
 exports.APPLICATION_ERROR_RECOVERY_IDS = Object.freeze([
     'pull-request-link-restored',
@@ -5167,6 +5168,7 @@ exports.APPLICATION_ERROR_RECOVERY_IDS = Object.freeze([
     'sdd-draft-size-exceeded',
     'sdd-draft-format-invalid',
     'workspace-changes-rejected',
+    'approval-evidence-read-failed',
 ]);
 const PRESERVED_STATE = 'Existing persisted state and completed external effects were preserved.';
 const UNCHANGED_STATE = 'No new state or external effect was created.';
@@ -5358,6 +5360,7 @@ class ApplicationError extends Error {
 exports.ApplicationError = ApplicationError;
 _ApplicationError_cause = new WeakMap();
 const RECOVERY_VARIABLE_KEYS = Object.freeze({
+    'approval-evidence-read-failed': Object.freeze(['operation', 'reason', 'permission']),
     'pull-request-link-restored': Object.freeze([]),
     'pull-request-link-base-retained': Object.freeze([]),
     'pull-request-link-reference-retained': Object.freeze([]),
@@ -5410,6 +5413,12 @@ function normalizeApplicationErrorRecovery(recovery) {
         && !branch_sync_validation_1.BRANCH_SYNC_VALIDATION_CODES.some(code => code === variables.validationCode)) {
         throw new TypeError('Application error recovery synchronization validation code is invalid.');
     }
+    if (recovery.id === 'approval-evidence-read-failed'
+        && (!Object.prototype.hasOwnProperty.call(approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_PERMISSIONS, variables.operation)
+            || !approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_REASONS.some(reason => reason === variables.reason)
+            || approval_evidence_diagnostic_1.APPROVAL_EVIDENCE_PERMISSIONS[variables.operation] !== variables.permission)) {
+        throw new TypeError('Approval evidence diagnostic is invalid.');
+    }
     return Object.freeze({
         id: recovery.id,
         variables: Object.freeze({ ...variables }),
@@ -5468,6 +5477,43 @@ function isAgentConfigurationReady(configuration) {
 }
 
 
+/***/ }),
+
+/***/ 8205:
+/***/ ((__unused_webpack_module, exports) => {
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.APPROVAL_EVIDENCE_REASONS = exports.APPROVAL_EVIDENCE_PERMISSIONS = void 0;
+/** Closed vocabulary: no provider text, URLs, headers, policy values or credentials. */
+exports.APPROVAL_EVIDENCE_PERMISSIONS = Object.freeze({
+    'evidence': 'repository-read',
+    'pull-request': 'pull-requests-read',
+    'base-ref': 'contents-read',
+    'merge-commit': 'contents-read',
+    'policy': 'actions-variables-read',
+    'files': 'pull-requests-read',
+    'reviews': 'pull-requests-read',
+    'comments': 'issues-read',
+    'head-checks': 'checks-read',
+    'merge-checks': 'checks-read',
+    'head-runs': 'actions-read',
+    'merge-runs': 'actions-read',
+    'jobs': 'actions-read',
+    'rules': 'metadata-read',
+    'classic-protection': 'administration-read',
+    'authenticated-user': 'authenticated-user-read',
+    'coverage-artifacts': 'actions-read',
+    'coverage-download': 'actions-read',
+    'coverage-parse': 'actions-read',
+});
+exports.APPROVAL_EVIDENCE_REASONS = Object.freeze([
+    'http-400', 'http-401', 'http-403', 'http-404', 'http-409', 'http-422', 'http-429',
+    'http-500', 'http-502', 'http-503', 'http-504', 'transport-unavailable',
+    'invalid-response', 'invalid-page', 'page-limit', 'artifact-unavailable', 'artifact-invalid', 'artifact-mismatch',
+]);
+
+
 /***/ }),
 
 /***/ 981:

build/api/src/data/model/application_error.d.ts

@@ -1,9 +1,11 @@
+import { type ApprovalEvidenceDiagnostic } from '../../domain/approval_evidence_diagnostic';
 import { type BranchSyncValidationCode } from '../../domain/branch_sync_validation';
 export type ApplicationErrorKind = 'configuration' | 'authorization' | 'provider' | 'agent' | 'validation' | 'workflow' | 'unknown';
 export type ApplicationErrorCode = 'configuration.invalid' | 'configuration.unsupported' | 'authorization.denied' | 'authorization.credential-invalid' | 'provider.not-found' | 'provider.conflict' | 'provider.rate-limited' | 'provider.unavailable' | 'provider.contract-invalid' | 'agent.policy-rejected' | 'agent.failed' | 'locale.output-invalid' | 'locale.translation-failed' | 'validation.invalid-input' | 'validation.evidence-too-large' | 'validation.evidence-unavailable' | 'workflow.invalid-event' | 'workflow.stale' | 'workflow.cancelled' | 'workflow.failed' | 'workflow.presentation-pending' | 'timeout' | 'unexpected';
-export declare const APPLICATION_ERROR_RECOVERY_IDS: readonly ["pull-request-link-restored", "pull-request-link-base-retained", "pull-request-link-reference-retained", "pull-request-link-base-and-reference-retained", "managed-branch-enrichment-failed", "inactivity-explanation-failed", "bugbot-review-blocks-pending", "branch-sync-agent-disabled", "branch-sync-fixer-unavailable", "branch-sync-resolution-invalid", "sdd-draft-size-exceeded", "sdd-draft-format-invalid", "workspace-changes-rejected"];
+export declare const APPLICATION_ERROR_RECOVERY_IDS: readonly ["pull-request-link-restored", "pull-request-link-base-retained", "pull-request-link-reference-retained", "pull-request-link-base-and-reference-retained", "managed-branch-enrichment-failed", "inactivity-explanation-failed", "bugbot-review-blocks-pending", "branch-sync-agent-disabled", "branch-sync-fixer-unavailable", "branch-sync-resolution-invalid", "sdd-draft-size-exceeded", "sdd-draft-format-invalid", "workspace-changes-rejected", "approval-evidence-read-failed"];
 export type ApplicationErrorRecoveryId = typeof APPLICATION_ERROR_RECOVERY_IDS[number];
 interface ApplicationErrorRecoveryVariables {
+    readonly 'approval-evidence-read-failed': ApprovalEvidenceDiagnostic;
     readonly 'pull-request-link-restored': Readonly<Record<string, never>>;
     readonly 'pull-request-link-base-retained': Readonly<Record<string, never>>;
     readonly 'pull-request-link-reference-retained': Readonly<Record<string, never>>;

build/api/src/domain/approval_evidence_diagnostic.d.ts

@@ -0,0 +1,30 @@
+/** Closed vocabulary: no provider text, URLs, headers, policy values or credentials. */
+export declare const APPROVAL_EVIDENCE_PERMISSIONS: Readonly<{
+    readonly evidence: "repository-read";
+    readonly 'pull-request': "pull-requests-read";
+    readonly 'base-ref': "contents-read";
+    readonly 'merge-commit': "contents-read";
+    readonly policy: "actions-variables-read";
+    readonly files: "pull-requests-read";
+    readonly reviews: "pull-requests-read";
+    readonly comments: "issues-read";
+    readonly 'head-checks': "checks-read";
+    readonly 'merge-checks': "checks-read";
+    readonly 'head-runs': "actions-read";
+    readonly 'merge-runs': "actions-read";
+    readonly jobs: "actions-read";
+    readonly rules: "metadata-read";
+    readonly 'classic-protection': "administration-read";
+    readonly 'authenticated-user': "authenticated-user-read";
+    readonly 'coverage-artifacts': "actions-read";
+    readonly 'coverage-download': "actions-read";
+    readonly 'coverage-parse': "actions-read";
+}>;
+export type ApprovalEvidenceOperation = keyof typeof APPROVAL_EVIDENCE_PERMISSIONS;
+export declare const APPROVAL_EVIDENCE_REASONS: readonly ["http-400", "http-401", "http-403", "http-404", "http-409", "http-422", "http-429", "http-500", "http-502", "http-503", "http-504", "transport-unavailable", "invalid-response", "invalid-page", "page-limit", "artifact-unavailable", "artifact-invalid", "artifact-mismatch"];
+export type ApprovalEvidenceReason = typeof APPROVAL_EVIDENCE_REASONS[number];
+export type ApprovalEvidenceDiagnostic = {
+    readonly operation: ApprovalEvidenceOperation;
+    readonly reason: ApprovalEvidenceReason;
+    readonly permission: typeof APPROVAL_EVIDENCE_PERMISSIONS[ApprovalEvidenceOperation];
+};