Gate a workflow with approval

import { pathToFileURL } from "node:url";
import { ApprovalManager, Workflow } from "@agentium/core";
import { HarnessRuntime, workflowDriver } from "@agentium/harness";
import { z } from "zod";

const orderInput = z.object({ orderId: z.literal("order-42") }).strict();
type State = { orderId: string; eligible: boolean; receipt: string };

export async function reviewRefund(approved: boolean) {
  let submissions = 0;
  let decisions = 0;
  const approvals = new ApprovalManager({
    policy: "none", // Mandatory asks below come from the execution policy.
    onApproval: async (request) => {
      decisions++;
      console.log("approval:", request.toolName, approved ? "approved" : "denied");
      return { approved, reason: "Local demonstration decision" };
    },
  });
  const workflow = new Workflow<State>({
    name: "refund-review", register: false,
    initialState: { orderId: "", eligible: false, receipt: "" },
    steps: [
      {
        name: "check-order",
        run: async (state) => ({ eligible: state.orderId === "order-42" }),
      },
      {
        name: "submit-refund",
        run: async (state) => {
          if (!state.eligible) throw new Error("Order is not eligible");
          submissions++;
          // Local effect only. Replace with an authorized, idempotent service.
          return { receipt: `simulated-refund:${state.orderId}` };
        },
      },
    ],
  });
  const runtime = new HarnessRuntime({
    driver: workflowDriver(workflow, {
      input: (input) => {
        if (typeof input !== "string") throw new Error("Expected JSON text");
        return orderInput.parse(JSON.parse(input));
      },
    }),
    grants: { toolIds: ["workflow:check-order", "workflow:submit-refund"], modelRoles: [] },
    budgets: { maxModelCalls: 0 },
    approvalManager: approvals,
    executionPolicy: {
      decide: (request) => ({ action: request.toolName === "workflow:submit-refund" ? "ask" : "allow" }),
      resolveEffect: (request) => request.toolName === "workflow:submit-refund" ? "write" : "read",
    },
  });
  const identity = { tenantId: "demo", userId: "reviewer" };
  const sessionId = "refund-review";
  try {
    const result = await runtime.run(JSON.stringify({ orderId: "order-42" }), { identity, sessionId });
    console.log("status:", result.status, "submissions:", submissions);
    if (result.reason) console.log("reason:", result.reason.code);
    if (result.status === "completed") console.log("state:", result.structured);
    return { result, submissions, decisions };
  } finally {
    try {
      const diagnostics = await runtime.resources.closeSession(identity, sessionId);
      if (diagnostics.length) throw new Error(`Cleanup failed: ${diagnostics.join(", ")}`);
    } finally {
      approvals.close();
    }
  }
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  await reviewRefund(process.argv.includes("--approve"));
}