Sealed approvals: approval { sealed } and the oxygen pin 2be1fe4ad345

    // Inputs as [artifact, from, path] sorted by path; absent when none.

    // Approval as [by, others-only, expires seconds]; absent without one.

    if let Some(a) = &j.approval {

    }

    // The environment it deploys to; absent without one.

    if let Some(e) = &j.environment {

    pub others_only: bool,

    /// How long it waits once the jobs it depends on are done, in seconds.

    pub expires_s: u64,

}

/// The longest a job waits for approval: 30 days.

/// `approval { by "maintain"; others-only #true; expires "24h" }`, each

/// optional: `maintain`, anyone with the role, 24 hours.

    if !node.entries().is_empty() {

        ctx.err(node.span(), "`approval` takes a block: approval { by \"maintain\"; others-only #true; expires \"24h\" }");

    }

    for c in children.nodes() {

        ctx.no_children(c);

        match c.name().value() {

                    _ => ctx.err(c.span(), "`others-only` takes #true or #false"),

                },

                _ => ctx.err(c.span(), "`others-only` takes #true or #false"),

            },

            "expires" => {

                let Some(t) = ctx.one_string(c) else { continue };

                    Some(_) => ctx.err(c.span(), format!("expires {t:?} must be from 1m to 720h")),

                    None => ctx.err(c.span(), format!("expires {t:?}: expected hours, minutes and seconds, as \"24h\"")),

                }

            }

        }

    }

}

/// `input { artifact "NAME" from "JOB"; path "/src/FILE" }`.

fn parse_job(ctx: &mut Ctx, node: &KdlNode) -> Option<Job> {

    let name = ctx.one_string(node)?;

    let named = ctx.name_ok(node.span(), "job", &name);

    let mut job = Job {

        name: name.clone(),

        sandbox: String::new(),

                parse_output(ctx, c, &mut job);

            }

            "input" => parse_input(ctx, c, &mut job),

            "environment" => {

                ctx.no_children(c);

                if let Some(e) = ctx.one_string(c) {

            other => ctx.err(c.span(), format!("unknown job setting `{other}`")),

        }

    }

    job.mounts.sort_by(|a, b| a.target.cmp(&b.target));

    job.outputs.sort_by(|a, b| a.name.cmp(&b.name));

    job.inputs.sort_by(|a, b| a.path.cmp(&b.path));

fn a_job_can_wait_for_approval() {

    let job = |approval: &str| doc(&format!("job \"apply\" {{\n    sandbox \"alpine\"\n{approval}    exec \"apply\"\n}}\n"));

    let p = Pipeline::parse(&job("    approval { by \"maintain\"; others-only #true; expires \"2h\"; }\n")).unwrap();

    let plain = Pipeline::parse(&job("    approval\n")).unwrap();

    assert_eq!(

        plain.jobs["apply"].approval,

        "defaults"

    );

    assert_eq!(Pipeline::parse(&job("")).unwrap().jobs["apply"].approval, None);

    assert_ne!(p.hash(), plain.hash(), "the approval is part of the job");

    let has = |a: &str, want: &str| {

    has("    approval { others-only \"yes\"; }\n", "#true or #false");

    has("    approval { expires \"800h\"; }\n", "from 1m to 720h");

    has("    approval { when \"later\"; }\n", "unknown approval setting");

}

#[test]

        by "maintain"        // the least role: "write", "maintain" (default) or "admin"

        others-only #true    // not the person whose push started the run

        expires "24h"        // from when the jobs it depends on are done; up to 720h

    }

}

```

bookmark cancels the run as before, so a stale plan is never applied. The

approval is part of the job's hash (field 11).

### 5.3.3 Environments (oxygenflow#59)

`environment "prod"` on a job says where it deploys (1 to 32 of `a-z`,