feat(approvals): declare file attachments on approve/reject decisions

[os-zhuang]

Backend half of retiring the approvals inbox's hand-wired attachment composer (objectui#2698). Pairs with the objectui PR that removes the composer and renders decisions purely through DeclaredActionsBar.

What

Add an optional multi-file attachments param to the declared approval_approve / approval_reject actions on sys_approval_request:

{ name: 'attachments', label: 'Attachments', type: 'file', multiple: true, required: false }

The console renders type:'file' action params through the shared upload widget (objectui ADR-0059 / #2700) and POSTs the resolved attachments: string[], so a reviewer attaches supporting files to a decision through the generic declared-action dialog — no bespoke composer.

Why it's this small

No service or route change. The decision route already forwards body.attachments to ApprovalService.decide (packages/rest/src/rest-server.ts), and the sys_approval_action.attachments column (Field.file, multiple) already persists them (#3266 / #3274). This PR only surfaces the capability as declared metadata. The spec already accepts type:'file' + multiple (ActionParamSchema), so no spec change either.

Verification

• plugin-approvals suite green (144 tests), incl. a new contract test pinning the attachments param (type file, multiple, optional) on both actions.
• End-to-end (with the objectui PR, against a live backend): the declared Approve dialog renders a file-upload widget, and staging a file + confirming POSTs {comment, attachments:["<fileId>"]} — the upload id serialized correctly. (The persist path is the pre-existing, already-tested decide → sys_approval_action.attachments.)

Refs

objectui#2698 (composer retirement) · #3266 / #3274 (attachments column + route passthrough) · framework#3300 (declared action set) · #2678 (P2-4)

🤖 Generated with Claude Code

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Canceled		Jul 20, 2026 2:09am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-approvals.

4 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/automation/approvals.mdx (via @objectstack/plugin-approvals)
• content/docs/plugins/packages.mdx (via @objectstack/plugin-approvals)
• content/docs/releases/implementation-status.mdx (via @objectstack/plugin-approvals)
• content/docs/releases/v9.mdx (via @objectstack/plugin-approvals)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.