@frontmcp/plugin-approval 1.8.0 → 1.8.2

package/esm/index.mjs

@@ -18,14 +18,41 @@ var __decorateClass = (decorators, target, key, kind) => {
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 
 // plugins/plugin-approval/src/approval.plugin.ts
-import { DynamicPlugin as DynamicPlugin2, Plugin as Plugin2, ProviderScope as ProviderScope4, FRONTMCP_CONTEXT } from "@frontmcp/sdk";
-
-// plugins/plugin-approval/src/stores/approval-storage.store.ts
-import { Provider, ProviderScope } from "@frontmcp/sdk";
 import {
-  createStorage,
-  createMemoryStorage
-} from "@frontmcp/utils";
+  DynamicPlugin as DynamicPlugin2,
+  FRONTMCP_CONTEXT,
+  Plugin as Plugin2,
+  ProviderScope as ProviderScope4
+} from "@frontmcp/sdk";
+
+// plugins/plugin-approval/src/approval.identity.ts
+import { randomUUID } from "@frontmcp/utils";
+function nonEmptyString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function resolveApprovalIdentity(ctx) {
+  const extra = ctx?.authInfo?.extra;
+  const userId = nonEmptyString(extra?.["userId"]) ?? nonEmptyString(extra?.["sub"]) ?? nonEmptyString(ctx?.authInfo?.clientId);
+  const sessionId = nonEmptyString(ctx?.verifiedSessionId);
+  if (sessionId) {
+    return { sessionId, userId };
+  }
+  return { sessionId: userId ? `stateless-user:${userId}` : `unidentified:${randomUUID()}`, userId };
+}
+
+// plugins/plugin-approval/src/approval.symbols.ts
+var ApprovalStoreToken = /* @__PURE__ */ Symbol.for(
+  "plugin:approval:store"
+);
+var ApprovalServiceToken = /* @__PURE__ */ Symbol.for(
+  "plugin:approval:service"
+);
+var ChallengeServiceToken = /* @__PURE__ */ Symbol.for(
+  "plugin:approval:challenge-service"
+);
+
+// plugins/plugin-approval/src/hooks/approval-check.hook.ts
+import { DynamicPlugin, Plugin, ToolHook } from "@frontmcp/sdk";
 
 // plugins/plugin-approval/src/approval/types.ts
 var ApprovalScope = /* @__PURE__ */ ((ApprovalScope2) => {
@@ -390,269 +417,125 @@ var ChallengeValidationError = class extends ApprovalError {
   }
 };
 
-// plugins/plugin-approval/src/stores/approval-storage.store.ts
-function escapePattern(str) {
-  return str.replace(/[*?[\]\\]/g, "\\$&");
-}
-var ApprovalStorageStore = class {
-  storage;
-  options;
-  cleanupInterval;
-  initialized = false;
-  ownedStorage = false;
-  constructor(options = {}) {
-    this.options = {
-      storage: options.storage ?? { type: "auto" },
-      storageInstance: options.storageInstance,
-      namespace: options.namespace ?? "approval",
-      cleanupIntervalSeconds: options.cleanupIntervalSeconds ?? 60
-    };
-  }
-  /**
-   * Initialize the storage connection.
-   */
-  async initialize() {
-    if (this.initialized) {
+// plugins/plugin-approval/src/hooks/approval-check.hook.ts
+var passedApprovalStores = /* @__PURE__ */ new WeakMap();
+var ApprovalCheckPlugin = class extends DynamicPlugin {
+  async checkApproval(flowCtx) {
+    const { tool, toolContext } = flowCtx.state;
+    if (!tool || !toolContext) return;
+    const metadata = tool.metadata;
+    const approvalConfig = this.resolveApprovalConfig(
+      metadata["approval"]
+    );
+    if (!approvalConfig.required) {
       return;
     }
-    if (this.options.storageInstance) {
-      this.storage = this.options.storageInstance.namespace(this.options.namespace);
-      this.ownedStorage = false;
-    } else {
-      const rootStorage = await createStorage(this.options.storage);
-      this.storage = rootStorage.namespace(this.options.namespace);
-      this.ownedStorage = true;
-    }
-    if (this.options.cleanupIntervalSeconds > 0) {
-      this.cleanupInterval = setInterval(() => {
-        void this.clearExpiredApprovals();
-      }, this.options.cleanupIntervalSeconds * 1e3);
-      this.cleanupInterval.unref?.();
+    if (approvalConfig.skipApproval) {
+      return;
     }
-    this.initialized = true;
+    const approvalStore = this.get(ApprovalStoreToken);
+    const passedStores = passedApprovalStores.get(toolContext) ?? /* @__PURE__ */ new WeakSet();
+    if (passedStores.has(approvalStore)) return;
+    await this.enforceApproval(flowCtx, tool, toolContext, approvalConfig, approvalStore);
+    passedStores.add(approvalStore);
+    passedApprovalStores.set(toolContext, passedStores);
   }
-  ensureInitialized() {
-    if (!this.initialized) {
-      throw new Error("ApprovalStorageStore not initialized. Call initialize() first.");
+  async enforceApproval(flowCtx, tool, toolContext, approvalConfig, approvalStore) {
+    const { sessionId, userId } = resolveApprovalIdentity(toolContext.tryGetContext?.());
+    const approval = await approvalStore.getApproval(tool.fullName, sessionId, userId);
+    if (approval?.state === "denied" /* DENIED */) {
+      throw new ApprovalRequiredError({
+        toolId: tool.fullName,
+        state: "denied",
+        message: `Tool "${tool.fullName}" execution denied.`
+      });
     }
-  }
-  buildKey(toolId, sessionId, userId, context) {
-    const parts = [toolId];
-    if (sessionId) parts.push(`session:${sessionId}`);
-    if (userId) parts.push(`user:${userId}`);
-    if (context) parts.push(`ctx:${context.type}:${context.identifier}`);
-    return parts.join(":");
-  }
-  parseRecord(value) {
-    if (!value) return void 0;
-    try {
-      const parsed = JSON.parse(value);
-      const result = approvalRecordSchema.safeParse(parsed);
-      if (!result.success) {
-        return void 0;
-      }
-      return result.data;
-    } catch {
-      return void 0;
+    if (this.isPreApprovedContext(approvalConfig, this.getCurrentContext(flowCtx))) {
+      return;
     }
-  }
-  isExpired(approval) {
-    return approval.expiresAt !== void 0 && Date.now() > approval.expiresAt;
-  }
-  async getApproval(toolId, sessionId, userId) {
-    this.ensureInitialized();
-    const sessionKey = this.buildKey(toolId, sessionId);
-    const sessionValue = await this.storage.get(sessionKey);
-    const sessionApproval = this.parseRecord(sessionValue);
-    if (sessionApproval && !this.isExpired(sessionApproval)) {
-      return sessionApproval;
+    if (approvalConfig.alwaysPrompt) {
+      await this.handleApprovalRequired(flowCtx, approvalConfig, approval);
+      return;
     }
-    if (userId) {
-      const userKey = this.buildKey(toolId, void 0, userId);
-      const userValue = await this.storage.get(userKey);
-      const userApproval = this.parseRecord(userValue);
-      if (userApproval && !this.isExpired(userApproval)) {
-        return userApproval;
+    if (approval?.state === "approved" /* APPROVED */) {
+      if (!this.isExpired(approval)) {
+        return;
       }
     }
-    return void 0;
+    await this.handleApprovalRequired(flowCtx, approvalConfig, approval);
   }
-  async queryApprovals(query) {
-    this.ensureInitialized();
-    const results = [];
-    const pattern = query.toolId ? `${query.toolId}:*` : "*";
-    const keys = await this.storage.keys(pattern);
-    const values = await this.storage.mget(keys);
-    for (const value of values) {
-      const approval = this.parseRecord(value);
-      if (!approval) continue;
-      if (!query.includeExpired && this.isExpired(approval)) {
-        continue;
-      }
-      if (query.toolId && approval.toolId !== query.toolId) continue;
-      if (query.toolIds && !query.toolIds.includes(approval.toolId)) continue;
-      if (query.scope && approval.scope !== query.scope) continue;
-      if (query.scopes && !query.scopes.includes(approval.scope)) continue;
-      if (query.state && approval.state !== query.state) continue;
-      if (query.states && !query.states.includes(approval.state)) continue;
-      if (query.sessionId && approval.sessionId !== query.sessionId) continue;
-      if (query.userId && approval.userId !== query.userId) continue;
-      if (query.context) {
-        if (!approval.context || approval.context.type !== query.context.type || approval.context.identifier !== query.context.identifier) {
-          continue;
-        }
-      }
-      results.push(approval);
+  resolveApprovalConfig(config) {
+    if (config === true) {
+      return { required: true, defaultScope: "session" /* SESSION */ };
     }
-    return results;
-  }
-  async grantApproval(options) {
-    this.ensureInitialized();
-    const now = Date.now();
-    const expiresAt = options.ttlMs ? now + options.ttlMs : void 0;
-    const grantedBy = normalizeGrantor(options.grantedBy);
-    const record = {
-      toolId: options.toolId,
-      state: "approved" /* APPROVED */,
-      scope: options.scope,
-      grantedAt: now,
-      expiresAt,
-      ttlMs: options.ttlMs,
-      sessionId: options.sessionId,
-      userId: options.userId,
-      context: options.context,
-      grantedBy,
-      reason: options.reason,
-      metadata: options.metadata
+    if (config === false || config === void 0) {
+      return { required: false };
+    }
+    return {
+      ...config,
+      required: config.required ?? true,
+      defaultScope: config.defaultScope ?? "session" /* SESSION */
     };
-    const key = this.buildKey(options.toolId, options.sessionId, options.userId, options.context);
-    const ttlSeconds = options.ttlMs ? Math.ceil(options.ttlMs / 1e3) : void 0;
-    await this.storage.set(key, JSON.stringify(record), { ttlSeconds });
-    return record;
   }
-  async revokeApproval(options) {
-    this.ensureInitialized();
-    const key = this.buildKey(options.toolId, options.sessionId, options.userId, options.context);
-    const exists = await this.storage.exists(key);
-    if (exists) {
-      await this.storage.delete(key);
-      return true;
-    }
-    return false;
+  isExpired(approval) {
+    if (!approval.expiresAt) return false;
+    return Date.now() > approval.expiresAt;
   }
-  async isApproved(toolId, sessionId, userId, context) {
-    this.ensureInitialized();
-    if (context) {
-      const contextKey = this.buildKey(toolId, sessionId, userId, context);
-      const contextValue = await this.storage.get(contextKey);
-      const contextApproval = this.parseRecord(contextValue);
-      if (contextApproval && contextApproval.state === "approved" /* APPROVED */ && !this.isExpired(contextApproval)) {
-        return true;
-      }
-    }
-    const sessionKey = this.buildKey(toolId, sessionId);
-    const sessionValue = await this.storage.get(sessionKey);
-    const sessionApproval = this.parseRecord(sessionValue);
-    if (sessionApproval && sessionApproval.state === "approved" /* APPROVED */ && !this.isExpired(sessionApproval)) {
-      return true;
-    }
-    if (userId) {
-      const userKey = this.buildKey(toolId, void 0, userId);
-      const userValue = await this.storage.get(userKey);
-      const userApproval = this.parseRecord(userValue);
-      if (userApproval && userApproval.state === "approved" /* APPROVED */ && !this.isExpired(userApproval)) {
-        return true;
-      }
-    }
-    return false;
+  /**
+   * The context this call is running in, as established by the SESSION (GHSA-r848-p7wf-96rc).
+   *
+   * Deliberately ignores `toolContext.input.context`. The only consumer of this value is
+   * `isPreApprovedContext`, which skips the approval prompt outright, so reading it from the
+   * arguments of the call being gated let a caller name its own pre-approved context and walk
+   * straight past the gate. Only `authInfo.extra.approvalContext`, which the server sets
+   * while authenticating, can say what context a call belongs to.
+   */
+  getCurrentContext(flowCtx) {
+    const ctx = flowCtx.state.toolContext?.tryGetContext?.();
+    const sessionContext = ctx?.authInfo?.extra?.["approvalContext"];
+    return this.isApprovalContext(sessionContext) ? sessionContext : void 0;
   }
-  async clearSessionApprovals(sessionId) {
-    this.ensureInitialized();
-    const escapedSessionId = escapePattern(sessionId);
-    const pattern = `*:session:${escapedSessionId}*`;
-    const keys = await this.storage.keys(pattern);
-    if (keys.length === 0) {
-      return 0;
+  isApprovalContext(value) {
+    return typeof value === "object" && value !== null && "type" in value && "identifier" in value && typeof value.type === "string" && typeof value.identifier === "string";
+  }
+  isPreApprovedContext(config, currentContext) {
+    if (!currentContext || !config.preApprovedContexts?.length) {
+      return false;
     }
-    return await this.storage.mdelete(keys);
+    return config.preApprovedContexts.some(
+      (preApproved) => preApproved.type === currentContext.type && preApproved.identifier === currentContext.identifier
+    );
   }
-  async clearExpiredApprovals() {
-    this.ensureInitialized();
-    const now = Date.now();
-    const keys = await this.storage.keys("*");
-    const values = await this.storage.mget(keys);
-    const keysToDelete = [];
-    for (let i = 0; i < keys.length; i++) {
-      const approval = this.parseRecord(values[i]);
-      if (approval && approval.expiresAt && approval.expiresAt <= now) {
-        keysToDelete.push(keys[i]);
-      }
-    }
-    if (keysToDelete.length > 0) {
-      return await this.storage.mdelete(keysToDelete);
-    }
-    return 0;
-  }
-  async getStats() {
-    this.ensureInitialized();
-    const byScope = {
-      ["session" /* SESSION */]: 0,
-      ["user" /* USER */]: 0,
-      ["time_limited" /* TIME_LIMITED */]: 0,
-      ["tool_specific" /* TOOL_SPECIFIC */]: 0,
-      ["context_specific" /* CONTEXT_SPECIFIC */]: 0
-    };
-    const byState = {
-      ["pending" /* PENDING */]: 0,
-      ["approved" /* APPROVED */]: 0,
-      ["denied" /* DENIED */]: 0,
-      ["expired" /* EXPIRED */]: 0
-    };
-    const keys = await this.storage.keys("*");
-    const values = await this.storage.mget(keys);
-    let total = 0;
-    for (const value of values) {
-      const approval = this.parseRecord(value);
-      if (approval) {
-        total++;
-        byScope[approval.scope]++;
-        byState[approval.state]++;
+  async handleApprovalRequired(flowCtx, config, existingApproval) {
+    const { tool } = flowCtx.state;
+    const message = config.approvalMessage ?? `Tool "${tool?.fullName}" requires approval to execute. Allow?`;
+    const isExpiredApproval = existingApproval ? this.isExpired(existingApproval) : false;
+    throw new ApprovalRequiredError({
+      toolId: tool?.fullName ?? "unknown",
+      state: isExpiredApproval ? "expired" : "pending",
+      message,
+      approvalOptions: {
+        allowedScopes: config.allowedScopes,
+        defaultScope: config.defaultScope,
+        maxTtlMs: config.maxTtlMs,
+        category: config.category,
+        riskLevel: config.riskLevel
       }
-    }
-    return {
-      totalApprovals: total,
-      byScope,
-      byState
-    };
-  }
-  async close() {
-    if (this.cleanupInterval) {
-      clearInterval(this.cleanupInterval);
-      this.cleanupInterval = void 0;
-    }
-    if (this.ownedStorage && this.storage) {
-      await this.storage.root.disconnect();
-    }
-    this.initialized = false;
+    });
   }
 };
-ApprovalStorageStore = __decorateClass([
-  Provider({
-    name: "provider:approval:store:storage",
-    description: "Storage-backed approval store (supports Memory, Redis, Vercel KV, Upstash)",
-    scope: ProviderScope.GLOBAL
+__decorateClass([
+  ToolHook.Will("execute", { priority: 100 })
+], ApprovalCheckPlugin.prototype, "checkApproval", 1);
+ApprovalCheckPlugin = __decorateClass([
+  Plugin({
+    name: "approval:check",
+    description: "Checks tool approval state before execution"
   })
-], ApprovalStorageStore);
-function createApprovalMemoryStore(options = {}) {
-  const memoryStorage = createMemoryStorage();
-  return new ApprovalStorageStore({
-    ...options,
-    storageInstance: memoryStorage
-  });
-}
+], ApprovalCheckPlugin);
 
 // plugins/plugin-approval/src/services/approval.service.ts
-import { Provider as Provider2, ProviderScope as ProviderScope2 } from "@frontmcp/sdk";
+import { Provider, ProviderScope } from "@frontmcp/sdk";
 var ApprovalService = class {
   constructor(store, sessionId, userId) {
     this.store = store;
@@ -794,10 +677,10 @@ var ApprovalService = class {
   }
 };
 ApprovalService = __decorateClass([
-  Provider2({
+  Provider({
     name: "provider:approval:service",
     description: "Service for managing tool approvals",
-    scope: ProviderScope2.CONTEXT
+    scope: ProviderScope.CONTEXT
   })
 ], ApprovalService);
 function createApprovalService(store, sessionId, userId) {
@@ -805,12 +688,12 @@ function createApprovalService(store, sessionId, userId) {
 }
 
 // plugins/plugin-approval/src/services/challenge.service.ts
-import { Provider as Provider3, ProviderScope as ProviderScope3 } from "@frontmcp/sdk";
+import { Provider as Provider2, ProviderScope as ProviderScope2 } from "@frontmcp/sdk";
 import {
   generatePkcePair,
   generateCodeChallenge,
-  createStorage as createStorage2,
-  createMemoryStorage as createMemoryStorage2
+  createStorage,
+  createMemoryStorage
 } from "@frontmcp/utils";
 var ChallengeService = class {
   storage;
@@ -834,7 +717,7 @@ var ChallengeService = class {
       this.storage = this.options.storageInstance.namespace(this.options.namespace);
       this.ownedStorage = false;
     } else {
-      const rootStorage = await createStorage2(this.options.storage);
+      const rootStorage = await createStorage(this.options.storage);
       this.storage = rootStorage.namespace(this.options.namespace);
       this.ownedStorage = true;
     }
@@ -944,10 +827,10 @@ var ChallengeService = class {
   }
 };
 ChallengeService = __decorateClass([
-  Provider3({
+  Provider2({
     name: "provider:approval:challenge-service",
     description: "PKCE challenge service for webhook approval flows",
-    scope: ProviderScope3.GLOBAL
+    scope: ProviderScope2.GLOBAL
   })
 ], ChallengeService);
 function generatePkcePairFromVerifier(codeVerifier) {
@@ -957,141 +840,279 @@ function generatePkcePairFromVerifier(codeVerifier) {
   };
 }
 function createMemoryChallengeService(options = {}) {
-  const memoryStorage = createMemoryStorage2();
+  const memoryStorage = createMemoryStorage();
   return new ChallengeService({
     ...options,
     storageInstance: memoryStorage
   });
 }
 
-// plugins/plugin-approval/src/approval.symbols.ts
-var ApprovalStoreToken = /* @__PURE__ */ Symbol.for(
-  "plugin:approval:store"
-);
-var ApprovalServiceToken = /* @__PURE__ */ Symbol.for(
-  "plugin:approval:service"
-);
-var ChallengeServiceToken = /* @__PURE__ */ Symbol.for(
-  "plugin:approval:challenge-service"
-);
-
-// plugins/plugin-approval/src/hooks/approval-check.hook.ts
-import { DynamicPlugin, Plugin, ToolHook } from "@frontmcp/sdk";
-var ApprovalCheckPlugin = class extends DynamicPlugin {
-  async checkApproval(flowCtx) {
-    const { tool, toolContext } = flowCtx.state;
-    if (!tool || !toolContext) return;
-    const metadata = tool.metadata;
-    const approvalConfig = this.resolveApprovalConfig(
-      metadata["approval"]
-    );
-    if (!approvalConfig.required) {
-      return;
-    }
-    if (approvalConfig.skipApproval) {
-      return;
-    }
-    const ctx = toolContext.tryGetContext?.();
-    const sessionId = ctx?.sessionId ?? "unknown";
-    const userId = this.getStringExtra(ctx?.authInfo?.extra, "userId") ?? this.getStringExtra(ctx?.authInfo?.extra, "sub") ?? ctx?.authInfo?.clientId;
-    const currentContext = this.getCurrentContext(flowCtx);
-    if (this.isPreApprovedContext(approvalConfig, currentContext)) {
-      return;
-    }
-    const approvalStore = this.get(ApprovalStoreToken);
-    const approval = await approvalStore.getApproval(tool.fullName, sessionId, userId);
-    if (approvalConfig.alwaysPrompt) {
-      await this.handleApprovalRequired(flowCtx, approvalConfig, approval);
+// plugins/plugin-approval/src/stores/approval-storage.store.ts
+import { Provider as Provider3, ProviderScope as ProviderScope3 } from "@frontmcp/sdk";
+import {
+  createMemoryStorage as createMemoryStorage2,
+  createStorage as createStorage2
+} from "@frontmcp/utils";
+function escapePattern(str) {
+  return str.replace(/[*?[\]\\]/g, "\\$&");
+}
+var ApprovalStorageStore = class {
+  storage;
+  options;
+  cleanupInterval;
+  initialized = false;
+  ownedStorage = false;
+  constructor(options = {}) {
+    this.options = {
+      storage: options.storage ?? { type: "auto" },
+      storageInstance: options.storageInstance,
+      namespace: options.namespace ?? "approval",
+      cleanupIntervalSeconds: options.cleanupIntervalSeconds ?? 60
+    };
+  }
+  /**
+   * Initialize the storage connection.
+   */
+  async initialize() {
+    if (this.initialized) {
       return;
     }
-    if (approval?.state === "approved" /* APPROVED */) {
-      if (!this.isExpired(approval)) {
-        return;
-      }
+    if (this.options.storageInstance) {
+      this.storage = this.options.storageInstance.namespace(this.options.namespace);
+      this.ownedStorage = false;
+    } else {
+      const rootStorage = await createStorage2(this.options.storage);
+      this.storage = rootStorage.namespace(this.options.namespace);
+      this.ownedStorage = true;
     }
-    if (approval?.state === "denied" /* DENIED */) {
-      throw new ApprovalRequiredError({
-        toolId: tool.fullName,
-        state: "denied",
-        message: `Tool "${tool.fullName}" execution denied.`
-      });
+    if (this.options.cleanupIntervalSeconds > 0) {
+      this.cleanupInterval = setInterval(() => {
+        void this.clearExpiredApprovals();
+      }, this.options.cleanupIntervalSeconds * 1e3);
+      this.cleanupInterval.unref?.();
     }
-    await this.handleApprovalRequired(flowCtx, approvalConfig, approval);
+    this.initialized = true;
   }
-  resolveApprovalConfig(config) {
-    if (config === true) {
-      return { required: true, defaultScope: "session" /* SESSION */ };
+  ensureInitialized() {
+    if (!this.initialized) {
+      throw new Error("ApprovalStorageStore not initialized. Call initialize() first.");
     }
-    if (config === false || config === void 0) {
-      return { required: false };
+  }
+  buildKey(toolId, sessionId, userId, context) {
+    const parts = [toolId];
+    if (sessionId) parts.push(`session:${sessionId}`);
+    if (userId) parts.push(`user:${userId}`);
+    if (context) parts.push(`ctx:${context.type}:${context.identifier}`);
+    return parts.join(":");
+  }
+  parseRecord(value) {
+    if (!value) return void 0;
+    try {
+      const parsed = JSON.parse(value);
+      const result = approvalRecordSchema.safeParse(parsed);
+      if (!result.success) {
+        return void 0;
+      }
+      return result.data;
+    } catch {
+      return void 0;
     }
-    return {
-      ...config,
-      required: config.required ?? true,
-      defaultScope: config.defaultScope ?? "session" /* SESSION */
-    };
   }
   isExpired(approval) {
-    if (!approval.expiresAt) return false;
-    return Date.now() > approval.expiresAt;
+    return approval.expiresAt !== void 0 && Date.now() > approval.expiresAt;
   }
   /**
-   * The context this call is running in, as established by the SESSION (GHSA-r848-p7wf-96rc).
-   *
-   * Deliberately ignores `toolContext.input.context`. The only consumer of this value is
-   * `isPreApprovedContext`, which skips the approval prompt outright, so reading it from the
-   * arguments of the call being gated let a caller name its own pre-approved context and walk
-   * straight past the gate. Only `authInfo.extra.approvalContext`, which the server sets
-   * while authenticating, can say what context a call belongs to.
+   * The session record, else the user record, except that a denial in either scope wins,
+   * so a session approval cannot mask a user-level denial.
    */
-  getCurrentContext(flowCtx) {
-    const ctx = flowCtx.state.toolContext?.tryGetContext?.();
-    const sessionContext = ctx?.authInfo?.extra?.["approvalContext"];
-    return this.isApprovalContext(sessionContext) ? sessionContext : void 0;
+  async getApproval(toolId, sessionId, userId) {
+    this.ensureInitialized();
+    const keys = [this.buildKey(toolId, sessionId)];
+    if (userId) {
+      keys.push(this.buildKey(toolId, void 0, userId));
+    }
+    const activeRecords = [];
+    for (const key of keys) {
+      const record = this.parseRecord(await this.storage.get(key));
+      if (record && !this.isExpired(record)) {
+        activeRecords.push(record);
+      }
+    }
+    return activeRecords.find((record) => record.state === "denied" /* DENIED */) ?? activeRecords[0];
   }
-  isApprovalContext(value) {
-    return typeof value === "object" && value !== null && "type" in value && "identifier" in value && typeof value.type === "string" && typeof value.identifier === "string";
+  async queryApprovals(query) {
+    this.ensureInitialized();
+    const results = [];
+    const pattern = query.toolId ? `${query.toolId}:*` : "*";
+    const keys = await this.storage.keys(pattern);
+    const values = await this.storage.mget(keys);
+    for (const value of values) {
+      const approval = this.parseRecord(value);
+      if (!approval) continue;
+      if (!query.includeExpired && this.isExpired(approval)) {
+        continue;
+      }
+      if (query.toolId && approval.toolId !== query.toolId) continue;
+      if (query.toolIds && !query.toolIds.includes(approval.toolId)) continue;
+      if (query.scope && approval.scope !== query.scope) continue;
+      if (query.scopes && !query.scopes.includes(approval.scope)) continue;
+      if (query.state && approval.state !== query.state) continue;
+      if (query.states && !query.states.includes(approval.state)) continue;
+      if (query.sessionId && approval.sessionId !== query.sessionId) continue;
+      if (query.userId && approval.userId !== query.userId) continue;
+      if (query.context) {
+        if (!approval.context || approval.context.type !== query.context.type || approval.context.identifier !== query.context.identifier) {
+          continue;
+        }
+      }
+      results.push(approval);
+    }
+    return results;
   }
-  getStringExtra(extra, key) {
-    if (!extra) return void 0;
-    const value = extra[key];
-    return typeof value === "string" ? value : void 0;
+  async grantApproval(options) {
+    this.ensureInitialized();
+    const now = Date.now();
+    const expiresAt = options.ttlMs ? now + options.ttlMs : void 0;
+    const grantedBy = normalizeGrantor(options.grantedBy);
+    const record = {
+      toolId: options.toolId,
+      state: "approved" /* APPROVED */,
+      scope: options.scope,
+      grantedAt: now,
+      expiresAt,
+      ttlMs: options.ttlMs,
+      sessionId: options.sessionId,
+      userId: options.userId,
+      context: options.context,
+      grantedBy,
+      reason: options.reason,
+      metadata: options.metadata
+    };
+    const key = this.buildKey(options.toolId, options.sessionId, options.userId, options.context);
+    const ttlSeconds = options.ttlMs ? Math.ceil(options.ttlMs / 1e3) : void 0;
+    await this.storage.set(key, JSON.stringify(record), { ttlSeconds });
+    return record;
   }
-  isPreApprovedContext(config, currentContext) {
-    if (!currentContext || !config.preApprovedContexts?.length) {
-      return false;
+  async revokeApproval(options) {
+    this.ensureInitialized();
+    const key = this.buildKey(options.toolId, options.sessionId, options.userId, options.context);
+    const exists = await this.storage.exists(key);
+    if (exists) {
+      await this.storage.delete(key);
+      return true;
     }
-    return config.preApprovedContexts.some(
-      (preApproved) => preApproved.type === currentContext.type && preApproved.identifier === currentContext.identifier
-    );
+    return false;
   }
-  async handleApprovalRequired(flowCtx, config, existingApproval) {
-    const { tool } = flowCtx.state;
-    const message = config.approvalMessage ?? `Tool "${tool?.fullName}" requires approval to execute. Allow?`;
-    const isExpiredApproval = existingApproval ? this.isExpired(existingApproval) : false;
-    throw new ApprovalRequiredError({
-      toolId: tool?.fullName ?? "unknown",
-      state: isExpiredApproval ? "expired" : "pending",
-      message,
-      approvalOptions: {
-        allowedScopes: config.allowedScopes,
-        defaultScope: config.defaultScope,
-        maxTtlMs: config.maxTtlMs,
-        category: config.category,
-        riskLevel: config.riskLevel
+  async isApproved(toolId, sessionId, userId, context) {
+    this.ensureInitialized();
+    if (context) {
+      const contextKey = this.buildKey(toolId, sessionId, userId, context);
+      const contextValue = await this.storage.get(contextKey);
+      const contextApproval = this.parseRecord(contextValue);
+      if (contextApproval && contextApproval.state === "approved" /* APPROVED */ && !this.isExpired(contextApproval)) {
+        return true;
       }
-    });
+    }
+    const sessionKey = this.buildKey(toolId, sessionId);
+    const sessionValue = await this.storage.get(sessionKey);
+    const sessionApproval = this.parseRecord(sessionValue);
+    if (sessionApproval && sessionApproval.state === "approved" /* APPROVED */ && !this.isExpired(sessionApproval)) {
+      return true;
+    }
+    if (userId) {
+      const userKey = this.buildKey(toolId, void 0, userId);
+      const userValue = await this.storage.get(userKey);
+      const userApproval = this.parseRecord(userValue);
+      if (userApproval && userApproval.state === "approved" /* APPROVED */ && !this.isExpired(userApproval)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  async clearSessionApprovals(sessionId) {
+    this.ensureInitialized();
+    const escapedSessionId = escapePattern(sessionId);
+    const pattern = `*:session:${escapedSessionId}*`;
+    const keys = await this.storage.keys(pattern);
+    if (keys.length === 0) {
+      return 0;
+    }
+    return await this.storage.mdelete(keys);
+  }
+  async clearExpiredApprovals() {
+    this.ensureInitialized();
+    const now = Date.now();
+    const keys = await this.storage.keys("*");
+    const values = await this.storage.mget(keys);
+    const keysToDelete = [];
+    for (let i = 0; i < keys.length; i++) {
+      const approval = this.parseRecord(values[i]);
+      if (approval && approval.expiresAt && approval.expiresAt <= now) {
+        keysToDelete.push(keys[i]);
+      }
+    }
+    if (keysToDelete.length > 0) {
+      return await this.storage.mdelete(keysToDelete);
+    }
+    return 0;
+  }
+  async getStats() {
+    this.ensureInitialized();
+    const byScope = {
+      ["session" /* SESSION */]: 0,
+      ["user" /* USER */]: 0,
+      ["time_limited" /* TIME_LIMITED */]: 0,
+      ["tool_specific" /* TOOL_SPECIFIC */]: 0,
+      ["context_specific" /* CONTEXT_SPECIFIC */]: 0
+    };
+    const byState = {
+      ["pending" /* PENDING */]: 0,
+      ["approved" /* APPROVED */]: 0,
+      ["denied" /* DENIED */]: 0,
+      ["expired" /* EXPIRED */]: 0
+    };
+    const keys = await this.storage.keys("*");
+    const values = await this.storage.mget(keys);
+    let total = 0;
+    for (const value of values) {
+      const approval = this.parseRecord(value);
+      if (approval) {
+        total++;
+        byScope[approval.scope]++;
+        byState[approval.state]++;
+      }
+    }
+    return {
+      totalApprovals: total,
+      byScope,
+      byState
+    };
+  }
+  async close() {
+    if (this.cleanupInterval) {
+      clearInterval(this.cleanupInterval);
+      this.cleanupInterval = void 0;
+    }
+    if (this.ownedStorage && this.storage) {
+      await this.storage.root.disconnect();
+    }
+    this.initialized = false;
   }
 };
-__decorateClass([
-  ToolHook.Will("execute", { priority: 100 })
-], ApprovalCheckPlugin.prototype, "checkApproval", 1);
-ApprovalCheckPlugin = __decorateClass([
-  Plugin({
-    name: "approval:check",
-    description: "Checks tool approval state before execution"
+ApprovalStorageStore = __decorateClass([
+  Provider3({
+    name: "provider:approval:store:storage",
+    description: "Storage-backed approval store (supports Memory, Redis, Vercel KV, Upstash)",
+    scope: ProviderScope3.GLOBAL
   })
-], ApprovalCheckPlugin);
+], ApprovalStorageStore);
+function createApprovalMemoryStore(options = {}) {
+  const memoryStorage = createMemoryStorage2();
+  return new ApprovalStorageStore({
+    ...options,
+    storageInstance: memoryStorage
+  });
+}
 
 // plugins/plugin-approval/src/approval.plugin.ts
 var ApprovalPlugin = class extends DynamicPlugin2 {
@@ -1103,12 +1124,6 @@ var ApprovalPlugin = class extends DynamicPlugin2 {
       ...options
     };
   }
-  /**
-   * Get plugin metadata including nested plugins.
-   */
-  static getPluginMetadata(_options) {
-    return { plugins: [ApprovalCheckPlugin] };
-  }
 };
 __publicField(ApprovalPlugin, "defaultOptions", {
   namespace: "approval",
@@ -1164,8 +1179,8 @@ __publicField(ApprovalPlugin, "dynamicProviders", (options) => {
     scope: ProviderScope4.CONTEXT,
     inject: () => [ApprovalStoreToken, FRONTMCP_CONTEXT],
     useFactory: (store, ctx) => {
-      const userId = ctx.authInfo?.extra?.["userId"] ?? ctx.authInfo?.extra?.["sub"] ?? ctx.authInfo?.clientId;
-      return createApprovalService(store, ctx.sessionId, userId);
+      const { sessionId, userId } = resolveApprovalIdentity(ctx);
+      return createApprovalService(store, sessionId, userId);
     }
   });
   return providers;
@@ -1174,6 +1189,7 @@ ApprovalPlugin = __decorateClass([
   Plugin2({
     name: "approval",
     description: "Tool authorization workflow with PKCE webhook security",
+    plugins: [ApprovalCheckPlugin],
     contextExtensions: [
       {
         property: "approval",