@frontmcp/plugin-approval 1.8.5 → 1.8.7

package/README.md

@@ -72,6 +72,24 @@ class DangerousTool extends ToolContext {
 }
 ```
 
+A refused call reaches the client as an error result whose text is exactly the tool's `approvalMessage` and whose
+`_meta.code` is `APPROVAL_REQUIRED`, in production too: the approval errors extend `PublicMcpError`.
+
+A grant made through `this.approval` records the signed-in caller as its grantor, `userGrantor(<user id>)`
+(`{ source: 'user', identifier, method: 'interactive' }`), or `{ source: 'user' }` when there is no signed-in user
+(an anonymous `anon:` subject included). Pass `grantedBy` to record something else:
+
+```typescript
+import { policyGrantor, userGrantor } from '@frontmcp/plugin-approval';
+
+await this.approval.grantSessionApproval('ops:deploy', { grantedBy: policyGrantor('safe-list') });
+await this.approval.grantUserApproval('ops:deploy', {
+  grantedBy: userGrantor('user-123', 'Jane Doe', { method: 'interactive' }),
+});
+```
+
+`revokeApproval()` records `revokedBy` by the same rule.
+
 ### Approval Scopes
 
 | Scope              | Description                                 |

package/approval/errors.d.ts

@@ -1,17 +1,18 @@
 /**
  * Error classes for approval operations.
  *
- * These are standalone error classes that can be extended by plugins
- * for MCP-specific error handling.
+ * They are public MCP errors: a refusal is an answer for the caller, so its message reaches the
+ * client as written, in every environment, instead of being wrapped as an internal server error.
  *
- * @module @frontmcp/utils/approval
+ * @module @frontmcp/plugin-approval
  */
+import { PublicMcpError } from '@frontmcp/sdk';
 import type { ApprovalScope } from './types';
 /**
  * Base class for approval-related errors.
  */
-export declare class ApprovalError extends Error {
-    constructor(message: string);
+export declare class ApprovalError extends PublicMcpError {
+    constructor(message: string, code?: string, statusCode?: number);
 }
 /**
  * Error thrown when tool approval is required but not granted.

package/approval/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/approval/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,aAAa;aAEpC,OAAO,EAAE;QACvB,sBAAsB;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,6BAA6B;QAC7B,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;QACxC,0BAA0B;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,0CAA0C;QAC1C,eAAe,CAAC,EAAE;YAChB,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;YAChC,YAAY,CAAC,EAAE,aAAa,CAAC;YAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;KACH;gBAfe,OAAO,EAAE;QACvB,sBAAsB;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,6BAA6B;QAC7B,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;QACxC,0BAA0B;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,0CAA0C;QAC1C,eAAe,CAAC,EAAE;YAChB,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;YAChC,YAAY,CAAC,EAAE,aAAa,CAAC;YAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;KACH;IAMH;;OAEG;IACH,cAAc;;;;;;;;gCAfQ,aAAa,EAAE;+BAChB,aAAa;2BACjB,MAAM;2BACN,MAAM;4BACL,MAAM;;;;CAuBzB;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,aAAa;aAErC,SAAS,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO;aACvC,MAAM,EAAE,MAAM;gBADd,SAAS,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,EACvC,MAAM,EAAE,MAAM;IAMhC;;OAEG;IACH,cAAc;;;;;;;;CAUf;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,aAAa;aAE3C,cAAc,EAAE,aAAa;aAC7B,aAAa,EAAE,aAAa,EAAE;gBAD9B,cAAc,EAAE,aAAa,EAC7B,aAAa,EAAE,aAAa,EAAE;IAShD;;OAEG;IACH,cAAc;;;;;;;;;CAWf;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,aAAa;aAEnC,MAAM,EAAE,MAAM;aACd,SAAS,EAAE,MAAM;gBADjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM;IAMnC;;OAEG;IACH,cAAc;;;;;;;;;CAWf;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,aAAa;aAEvC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc;gBAA5D,MAAM,GAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,cAA0B,EACxF,OAAO,CAAC,EAAE,MAAM;IAMlB;;OAEG;IACH,cAAc;;;;;;;;CAUf"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/approval/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C;;GAEG;AACH,qBAAa,aAAc,SAAQ,cAAc;gBACnC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAsB,EAAE,UAAU,SAAM;CAI1E;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,aAAa;aAEpC,OAAO,EAAE;QACvB,sBAAsB;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,6BAA6B;QAC7B,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;QACxC,0BAA0B;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,0CAA0C;QAC1C,eAAe,CAAC,EAAE;YAChB,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;YAChC,YAAY,CAAC,EAAE,aAAa,CAAC;YAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;KACH;gBAfe,OAAO,EAAE;QACvB,sBAAsB;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,6BAA6B;QAC7B,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;QACxC,0BAA0B;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,0CAA0C;QAC1C,eAAe,CAAC,EAAE;YAChB,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;YAChC,YAAY,CAAC,EAAE,aAAa,CAAC;YAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;KACH;IAMH;;OAEG;IACH,cAAc;;;;;;;;gCAfQ,aAAa,EAAE;+BAChB,aAAa;2BACjB,MAAM;2BACN,MAAM;4BACL,MAAM;;;;CAuBzB;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,aAAa;aAErC,SAAS,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO;aACvC,MAAM,EAAE,MAAM;gBADd,SAAS,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,EACvC,MAAM,EAAE,MAAM;IAMhC;;OAEG;IACH,cAAc;;;;;;;;CAUf;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,aAAa;aAE3C,cAAc,EAAE,aAAa;aAC7B,aAAa,EAAE,aAAa,EAAE;gBAD9B,cAAc,EAAE,aAAa,EAC7B,aAAa,EAAE,aAAa,EAAE;IAWhD;;OAEG;IACH,cAAc;;;;;;;;;CAWf;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,aAAa;aAEnC,MAAM,EAAE,MAAM;aACd,SAAS,EAAE,MAAM;gBADjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM;IAMnC;;OAEG;IACH,cAAc;;;;;;;;;CAWf;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,aAAa;aAEvC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc;gBAA5D,MAAM,GAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,cAA0B,EACxF,OAAO,CAAC,EAAE,MAAM;IAMlB;;OAEG;IACH,cAAc;;;;;;;;CAUf"}

package/esm/index.mjs

@@ -27,9 +27,10 @@ import {
 } from "@frontmcp/sdk";
 
 // plugins/plugin-approval/src/approval/errors.ts
-var ApprovalError = class extends Error {
-  constructor(message) {
-    super(message);
+import { PublicMcpError } from "@frontmcp/sdk";
+var ApprovalError = class extends PublicMcpError {
+  constructor(message, code = "APPROVAL_REQUIRED", statusCode = 403) {
+    super(message, code, statusCode);
     this.name = "ApprovalError";
   }
 };
@@ -59,7 +60,7 @@ var ApprovalRequiredError = class extends ApprovalError {
 };
 var ApprovalOperationError = class extends ApprovalError {
   constructor(operation, reason) {
-    super(`Approval ${operation} failed: ${reason}`);
+    super(`Approval ${operation} failed: ${reason}`, "APPROVAL_OPERATION_FAILED", 400);
     this.operation = operation;
     this.reason = reason;
     this.name = "ApprovalOperationError";
@@ -84,7 +85,9 @@ var ApprovalOperationError = class extends ApprovalError {
 var ApprovalScopeNotAllowedError = class extends ApprovalError {
   constructor(requestedScope, allowedScopes) {
     super(
-      `Approval scope '${requestedScope}' is not allowed for this tool. Allowed scopes: ${allowedScopes.join(", ")}`
+      `Approval scope '${requestedScope}' is not allowed for this tool. Allowed scopes: ${allowedScopes.join(", ")}`,
+      "APPROVAL_SCOPE_NOT_ALLOWED",
+      400
     );
     this.requestedScope = requestedScope;
     this.allowedScopes = allowedScopes;
@@ -110,7 +113,7 @@ var ApprovalScopeNotAllowedError = class extends ApprovalError {
 };
 var ApprovalExpiredError = class extends ApprovalError {
   constructor(toolId, expiredAt) {
-    super(`Approval for tool '${toolId}' expired at ${new Date(expiredAt).toISOString()}`);
+    super(`Approval for tool '${toolId}' expired at ${new Date(expiredAt).toISOString()}`, "APPROVAL_EXPIRED", 403);
     this.toolId = toolId;
     this.expiredAt = expiredAt;
     this.name = "ApprovalExpiredError";
@@ -135,7 +138,7 @@ var ApprovalExpiredError = class extends ApprovalError {
 };
 var ChallengeValidationError = class extends ApprovalError {
   constructor(reason = "invalid", message) {
-    super(message ?? `PKCE challenge validation failed: ${reason}`);
+    super(message ?? `PKCE challenge validation failed: ${reason}`, "CHALLENGE_VALIDATION_FAILED", 400);
     this.reason = reason;
     this.name = "ChallengeValidationError";
   }
@@ -589,7 +592,7 @@ ApprovalCheckPlugin = __decorateClass([
 ], ApprovalCheckPlugin);
 
 // plugins/plugin-approval/src/services/approval.service.ts
-import { Provider, ProviderScope } from "@frontmcp/sdk";
+import { isAnonymousSubject, Provider, ProviderScope } from "@frontmcp/sdk";
 var ApprovalService = class {
   constructor(store, sessionId, userId, requirementOf = () => void 0) {
     this.store = store;
@@ -605,6 +608,27 @@ var ApprovalService = class {
   checkGrant(toolId, scope, ttlMs) {
     return checkGrantAgainstPolicy(toolId, scope, ttlMs, this.requirementOf(toolId));
   }
+  /** The caller's user id, when it names a principal: an anonymous subject (`anon:…`) names no one. */
+  get signedInUserId() {
+    return this.userId && !isAnonymousSubject(this.userId) ? this.userId : void 0;
+  }
+  /**
+   * Who a grant is recorded as when the call names no one: the signed-in user whose tool call made it.
+   * It used to be `'policy'`, so an audit trail showed every approval a user gave as a policy's.
+   * Without a signed-in user it is a user with no identifier.
+   *
+   * The method is `'implicit'`: a tool that grants through `this.approval` asked no one, so the grant
+   * is not an `'interactive'` answer. A tool that did ask passes `grantedBy: userGrantor(id)`.
+   */
+  defaultGrantor() {
+    const userId = this.signedInUserId;
+    return userId ? userGrantor(userId, void 0, { method: "implicit" }) : { source: "user", method: "implicit" };
+  }
+  /** Who a revocation is recorded as when the call names no one, by the same rule as a grant. */
+  defaultRevoker() {
+    const userId = this.signedInUserId;
+    return userId ? { source: "user", identifier: userId, method: "implicit" } : { source: "user", method: "implicit" };
+  }
   // ─────────────────────────────────────────────────────────────────────────────
   // Query Methods
   // ─────────────────────────────────────────────────────────────────────────────
@@ -660,6 +684,13 @@ var ApprovalService = class {
       (record) => record.sessionId === this.sessionId || this.userId !== void 0 && record.userId === this.userId
     );
   }
+  /**
+   * The caller's recent revocations of a tool, newest last: each is the approval that was revoked,
+   * with `revokedBy`, `revokedAt` and `revocationReason`. Empty when the store keeps no revocations.
+   */
+  async getRevocations(toolId) {
+    return await this.store.getRevocations?.(toolId, this.sessionId, this.userId) ?? [];
+  }
   // ─────────────────────────────────────────────────────────────────────────────
   // Grant Methods
   // ─────────────────────────────────────────────────────────────────────────────
@@ -673,7 +704,7 @@ var ApprovalService = class {
       scope: "session" /* SESSION */,
       ttlMs,
       sessionId: this.sessionId,
-      grantedBy: options.grantedBy ?? "policy",
+      grantedBy: options.grantedBy ?? this.defaultGrantor(),
       reason: options.reason,
       metadata: options.metadata
     });
@@ -691,7 +722,7 @@ var ApprovalService = class {
       scope: "user" /* USER */,
       ttlMs,
       userId: this.userId,
-      grantedBy: options.grantedBy ?? "policy",
+      grantedBy: options.grantedBy ?? this.defaultGrantor(),
       reason: options.reason,
       metadata: options.metadata
     });
@@ -707,7 +738,7 @@ var ApprovalService = class {
       ttlMs,
       sessionId: this.sessionId,
       userId: this.userId,
-      grantedBy: options.grantedBy ?? "policy",
+      grantedBy: options.grantedBy ?? this.defaultGrantor(),
       reason: options.reason,
       metadata: options.metadata
     });
@@ -724,7 +755,7 @@ var ApprovalService = class {
       context,
       sessionId: this.sessionId,
       userId: this.userId,
-      grantedBy: options.grantedBy ?? "policy",
+      grantedBy: options.grantedBy ?? this.defaultGrantor(),
       reason: options.reason,
       metadata: options.metadata
     });
@@ -741,7 +772,7 @@ var ApprovalService = class {
       toolId,
       sessionId: this.sessionId,
       userId: this.userId,
-      revokedBy: options.revokedBy ?? "policy",
+      revokedBy: options.revokedBy ?? this.defaultRevoker(),
       reason: options.reason
     });
   }
@@ -927,14 +958,18 @@ function createMemoryChallengeService(options = {}) {
 import { Provider as Provider3, ProviderScope as ProviderScope3 } from "@frontmcp/sdk";
 import {
   createMemoryStorage as createMemoryStorage2,
+  createNamespacedStorage,
   createStorage as createStorage2
 } from "@frontmcp/utils";
 function escapePattern(str) {
   return str.replace(/[*?[\]\\]/g, "\\$&");
 }
+var REVOCATION_RETENTION_SECONDS = 24 * 60 * 60;
 var TIME_LIMITED_KEY_SEGMENT = `scope:${"time_limited" /* TIME_LIMITED */}`;
 var ApprovalStorageStore = class {
   storage;
+  /** Revoked approvals live beside the live ones, in a namespace no live-approval query scans. */
+  revocationStorage;
   options;
   cleanupInterval;
   initialized = false;
@@ -970,6 +1005,13 @@ var ApprovalStorageStore = class {
     }
     this.initialized = true;
   }
+  get revocations() {
+    this.revocationStorage ??= createNamespacedStorage(
+      this.storage.root,
+      `${this.storage.prefix.replace(/:$/, "")}-revoked`
+    );
+    return this.revocationStorage;
+  }
   ensureInitialized() {
     if (!this.initialized) {
       throw new Error("ApprovalStorageStore not initialized. Call initialize() first.");
@@ -1131,27 +1173,43 @@ var ApprovalStorageStore = class {
     const keys = await this.storage.keys(`${escapePattern(toolId)}:*`);
     const values = await this.storage.mget(keys);
     const keysToDelete = [];
+    const revoked = /* @__PURE__ */ new Map();
     for (let i = 0; i < keys.length; i++) {
       const record = this.parseRecord(values[i]);
       if (!record || record.toolId !== toolId || record.state === "denied" /* DENIED */) continue;
+      const matches = keysToDelete.length;
       if (context) {
         const sameSession = sessionId !== void 0 && record.sessionId === sessionId;
         if (record.context?.type === context.type && record.context.identifier === context.identifier && (!sessionId || sameSession) && // A context approval granted to the session before it had a user applies to that user too.
         (!userId || record.userId === userId || sameSession && record.userId === void 0)) {
           keysToDelete.push(keys[i]);
         }
-        continue;
-      }
-      if (sessionId && record.sessionId === sessionId || userId && record.userId === userId) {
+      } else if (sessionId && record.sessionId === sessionId || userId && record.userId === userId) {
         keysToDelete.push(keys[i]);
       }
+      if (keysToDelete.length > matches) revoked.set(keys[i], record);
     }
     if (keysToDelete.length === 0) {
       return false;
     }
+    const revokedAt = Date.now();
+    const revokedBy = normalizeRevoker(options.revokedBy);
+    for (const [key, record] of revoked) {
+      const entry = { ...record, revokedAt, revokedBy, revocationReason: options.reason };
+      await this.revocations.set(key, JSON.stringify(entry), { ttlSeconds: REVOCATION_RETENTION_SECONDS });
+    }
     await this.storage.mdelete(keysToDelete);
     return true;
   }
+  async getRevocations(toolId, sessionId, userId, context) {
+    this.ensureInitialized();
+    const records = [];
+    for (const key of this.callerKeys(toolId, sessionId, userId, context)) {
+      const record = this.parseRecord(await this.revocations.get(key));
+      if (record && record.toolId === toolId) records.push(record);
+    }
+    return records.sort((a, b) => (a.revokedAt ?? 0) - (b.revokedAt ?? 0));
+  }
   async isApproved(toolId, sessionId, userId, context) {
     const approval = await this.getApproval(toolId, sessionId, userId, context);
     return approval?.state === "approved" /* APPROVED */;
@@ -1227,6 +1285,7 @@ var ApprovalStorageStore = class {
     if (this.ownedStorage && this.storage) {
       await this.storage.root.disconnect();
     }
+    this.revocationStorage = void 0;
     this.initialized = false;
   }
 };

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-approval",
-  "version": "1.8.5",
+  "version": "1.8.7",
   "description": "Approval plugin for FrontMCP - tool authorization workflow with PKCE webhook security",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.8.5",
-    "@frontmcp/utils": "1.8.5",
+    "@frontmcp/sdk": "1.8.7",
+    "@frontmcp/utils": "1.8.7",
     "ioredis": "^5.8.0",
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.5",
+    "@frontmcp/lazy-zod": "1.8.7",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {

package/index.js

@@ -76,12 +76,13 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // plugins/plugin-approval/src/approval.plugin.ts
-var import_sdk5 = require("@frontmcp/sdk");
+var import_sdk6 = require("@frontmcp/sdk");
 
 // plugins/plugin-approval/src/approval/errors.ts
-var ApprovalError = class extends Error {
-  constructor(message) {
-    super(message);
+var import_sdk = require("@frontmcp/sdk");
+var ApprovalError = class extends import_sdk.PublicMcpError {
+  constructor(message, code = "APPROVAL_REQUIRED", statusCode = 403) {
+    super(message, code, statusCode);
     this.name = "ApprovalError";
   }
 };
@@ -111,7 +112,7 @@ var ApprovalRequiredError = class extends ApprovalError {
 };
 var ApprovalOperationError = class extends ApprovalError {
   constructor(operation, reason) {
-    super(`Approval ${operation} failed: ${reason}`);
+    super(`Approval ${operation} failed: ${reason}`, "APPROVAL_OPERATION_FAILED", 400);
     this.operation = operation;
     this.reason = reason;
     this.name = "ApprovalOperationError";
@@ -136,7 +137,9 @@ var ApprovalOperationError = class extends ApprovalError {
 var ApprovalScopeNotAllowedError = class extends ApprovalError {
   constructor(requestedScope, allowedScopes) {
     super(
-      `Approval scope '${requestedScope}' is not allowed for this tool. Allowed scopes: ${allowedScopes.join(", ")}`
+      `Approval scope '${requestedScope}' is not allowed for this tool. Allowed scopes: ${allowedScopes.join(", ")}`,
+      "APPROVAL_SCOPE_NOT_ALLOWED",
+      400
     );
     this.requestedScope = requestedScope;
     this.allowedScopes = allowedScopes;
@@ -162,7 +165,7 @@ var ApprovalScopeNotAllowedError = class extends ApprovalError {
 };
 var ApprovalExpiredError = class extends ApprovalError {
   constructor(toolId, expiredAt) {
-    super(`Approval for tool '${toolId}' expired at ${new Date(expiredAt).toISOString()}`);
+    super(`Approval for tool '${toolId}' expired at ${new Date(expiredAt).toISOString()}`, "APPROVAL_EXPIRED", 403);
     this.toolId = toolId;
     this.expiredAt = expiredAt;
     this.name = "ApprovalExpiredError";
@@ -187,7 +190,7 @@ var ApprovalExpiredError = class extends ApprovalError {
 };
 var ChallengeValidationError = class extends ApprovalError {
   constructor(reason = "invalid", message) {
-    super(message ?? `PKCE challenge validation failed: ${reason}`);
+    super(message ?? `PKCE challenge validation failed: ${reason}`, "CHALLENGE_VALIDATION_FAILED", 400);
     this.reason = reason;
     this.name = "ChallengeValidationError";
   }
@@ -304,7 +307,7 @@ var ChallengeServiceToken = /* @__PURE__ */ Symbol.for(
 );
 
 // plugins/plugin-approval/src/hooks/approval-check.hook.ts
-var import_sdk = require("@frontmcp/sdk");
+var import_sdk2 = require("@frontmcp/sdk");
 
 // plugins/plugin-approval/src/approval/schemas.ts
 var import_lazy_zod = require("@frontmcp/lazy-zod");
@@ -524,7 +527,7 @@ function isApiGrantor(grantor) {
 
 // plugins/plugin-approval/src/hooks/approval-check.hook.ts
 var passedApprovalStores = /* @__PURE__ */ new WeakMap();
-var ApprovalCheckPlugin = class extends import_sdk.DynamicPlugin {
+var ApprovalCheckPlugin = class extends import_sdk2.DynamicPlugin {
   async checkApproval(flowCtx) {
     const { tool, toolContext } = flowCtx.state;
     if (!tool || !toolContext) return;
@@ -629,10 +632,10 @@ var ApprovalCheckPlugin = class extends import_sdk.DynamicPlugin {
   }
 };
 __decorateClass([
-  import_sdk.ToolHook.Will("execute", { priority: 100, appliesTo: "uncovered-apps" })
+  import_sdk2.ToolHook.Will("execute", { priority: 100, appliesTo: "uncovered-apps" })
 ], ApprovalCheckPlugin.prototype, "checkApproval", 1);
 ApprovalCheckPlugin = __decorateClass([
-  (0, import_sdk.Plugin)({
+  (0, import_sdk2.Plugin)({
     name: "approval:check",
     description: "Checks tool approval state before execution",
     // A server where a tool or agent declares `approval` and this gate does not reach it refuses to start.
@@ -641,7 +644,7 @@ ApprovalCheckPlugin = __decorateClass([
 ], ApprovalCheckPlugin);
 
 // plugins/plugin-approval/src/services/approval.service.ts
-var import_sdk2 = require("@frontmcp/sdk");
+var import_sdk3 = require("@frontmcp/sdk");
 var ApprovalService = class {
   constructor(store, sessionId, userId, requirementOf = () => void 0) {
     this.store = store;
@@ -657,6 +660,27 @@ var ApprovalService = class {
   checkGrant(toolId, scope, ttlMs) {
     return checkGrantAgainstPolicy(toolId, scope, ttlMs, this.requirementOf(toolId));
   }
+  /** The caller's user id, when it names a principal: an anonymous subject (`anon:…`) names no one. */
+  get signedInUserId() {
+    return this.userId && !(0, import_sdk3.isAnonymousSubject)(this.userId) ? this.userId : void 0;
+  }
+  /**
+   * Who a grant is recorded as when the call names no one: the signed-in user whose tool call made it.
+   * It used to be `'policy'`, so an audit trail showed every approval a user gave as a policy's.
+   * Without a signed-in user it is a user with no identifier.
+   *
+   * The method is `'implicit'`: a tool that grants through `this.approval` asked no one, so the grant
+   * is not an `'interactive'` answer. A tool that did ask passes `grantedBy: userGrantor(id)`.
+   */
+  defaultGrantor() {
+    const userId = this.signedInUserId;
+    return userId ? userGrantor(userId, void 0, { method: "implicit" }) : { source: "user", method: "implicit" };
+  }
+  /** Who a revocation is recorded as when the call names no one, by the same rule as a grant. */
+  defaultRevoker() {
+    const userId = this.signedInUserId;
+    return userId ? { source: "user", identifier: userId, method: "implicit" } : { source: "user", method: "implicit" };
+  }
   // ─────────────────────────────────────────────────────────────────────────────
   // Query Methods
   // ─────────────────────────────────────────────────────────────────────────────
@@ -712,6 +736,13 @@ var ApprovalService = class {
       (record) => record.sessionId === this.sessionId || this.userId !== void 0 && record.userId === this.userId
     );
   }
+  /**
+   * The caller's recent revocations of a tool, newest last: each is the approval that was revoked,
+   * with `revokedBy`, `revokedAt` and `revocationReason`. Empty when the store keeps no revocations.
+   */
+  async getRevocations(toolId) {
+    return await this.store.getRevocations?.(toolId, this.sessionId, this.userId) ?? [];
+  }
   // ─────────────────────────────────────────────────────────────────────────────
   // Grant Methods
   // ─────────────────────────────────────────────────────────────────────────────
@@ -725,7 +756,7 @@ var ApprovalService = class {
       scope: "session" /* SESSION */,
       ttlMs,
       sessionId: this.sessionId,
-      grantedBy: options.grantedBy ?? "policy",
+      grantedBy: options.grantedBy ?? this.defaultGrantor(),
       reason: options.reason,
       metadata: options.metadata
     });
@@ -743,7 +774,7 @@ var ApprovalService = class {
       scope: "user" /* USER */,
       ttlMs,
       userId: this.userId,
-      grantedBy: options.grantedBy ?? "policy",
+      grantedBy: options.grantedBy ?? this.defaultGrantor(),
       reason: options.reason,
       metadata: options.metadata
     });
@@ -759,7 +790,7 @@ var ApprovalService = class {
       ttlMs,
       sessionId: this.sessionId,
       userId: this.userId,
-      grantedBy: options.grantedBy ?? "policy",
+      grantedBy: options.grantedBy ?? this.defaultGrantor(),
       reason: options.reason,
       metadata: options.metadata
     });
@@ -776,7 +807,7 @@ var ApprovalService = class {
       context,
       sessionId: this.sessionId,
       userId: this.userId,
-      grantedBy: options.grantedBy ?? "policy",
+      grantedBy: options.grantedBy ?? this.defaultGrantor(),
       reason: options.reason,
       metadata: options.metadata
     });
@@ -793,7 +824,7 @@ var ApprovalService = class {
       toolId,
       sessionId: this.sessionId,
       userId: this.userId,
-      revokedBy: options.revokedBy ?? "policy",
+      revokedBy: options.revokedBy ?? this.defaultRevoker(),
       reason: options.reason
     });
   }
@@ -805,10 +836,10 @@ var ApprovalService = class {
   }
 };
 ApprovalService = __decorateClass([
-  (0, import_sdk2.Provider)({
+  (0, import_sdk3.Provider)({
     name: "provider:approval:service",
     description: "Service for managing tool approvals",
-    scope: import_sdk2.ProviderScope.CONTEXT
+    scope: import_sdk3.ProviderScope.CONTEXT
   })
 ], ApprovalService);
 function createApprovalService(store, sessionId, userId, requirementOf) {
@@ -816,7 +847,7 @@ function createApprovalService(store, sessionId, userId, requirementOf) {
 }
 
 // plugins/plugin-approval/src/services/challenge.service.ts
-var import_sdk3 = require("@frontmcp/sdk");
+var import_sdk4 = require("@frontmcp/sdk");
 var import_utils2 = require("@frontmcp/utils");
 var ChallengeService = class {
   storage;
@@ -950,10 +981,10 @@ var ChallengeService = class {
   }
 };
 ChallengeService = __decorateClass([
-  (0, import_sdk3.Provider)({
+  (0, import_sdk4.Provider)({
     name: "provider:approval:challenge-service",
     description: "PKCE challenge service for webhook approval flows",
-    scope: import_sdk3.ProviderScope.GLOBAL
+    scope: import_sdk4.ProviderScope.GLOBAL
   })
 ], ChallengeService);
 function generatePkcePairFromVerifier(codeVerifier) {
@@ -971,14 +1002,17 @@ function createMemoryChallengeService(options = {}) {
 }
 
 // plugins/plugin-approval/src/stores/approval-storage.store.ts
-var import_sdk4 = require("@frontmcp/sdk");
+var import_sdk5 = require("@frontmcp/sdk");
 var import_utils3 = require("@frontmcp/utils");
 function escapePattern(str) {
   return str.replace(/[*?[\]\\]/g, "\\$&");
 }
+var REVOCATION_RETENTION_SECONDS = 24 * 60 * 60;
 var TIME_LIMITED_KEY_SEGMENT = `scope:${"time_limited" /* TIME_LIMITED */}`;
 var ApprovalStorageStore = class {
   storage;
+  /** Revoked approvals live beside the live ones, in a namespace no live-approval query scans. */
+  revocationStorage;
   options;
   cleanupInterval;
   initialized = false;
@@ -1014,6 +1048,13 @@ var ApprovalStorageStore = class {
     }
     this.initialized = true;
   }
+  get revocations() {
+    this.revocationStorage ??= (0, import_utils3.createNamespacedStorage)(
+      this.storage.root,
+      `${this.storage.prefix.replace(/:$/, "")}-revoked`
+    );
+    return this.revocationStorage;
+  }
   ensureInitialized() {
     if (!this.initialized) {
       throw new Error("ApprovalStorageStore not initialized. Call initialize() first.");
@@ -1175,27 +1216,43 @@ var ApprovalStorageStore = class {
     const keys = await this.storage.keys(`${escapePattern(toolId)}:*`);
     const values = await this.storage.mget(keys);
     const keysToDelete = [];
+    const revoked = /* @__PURE__ */ new Map();
     for (let i = 0; i < keys.length; i++) {
       const record = this.parseRecord(values[i]);
       if (!record || record.toolId !== toolId || record.state === "denied" /* DENIED */) continue;
+      const matches = keysToDelete.length;
       if (context) {
         const sameSession = sessionId !== void 0 && record.sessionId === sessionId;
         if (record.context?.type === context.type && record.context.identifier === context.identifier && (!sessionId || sameSession) && // A context approval granted to the session before it had a user applies to that user too.
         (!userId || record.userId === userId || sameSession && record.userId === void 0)) {
           keysToDelete.push(keys[i]);
         }
-        continue;
-      }
-      if (sessionId && record.sessionId === sessionId || userId && record.userId === userId) {
+      } else if (sessionId && record.sessionId === sessionId || userId && record.userId === userId) {
         keysToDelete.push(keys[i]);
       }
+      if (keysToDelete.length > matches) revoked.set(keys[i], record);
     }
     if (keysToDelete.length === 0) {
       return false;
     }
+    const revokedAt = Date.now();
+    const revokedBy = normalizeRevoker(options.revokedBy);
+    for (const [key, record] of revoked) {
+      const entry = { ...record, revokedAt, revokedBy, revocationReason: options.reason };
+      await this.revocations.set(key, JSON.stringify(entry), { ttlSeconds: REVOCATION_RETENTION_SECONDS });
+    }
     await this.storage.mdelete(keysToDelete);
     return true;
   }
+  async getRevocations(toolId, sessionId, userId, context) {
+    this.ensureInitialized();
+    const records = [];
+    for (const key of this.callerKeys(toolId, sessionId, userId, context)) {
+      const record = this.parseRecord(await this.revocations.get(key));
+      if (record && record.toolId === toolId) records.push(record);
+    }
+    return records.sort((a, b) => (a.revokedAt ?? 0) - (b.revokedAt ?? 0));
+  }
   async isApproved(toolId, sessionId, userId, context) {
     const approval = await this.getApproval(toolId, sessionId, userId, context);
     return approval?.state === "approved" /* APPROVED */;
@@ -1271,14 +1328,15 @@ var ApprovalStorageStore = class {
     if (this.ownedStorage && this.storage) {
       await this.storage.root.disconnect();
     }
+    this.revocationStorage = void 0;
     this.initialized = false;
   }
 };
 ApprovalStorageStore = __decorateClass([
-  (0, import_sdk4.Provider)({
+  (0, import_sdk5.Provider)({
     name: "provider:approval:store:storage",
     description: "Storage-backed approval store (supports Memory, Redis, Vercel KV, Upstash)",
-    scope: import_sdk4.ProviderScope.GLOBAL
+    scope: import_sdk5.ProviderScope.GLOBAL
   })
 ], ApprovalStorageStore);
 function createApprovalMemoryStore(options = {}) {
@@ -1290,7 +1348,7 @@ function createApprovalMemoryStore(options = {}) {
 }
 
 // plugins/plugin-approval/src/approval.plugin.ts
-var ApprovalPlugin = class extends import_sdk5.DynamicPlugin {
+var ApprovalPlugin = class extends import_sdk6.DynamicPlugin {
   options;
   constructor(options = {}) {
     super();
@@ -1351,8 +1409,8 @@ __publicField(ApprovalPlugin, "dynamicProviders", (options) => {
   providers.push({
     name: "approval:service",
     provide: ApprovalServiceToken,
-    scope: import_sdk5.ProviderScope.CONTEXT,
-    inject: () => [ApprovalStoreToken, import_sdk5.FRONTMCP_CONTEXT, import_sdk5.ScopeEntry],
+    scope: import_sdk6.ProviderScope.CONTEXT,
+    inject: () => [ApprovalStoreToken, import_sdk6.FRONTMCP_CONTEXT, import_sdk6.ScopeEntry],
     useFactory: (store, ctx, scope) => {
       const { sessionId, userId } = resolveApprovalIdentity(ctx);
       const requirementOf = (toolId) => {
@@ -1367,7 +1425,7 @@ __publicField(ApprovalPlugin, "dynamicProviders", (options) => {
   return providers;
 });
 ApprovalPlugin = __decorateClass([
-  (0, import_sdk5.Plugin)({
+  (0, import_sdk6.Plugin)({
     name: "approval",
     description: "Tool authorization workflow with PKCE webhook security",
     plugins: [ApprovalCheckPlugin],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-approval",
-  "version": "1.8.5",
+  "version": "1.8.7",
   "description": "Approval plugin for FrontMCP - tool authorization workflow with PKCE webhook security",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.8.5",
-    "@frontmcp/utils": "1.8.5",
+    "@frontmcp/sdk": "1.8.7",
+    "@frontmcp/utils": "1.8.7",
     "ioredis": "^5.8.0",
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.5",
+    "@frontmcp/lazy-zod": "1.8.7",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {

package/services/approval.service.d.ts

@@ -14,7 +14,7 @@ export type ApprovalRequirementLookup = (toolId: string) => ToolApprovalRequirem
  * Options for granting approvals via the service.
  */
 export interface GrantOptions {
-    /** Who/what is granting the approval (defaults to 'policy') */
+    /** Who/what is granting the approval (defaults to the signed-in user, or `{ source: 'user' }` without one) */
     grantedBy?: ApprovalGrantor | ApprovalSourceType;
     /** Optional reason for the approval */
     reason?: string;
@@ -25,7 +25,7 @@ export interface GrantOptions {
  * Options for revoking approvals via the service.
  */
 export interface RevokeOptions {
-    /** Who/what is revoking the approval (defaults to 'policy') */
+    /** Who/what is revoking the approval (defaults to the signed-in user, or `{ source: 'user' }` without one) */
     revokedBy?: ApprovalRevoker | RevocationSourceType;
     /** Optional reason for revocation */
     reason?: string;
@@ -41,6 +41,19 @@ export declare class ApprovalService {
     constructor(store: ApprovalStore, sessionId: string, userId?: string | undefined, requirementOf?: ApprovalRequirementLookup);
     /** Checks a grant against the tool's `allowedScopes` and `maxTtlMs`; returns the ttl to store. */
     private checkGrant;
+    /** The caller's user id, when it names a principal: an anonymous subject (`anon:…`) names no one. */
+    private get signedInUserId();
+    /**
+     * Who a grant is recorded as when the call names no one: the signed-in user whose tool call made it.
+     * It used to be `'policy'`, so an audit trail showed every approval a user gave as a policy's.
+     * Without a signed-in user it is a user with no identifier.
+     *
+     * The method is `'implicit'`: a tool that grants through `this.approval` asked no one, so the grant
+     * is not an `'interactive'` answer. A tool that did ask passes `grantedBy: userGrantor(id)`.
+     */
+    private defaultGrantor;
+    /** Who a revocation is recorded as when the call names no one, by the same rule as a grant. */
+    private defaultRevoker;
     /**
      * Check if a tool is approved for current session/user.
      */
@@ -63,6 +76,11 @@ export declare class ApprovalService {
      * another caller's records. Read the store directly for administrative queries.
      */
     queryApprovals(query: Partial<ApprovalQuery>): Promise<ApprovalRecord[]>;
+    /**
+     * The caller's recent revocations of a tool, newest last: each is the approval that was revoked,
+     * with `revokedBy`, `revokedAt` and `revocationReason`. Empty when the store keeps no revocations.
+     */
+    getRevocations(toolId: string): Promise<ApprovalRecord[]>;
     /**
      * Grant session-scoped approval for a tool.
      */

package/services/approval.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval.service.d.ts","sourceRoot":"","sources":["../../src/services/approval.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,uBAAuB,GAAG,SAAS,CAAC;AAEhG;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACjD,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IACnD,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,qBAKa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,aAAa,GAAE,yBAA2C;IAG7E,kGAAkG;IAClG,OAAO,CAAC,UAAU;IAQlB;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAY7E;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAItE;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAQtD;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAUnD;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAW9E;;OAEG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAa/F;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB5F;;OAEG;IACG,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAclH;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,eAAe,EACxB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,cAAc,CAAC;IAmB1B;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAUnF;;OAEG;IACG,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;CAG/C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,yBAAyB,GACxC,eAAe,CAEjB"}
+{"version":3,"file":"approval.service.d.ts","sourceRoot":"","sources":["../../src/services/approval.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,uBAAuB,GAAG,SAAS,CAAC;AAEhG;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,8GAA8G;IAC9G,SAAS,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACjD,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8GAA8G;IAC9G,SAAS,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IACnD,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,qBAKa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,aAAa,GAAE,yBAA2C;IAG7E,kGAAkG;IAClG,OAAO,CAAC,UAAU;IAIlB,qGAAqG;IACrG,OAAO,KAAK,cAAc,GAEzB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAKtB,+FAA+F;IAC/F,OAAO,CAAC,cAAc;IAStB;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAY7E;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAItE;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAQtD;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAUnD;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAO9E;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAQ/D;;OAEG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAa/F;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB5F;;OAEG;IACG,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAclH;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,eAAe,EACxB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,cAAc,CAAC;IAmB1B;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAUnF;;OAEG;IACG,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;CAG/C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,yBAAyB,GACxC,eAAe,CAEjB"}

package/stores/approval-storage.store.d.ts

@@ -37,6 +37,8 @@ export interface ApprovalStorageStoreOptions {
  */
 export declare class ApprovalStorageStore implements ApprovalStore {
     private storage;
+    /** Revoked approvals live beside the live ones, in a namespace no live-approval query scans. */
+    private revocationStorage?;
     private readonly options;
     private cleanupInterval?;
     private initialized;
@@ -46,6 +48,7 @@ export declare class ApprovalStorageStore implements ApprovalStore {
      * Initialize the storage connection.
      */
     initialize(): Promise<void>;
+    private get revocations();
     private ensureInitialized;
     private buildKey;
     /**
@@ -85,6 +88,7 @@ export declare class ApprovalStorageStore implements ApprovalStore {
      * (session, user, time-limited and context approvals alike). Recorded denials are kept.
      */
     revokeApproval(options: RevokeApprovalOptions): Promise<boolean>;
+    getRevocations(toolId: string, sessionId: string, userId?: string, context?: ApprovalContext): Promise<ApprovalRecord[]>;
     isApproved(toolId: string, sessionId: string, userId?: string, context?: ApprovalContext): Promise<boolean>;
     clearSessionApprovals(sessionId: string): Promise<number>;
     clearExpiredApprovals(): Promise<number>;

package/stores/approval-storage.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-storage.store.d.ts","sourceRoot":"","sources":["../../src/stores/approval-storage.store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACnG,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,4BAA4B,CAAC;AAqBpC;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB;;OAEG;IACH,eAAe,CAAC,EAAE,WAAW,GAAG,iBAAiB,CAAC;IAElD;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAMD;;;GAGG;AACH,qBAKa,oBAAqB,YAAW,aAAa;IACxD,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAEtB;IACF,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,GAAE,2BAAgC;IASrD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAwBjC,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,QAAQ;IAQhB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAItB,4CAA4C;IAC5C,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;IAgBlB;;;OAGG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,EAAE,CAAC;IAa5B;;;OAGG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAKhC,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAwC/D,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAkC3E;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuChE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAK3G,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoBzD,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAuBxC,QAAQ,IAAI,OAAO,CAAC;QACxB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;KACxC,CAAC;IAsCI,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAY7B;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,IAAI,CAAC,2BAA2B,EAAE,SAAS,GAAG,iBAAiB,CAAM,GAC7E,oBAAoB,CAMtB"}
+{"version":3,"file":"approval-storage.store.d.ts","sourceRoot":"","sources":["../../src/stores/approval-storage.store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACnG,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,4BAA4B,CAAC;AAwBpC;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB;;OAEG;IACH,eAAe,CAAC,EAAE,WAAW,GAAG,iBAAiB,CAAC;IAElD;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAMD;;;GAGG;AACH,qBAKa,oBAAqB,YAAW,aAAa;IACxD,OAAO,CAAC,OAAO,CAAqB;IACpC,gGAAgG;IAChG,OAAO,CAAC,iBAAiB,CAAC,CAAoB;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAEtB;IACF,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,GAAE,2BAAgC;IASrD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAwBjC,OAAO,KAAK,WAAW,GAMtB;IAED,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,QAAQ;IAQhB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAItB,4CAA4C;IAC5C,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;IAgBlB;;;OAGG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,EAAE,CAAC;IAa5B;;;OAGG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAKhC,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAwC/D,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAkC3E;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC;IA+ChE,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,EAAE,CAAC;IAWtB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAK3G,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoBzD,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAuBxC,QAAQ,IAAI,OAAO,CAAC;QACxB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;KACxC,CAAC;IAsCI,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAa7B;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,IAAI,CAAC,2BAA2B,EAAE,SAAS,GAAG,iBAAiB,CAAM,GAC7E,oBAAoB,CAMtB"}

package/stores/approval-store.interface.d.ts

@@ -3,7 +3,7 @@
  *
  * @module @frontmcp/plugin-approval
  */
-import type { ApprovalScope, ApprovalState, ApprovalContext, ApprovalGrantor, ApprovalRevoker, ApprovalRecord, ApprovalSourceType, RevocationSourceType } from '../types';
+import type { ApprovalContext, ApprovalGrantor, ApprovalRecord, ApprovalRevoker, ApprovalScope, ApprovalSourceType, ApprovalState, RevocationSourceType } from '../types';
 /**
  * Query options for finding approvals.
  */
@@ -101,6 +101,11 @@ export interface ApprovalStore {
      * (only the given context's, when `context` is set). Recorded denials are kept.
      */
     revokeApproval(options: RevokeApprovalOptions): Promise<boolean>;
+    /**
+     * The caller's recent revocations of a tool: each is the approval that was revoked, with `revokedBy`,
+     * `revokedAt` and `revocationReason`. Optional: a store that keeps no revocations leaves it out.
+     */
+    getRevocations?(toolId: string, sessionId: string, userId?: string, context?: ApprovalContext): Promise<ApprovalRecord[]>;
     /**
      * Check if a tool is approved.
      */

package/stores/approval-store.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-store.interface.d.ts","sourceRoot":"","sources":["../../src/stores/approval-store.interface.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,UAAU,CAAC;AAMlB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,sBAAsB;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;IAEtB,gCAAgC;IAChC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IAEzB,sBAAsB;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;IAEtB,gCAAgC;IAChC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IAEzB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,wBAAwB;IACxB,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,iDAAiD;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,qBAAqB;IACrB,KAAK,EAAE,aAAa,CAAC;IAErB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,oCAAoC;IACpC,SAAS,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IAEjD,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,oCAAoC;IACpC,SAAS,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAEnD,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;OAGG;IACH,WAAW,CACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEvC;;;;OAIG;IACH,YAAY,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAExH;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAEhE;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAEtE;;;OAGG;IACH,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjE;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5G;;OAEG;IACH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D;;OAEG;IACH,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;KACxC,CAAC,CAAC;IAEH;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}
+{"version":3,"file":"approval-store.interface.d.ts","sourceRoot":"","sources":["../../src/stores/approval-store.interface.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACrB,MAAM,UAAU,CAAC;AAMlB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,sBAAsB;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;IAEtB,gCAAgC;IAChC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IAEzB,sBAAsB;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;IAEtB,gCAAgC;IAChC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IAEzB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,wBAAwB;IACxB,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,iDAAiD;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,qBAAqB;IACrB,KAAK,EAAE,aAAa,CAAC;IAErB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,oCAAoC;IACpC,SAAS,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IAEjD,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,oCAAoC;IACpC,SAAS,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAEnD,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;OAGG;IACH,WAAW,CACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEvC;;;;OAIG;IACH,YAAY,CAAC,CACX,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAE7B;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAEhE;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAEtE;;;OAGG;IACH,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjE;;;OAGG;IACH,cAAc,CAAC,CACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAE7B;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5G;;OAEG;IACH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D;;OAEG;IACH,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;KACxC,CAAC,CAAC;IAEH;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}