@frontmcp/plugin-approval 1.8.6 → 1.9.0

package/approval/types.d.ts

@@ -221,7 +221,8 @@ export interface ToolApprovalRequirement {
     maxTtlMs?: number;
     /**
      * Whether to prompt on each call even if approved.
-     * For highly sensitive operations.
+     * For highly sensitive operations: each approval lets exactly one call through and is used up by
+     * it, so the next call is refused with `pending` until the caller approves again.
      * @default false
      */
     alwaysPrompt?: boolean;

package/approval/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/approval/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;GAEG;AACH,oBAAY,aAAa;IACvB,8DAA8D;IAC9D,OAAO,YAAY;IAEnB,oEAAoE;IACpE,IAAI,SAAS;IAEb,sEAAsE;IACtE,YAAY,iBAAiB;IAE7B,0DAA0D;IAC1D,aAAa,kBAAkB;IAE/B,wEAAwE;IACxE,gBAAgB,qBAAqB;CACtC;AAMD;;GAEG;AACH,oBAAY,aAAa;IACvB,oCAAoC;IACpC,OAAO,YAAY;IAEnB,2CAA2C;IAC3C,QAAQ,aAAa;IAErB,yCAAyC;IACzC,MAAM,WAAW;IAEjB,4CAA4C;IAC5C,OAAO,YAAY;CACpB;AAMD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IAEb,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IAEnB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAMD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,OAAO,GACP,KAAK,GACL,OAAO,GACP,MAAM,GACN,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,KAAK,CAAC;AAMzF;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IAEpB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IAEnB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,MAAM,EAAE,kBAAkB,CAAC;IAE3B,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,oCAAoC;IACpC,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAMD;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,kBAAkB,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEjF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,MAAM,EAAE,oBAAoB,CAAC;IAE7B,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,uCAAuC;IACvC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAMD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IAEf,6BAA6B;IAC7B,KAAK,EAAE,aAAa,CAAC;IAErB,6BAA6B;IAC7B,KAAK,EAAE,aAAa,CAAC;IAErB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAElB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,uDAAuD;IACvD,SAAS,EAAE,eAAe,CAAC;IAE3B,8CAA8C;IAC9C,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAElC,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,oCAAoC;IACpC,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B,4BAA4B;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjF;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;IAE7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;IAEhC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAE5B;;OAEG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IAEtB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,eAAe,EAAE,CAAC;CACzC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/approval/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;GAEG;AACH,oBAAY,aAAa;IACvB,8DAA8D;IAC9D,OAAO,YAAY;IAEnB,oEAAoE;IACpE,IAAI,SAAS;IAEb,sEAAsE;IACtE,YAAY,iBAAiB;IAE7B,0DAA0D;IAC1D,aAAa,kBAAkB;IAE/B,wEAAwE;IACxE,gBAAgB,qBAAqB;CACtC;AAMD;;GAEG;AACH,oBAAY,aAAa;IACvB,oCAAoC;IACpC,OAAO,YAAY;IAEnB,2CAA2C;IAC3C,QAAQ,aAAa;IAErB,yCAAyC;IACzC,MAAM,WAAW;IAEjB,4CAA4C;IAC5C,OAAO,YAAY;CACpB;AAMD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IAEb,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IAEnB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAMD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,OAAO,GACP,KAAK,GACL,OAAO,GACP,MAAM,GACN,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,KAAK,CAAC;AAMzF;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IAEpB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IAEnB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,MAAM,EAAE,kBAAkB,CAAC;IAE3B,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,oCAAoC;IACpC,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAMD;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,kBAAkB,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEjF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,MAAM,EAAE,oBAAoB,CAAC;IAE7B,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,uCAAuC;IACvC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAMD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IAEf,6BAA6B;IAC7B,KAAK,EAAE,aAAa,CAAC;IAErB,6BAA6B;IAC7B,KAAK,EAAE,aAAa,CAAC;IAErB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAElB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,uDAAuD;IACvD,SAAS,EAAE,eAAe,CAAC;IAE3B,8CAA8C;IAC9C,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAElC,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,oCAAoC;IACpC,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B,4BAA4B;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjF;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;OAGG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;IAE7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;IAEhC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAE5B;;OAEG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IAEtB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,eAAe,EAAE,CAAC;CACzC"}

package/esm/index.mjs

@@ -1,3 +1,6 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
@@ -23,7 +26,7 @@ import {
   FRONTMCP_CONTEXT,
   Plugin as Plugin2,
   ProviderScope as ProviderScope4,
-  ScopeEntry
+  ScopeEntry as ScopeEntry2
 } from "@frontmcp/sdk";
 
 // plugins/plugin-approval/src/approval/errors.ts
@@ -255,7 +258,7 @@ var ChallengeServiceToken = /* @__PURE__ */ Symbol.for(
 );
 
 // plugins/plugin-approval/src/hooks/approval-check.hook.ts
-import { DynamicPlugin, Plugin, ToolHook } from "@frontmcp/sdk";
+import { DynamicPlugin, isEntryGatedBy, Plugin, ScopeEntry, ToolHook } from "@frontmcp/sdk";
 
 // plugins/plugin-approval/src/approval/schemas.ts
 import { z } from "@frontmcp/lazy-zod";
@@ -474,7 +477,7 @@ function isApiGrantor(grantor) {
 }
 
 // plugins/plugin-approval/src/hooks/approval-check.hook.ts
-var passedApprovalStores = /* @__PURE__ */ new WeakMap();
+var decidedCalls = /* @__PURE__ */ new WeakSet();
 var ApprovalCheckPlugin = class extends DynamicPlugin {
   async checkApproval(flowCtx) {
     const { tool, toolContext } = flowCtx.state;
@@ -489,17 +492,19 @@ var ApprovalCheckPlugin = class extends DynamicPlugin {
     if (approvalConfig.skipApproval) {
       return;
     }
-    const approvalStore = this.get(ApprovalStoreToken);
-    const passedStores = passedApprovalStores.get(toolContext) ?? /* @__PURE__ */ new WeakSet();
-    if (passedStores.has(approvalStore)) return;
-    await this.enforceApproval(flowCtx, tool, toolContext, approvalConfig, approvalStore);
-    passedStores.add(approvalStore);
-    passedApprovalStores.set(toolContext, passedStores);
-  }
-  async enforceApproval(flowCtx, tool, toolContext, approvalConfig, approvalStore) {
+    if (decidedCalls.has(toolContext)) return;
+    await this.enforceApproval(flowCtx, tool, toolContext, approvalConfig, this.coveringStores(tool));
+    decidedCalls.add(toolContext);
+  }
+  async enforceApproval(flowCtx, tool, toolContext, approvalConfig, stores) {
     const { sessionId, userId } = resolveApprovalIdentity(toolContext.tryGetContext?.());
     const currentContext = this.getCurrentContext(flowCtx);
-    const records = await this.readApprovals(approvalStore, tool.fullName, sessionId, userId, currentContext);
+    const stored = [];
+    for (const store of stores) {
+      const records2 = await this.readApprovals(store, tool.fullName, sessionId, userId, currentContext);
+      stored.push(...records2.map((record) => ({ store, record })));
+    }
+    const records = stored.map(({ record }) => record);
     if (records.some((record) => record.state === "denied" /* DENIED */)) {
       throw new ApprovalRequiredError({
         toolId: tool.fullName,
@@ -511,12 +516,13 @@ var ApprovalCheckPlugin = class extends DynamicPlugin {
       return;
     }
     const approved = records.filter((record) => record.state === "approved" /* APPROVED */);
-    if (approvalConfig.alwaysPrompt) {
-      await this.handleApprovalRequired(flowCtx, approvalConfig, approved[0]);
-      return;
-    }
     const now = Date.now();
-    if (approved.some((record) => isApprovalUsable(record, approvalConfig, now))) {
+    const usable = stored.filter(({ record }) => isApprovalUsable(record, approvalConfig, now));
+    if (approvalConfig.alwaysPrompt) {
+      for (const { store, record } of usable) {
+        if (await this.consumeApproval(store, record, sessionId, userId, currentContext)) return;
+      }
+    } else if (usable.length > 0) {
       return;
     }
     await this.handleApprovalRequired(
@@ -525,6 +531,47 @@ var ApprovalCheckPlugin = class extends DynamicPlugin {
       approved.find((record) => isApprovalExpired(record, approvalConfig, now)) ?? approved[0]
     );
   }
+  /**
+   * The stores of every approval gate that runs for the tool: this plugin's, and that of each other
+   * `ApprovalCheckPlugin` whose hook the scope runs for it (an `ApprovalPlugin` on the server and
+   * one on the tool's app, say). One store shared by two gates counts once.
+   */
+  coveringStores(tool) {
+    const stores = /* @__PURE__ */ new Set([this.get(ApprovalStoreToken)]);
+    let scope;
+    try {
+      scope = this.get(ScopeEntry);
+    } catch {
+      scope = void 0;
+    }
+    if (!scope?.hooks) return [...stores];
+    for (const hook of scope.hooks.getFlowHooks("tools:call-tool")) {
+      const gate = hook.metadata.target;
+      if (gate instanceof ApprovalCheckPlugin && isEntryGatedBy(scope, { tool }, gate)) {
+        stores.add(gate.get(ApprovalStoreToken));
+      }
+    }
+    return [...stores];
+  }
+  /**
+   * Use up an approval of an `alwaysPrompt` tool, reporting whether this call got it.
+   *
+   * `consumeApproval()` deletes exactly that record, and only one of two calls racing for it wins.
+   * A store without it has the caller's approvals of the tool revoked instead, which leaves none
+   * standing but cannot tell two concurrent calls apart.
+   */
+  async consumeApproval(store, record, sessionId, userId, context) {
+    if (store.consumeApproval) {
+      return store.consumeApproval(record, sessionId, userId, context);
+    }
+    return store.revokeApproval({
+      toolId: record.toolId,
+      sessionId,
+      userId,
+      revokedBy: "system",
+      reason: "Used by a call of an alwaysPrompt tool"
+    });
+  }
   /**
    * The caller's approvals and denials of the tool, from the context it runs in too. Stores
    * without `getApprovals()` give the one record `getApproval()` picks.
@@ -615,16 +662,19 @@ var ApprovalService = class {
   /**
    * Who a grant is recorded as when the call names no one: the signed-in user whose tool call made it.
    * It used to be `'policy'`, so an audit trail showed every approval a user gave as a policy's.
-   * Without a signed-in user it is the store's default, a user with no identifier.
+   * Without a signed-in user it is a user with no identifier.
+   *
+   * The method is `'implicit'`: a tool that grants through `this.approval` asked no one, so the grant
+   * is not an `'interactive'` answer. A tool that did ask passes `grantedBy: userGrantor(id)`.
    */
   defaultGrantor() {
     const userId = this.signedInUserId;
-    return userId ? userGrantor(userId) : { source: "user" };
+    return userId ? userGrantor(userId, void 0, { method: "implicit" }) : { source: "user", method: "implicit" };
   }
   /** Who a revocation is recorded as when the call names no one, by the same rule as a grant. */
   defaultRevoker() {
     const userId = this.signedInUserId;
-    return userId ? userRevoker(userId) : { source: "user" };
+    return userId ? { source: "user", identifier: userId, method: "implicit" } : { source: "user", method: "implicit" };
   }
   // ─────────────────────────────────────────────────────────────────────────────
   // Query Methods
@@ -681,6 +731,13 @@ var ApprovalService = class {
       (record) => record.sessionId === this.sessionId || this.userId !== void 0 && record.userId === this.userId
     );
   }
+  /**
+   * The caller's recent revocations of a tool, newest last: each is the approval that was revoked,
+   * with `revokedBy`, `revokedAt` and `revocationReason`. Empty when the store keeps no revocations.
+   */
+  async getRevocations(toolId) {
+    return await this.store.getRevocations?.(toolId, this.sessionId, this.userId) ?? [];
+  }
   // ─────────────────────────────────────────────────────────────────────────────
   // Grant Methods
   // ─────────────────────────────────────────────────────────────────────────────
@@ -948,14 +1005,22 @@ function createMemoryChallengeService(options = {}) {
 import { Provider as Provider3, ProviderScope as ProviderScope3 } from "@frontmcp/sdk";
 import {
   createMemoryStorage as createMemoryStorage2,
-  createStorage as createStorage2
+  createNamespacedStorage,
+  createStorage as createStorage2,
+  StorageNotSupportedError
 } from "@frontmcp/utils";
 function escapePattern(str) {
   return str.replace(/[*?[\]\\]/g, "\\$&");
 }
+function isSameRecord(a, b) {
+  return a.toolId === b.toolId && a.state === b.state && a.scope === b.scope && a.grantedAt === b.grantedAt && a.sessionId === b.sessionId && a.userId === b.userId && a.context?.type === b.context?.type && a.context?.identifier === b.context?.identifier;
+}
+var REVOCATION_RETENTION_SECONDS = 24 * 60 * 60;
 var TIME_LIMITED_KEY_SEGMENT = `scope:${"time_limited" /* TIME_LIMITED */}`;
 var ApprovalStorageStore = class {
   storage;
+  /** Revoked approvals live beside the live ones, in a namespace no live-approval query scans. */
+  revocationStorage;
   options;
   cleanupInterval;
   initialized = false;
@@ -991,6 +1056,13 @@ var ApprovalStorageStore = class {
     }
     this.initialized = true;
   }
+  get revocations() {
+    this.revocationStorage ??= createNamespacedStorage(
+      this.storage.root,
+      `${this.storage.prefix.replace(/:$/, "")}-revoked`
+    );
+    return this.revocationStorage;
+  }
   ensureInitialized() {
     if (!this.initialized) {
       throw new Error("ApprovalStorageStore not initialized. Call initialize() first.");
@@ -1152,27 +1224,68 @@ var ApprovalStorageStore = class {
     const keys = await this.storage.keys(`${escapePattern(toolId)}:*`);
     const values = await this.storage.mget(keys);
     const keysToDelete = [];
+    const revoked = /* @__PURE__ */ new Map();
     for (let i = 0; i < keys.length; i++) {
       const record = this.parseRecord(values[i]);
       if (!record || record.toolId !== toolId || record.state === "denied" /* DENIED */) continue;
+      const matches = keysToDelete.length;
       if (context) {
         const sameSession = sessionId !== void 0 && record.sessionId === sessionId;
         if (record.context?.type === context.type && record.context.identifier === context.identifier && (!sessionId || sameSession) && // A context approval granted to the session before it had a user applies to that user too.
         (!userId || record.userId === userId || sameSession && record.userId === void 0)) {
           keysToDelete.push(keys[i]);
         }
-        continue;
-      }
-      if (sessionId && record.sessionId === sessionId || userId && record.userId === userId) {
+      } else if (sessionId && record.sessionId === sessionId || userId && record.userId === userId) {
         keysToDelete.push(keys[i]);
       }
+      if (keysToDelete.length > matches) revoked.set(keys[i], record);
     }
     if (keysToDelete.length === 0) {
       return false;
     }
+    const revokedAt = Date.now();
+    const revokedBy = normalizeRevoker(options.revokedBy);
+    for (const [key, record] of revoked) {
+      const entry = { ...record, revokedAt, revokedBy, revocationReason: options.reason };
+      await this.revocations.set(key, JSON.stringify(entry), { ttlSeconds: REVOCATION_RETENTION_SECONDS });
+    }
     await this.storage.mdelete(keysToDelete);
     return true;
   }
+  /**
+   * Deletes the key that holds `record`, if it still does, and reports whether this call deleted
+   * it. Two calls racing for one approval both find it, but only one deletes it, and a denial or
+   * approval written to the key after it was read is kept.
+   */
+  async consumeApproval(record, sessionId, userId, context) {
+    this.ensureInitialized();
+    for (const key of this.callerKeys(record.toolId, sessionId, userId, context)) {
+      const storedValue = await this.storage.get(key);
+      const stored = this.parseRecord(storedValue);
+      if (storedValue !== null && stored && isSameRecord(stored, record)) {
+        return this.deleteIfUnchanged(key, storedValue);
+      }
+    }
+    return false;
+  }
+  /** Deletes `key` only while it still holds `storedValue`, in one step where the backend allows. */
+  async deleteIfUnchanged(key, storedValue) {
+    try {
+      return await this.storage.deleteIfEquals(key, storedValue);
+    } catch (error) {
+      if (!(error instanceof StorageNotSupportedError)) throw error;
+      return this.storage.delete(key);
+    }
+  }
+  async getRevocations(toolId, sessionId, userId, context) {
+    this.ensureInitialized();
+    const records = [];
+    for (const key of this.callerKeys(toolId, sessionId, userId, context)) {
+      const record = this.parseRecord(await this.revocations.get(key));
+      if (record && record.toolId === toolId) records.push(record);
+    }
+    return records.sort((a, b) => (a.revokedAt ?? 0) - (b.revokedAt ?? 0));
+  }
   async isApproved(toolId, sessionId, userId, context) {
     const approval = await this.getApproval(toolId, sessionId, userId, context);
     return approval?.state === "approved" /* APPROVED */;
@@ -1248,6 +1361,7 @@ var ApprovalStorageStore = class {
     if (this.ownedStorage && this.storage) {
       await this.storage.root.disconnect();
     }
+    this.revocationStorage = void 0;
     this.initialized = false;
   }
 };
@@ -1329,7 +1443,7 @@ __publicField(ApprovalPlugin, "dynamicProviders", (options) => {
     name: "approval:service",
     provide: ApprovalServiceToken,
     scope: ProviderScope4.CONTEXT,
-    inject: () => [ApprovalStoreToken, FRONTMCP_CONTEXT, ScopeEntry],
+    inject: () => [ApprovalStoreToken, FRONTMCP_CONTEXT, ScopeEntry2],
     useFactory: (store, ctx, scope) => {
       const { sessionId, userId } = resolveApprovalIdentity(ctx);
       const requirementOf = (toolId) => {

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-approval",
-  "version": "1.8.6",
+  "version": "1.9.0",
   "description": "Approval plugin for FrontMCP - tool authorization workflow with PKCE webhook security",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.8.6",
-    "@frontmcp/utils": "1.8.6",
+    "@frontmcp/sdk": "1.9.0",
+    "@frontmcp/utils": "1.9.0",
     "ioredis": "^5.8.0",
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.6",
+    "@frontmcp/lazy-zod": "1.9.0",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {

package/hooks/approval-check.hook.d.ts

@@ -17,9 +17,28 @@ export default class ApprovalCheckPlugin extends DynamicPlugin<Record<string, ne
      * Runs for the tools of the app the plugin is installed on and, `appliesTo: 'uncovered-apps'`,
      * for the tools of any app with no approval gate of its own, so an `approval` tool is never left
      * ungated because the plugin sits on a different app.
+     *
+     * A tool more than one gate covers (an `ApprovalPlugin` on the server and one on the tool's app)
+     * is decided once, over all their stores: an approval in any of them lets it run, a denial in any
+     * of them refuses it. It used to need an approval in each store (#678), so a grant through
+     * `this.approval`, which writes to one of them, never let it run.
      */
     checkApproval(flowCtx: FlowCtxOf<'tools:call-tool'>): Promise<void>;
     private enforceApproval;
+    /**
+     * The stores of every approval gate that runs for the tool: this plugin's, and that of each other
+     * `ApprovalCheckPlugin` whose hook the scope runs for it (an `ApprovalPlugin` on the server and
+     * one on the tool's app, say). One store shared by two gates counts once.
+     */
+    private coveringStores;
+    /**
+     * Use up an approval of an `alwaysPrompt` tool, reporting whether this call got it.
+     *
+     * `consumeApproval()` deletes exactly that record, and only one of two calls racing for it wins.
+     * A store without it has the caller's approvals of the tool revoked instead, which leaves none
+     * standing but cannot tell two concurrent calls apart.
+     */
+    private consumeApproval;
     /**
      * The caller's approvals and denials of the tool, from the context it runs in too. Stores
      * without `getApprovals()` give the one record `getApproval()` picks.

package/hooks/approval-check.hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-check.hook.d.ts","sourceRoot":"","sources":["../../src/hooks/approval-check.hook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAoB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAmBhF;;;;;GAKG;AAOH,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnF;;;;;;OAMG;IAEG,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC;YA2B3C,eAAe;IA6C7B;;;OAGG;YACW,aAAa;IAc3B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,oBAAoB;YAUd,sBAAsB;CAsBrC"}
+{"version":3,"file":"approval-check.hook.d.ts","sourceRoot":"","sources":["../../src/hooks/approval-check.hook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAgD,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAwB5G;;;;;GAKG;AAOH,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnF;;;;;;;;;;;OAWG;IAEG,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC;YAwB3C,eAAe;IAqD7B;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAoBtB;;;;;;OAMG;YACW,eAAe;IAmB7B;;;OAGG;YACW,aAAa;IAc3B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,oBAAoB;YAUd,sBAAsB;CAsBrC"}

package/index.js

@@ -526,7 +526,7 @@ function isApiGrantor(grantor) {
 }
 
 // plugins/plugin-approval/src/hooks/approval-check.hook.ts
-var passedApprovalStores = /* @__PURE__ */ new WeakMap();
+var decidedCalls = /* @__PURE__ */ new WeakSet();
 var ApprovalCheckPlugin = class extends import_sdk2.DynamicPlugin {
   async checkApproval(flowCtx) {
     const { tool, toolContext } = flowCtx.state;
@@ -541,17 +541,19 @@ var ApprovalCheckPlugin = class extends import_sdk2.DynamicPlugin {
     if (approvalConfig.skipApproval) {
       return;
     }
-    const approvalStore = this.get(ApprovalStoreToken);
-    const passedStores = passedApprovalStores.get(toolContext) ?? /* @__PURE__ */ new WeakSet();
-    if (passedStores.has(approvalStore)) return;
-    await this.enforceApproval(flowCtx, tool, toolContext, approvalConfig, approvalStore);
-    passedStores.add(approvalStore);
-    passedApprovalStores.set(toolContext, passedStores);
-  }
-  async enforceApproval(flowCtx, tool, toolContext, approvalConfig, approvalStore) {
+    if (decidedCalls.has(toolContext)) return;
+    await this.enforceApproval(flowCtx, tool, toolContext, approvalConfig, this.coveringStores(tool));
+    decidedCalls.add(toolContext);
+  }
+  async enforceApproval(flowCtx, tool, toolContext, approvalConfig, stores) {
     const { sessionId, userId } = resolveApprovalIdentity(toolContext.tryGetContext?.());
     const currentContext = this.getCurrentContext(flowCtx);
-    const records = await this.readApprovals(approvalStore, tool.fullName, sessionId, userId, currentContext);
+    const stored = [];
+    for (const store of stores) {
+      const records2 = await this.readApprovals(store, tool.fullName, sessionId, userId, currentContext);
+      stored.push(...records2.map((record) => ({ store, record })));
+    }
+    const records = stored.map(({ record }) => record);
     if (records.some((record) => record.state === "denied" /* DENIED */)) {
       throw new ApprovalRequiredError({
         toolId: tool.fullName,
@@ -563,12 +565,13 @@ var ApprovalCheckPlugin = class extends import_sdk2.DynamicPlugin {
       return;
     }
     const approved = records.filter((record) => record.state === "approved" /* APPROVED */);
-    if (approvalConfig.alwaysPrompt) {
-      await this.handleApprovalRequired(flowCtx, approvalConfig, approved[0]);
-      return;
-    }
     const now = Date.now();
-    if (approved.some((record) => isApprovalUsable(record, approvalConfig, now))) {
+    const usable = stored.filter(({ record }) => isApprovalUsable(record, approvalConfig, now));
+    if (approvalConfig.alwaysPrompt) {
+      for (const { store, record } of usable) {
+        if (await this.consumeApproval(store, record, sessionId, userId, currentContext)) return;
+      }
+    } else if (usable.length > 0) {
       return;
     }
     await this.handleApprovalRequired(
@@ -577,6 +580,47 @@ var ApprovalCheckPlugin = class extends import_sdk2.DynamicPlugin {
       approved.find((record) => isApprovalExpired(record, approvalConfig, now)) ?? approved[0]
     );
   }
+  /**
+   * The stores of every approval gate that runs for the tool: this plugin's, and that of each other
+   * `ApprovalCheckPlugin` whose hook the scope runs for it (an `ApprovalPlugin` on the server and
+   * one on the tool's app, say). One store shared by two gates counts once.
+   */
+  coveringStores(tool) {
+    const stores = /* @__PURE__ */ new Set([this.get(ApprovalStoreToken)]);
+    let scope;
+    try {
+      scope = this.get(import_sdk2.ScopeEntry);
+    } catch {
+      scope = void 0;
+    }
+    if (!scope?.hooks) return [...stores];
+    for (const hook of scope.hooks.getFlowHooks("tools:call-tool")) {
+      const gate = hook.metadata.target;
+      if (gate instanceof ApprovalCheckPlugin && (0, import_sdk2.isEntryGatedBy)(scope, { tool }, gate)) {
+        stores.add(gate.get(ApprovalStoreToken));
+      }
+    }
+    return [...stores];
+  }
+  /**
+   * Use up an approval of an `alwaysPrompt` tool, reporting whether this call got it.
+   *
+   * `consumeApproval()` deletes exactly that record, and only one of two calls racing for it wins.
+   * A store without it has the caller's approvals of the tool revoked instead, which leaves none
+   * standing but cannot tell two concurrent calls apart.
+   */
+  async consumeApproval(store, record, sessionId, userId, context) {
+    if (store.consumeApproval) {
+      return store.consumeApproval(record, sessionId, userId, context);
+    }
+    return store.revokeApproval({
+      toolId: record.toolId,
+      sessionId,
+      userId,
+      revokedBy: "system",
+      reason: "Used by a call of an alwaysPrompt tool"
+    });
+  }
   /**
    * The caller's approvals and denials of the tool, from the context it runs in too. Stores
    * without `getApprovals()` give the one record `getApproval()` picks.
@@ -667,16 +711,19 @@ var ApprovalService = class {
   /**
    * Who a grant is recorded as when the call names no one: the signed-in user whose tool call made it.
    * It used to be `'policy'`, so an audit trail showed every approval a user gave as a policy's.
-   * Without a signed-in user it is the store's default, a user with no identifier.
+   * Without a signed-in user it is a user with no identifier.
+   *
+   * The method is `'implicit'`: a tool that grants through `this.approval` asked no one, so the grant
+   * is not an `'interactive'` answer. A tool that did ask passes `grantedBy: userGrantor(id)`.
    */
   defaultGrantor() {
     const userId = this.signedInUserId;
-    return userId ? userGrantor(userId) : { source: "user" };
+    return userId ? userGrantor(userId, void 0, { method: "implicit" }) : { source: "user", method: "implicit" };
   }
   /** Who a revocation is recorded as when the call names no one, by the same rule as a grant. */
   defaultRevoker() {
     const userId = this.signedInUserId;
-    return userId ? userRevoker(userId) : { source: "user" };
+    return userId ? { source: "user", identifier: userId, method: "implicit" } : { source: "user", method: "implicit" };
   }
   // ─────────────────────────────────────────────────────────────────────────────
   // Query Methods
@@ -733,6 +780,13 @@ var ApprovalService = class {
       (record) => record.sessionId === this.sessionId || this.userId !== void 0 && record.userId === this.userId
     );
   }
+  /**
+   * The caller's recent revocations of a tool, newest last: each is the approval that was revoked,
+   * with `revokedBy`, `revokedAt` and `revocationReason`. Empty when the store keeps no revocations.
+   */
+  async getRevocations(toolId) {
+    return await this.store.getRevocations?.(toolId, this.sessionId, this.userId) ?? [];
+  }
   // ─────────────────────────────────────────────────────────────────────────────
   // Grant Methods
   // ─────────────────────────────────────────────────────────────────────────────
@@ -997,9 +1051,15 @@ var import_utils3 = require("@frontmcp/utils");
 function escapePattern(str) {
   return str.replace(/[*?[\]\\]/g, "\\$&");
 }
+function isSameRecord(a, b) {
+  return a.toolId === b.toolId && a.state === b.state && a.scope === b.scope && a.grantedAt === b.grantedAt && a.sessionId === b.sessionId && a.userId === b.userId && a.context?.type === b.context?.type && a.context?.identifier === b.context?.identifier;
+}
+var REVOCATION_RETENTION_SECONDS = 24 * 60 * 60;
 var TIME_LIMITED_KEY_SEGMENT = `scope:${"time_limited" /* TIME_LIMITED */}`;
 var ApprovalStorageStore = class {
   storage;
+  /** Revoked approvals live beside the live ones, in a namespace no live-approval query scans. */
+  revocationStorage;
   options;
   cleanupInterval;
   initialized = false;
@@ -1035,6 +1095,13 @@ var ApprovalStorageStore = class {
     }
     this.initialized = true;
   }
+  get revocations() {
+    this.revocationStorage ??= (0, import_utils3.createNamespacedStorage)(
+      this.storage.root,
+      `${this.storage.prefix.replace(/:$/, "")}-revoked`
+    );
+    return this.revocationStorage;
+  }
   ensureInitialized() {
     if (!this.initialized) {
       throw new Error("ApprovalStorageStore not initialized. Call initialize() first.");
@@ -1196,27 +1263,68 @@ var ApprovalStorageStore = class {
     const keys = await this.storage.keys(`${escapePattern(toolId)}:*`);
     const values = await this.storage.mget(keys);
     const keysToDelete = [];
+    const revoked = /* @__PURE__ */ new Map();
     for (let i = 0; i < keys.length; i++) {
       const record = this.parseRecord(values[i]);
       if (!record || record.toolId !== toolId || record.state === "denied" /* DENIED */) continue;
+      const matches = keysToDelete.length;
       if (context) {
         const sameSession = sessionId !== void 0 && record.sessionId === sessionId;
         if (record.context?.type === context.type && record.context.identifier === context.identifier && (!sessionId || sameSession) && // A context approval granted to the session before it had a user applies to that user too.
         (!userId || record.userId === userId || sameSession && record.userId === void 0)) {
           keysToDelete.push(keys[i]);
         }
-        continue;
-      }
-      if (sessionId && record.sessionId === sessionId || userId && record.userId === userId) {
+      } else if (sessionId && record.sessionId === sessionId || userId && record.userId === userId) {
         keysToDelete.push(keys[i]);
       }
+      if (keysToDelete.length > matches) revoked.set(keys[i], record);
     }
     if (keysToDelete.length === 0) {
       return false;
     }
+    const revokedAt = Date.now();
+    const revokedBy = normalizeRevoker(options.revokedBy);
+    for (const [key, record] of revoked) {
+      const entry = { ...record, revokedAt, revokedBy, revocationReason: options.reason };
+      await this.revocations.set(key, JSON.stringify(entry), { ttlSeconds: REVOCATION_RETENTION_SECONDS });
+    }
     await this.storage.mdelete(keysToDelete);
     return true;
   }
+  /**
+   * Deletes the key that holds `record`, if it still does, and reports whether this call deleted
+   * it. Two calls racing for one approval both find it, but only one deletes it, and a denial or
+   * approval written to the key after it was read is kept.
+   */
+  async consumeApproval(record, sessionId, userId, context) {
+    this.ensureInitialized();
+    for (const key of this.callerKeys(record.toolId, sessionId, userId, context)) {
+      const storedValue = await this.storage.get(key);
+      const stored = this.parseRecord(storedValue);
+      if (storedValue !== null && stored && isSameRecord(stored, record)) {
+        return this.deleteIfUnchanged(key, storedValue);
+      }
+    }
+    return false;
+  }
+  /** Deletes `key` only while it still holds `storedValue`, in one step where the backend allows. */
+  async deleteIfUnchanged(key, storedValue) {
+    try {
+      return await this.storage.deleteIfEquals(key, storedValue);
+    } catch (error) {
+      if (!(error instanceof import_utils3.StorageNotSupportedError)) throw error;
+      return this.storage.delete(key);
+    }
+  }
+  async getRevocations(toolId, sessionId, userId, context) {
+    this.ensureInitialized();
+    const records = [];
+    for (const key of this.callerKeys(toolId, sessionId, userId, context)) {
+      const record = this.parseRecord(await this.revocations.get(key));
+      if (record && record.toolId === toolId) records.push(record);
+    }
+    return records.sort((a, b) => (a.revokedAt ?? 0) - (b.revokedAt ?? 0));
+  }
   async isApproved(toolId, sessionId, userId, context) {
     const approval = await this.getApproval(toolId, sessionId, userId, context);
     return approval?.state === "approved" /* APPROVED */;
@@ -1292,6 +1400,7 @@ var ApprovalStorageStore = class {
     if (this.ownedStorage && this.storage) {
       await this.storage.root.disconnect();
     }
+    this.revocationStorage = void 0;
     this.initialized = false;
   }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-approval",
-  "version": "1.8.6",
+  "version": "1.9.0",
   "description": "Approval plugin for FrontMCP - tool authorization workflow with PKCE webhook security",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.8.6",
-    "@frontmcp/utils": "1.8.6",
+    "@frontmcp/sdk": "1.9.0",
+    "@frontmcp/utils": "1.9.0",
     "ioredis": "^5.8.0",
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.6",
+    "@frontmcp/lazy-zod": "1.9.0",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {

package/services/approval.service.d.ts

@@ -46,7 +46,10 @@ export declare class ApprovalService {
     /**
      * Who a grant is recorded as when the call names no one: the signed-in user whose tool call made it.
      * It used to be `'policy'`, so an audit trail showed every approval a user gave as a policy's.
-     * Without a signed-in user it is the store's default, a user with no identifier.
+     * Without a signed-in user it is a user with no identifier.
+     *
+     * The method is `'implicit'`: a tool that grants through `this.approval` asked no one, so the grant
+     * is not an `'interactive'` answer. A tool that did ask passes `grantedBy: userGrantor(id)`.
      */
     private defaultGrantor;
     /** Who a revocation is recorded as when the call names no one, by the same rule as a grant. */
@@ -73,6 +76,11 @@ export declare class ApprovalService {
      * another caller's records. Read the store directly for administrative queries.
      */
     queryApprovals(query: Partial<ApprovalQuery>): Promise<ApprovalRecord[]>;
+    /**
+     * The caller's recent revocations of a tool, newest last: each is the approval that was revoked,
+     * with `revokedBy`, `revokedAt` and `revocationReason`. Empty when the store keeps no revocations.
+     */
+    getRevocations(toolId: string): Promise<ApprovalRecord[]>;
     /**
      * Grant session-scoped approval for a tool.
      */

package/services/approval.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval.service.d.ts","sourceRoot":"","sources":["../../src/services/approval.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,uBAAuB,GAAG,SAAS,CAAC;AAEhG;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,8GAA8G;IAC9G,SAAS,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACjD,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8GAA8G;IAC9G,SAAS,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IACnD,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,qBAKa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,aAAa,GAAE,yBAA2C;IAG7E,kGAAkG;IAClG,OAAO,CAAC,UAAU;IAIlB,qGAAqG;IACrG,OAAO,KAAK,cAAc,GAEzB;IAED;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAKtB,+FAA+F;IAC/F,OAAO,CAAC,cAAc;IAStB;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAY7E;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAItE;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAQtD;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAUnD;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAW9E;;OAEG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAa/F;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB5F;;OAEG;IACG,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAclH;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,eAAe,EACxB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,cAAc,CAAC;IAmB1B;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAUnF;;OAEG;IACG,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;CAG/C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,yBAAyB,GACxC,eAAe,CAEjB"}
+{"version":3,"file":"approval.service.d.ts","sourceRoot":"","sources":["../../src/services/approval.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,uBAAuB,GAAG,SAAS,CAAC;AAEhG;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,8GAA8G;IAC9G,SAAS,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACjD,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8GAA8G;IAC9G,SAAS,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IACnD,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,qBAKa,eAAe;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,aAAa,GAAE,yBAA2C;IAG7E,kGAAkG;IAClG,OAAO,CAAC,UAAU;IAIlB,qGAAqG;IACrG,OAAO,KAAK,cAAc,GAEzB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAKtB,+FAA+F;IAC/F,OAAO,CAAC,cAAc;IAStB;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAY7E;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAItE;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAQtD;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAUnD;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAO9E;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAQ/D;;OAEG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAa/F;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB5F;;OAEG;IACG,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAclH;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,eAAe,EACxB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,cAAc,CAAC;IAmB1B;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAUnF;;OAEG;IACG,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;CAG/C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,yBAAyB,GACxC,eAAe,CAEjB"}

package/stores/approval-storage.store.d.ts

@@ -37,6 +37,8 @@ export interface ApprovalStorageStoreOptions {
  */
 export declare class ApprovalStorageStore implements ApprovalStore {
     private storage;
+    /** Revoked approvals live beside the live ones, in a namespace no live-approval query scans. */
+    private revocationStorage?;
     private readonly options;
     private cleanupInterval?;
     private initialized;
@@ -46,6 +48,7 @@ export declare class ApprovalStorageStore implements ApprovalStore {
      * Initialize the storage connection.
      */
     initialize(): Promise<void>;
+    private get revocations();
     private ensureInitialized;
     private buildKey;
     /**
@@ -85,6 +88,15 @@ export declare class ApprovalStorageStore implements ApprovalStore {
      * (session, user, time-limited and context approvals alike). Recorded denials are kept.
      */
     revokeApproval(options: RevokeApprovalOptions): Promise<boolean>;
+    /**
+     * Deletes the key that holds `record`, if it still does, and reports whether this call deleted
+     * it. Two calls racing for one approval both find it, but only one deletes it, and a denial or
+     * approval written to the key after it was read is kept.
+     */
+    consumeApproval(record: ApprovalRecord, sessionId: string, userId?: string, context?: ApprovalContext): Promise<boolean>;
+    /** Deletes `key` only while it still holds `storedValue`, in one step where the backend allows. */
+    private deleteIfUnchanged;
+    getRevocations(toolId: string, sessionId: string, userId?: string, context?: ApprovalContext): Promise<ApprovalRecord[]>;
     isApproved(toolId: string, sessionId: string, userId?: string, context?: ApprovalContext): Promise<boolean>;
     clearSessionApprovals(sessionId: string): Promise<number>;
     clearExpiredApprovals(): Promise<number>;

package/stores/approval-storage.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-storage.store.d.ts","sourceRoot":"","sources":["../../src/stores/approval-storage.store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACnG,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,4BAA4B,CAAC;AAqBpC;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB;;OAEG;IACH,eAAe,CAAC,EAAE,WAAW,GAAG,iBAAiB,CAAC;IAElD;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAMD;;;GAGG;AACH,qBAKa,oBAAqB,YAAW,aAAa;IACxD,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAEtB;IACF,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,GAAE,2BAAgC;IASrD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAwBjC,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,QAAQ;IAQhB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAItB,4CAA4C;IAC5C,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;IAgBlB;;;OAGG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,EAAE,CAAC;IAa5B;;;OAGG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAKhC,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAwC/D,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAkC3E;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuChE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAK3G,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoBzD,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAuBxC,QAAQ,IAAI,OAAO,CAAC;QACxB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;KACxC,CAAC;IAsCI,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAY7B;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,IAAI,CAAC,2BAA2B,EAAE,SAAS,GAAG,iBAAiB,CAAM,GAC7E,oBAAoB,CAMtB"}
+{"version":3,"file":"approval-storage.store.d.ts","sourceRoot":"","sources":["../../src/stores/approval-storage.store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACnG,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,4BAA4B,CAAC;AAsCpC;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB;;OAEG;IACH,eAAe,CAAC,EAAE,WAAW,GAAG,iBAAiB,CAAC;IAElD;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAMD;;;GAGG;AACH,qBAKa,oBAAqB,YAAW,aAAa;IACxD,OAAO,CAAC,OAAO,CAAqB;IACpC,gGAAgG;IAChG,OAAO,CAAC,iBAAiB,CAAC,CAAoB;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAEtB;IACF,OAAO,CAAC,eAAe,CAAC,CAAiB;IACzC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAS;gBAEjB,OAAO,GAAE,2BAAgC;IASrD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAwBjC,OAAO,KAAK,WAAW,GAMtB;IAED,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,QAAQ;IAQhB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAItB,4CAA4C;IAC5C,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;IAgBlB;;;OAGG;IACG,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,EAAE,CAAC;IAa5B;;;OAGG;IACG,WAAW,CACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAKhC,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAwC/D,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAkC3E;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC;IA+CtE;;;;OAIG;IACG,eAAe,CACnB,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,CAAC;IAanB,mGAAmG;YACrF,iBAAiB;IASzB,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,EAAE,CAAC;IAWtB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAK3G,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoBzD,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAuBxC,QAAQ,IAAI,OAAO,CAAC;QACxB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;KACxC,CAAC;IAsCI,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAa7B;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,IAAI,CAAC,2BAA2B,EAAE,SAAS,GAAG,iBAAiB,CAAM,GAC7E,oBAAoB,CAMtB"}

package/stores/approval-store.interface.d.ts

@@ -3,7 +3,7 @@
  *
  * @module @frontmcp/plugin-approval
  */
-import type { ApprovalScope, ApprovalState, ApprovalContext, ApprovalGrantor, ApprovalRevoker, ApprovalRecord, ApprovalSourceType, RevocationSourceType } from '../types';
+import type { ApprovalContext, ApprovalGrantor, ApprovalRecord, ApprovalRevoker, ApprovalScope, ApprovalSourceType, ApprovalState, RevocationSourceType } from '../types';
 /**
  * Query options for finding approvals.
  */
@@ -101,6 +101,20 @@ export interface ApprovalStore {
      * (only the given context's, when `context` is set). Recorded denials are kept.
      */
     revokeApproval(options: RevokeApprovalOptions): Promise<boolean>;
+    /**
+     * Use up one approval: delete the stored record `record` (one `getApprovals()` returned for this
+     * caller) and resolve `true` only for the call that deleted it, so two calls racing for one
+     * approval cannot both get it. A record written in its place since it was read (a denial, a new
+     * approval) must be kept, so the delete has to compare and delete in one step. The approval gate uses it for `alwaysPrompt` tools, where each
+     * approval admits a single call. Optional: for a store without it the gate revokes the caller's
+     * approvals of the tool instead.
+     */
+    consumeApproval?(record: ApprovalRecord, sessionId: string, userId?: string, context?: ApprovalContext): Promise<boolean>;
+    /**
+     * The caller's recent revocations of a tool: each is the approval that was revoked, with `revokedBy`,
+     * `revokedAt` and `revocationReason`. Optional: a store that keeps no revocations leaves it out.
+     */
+    getRevocations?(toolId: string, sessionId: string, userId?: string, context?: ApprovalContext): Promise<ApprovalRecord[]>;
     /**
      * Check if a tool is approved.
      */

package/stores/approval-store.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-store.interface.d.ts","sourceRoot":"","sources":["../../src/stores/approval-store.interface.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,UAAU,CAAC;AAMlB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,sBAAsB;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;IAEtB,gCAAgC;IAChC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IAEzB,sBAAsB;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;IAEtB,gCAAgC;IAChC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IAEzB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,wBAAwB;IACxB,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,iDAAiD;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,qBAAqB;IACrB,KAAK,EAAE,aAAa,CAAC;IAErB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,oCAAoC;IACpC,SAAS,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IAEjD,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,oCAAoC;IACpC,SAAS,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAEnD,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;OAGG;IACH,WAAW,CACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEvC;;;;OAIG;IACH,YAAY,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAExH;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAEhE;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAEtE;;;OAGG;IACH,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjE;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5G;;OAEG;IACH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D;;OAEG;IACH,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;KACxC,CAAC,CAAC;IAEH;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}
+{"version":3,"file":"approval-store.interface.d.ts","sourceRoot":"","sources":["../../src/stores/approval-store.interface.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACrB,MAAM,UAAU,CAAC;AAMlB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,sBAAsB;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;IAEtB,gCAAgC;IAChC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IAEzB,sBAAsB;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;IAEtB,gCAAgC;IAChC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IAEzB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,wBAAwB;IACxB,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,iDAAiD;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,qBAAqB;IACrB,KAAK,EAAE,aAAa,CAAC;IAErB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,oCAAoC;IACpC,SAAS,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IAEjD,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,oCAAoC;IACpC,SAAS,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAEnD,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;OAGG;IACH,WAAW,CACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEvC;;;;OAIG;IACH,YAAY,CAAC,CACX,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAE7B;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAEhE;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAEtE;;;OAGG;IACH,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjE;;;;;;;OAOG;IACH,eAAe,CAAC,CACd,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;OAGG;IACH,cAAc,CAAC,CACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAE7B;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5G;;OAEG;IACH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D;;OAEG;IACH,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;KACxC,CAAC,CAAC;IAEH;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}