@permission-protocol/mcp-guard 0.1.0 → 0.2.0

package/dist/src/approval-server.js

@@ -1,128 +1,387 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_TOKEN_LENGTH = void 0;
 exports.pushReceipt = pushReceipt;
-exports.setOnApprove = setOnApprove;
+exports.toQueueItem = toQueueItem;
+exports.pendingQueue = pendingQueue;
+exports.notifyQueueChange = notifyQueueChange;
 exports.startApprovalServer = startApprovalServer;
+const node_crypto_1 = require("node:crypto");
 const node_http_1 = require("node:http");
+const node_os_1 = require("node:os");
 const pending_js_1 = require("./pending.js");
+const config_js_1 = require("./config.js");
 const approval_ui_js_1 = require("./approval-ui.js");
-/** Recent receipts store (ring buffer) */
-const recentReceipts = [];
+const receipt_js_1 = require("./receipt.js");
+const webhook_js_1 = require("./webhook.js");
+const frame_js_1 = require("./frame.js");
+/**
+ * The local approval channel.
+ *
+ * - Listens on 127.0.0.1 only and rejects any Host header but its own (DNS rebinding).
+ * - Sends no CORS headers: other origins cannot read or drive it.
+ * - Every /api route except the GitHub webhook needs `Authorization: Bearer <token>`.
+ *   The token is generated per process (or supplied via PP_APPROVAL_TOKEN) and reaches
+ *   the browser only in the URL fragment printed at startup; GET / holds no secret.
+ * - Every decision goes through the pending-queue state machine, so final states hold.
+ */
+exports.MIN_TOKEN_LENGTH = 32;
+const MAX_BODY_BYTES = 1024 * 1024;
 const MAX_RECEIPTS = 50;
+const MAX_DELIVERIES = 1000;
+const recentReceipts = [];
 function pushReceipt(receipt) {
     recentReceipts.push(receipt);
     if (recentReceipts.length > MAX_RECEIPTS)
         recentReceipts.shift();
 }
-/** Callback invoked when an action is approved — proxy registers this */
-let onApproveCallback = null;
-function setOnApprove(cb) {
-    onApproveCallback = cb;
+function toQueueItem(p) {
+    const remaining = (0, pending_js_1.countdownRemaining)(p);
+    return {
+        id: p.id,
+        tool_name: p.tool_name,
+        lane: p.lane,
+        reversibility: p.reversibility,
+        // Countdown fields appear only while a countdown is live (a held item has none).
+        ...(remaining !== undefined ? { countdown_seconds: p.countdown_seconds, countdown_remaining: remaining } : {}),
+        ...(p.confidence !== undefined ? { confidence: p.confidence } : {}),
+        summary: p.summary,
+        args_preview: p.args_preview,
+        args_full: JSON.stringify(p.tool_args, null, 2),
+        ...(p.scope ? { scope: { scope: p.scope, ref: p.scope_ref ?? null, sha: p.scope_sha ?? null } } : {}),
+        agent_id: p.agent_id,
+        rule_id: p.rule_id,
+        status: p.status,
+        acted: p.kind === 'acted',
+        created_at: p.created_at,
+        ...(p.expires_at !== undefined ? { expires_at: p.expires_at } : {}),
+        ...(p.receipt_id !== undefined ? { receipt_id: p.receipt_id } : {}),
+    };
+}
+function pendingQueue() {
+    return (0, pending_js_1.getPending)().map(toQueueItem);
+}
+// --- SSE stream plumbing ------------------------------------------------------
+const sseClients = new Set();
+function broadcastQueue() {
+    if (sseClients.size === 0)
+        return;
+    const payload = `event: queue\ndata: ${JSON.stringify(pendingQueue())}\n\n`;
+    for (const client of sseClients) {
+        try {
+            client.write(payload);
+        }
+        catch { /* cleanup happens on 'close' */ }
+    }
+}
+/** Call after any queue mutation so SSE subscribers see it immediately. */
+function notifyQueueChange() {
+    broadcastQueue();
+}
+// --- HTTP helpers -------------------------------------------------------------
+const BASE_HEADERS = {
+    'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'Referrer-Policy': 'no-referrer',
+};
+function json(res, status, data) {
+    res.writeHead(status, { ...BASE_HEADERS, 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(data));
 }
-function parseBody(req) {
+function readBody(req) {
     return new Promise((resolve, reject) => {
         const chunks = [];
-        req.on('data', (c) => chunks.push(c));
+        let size = 0;
+        req.on('data', (c) => {
+            size += c.length;
+            if (size > MAX_BODY_BYTES) {
+                reject(new Error('body too large'));
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
         req.on('end', () => resolve(Buffer.concat(chunks).toString()));
         req.on('error', reject);
     });
 }
-function json(res, status, data) {
-    const body = JSON.stringify(data);
-    res.writeHead(status, {
-        'Content-Type': 'application/json',
-        'Access-Control-Allow-Origin': '*',
-    });
-    res.end(body);
+function digest(s) {
+    return (0, node_crypto_1.createHash)('sha256').update(s).digest();
 }
-function text(res, status, msg) {
-    res.writeHead(status, { 'Content-Type': 'text/plain' });
-    res.end(msg);
+function transitionError(res, r) {
+    if (r.error === 'not_found') {
+        json(res, 404, { error: 'not_found' });
+        return;
+    }
+    if (r.error === 'final') {
+        json(res, 409, { error: 'already_resolved', status: r.action?.status });
+        return;
+    }
+    json(res, 409, { error: 'not_allowed', status: r.action?.status });
 }
-function startApprovalServer(port) {
-    const server = (0, node_http_1.createServer)(async (req, res) => {
-        const url = req.url ?? '/';
-        const method = req.method ?? 'GET';
-        // CORS preflight
-        if (method === 'OPTIONS') {
-            res.writeHead(204, {
-                'Access-Control-Allow-Origin': '*',
-                'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-                'Access-Control-Allow-Headers': 'Content-Type',
-            });
-            res.end();
+function resolveToken(explicit) {
+    const supplied = explicit ?? process.env.PP_APPROVAL_TOKEN;
+    if (supplied !== undefined) {
+        if (supplied.length < exports.MIN_TOKEN_LENGTH) {
+            throw new Error(`Approval token must be at least ${exports.MIN_TOKEN_LENGTH} characters`);
+        }
+        return { token: supplied, generated: false };
+    }
+    return { token: (0, node_crypto_1.randomBytes)(32).toString('base64url'), generated: true };
+}
+function defaultOperator() {
+    try {
+        return (0, node_os_1.userInfo)().username || 'operator';
+    }
+    catch {
+        return 'operator';
+    }
+}
+function startApprovalServer(opts) {
+    const { token, generated } = resolveToken(opts.token);
+    const tokenDigest = digest(token);
+    const operator = opts.operator || defaultOperator();
+    const approval = { kind: 'human', id: operator, via: 'local-token' };
+    const hooks = opts.hooks ?? {};
+    const seenDeliveries = new Set();
+    let boundPort = opts.port;
+    function hostAllowed(req) {
+        const host = req.headers.host;
+        return host === `127.0.0.1:${boundPort}` || host === `localhost:${boundPort}`;
+    }
+    function authorized(req) {
+        const h = req.headers.authorization;
+        if (typeof h !== 'string' || !h.startsWith('Bearer '))
+            return false;
+        return (0, node_crypto_1.timingSafeEqual)(digest(h.slice(7)), tokenDigest);
+    }
+    function issueExternalReceipt(action) {
+        const receipt = (0, receipt_js_1.issueReceipt)({
+            method: 'github/merge',
+            tool: action.tool_name,
+            args: action.tool_args,
+            decision: { decision: 'allowed', rule_id: action.rule_id, reason: 'Approved in the Permission Deck (GitHub webhook)' },
+            approval,
+            actor: action.agent_id,
+            mode: 'enforce',
+            policy_sha256: opts.policySha256 ?? 'github-webhook',
+            ttl_seconds: opts.receiptTtlSeconds ?? config_js_1.DEFAULT_RECEIPT_TTL_SECONDS,
+            target_server: 'github-webhook',
+            scope: { scope: action.scope, scope_ref: action.scope_ref, scope_sha: action.scope_sha },
+        });
+        action.receipt_id = receipt.envelope.receipt_id;
+        (0, receipt_js_1.emitReceipt)(receipt);
+        pushReceipt(receipt);
+        return receipt;
+    }
+    async function handleApi(method, path, req, res) {
+        if (method === 'GET' && path === '/api/pending') {
+            json(res, 200, pendingQueue());
             return;
         }
-        try {
-            // GET / — Approval UI
-            if (method === 'GET' && url === '/') {
-                res.writeHead(200, { 'Content-Type': 'text/html' });
-                res.end((0, approval_ui_js_1.getApprovalHTML)());
+        if (method === 'GET' && path === '/api/receipts') {
+            json(res, 200, recentReceipts.slice().reverse());
+            return;
+        }
+        if (method === 'GET' && path === '/api/stream') {
+            res.writeHead(200, { ...BASE_HEADERS, 'Content-Type': 'text/event-stream', Connection: 'keep-alive' });
+            res.write(`event: queue\ndata: ${JSON.stringify(pendingQueue())}\n\n`);
+            sseClients.add(res);
+            req.on('close', () => sseClients.delete(res));
+            return;
+        }
+        const m = method === 'POST' ? path.match(/^\/api\/(approve|deny|hold)\/([a-f0-9-]{36})$/) : null;
+        if (!m) {
+            json(res, 404, { error: 'not_found' });
+            return;
+        }
+        const [, verb, id] = m;
+        const existing = (0, pending_js_1.getAction)(id);
+        if (!existing) {
+            json(res, 404, { error: 'not_found' });
+            return;
+        }
+        if (verb === 'hold') {
+            const r = (0, pending_js_1.transition)(id, 'hold');
+            if (!r.ok) {
+                transitionError(res, r);
                 return;
             }
-            // GET /api/pending
-            if (method === 'GET' && url === '/api/pending') {
-                const pending = (0, pending_js_1.getPending)().map(p => ({
-                    id: p.id,
-                    timestamp: p.timestamp,
-                    tool_name: p.tool_name,
-                    tool_args: p.tool_args,
-                    agent_id: p.agent_id,
-                    rule_id: p.rule_id,
-                    status: p.status,
-                }));
-                json(res, 200, pending);
+            process.stderr.write(`[mcp-guard] Held (countdown cancelled): ${r.action.tool_name} (${id})\n`);
+            notifyQueueChange();
+            json(res, 200, { id, status: 'pending' });
+            return;
+        }
+        if (verb === 'deny') {
+            const r = (0, pending_js_1.transition)(id, 'deny');
+            if (!r.ok) {
+                transitionError(res, r);
                 return;
             }
-            // POST /api/approve/:id
-            const approveMatch = url.match(/^\/api\/approve\/([a-f0-9-]+)$/);
-            if (method === 'POST' && approveMatch) {
-                const id = approveMatch[1];
-                const action = (0, pending_js_1.resolveAction)(id, 'approved');
-                if (!action) {
-                    json(res, 404, { error: 'Not found or already resolved' });
-                    return;
-                }
-                process.stderr.write(`[mcp-guard] Approved: ${action.tool_name} (${id})\n`);
-                // Notify proxy to forward the original request
-                if (onApproveCallback)
-                    onApproveCallback(id);
-                json(res, 200, { id, status: 'approved' });
+            process.stderr.write(`[mcp-guard] Denied by ${operator}: ${r.action.tool_name} (${id})\n`);
+            if (r.action.kind === 'held')
+                r.action.resolve((0, frame_js_1.errorLine)(r.action.jsonrpcId, frame_js_1.DENIED, `Denied by ${operator}`));
+            notifyQueueChange();
+            json(res, 200, { id, status: 'denied' });
+            return;
+        }
+        // approve
+        if (existing.kind === 'acted') {
+            const r = (0, pending_js_1.transition)(id, 'acknowledge');
+            if (!r.ok) {
+                transitionError(res, r);
                 return;
             }
-            // POST /api/deny/:id
-            const denyMatch = url.match(/^\/api\/deny\/([a-f0-9-]+)$/);
-            if (method === 'POST' && denyMatch) {
-                const id = denyMatch[1];
-                const action = (0, pending_js_1.resolveAction)(id, 'denied');
-                if (!action) {
-                    json(res, 404, { error: 'Not found or already resolved' });
-                    return;
-                }
-                process.stderr.write(`[mcp-guard] Denied: ${action.tool_name} (${id})\n`);
-                // Return JSON-RPC error to the waiting caller
-                const errResp = JSON.stringify({
-                    jsonrpc: '2.0',
-                    id: action.jsonrpcId,
-                    error: { code: -32002, message: 'Denied by administrator' },
+            process.stderr.write(`[mcp-guard] Acknowledged (verify): ${r.action.tool_name} (${id})\n`);
+            notifyQueueChange();
+            json(res, 200, { id, status: 'acknowledged', receipt_id: r.action.receipt_id ?? null });
+            return;
+        }
+        const r = (0, pending_js_1.transition)(id, 'approve');
+        if (!r.ok) {
+            transitionError(res, r);
+            return;
+        }
+        let receipt;
+        if (r.action.kind === 'external') {
+            receipt = issueExternalReceipt(r.action);
+        }
+        else if (hooks.release) {
+            receipt = hooks.release(r.action, approval);
+        }
+        else {
+            throw new Error('No release hook registered for held requests');
+        }
+        process.stderr.write(`[mcp-guard] Approved by ${operator}: ${r.action.tool_name} (${id}) → receipt ${receipt.envelope.receipt_id}\n`);
+        notifyQueueChange();
+        json(res, 200, { id, status: 'approved', receipt_id: receipt.envelope.receipt_id });
+    }
+    async function handleWebhook(req, res) {
+        const raw = await readBody(req);
+        const sig = req.headers['x-hub-signature-256'];
+        if (!(0, webhook_js_1.verifyGithubSignature)(process.env.PP_WEBHOOK_SECRET, raw, sig)) {
+            process.stderr.write('[mcp-guard] Webhook REJECTED — bad/missing signature\n');
+            json(res, 401, { error: 'invalid signature' });
+            return;
+        }
+        const delivery = req.headers['x-github-delivery'];
+        if (typeof delivery === 'string' && delivery) {
+            if (seenDeliveries.has(delivery)) {
+                json(res, 200, { ignored: true, reason: 'duplicate delivery' });
+                return;
+            }
+            seenDeliveries.add(delivery);
+            if (seenDeliveries.size > MAX_DELIVERIES) {
+                const oldest = seenDeliveries.values().next().value;
+                if (oldest !== undefined)
+                    seenDeliveries.delete(oldest);
+            }
+        }
+        let payload;
+        try {
+            payload = JSON.parse(raw);
+        }
+        catch {
+            json(res, 400, { error: 'invalid JSON' });
+            return;
+        }
+        const ev = (0, webhook_js_1.parsePrEvent)(payload);
+        if (!ev) {
+            json(res, 200, { ignored: true, reason: 'not a pull_request event' });
+            return;
+        }
+        if (!(0, webhook_js_1.shouldGate)(ev)) {
+            json(res, 200, { ignored: true, reason: 'no needs-authority label or irrelevant action' });
+            return;
+        }
+        const sc = (0, webhook_js_1.scopeForPr)(ev);
+        const item = (0, pending_js_1.addExternalDecision)({
+            toolName: 'merge_pr',
+            agentId: 'github-webhook',
+            ruleId: 'pr-needs-authority',
+            enrichment: {
+                lane: 'decide',
+                reversibility: 'reversible',
+                summary: `Merge ${ev.repo} #${ev.pr_number} · ${ev.title}`,
+                args_preview: JSON.stringify({ repo: ev.repo, pr_number: ev.pr_number, title: ev.title, head_sha: ev.head_sha, html_url: ev.html_url }),
+            },
+            toolArgs: { repo: ev.repo, pr_number: ev.pr_number, scope_sha: ev.head_sha },
+            ...sc,
+        });
+        process.stderr.write(`[mcp-guard] Webhook queued PR ${ev.repo}#${ev.pr_number} for authority (${item.id})\n`);
+        notifyQueueChange();
+        json(res, 202, { queued: true, id: item.id, scope_ref: sc.scope_ref });
+    }
+    const server = (0, node_http_1.createServer)(async (req, res) => {
+        const method = req.method ?? 'GET';
+        const path = (req.url ?? '/').split('?')[0];
+        try {
+            if (!hostAllowed(req)) {
+                json(res, 421, { error: 'misdirected request' });
+                return;
+            }
+            if (method === 'GET' && path === '/') {
+                res.writeHead(200, {
+                    ...BASE_HEADERS,
+                    'Content-Type': 'text/html; charset=utf-8',
+                    'Content-Security-Policy': "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'",
                 });
-                action.resolve(errResp);
-                json(res, 200, { id, status: 'denied' });
+                res.end((0, approval_ui_js_1.getApprovalHTML)());
+                return;
+            }
+            if (method === 'POST' && path === '/api/github/webhook') {
+                await handleWebhook(req, res);
                 return;
             }
-            // GET /api/receipts
-            if (method === 'GET' && url === '/api/receipts') {
-                json(res, 200, recentReceipts.slice(-50).reverse());
+            if (path.startsWith('/api/')) {
+                if (!authorized(req)) {
+                    json(res, 401, { error: 'unauthorized' });
+                    return;
+                }
+                await handleApi(method, path, req, res);
                 return;
             }
-            text(res, 404, 'Not found');
+            json(res, 404, { error: 'not_found' });
         }
         catch (err) {
-            text(res, 500, err.message ?? 'Internal error');
+            process.stderr.write(`[mcp-guard] Approval server error: ${err?.message ?? err}\n`);
+            if (!res.headersSent)
+                json(res, 500, { error: 'internal_error' });
+            else
+                res.end();
         }
     });
-    server.listen(port, () => {
-        process.stderr.write(`[mcp-guard] Approval UI: http://localhost:${port}\n`);
+    // ~1s tick so countdown_remaining counts down live for SSE subscribers.
+    const tick = setInterval(() => broadcastQueue(), 1000);
+    tick.unref?.();
+    const ready = new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(opts.port, '127.0.0.1', () => {
+            boundPort = server.address().port;
+            const url = `http://127.0.0.1:${boundPort}/`;
+            process.stderr.write(generated
+                ? `[mcp-guard] Approval UI: ${url}#t=${token}\n`
+                : `[mcp-guard] Approval UI: ${url} (token from PP_APPROVAL_TOKEN)\n`);
+            resolve(boundPort);
+        });
     });
+    return {
+        token,
+        operator,
+        ready,
+        close: () => new Promise((resolve) => {
+            clearInterval(tick);
+            for (const client of sseClients) {
+                try {
+                    client.end();
+                }
+                catch { /* ignore */ }
+            }
+            sseClients.clear();
+            server.close(() => resolve());
+            server.closeAllConnections?.();
+        }),
+    };
 }
 //# sourceMappingURL=approval-server.js.map

package/dist/src/approval-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-server.js","sourceRoot":"","sources":["../../src/approval-server.ts"],"names":[],"mappings":";;AASA,kCAGC;AAKD,oCAEC;AAyBD,kDA2FC;AAvID,yCAAoF;AACpF,6CAAoF;AACpF,qDAAmD;AAGnD,0CAA0C;AAC1C,MAAM,cAAc,GAAc,EAAE,CAAC;AACrC,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,SAAgB,WAAW,CAAC,OAAgB;IAC1C,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,cAAc,CAAC,MAAM,GAAG,YAAY;QAAE,cAAc,CAAC,KAAK,EAAE,CAAC;AACnE,CAAC;AAED,yEAAyE;AACzE,IAAI,iBAAiB,GAAkC,IAAI,CAAC;AAE5D,SAAgB,YAAY,CAAC,EAAwB;IACnD,iBAAiB,GAAG,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,SAAS,CAAC,GAAoB;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,kBAAkB;QAClC,6BAA6B,EAAE,GAAG;KACnC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,GAAW;IAC5D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,MAAM,GAAG,IAAA,wBAAY,EAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QAEnC,iBAAiB;QACjB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,6BAA6B,EAAE,GAAG;gBAClC,8BAA8B,EAAE,oBAAoB;gBACpD,8BAA8B,EAAE,cAAc;aAC/C,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,sBAAsB;YACtB,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,IAAA,gCAAe,GAAE,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,mBAAmB;YACnB,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;gBAC/C,MAAM,OAAO,GAAG,IAAA,uBAAU,GAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACrC,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;iBACjB,CAAC,CAAC,CAAC;gBACJ,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,wBAAwB;YACxB,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACjE,IAAI,MAAM,KAAK,MAAM,IAAI,YAAY,EAAE,CAAC;gBACtC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC3B,MAAM,MAAM,GAAG,IAAA,0BAAa,EAAC,EAAE,EAAE,UAAU,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;oBAC3D,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,SAAS,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC5E,+CAA+C;gBAC/C,IAAI,iBAAiB;oBAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,qBAAqB;YACrB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC3D,IAAI,MAAM,KAAK,MAAM,IAAI,SAAS,EAAE,CAAC;gBACnC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACxB,MAAM,MAAM,GAAG,IAAA,0BAAa,EAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;oBAC3D,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,MAAM,CAAC,SAAS,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC1E,8CAA8C;gBAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;oBAC7B,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,MAAM,CAAC,SAAS;oBACpB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE;iBAC5D,CAAC,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACxB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,oBAAoB;YACpB,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;gBAChD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,IAAI,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"approval-server.js","sourceRoot":"","sources":["../../src/approval-server.ts"],"names":[],"mappings":";;;AAuCA,kCAGC;AAmDD,kCAsBC;AAED,oCAEC;AAeD,8CAEC;AAuDD,kDA+MC;AA9YD,6CAAuE;AACvE,yCAAoF;AAEpF,qCAAmC;AACnC,6CAQsB;AAGtB,2CAA0D;AAC1D,qDAAmD;AACnD,6CAAsF;AACtF,6CAA2F;AAC3F,yCAA+C;AAE/C;;;;;;;;;GASG;AAEU,QAAA,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAM,cAAc,GAAc,EAAE,CAAC;AAErC,SAAgB,WAAW,CAAC,OAAgB;IAC1C,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,cAAc,CAAC,MAAM,GAAG,YAAY;QAAE,cAAc,CAAC,KAAK,EAAE,CAAC;AACnE,CAAC;AAmDD,SAAgB,WAAW,CAAC,CAAgB;IAC1C,MAAM,SAAS,GAAG,IAAA,+BAAkB,EAAC,CAAC,CAAC,CAAC;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,iFAAiF;QACjF,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9G,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrG,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,OAAO;QACzB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY;IAC1B,OAAO,IAAA,uBAAU,GAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,GAAwB,IAAI,GAAG,EAAE,CAAC;AAElD,SAAS,cAAc;IACrB,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,OAAO,GAAG,uBAAuB,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC;IAC5E,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC;YAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAgB,iBAAiB;IAC/B,cAAc,EAAE,CAAC;AACnB,CAAC;AAED,iFAAiF;AAEjF,MAAM,YAAY,GAAG;IACnB,eAAe,EAAE,UAAU;IAC3B,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,aAAa;CACjC,CAAC;AAEF,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC1F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB,EAAE,CAA2C;IACvF,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAChF,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC7G,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,QAA4B;IAChD,MAAM,QAAQ,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,MAAM,GAAG,wBAAgB,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,wBAAgB,aAAa,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QAAC,OAAO,IAAA,kBAAQ,GAAE,CAAC,QAAQ,IAAI,UAAU,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,UAAU,CAAC;IAAC,CAAC;AAChF,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAA2B;IAC7D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAa,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC;IAE1B,SAAS,WAAW,CAAC,GAAoB;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,OAAO,IAAI,KAAK,aAAa,SAAS,EAAE,IAAI,IAAI,KAAK,aAAa,SAAS,EAAE,CAAC;IAChF,CAAC;IAED,SAAS,UAAU,CAAC,GAAoB;QACtC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACpC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACpE,OAAO,IAAA,6BAAe,EAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1D,CAAC;IAED,SAAS,oBAAoB,CAAC,MAAqB;QACjD,MAAM,OAAO,GAAG,IAAA,yBAAY,EAAC;YAC3B,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,MAAM,CAAC,SAAS;YACtB,IAAI,EAAE,MAAM,CAAC,SAAS;YACtB,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,kDAAkD,EAAE;YACtH,QAAQ;YACR,KAAK,EAAE,MAAM,CAAC,QAAQ;YACtB,IAAI,EAAE,SAAS;YACf,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,gBAAgB;YACpD,WAAW,EAAE,IAAI,CAAC,iBAAiB,IAAI,uCAA2B;YAClE,aAAa,EAAE,gBAAgB;YAC/B,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;SACzF,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAChD,IAAA,wBAAW,EAAC,OAAO,CAAC,CAAC;QACrB,WAAW,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,IAAY,EAAE,GAAoB,EAAE,GAAmB;QAC9F,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAE5F,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAE/G,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;YACvG,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC;YACvE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,MAAM,CAAC,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjG,IAAI,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3D,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAA,sBAAS,EAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAElE,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,IAAA,uBAAU,EAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,KAAK,CAAC,CAAC;YAChG,iBAAiB,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,IAAA,uBAAU,EAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3F,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;gBAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAA,oBAAS,EAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,iBAAM,EAAE,aAAa,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC/G,iBAAiB,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QAED,UAAU;QACV,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,IAAA,uBAAU,EAAC,EAAE,EAAE,aAAa,CAAC,CAAC;YACxC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3F,iBAAiB,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,MAAM,CAAC,GAAG,IAAA,uBAAU,EAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/C,IAAI,OAA4B,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,eAAe,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;QACtI,iBAAiB,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAoB,EAAE,GAAmB;QACpE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAuB,CAAC;QACrE,IAAI,CAAC,IAAA,kCAAqB,EAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC/E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAClD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAC7C,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC9G,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,IAAI,cAAc,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;gBACzC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBACpD,IAAI,MAAM,KAAK,SAAS;oBAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,IAAI,OAAY,CAAC;QACjB,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/F,MAAM,EAAE,GAAG,IAAA,yBAAY,EAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3F,IAAI,CAAC,IAAA,uBAAU,EAAC,EAAE,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5H,MAAM,EAAE,GAAG,IAAA,uBAAU,EAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAA,gCAAmB,EAAC;YAC/B,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,oBAAoB;YAC5B,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,aAAa,EAAE,YAAY;gBAC3B,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,KAAK,EAAE;gBAC1D,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC;aACxI;YACD,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE;YAC5E,GAAG,EAAE;SACN,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,SAAS,mBAAmB,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9G,iBAAiB,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,wBAAY,EAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAEpF,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,GAAG,YAAY;oBACf,cAAc,EAAE,0BAA0B;oBAC1C,yBAAyB,EAAE,uHAAuH;iBACnJ,CAAC,CAAC;gBACH,GAAG,CAAC,GAAG,CAAC,IAAA,gCAAe,GAAE,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBAAC,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAEnG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC5E,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,EAAE,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC;YACpF,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;;gBAC7D,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IAEf,MAAM,KAAK,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACzC,SAAS,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;YACnD,MAAM,GAAG,GAAG,oBAAoB,SAAS,GAAG,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS;gBACP,CAAC,CAAC,4BAA4B,GAAG,MAAM,KAAK,IAAI;gBAChD,CAAC,CAAC,4BAA4B,GAAG,mCAAmC,CACvE,CAAC;YACF,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,QAAQ;QACR,KAAK;QACL,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5B,aAAa,CAAC,IAAI,CAAC,CAAC;YACpB,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAAC,CAAC;YACjF,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACjC,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/src/approval-ui.d.ts

@@ -1 +1,6 @@
+/**
+ * The built-in approval page. It is static and holds no secret: the access token
+ * arrives in the URL fragment (`#t=…`, never sent to any server), is kept in
+ * sessionStorage for this tab, and is sent as `Authorization: Bearer` on every call.
+ */
 export declare function getApprovalHTML(): string;