@securecode-ai/mcp 0.5.5 → 0.5.6

package/dist/api/types.d.ts

@@ -184,18 +184,25 @@ export interface SandboxProveResponse {
         exploitStatus?: number;
     };
     scanCredits?: number;
+    proofEvidence?: import('../attack/proofTypes').ProofEvidence;
+    proofGateResult?: import('../attack/proofTypes').ProofGateResult;
 }
 export interface VerifyGenerateResponse {
     canTest: boolean;
     testScript?: string;
+    setupScript?: string | null;
     runner?: string;
     description?: string;
     skipReason?: string;
     scanCredits?: number;
+    /** Dollar cost the API charged for this generate call (credits → USD). */
+    costUsd?: number;
 }
 export interface VerifyAnalyzeResponse {
     verdict: 'PROVEN' | 'UNPROVEN' | 'INCONCLUSIVE';
     reason: string;
     shouldRetry: boolean;
     scanCredits?: number;
+    /** Dollar cost the API charged for this analyze call (credits → USD). */
+    costUsd?: number;
 }

package/dist/approval/auditLog.d.ts

@@ -1,3 +1,3 @@
 import type { AuditEntry } from './types';
-export declare function appendAudit(entry: AuditEntry): void;
+export declare function appendAudit(entry: AuditEntry): boolean;
 export declare function readAudit(limit?: number): AuditEntry[];

package/dist/approval/auditLog.js

@@ -40,6 +40,8 @@ const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const AUDIT_DIR = path.join(os.homedir(), '.securecode');
 const AUDIT_FILE = path.join(AUDIT_DIR, 'approval-audit.log');
+const MAX_ENTRIES = 200;
+let auditWriteFailed = false;
 function appendAudit(entry) {
     try {
         if (!fs.existsSync(AUDIT_DIR)) {
@@ -47,12 +49,18 @@ function appendAudit(entry) {
         }
         const line = JSON.stringify(entry) + '\n';
         fs.appendFileSync(AUDIT_FILE, line, { mode: 0o600 });
+        auditWriteFailed = false;
+        return true;
     }
-    catch {
-        // best effort — audit failure must not block the operation
+    catch (err) {
+        if (!auditWriteFailed) {
+            auditWriteFailed = true;
+            console.warn(`[securecode] Audit write failed: ${err?.message || err}. Further audit failures will be silent.`);
+        }
+        return false;
     }
 }
-function readAudit(limit = 100) {
+function readAudit(limit = MAX_ENTRIES) {
     try {
         if (!fs.existsSync(AUDIT_FILE))
             return [];

package/dist/approval/auditLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../src/approval/auditLog.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,kCAUC;AAED,8BASC;AA7BD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAGzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAE9D,SAAgB,WAAW,CAAC,KAAiB;IACzC,IAAI,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1C,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACL,2DAA2D;IAC/D,CAAC;AACL,CAAC;AAED,SAAgB,SAAS,CAAC,QAAgB,GAAG;IACzC,IAAI,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC"}
+{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../src/approval/auditLog.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,kCAgBC;AAED,8BASC;AAtCD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAGzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAC9D,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B,SAAgB,WAAW,CAAC,KAAiB;IACzC,IAAI,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1C,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,gBAAgB,GAAG,KAAK,CAAC;QACzB,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpB,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,oCAAoC,GAAG,EAAE,OAAO,IAAI,GAAG,0CAA0C,CAAC,CAAC;QACpH,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,SAAgB,SAAS,CAAC,QAAgB,WAAW;IACjD,IAAI,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC"}

package/dist/approval/broker.d.ts

@@ -1,4 +1,4 @@
-import { type ApprovalResult } from './types';
+import { type ApprovalResult, type OperationCategory } from './types';
 export declare class ApprovalBroker {
     private server;
     private port;
@@ -6,6 +6,11 @@ export declare class ApprovalBroker {
     start(): Promise<number>;
     stop(): Promise<void>;
     getPort(): number;
-    requestApproval(tool: string, summary: string, operationParts: unknown[], timeoutMs?: number): Promise<ApprovalResult>;
+    requestApproval(tool: string, summary: string, operationParts: unknown[], timeoutMs?: number, category?: OperationCategory, workspaceRoot?: string | null): Promise<ApprovalResult>;
+    private settle;
+    private isLocalOrigin;
+    private isLocalHost;
     private handle;
+    private handleDetails;
+    private handleDecide;
 }

package/dist/approval/broker.js

@@ -38,6 +38,9 @@ const http = __importStar(require("http"));
 const child_process_1 = require("child_process");
 const types_1 = require("./types");
 const auditLog_1 = require("./auditLog");
+const MAX_PENDING = 16;
+const MAX_BODY_BYTES = 4096;
+const LOOPBACK = '127.0.0.1';
 const APPROVAL_PAGE_HTML = `<!DOCTYPE html>
 <html>
 <head>
@@ -55,6 +58,7 @@ button { padding: 10px 24px; border: none; border-radius: 6px; font-size: 14px;
 .result { margin-top: 24px; font-size: 16px; font-weight: 600; }
 .timeout { color: #d97706; }
 .expired { display: none; color: #dc2626; }
+.error { color: #dc2626; }
 </style>
 </head>
 <body>
@@ -70,42 +74,65 @@ button { padding: 10px 24px; border: none; border-radius: 6px; font-size: 14px;
 <script>
 const params = new URLSearchParams(window.location.search);
 const reqId = params.get('id');
-document.getElementById('tool').textContent = params.get('tool') || '';
-document.getElementById('hash').textContent = params.get('hash') || '';
-document.getElementById('summary').textContent = decodeURIComponent(params.get('summary') || '');
+let decisionToken = '';
 
-async function respond(approved) {
-document.getElementById('buttons').style.display = 'none';
-const res = document.getElementById('result');
-try {
-const r = await fetch('/decide', {
-method: 'POST',
-headers: {'Content-Type': 'application/json'},
-body: JSON.stringify({ id: reqId, approved })
-});
-const data = await r.json();
-if (data.ok) {
-res.textContent = approved ? 'Approved. You can close this page.' : 'Denied. You can close this page.';
-res.style.color = approved ? '#16a34a' : '#dc2626';
-} else {
-res.textContent = 'Error: ' + (data.error || 'unknown');
-res.style.color = '#dc2626';
-}
-} catch (e) {
-res.textContent = 'Error: ' + e.message;
-res.style.color = '#dc2626';
-}
+async function loadDetails() {
+    try {
+        const r = await fetch('/details?id=' + encodeURIComponent(reqId || ''));
+        const data = await r.json();
+        if (!data.ok) {
+            document.getElementById('buttons').style.display = 'none';
+            const el = document.getElementById('result');
+            el.textContent = 'Error: ' + (data.error || 'unknown');
+            el.style.color = '#dc2626';
+            return;
+        }
+        document.getElementById('tool').textContent = data.tool || '';
+        document.getElementById('hash').textContent = data.operationHash || '';
+        document.getElementById('summary').textContent = data.summary || '';
+        decisionToken = data.decisionToken || '';
+        if (data.expiresAt && Date.now() > data.expiresAt) {
+            document.getElementById('buttons').style.display = 'none';
+            document.getElementById('expired').style.display = 'block';
+        }
+    } catch (e) {
+        document.getElementById('buttons').style.display = 'none';
+        const el = document.getElementById('result');
+        el.textContent = 'Error loading details: ' + e.message;
+        el.style.color = '#dc2626';
+    }
 }
 
-const expiresAt = parseInt(params.get('exp') || '0');
-if (expiresAt && Date.now() > expiresAt) {
-document.getElementById('buttons').style.display = 'none';
-document.getElementById('expired').style.display = 'block';
+async function respond(approved) {
+    document.getElementById('buttons').style.display = 'none';
+    const res = document.getElementById('result');
+    try {
+        const r = await fetch('/decide', {
+            method: 'POST',
+            headers: {'Content-Type': 'application/json'},
+            body: JSON.stringify({ id: reqId, decisionToken, approved })
+        });
+        const data = await r.json();
+        if (data.ok) {
+            res.textContent = approved ? 'Approved. You can close this page.' : 'Denied. You can close this page.';
+            res.style.color = approved ? '#16a34a' : '#dc2626';
+        } else {
+            res.textContent = 'Error: ' + (data.error || 'unknown');
+            res.style.color = '#dc2626';
+        }
+    } catch (e) {
+        res.textContent = 'Error: ' + e.message;
+        res.style.color = '#dc2626';
+    }
 }
+
+loadDetails();
 </script>
 </body>
 </html>`;
 function openBrowser(url) {
+    if (process.env.SECURECODE_TEST_MODE === '1')
+        return;
     const platform = process.platform;
     try {
         if (platform === 'darwin') {
@@ -122,14 +149,23 @@ function openBrowser(url) {
         // If browser open fails, the user can copy the URL from stdout
     }
 }
+const SECURITY_HEADERS = {
+    'Content-Security-Policy': "default-src 'self'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'",
+    'X-Content-Type-Options': 'nosniff',
+    'Cache-Control': 'no-store',
+    'Referrer-Policy': 'no-referrer',
+};
 class ApprovalBroker {
     server = null;
     port = 0;
     pending = new Map();
     async start() {
-        return new Promise((resolve) => {
+        return new Promise((resolve, reject) => {
             this.server = http.createServer((req, res) => this.handle(req, res));
-            this.server.listen(0, '127.0.0.1', () => {
+            this.server.once('error', (err) => {
+                reject(err);
+            });
+            this.server.listen(0, LOOPBACK, () => {
                 const addr = this.server.address();
                 this.port = addr.port;
                 resolve(this.port);
@@ -137,6 +173,9 @@ class ApprovalBroker {
         });
     }
     async stop() {
+        for (const [, entry] of this.pending) {
+            this.settle(entry, false, 'shutdown', 'Broker shutting down');
+        }
         return new Promise((resolve) => {
             if (this.server) {
                 this.server.close(() => resolve());
@@ -149,104 +188,194 @@ class ApprovalBroker {
     getPort() {
         return this.port;
     }
-    requestApproval(tool, summary, operationParts, timeoutMs = 60_000) {
+    requestApproval(tool, summary, operationParts, timeoutMs = 60_000, category = 'paid-generation', workspaceRoot = null) {
         return new Promise((resolve) => {
-            const req = (0, types_1.createApprovalRequest)(tool, summary, operationParts, timeoutMs);
-            const startTime = Date.now();
-            this.pending.set(req.id, { req, resolve });
-            const url = `http://127.0.0.1:${this.port}/?id=${req.id}&tool=${encodeURIComponent(tool)}&hash=${req.operationHash}&summary=${encodeURIComponent(summary)}&exp=${req.expiresAt}`;
-            console.error(`[securecode] Approval required for ${tool}. Open: ${url}`);
-            openBrowser(url);
+            if (this.pending.size >= MAX_PENDING) {
+                resolve({
+                    approved: false,
+                    reason: 'Too many pending approval requests',
+                    requestId: '',
+                    duration: 0,
+                    category,
+                });
+                return;
+            }
+            const req = (0, types_1.createApprovalRequest)(tool, summary, operationParts, timeoutMs, category, workspaceRoot);
+            const startTime = req.createdAt;
             const timer = setTimeout(() => {
                 const entry = this.pending.get(req.id);
-                if (entry) {
-                    this.pending.delete(req.id);
-                    const result = {
-                        approved: false,
-                        reason: 'Request timed out',
-                        requestId: req.id,
-                        duration: Date.now() - startTime,
-                    };
-                    (0, auditLog_1.appendAudit)({
-                        timestamp: new Date().toISOString(),
-                        requestId: req.id,
-                        tool: req.tool,
-                        operationHash: req.operationHash,
-                        approved: false,
-                        reason: 'timeout',
-                        durationMs: result.duration,
-                    });
-                    resolve(result);
+                if (entry && !entry.settled) {
+                    this.settle(entry, false, 'timeout', 'Request timed out');
                 }
             }, timeoutMs + 5000);
-            const origResolve = resolve;
-            this.pending.set(req.id, {
-                req,
-                resolve: (r) => {
-                    clearTimeout(timer);
-                    origResolve(r);
-                },
-            });
+            const entry = { req, resolve, timer, settled: false };
+            this.pending.set(req.id, entry);
+            const url = `http://${LOOPBACK}:${this.port}/?id=${req.id}`;
+            console.error(`[securecode] Approval required for ${tool}. Open: ${url}`);
+            openBrowser(url);
         });
     }
+    settle(entry, approved, reason, humanReason) {
+        if (entry.settled)
+            return;
+        entry.settled = true;
+        clearTimeout(entry.timer);
+        this.pending.delete(entry.req.id);
+        const duration = Date.now() - entry.req.createdAt;
+        const result = {
+            approved,
+            reason: humanReason,
+            requestId: entry.req.id,
+            duration,
+            category: entry.req.category,
+        };
+        const audit = {
+            timestamp: new Date().toISOString(),
+            requestId: entry.req.id,
+            tool: entry.req.tool,
+            operationHash: entry.req.operationHash,
+            category: entry.req.category,
+            workspaceId: entry.req.workspaceId,
+            approved,
+            reason,
+            durationMs: duration,
+        };
+        (0, auditLog_1.appendAudit)(audit);
+        entry.resolve(result);
+    }
+    isLocalOrigin(req) {
+        const origin = req.headers.origin;
+        if (!origin)
+            return true; // non-browser client
+        try {
+            const u = new URL(origin);
+            return u.hostname === LOOPBACK;
+        }
+        catch {
+            return false;
+        }
+    }
+    isLocalHost(req) {
+        const host = req.headers.host || '';
+        try {
+            const { hostname } = new URL(`http://${host}`);
+            return hostname === LOOPBACK || hostname === 'localhost';
+        }
+        catch {
+            return false;
+        }
+    }
     handle(req, res) {
+        if (!this.isLocalHost(req)) {
+            res.writeHead(403, SECURITY_HEADERS);
+            res.end('Forbidden');
+            return;
+        }
         const url = req.url || '/';
         if (req.method === 'GET' && (url === '/' || url.startsWith('/?'))) {
-            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.writeHead(200, { 'Content-Type': 'text/html', ...SECURITY_HEADERS });
             res.end(APPROVAL_PAGE_HTML);
             return;
         }
+        if (req.method === 'GET' && url.startsWith('/details')) {
+            this.handleDetails(req, res);
+            return;
+        }
         if (req.method === 'POST' && req.url === '/decide') {
-            let body = '';
-            req.on('data', (c) => { body += c; });
-            req.on('end', () => {
-                try {
-                    const data = JSON.parse(body);
-                    const requestId = data.id;
-                    const entry = requestId ? this.pending.get(requestId) : undefined;
-                    if (!entry || !requestId) {
-                        res.writeHead(200, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ ok: false, error: 'Request not found or already answered' }));
-                        return;
-                    }
-                    if ((0, types_1.isExpired)(entry.req)) {
-                        this.pending.delete(requestId);
-                        res.writeHead(200, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ ok: false, error: 'Request expired' }));
-                        return;
-                    }
-                    this.pending.delete(requestId);
-                    const approved = data.approved === true;
-                    const startTime = entry.req.createdAt;
-                    const result = {
-                        approved,
-                        reason: approved ? 'User approved' : 'User denied',
-                        requestId: entry.req.id,
-                        duration: Date.now() - startTime,
-                    };
-                    (0, auditLog_1.appendAudit)({
-                        timestamp: new Date().toISOString(),
-                        requestId: entry.req.id,
-                        tool: entry.req.tool,
-                        operationHash: entry.req.operationHash,
-                        approved,
-                        reason: approved ? 'approved' : 'denied',
-                        durationMs: result.duration,
-                    });
-                    entry.resolve(result);
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true }));
-                }
-                catch {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: false, error: 'Invalid request body' }));
-                }
-            });
+            this.handleDecide(req, res);
             return;
         }
-        res.writeHead(404);
+        res.writeHead(404, SECURITY_HEADERS);
         res.end('Not found');
     }
+    handleDetails(req, res) {
+        const parsed = new URL(req.url || '', `http://${LOOPBACK}`);
+        const id = parsed.searchParams.get('id');
+        const entry = id ? this.pending.get(id) : undefined;
+        if (!entry || !id) {
+            res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+            res.end(JSON.stringify({ ok: false, error: 'Request not found or already answered' }));
+            return;
+        }
+        if ((0, types_1.isExpired)(entry.req)) {
+            res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+            res.end(JSON.stringify({ ok: false, error: 'Request expired' }));
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+        res.end(JSON.stringify({
+            ok: true,
+            tool: entry.req.tool,
+            summary: entry.req.summary,
+            operationHash: entry.req.operationHash,
+            expiresAt: entry.req.expiresAt,
+            decisionToken: entry.req.decisionToken,
+        }));
+    }
+    handleDecide(req, res) {
+        if (!this.isLocalOrigin(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+            res.end(JSON.stringify({ ok: false, error: 'Forbidden origin' }));
+            return;
+        }
+        const ct = req.headers['content-type'] || '';
+        if (!ct.includes('application/json')) {
+            res.writeHead(400, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+            res.end(JSON.stringify({ ok: false, error: 'Content-Type must be application/json' }));
+            return;
+        }
+        let body = '';
+        let tooLarge = false;
+        req.on('data', (c) => {
+            body += c;
+            if (body.length > MAX_BODY_BYTES) {
+                tooLarge = true;
+                req.destroy();
+            }
+        });
+        req.on('end', () => {
+            if (tooLarge) {
+                res.writeHead(413, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                res.end(JSON.stringify({ ok: false, error: 'Body too large' }));
+                return;
+            }
+            try {
+                const data = JSON.parse(body);
+                const requestId = data.id;
+                const entry = requestId ? this.pending.get(requestId) : undefined;
+                if (!entry || !requestId) {
+                    res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                    res.end(JSON.stringify({ ok: false, error: 'Request not found or already answered' }));
+                    return;
+                }
+                if (entry.settled) {
+                    res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                    res.end(JSON.stringify({ ok: false, error: 'Request already answered' }));
+                    return;
+                }
+                if (!data.decisionToken || data.decisionToken !== entry.req.decisionToken) {
+                    this.settle(entry, false, 'invalid-token', 'Invalid decision token');
+                    res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                    res.end(JSON.stringify({ ok: false, error: 'Invalid decision token' }));
+                    return;
+                }
+                if ((0, types_1.isExpired)(entry.req)) {
+                    this.settle(entry, false, 'expired', 'Request expired');
+                    res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                    res.end(JSON.stringify({ ok: false, error: 'Request expired' }));
+                    return;
+                }
+                const approved = data.approved === true;
+                this.settle(entry, approved, approved ? 'approved' : 'denied', approved ? 'User approved' : 'User denied');
+                res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch {
+                res.writeHead(400, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                res.end(JSON.stringify({ ok: false, error: 'Invalid request body' }));
+            }
+        });
+    }
 }
 exports.ApprovalBroker = ApprovalBroker;
 //# sourceMappingURL=broker.js.map

package/dist/approval/broker.js.map

@@ -1 +1 @@
-{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../src/approval/broker.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,iDAAqC;AACrC,mCAAsG;AACtG,yCAAyC;AAEzC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAkEnB,CAAC;AAET,SAAS,WAAW,CAAC,GAAW;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAA,oBAAI,EAAC,SAAS,GAAG,GAAG,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAA,oBAAI,EAAC,aAAa,GAAG,GAAG,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACJ,IAAA,oBAAI,EAAC,aAAa,GAAG,GAAG,CAAC,CAAC;QAC9B,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,+DAA+D;IACnE,CAAC;AACL,CAAC;AAED,MAAa,cAAc;IACf,MAAM,GAAuB,IAAI,CAAC;IAClC,IAAI,GAAG,CAAC,CAAC;IACT,OAAO,GAAgF,IAAI,GAAG,EAAE,CAAC;IAEzG,KAAK,CAAC,KAAK;QACP,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACpC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAO,CAAC,OAAO,EAAS,CAAC;gBAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,IAAI;QACN,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACJ,OAAO,EAAE,CAAC;YACd,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,eAAe,CACX,IAAY,EACZ,OAAe,EACf,cAAyB,EACzB,YAAoB,MAAM;QAE1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,IAAA,6BAAqB,EAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;YAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAE3C,MAAM,GAAG,GAAG,oBAAoB,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,SAAS,kBAAkB,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,aAAa,YAAY,kBAAkB,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,SAAS,EAAE,CAAC;YACjL,OAAO,CAAC,KAAK,CAAC,sCAAsC,IAAI,WAAW,GAAG,EAAE,CAAC,CAAC;YAC1E,WAAW,CAAC,GAAG,CAAC,CAAC;YAEjB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvC,IAAI,KAAK,EAAE,CAAC;oBACR,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC5B,MAAM,MAAM,GAAmB;wBAC3B,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,mBAAmB;wBAC3B,SAAS,EAAE,GAAG,CAAC,EAAE;wBACjB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;qBACnC,CAAC;oBACF,IAAA,sBAAW,EAAC;wBACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,GAAG,CAAC,EAAE;wBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,aAAa,EAAE,GAAG,CAAC,aAAa;wBAChC,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,SAAS;wBACjB,UAAU,EAAE,MAAM,CAAC,QAAQ;qBAC9B,CAAC,CAAC;oBACH,OAAO,CAAC,MAAM,CAAC,CAAC;gBACpB,CAAC;YACL,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;YAErB,MAAM,WAAW,GAAG,OAAO,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;gBACrB,GAAG;gBACH,OAAO,EAAE,CAAC,CAAiB,EAAE,EAAE;oBAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,WAAW,CAAC,CAAC,CAAC,CAAC;gBACnB,CAAC;aACJ,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,MAAM,CAAC,GAAyB,EAAE,GAAwB;QAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAE3B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC5B,OAAO;QACX,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACf,IAAI,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwC,CAAC;oBACrE,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAClE,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;wBACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;wBACvF,OAAO;oBACX,CAAC;oBAED,IAAI,IAAA,iBAAS,EAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;wBAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;wBACjE,OAAO;oBACX,CAAC;oBAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;oBACxC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;oBACtC,MAAM,MAAM,GAAmB;wBAC3B,QAAQ;wBACR,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa;wBAClD,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;wBACvB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;qBACnC,CAAC;oBAEF,IAAA,sBAAW,EAAC;wBACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;wBACvB,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;wBACpB,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa;wBACtC,QAAQ;wBACR,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;wBACxC,UAAU,EAAE,MAAM,CAAC,QAAQ;qBAC9B,CAAC,CAAC;oBAEH,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAEtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACL,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;gBAC1E,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;CACJ;AAjJD,wCAiJC"}
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../src/approval/broker.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,iDAAqC;AACrC,mCAQiB;AACjB,yCAAyC;AAEzC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC;AAE7B,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAwFnB,CAAC;AAET,SAAS,WAAW,CAAC,GAAW;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG;QAAE,OAAO;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAA,oBAAI,EAAC,SAAS,GAAG,GAAG,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAA,oBAAI,EAAC,aAAa,GAAG,GAAG,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACJ,IAAA,oBAAI,EAAC,aAAa,GAAG,GAAG,CAAC,CAAC;QAC9B,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,+DAA+D;IACnE,CAAC;AACL,CAAC;AASD,MAAM,gBAAgB,GAA2B;IAC7C,yBAAyB,EAAE,+FAA+F;IAC1H,wBAAwB,EAAE,SAAS;IACnC,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,aAAa;CACnC,CAAC;AAEF,MAAa,cAAc;IACf,MAAM,GAAuB,IAAI,CAAC;IAClC,IAAI,GAAG,CAAC,CAAC;IACT,OAAO,GAA8B,IAAI,GAAG,EAAE,CAAC;IAEvD,KAAK,CAAC,KAAK;QACP,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9B,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAO,CAAC,OAAO,EAAS,CAAC;gBAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,IAAI;QACN,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACJ,OAAO,EAAE,CAAC;YACd,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,eAAe,CACX,IAAY,EACZ,OAAe,EACf,cAAyB,EACzB,YAAoB,MAAM,EAC1B,WAA8B,iBAAiB,EAC/C,gBAA+B,IAAI;QAEnC,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;YAC3C,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;gBACnC,OAAO,CAAC;oBACJ,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,oCAAoC;oBAC5C,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,CAAC;oBACX,QAAQ;iBACX,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,MAAM,GAAG,GAAG,IAAA,6BAAqB,EAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;YACrG,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;YAEhC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;gBAC9D,CAAC;YACL,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;YAErB,MAAM,KAAK,GAAiB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACpE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAEhC,MAAM,GAAG,GAAG,UAAU,QAAQ,IAAI,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,EAAE,CAAC;YAC5D,OAAO,CAAC,KAAK,CAAC,sCAAsC,IAAI,WAAW,GAAG,EAAE,CAAC,CAAC;YAC1E,WAAW,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,MAAM,CACV,KAAmB,EACnB,QAAiB,EACjB,MAAmB,EACnB,WAAmB;QAEnB,IAAI,KAAK,CAAC,OAAO;YAAE,OAAO;QAC1B,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QAClD,MAAM,MAAM,GAAmB;YAC3B,QAAQ;YACR,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;YACvB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;SAC/B,CAAC;QAEF,MAAM,KAAK,GAAe;YACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;YACvB,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;YACpB,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa;YACtC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;YAC5B,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW;YAClC,QAAQ;YACR,MAAM;YACN,UAAU,EAAE,QAAQ;SACvB,CAAC;QACF,IAAA,sBAAW,EAAC,KAAK,CAAC,CAAC;QAEnB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAEO,aAAa,CAAC,GAAyB;QAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;QAC/C,IAAI,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,GAAyB;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAC/C,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,GAAyB,EAAE,GAAwB;QAC9D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACX,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAE3B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;YACzE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC5B,OAAO;QACX,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7B,OAAO;QACX,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5B,OAAO;QACX,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;IAEO,aAAa,CAAC,GAAyB,EAAE,GAAwB;QACrE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;QAC5D,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpD,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;YACvF,OAAO;QACX,CAAC;QAED,IAAI,IAAA,iBAAS,EAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;YACjE,OAAO;QACX,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;QAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACnB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;YACpB,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO;YAC1B,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa;YACtC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;YAC9B,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa;SACzC,CAAC,CAAC,CAAC;IACR,CAAC;IAEO,YAAY,CAAC,GAAyB,EAAE,GAAwB;QACpE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;YAClE,OAAO;QACX,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;YACvF,OAAO;QACX,CAAC;QAED,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YACjB,IAAI,IAAI,CAAC,CAAC;YACV,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;gBAC/B,QAAQ,GAAG,IAAI,CAAC;gBAChB,GAAG,CAAC,OAAO,EAAE,CAAC;YAClB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACf,IAAI,QAAQ,EAAE,CAAC;gBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;gBAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;gBAChE,OAAO;YACX,CAAC;YACD,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgE,CAAC;gBAC7F,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAElE,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;oBACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;oBAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAAC;oBACvF,OAAO;gBACX,CAAC;gBAED,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;oBAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;oBAC1E,OAAO;gBACX,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;oBACxE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,wBAAwB,CAAC,CAAC;oBACrE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;oBAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;oBACxE,OAAO;gBACX,CAAC;gBAED,IAAI,IAAA,iBAAS,EAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;oBACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;oBAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;oBACjE,OAAO;gBACX,CAAC;gBAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAE3G,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;gBAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACL,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,EAAE,CAAC,CAAC;gBAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AApQD,wCAoQC"}

package/dist/approval/policy.d.ts

@@ -0,0 +1,10 @@
+import type { OperationCategory } from '../approval/types';
+export interface ToolPolicy {
+    name: string;
+    category: OperationCategory;
+    requiresApproval: boolean;
+    approvalNote?: string;
+}
+export declare const TOOL_POLICIES: Record<string, ToolPolicy>;
+export declare function getToolPolicy(toolName: string): ToolPolicy | undefined;
+export declare function validateAllToolsHavePolicies(registeredTools: string[]): string[];