Function list_pending_authorizations 

pub(crate) async fn list_pending_authorizations(
    __arg0: State<AppState>,
    headers: HeaderMap,
    query: Result<Query<ListPendingAuthorizationsQuery>, QueryRejection>,
) -> Response

GET /xrpc/bot.did.listPendingAuthorizations

Credential::AccountSelf, used as identity rather than as a comparison: this route names no account, and the decisions it lists are the ones addressed to the account the presented agent token authenticates as. An agent cannot ask for anybody else’s, because there is nowhere in the request to ask.

Long-polls. It answers at once when this account has a live decision newer than cursor, and otherwise holds the request open for up to wait seconds waiting for one — which is what lets the daemon learn of a decision without polling in a tight loop. Records that were approved, declined, or whose pushed request expired are not returned; the cursor still advances past them, so a caller that keeps sending back what it was given never re-reads a decision it has already seen.