@peers-app/peers-sdk 0.21.7 → 0.23.0

package/dist/context/user-context-singleton.d.ts

@@ -1,12 +1,54 @@
 import type { Table } from "../data/orm";
 import type { DataContext } from "./data-context";
 import { UserContext } from "./user-context";
+/**
+ * Return the process user context, waiting until {@link setUserContext} if needed.
+ *
+ * Prefer an explicit `UserContext` when one is already in hand (multi-device
+ * tests and connection providers). Use {@link peekUserContext} to fail closed
+ * instead of waiting.
+ */
 export declare function getUserContext(): Promise<UserContext>;
+/**
+ * Return the process user context if {@link setUserContext} has already run.
+ *
+ * Does not wait. Callers that must not hang (role checks, contract tools)
+ * should treat `undefined` as fail-closed.
+ */
+export declare function peekUserContext(): UserContext | undefined;
+/**
+ * Install the process-wide user context. Throws if one is already set, except
+ * in a browser/PWA where HMR and navigations may replace it.
+ *
+ * @param userContext - Context that owns local personal and group data.
+ */
 export declare function setUserContext(userContext: UserContext): void;
+/**
+ * Return the current user's default data context after the singleton is ready.
+ */
 export declare function getDefaultDataContext(): Promise<DataContext>;
+/**
+ * Return the table container for `dataContext`, or the singleton default.
+ *
+ * @param dataContext - Context to read tables from. Falls back to the singleton.
+ */
 export declare function getTableContainer(dataContext?: DataContext | undefined): import("../data/orm").TableContainer;
+/**
+ * Install a client-proxy user context for renderer/RPC processes.
+ *
+ * No-ops when a real server-side context is already set in-process.
+ *
+ * @param userId - Local user id used as the personal data-context id.
+ */
 export declare function setDefaultClientUserContext(userId: string): void;
+/**
+ * Return every table currently loaded in the default table container, keyed by
+ * full table name.
+ */
 export declare function getAllTables(): {
     [tableName: string]: Table<any>;
 };
+/**
+ * Return the singleton user's id. Throws if {@link setUserContext} has not run.
+ */
 export declare const myUserId: () => string;

package/dist/context/user-context-singleton.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.myUserId = void 0;
 exports.getUserContext = getUserContext;
+exports.peekUserContext = peekUserContext;
 exports.setUserContext = setUserContext;
 exports.getDefaultDataContext = getDefaultDataContext;
 exports.getTableContainer = getTableContainer;
@@ -16,6 +17,13 @@ const user_context_1 = require("./user-context");
 var userContextInstance;
 var userContextResolved;
 var userContextPromise;
+/**
+ * Return the process user context, waiting until {@link setUserContext} if needed.
+ *
+ * Prefer an explicit `UserContext` when one is already in hand (multi-device
+ * tests and connection providers). Use {@link peekUserContext} to fail closed
+ * instead of waiting.
+ */
 async function getUserContext() {
     if (userContextInstance) {
         return userContextInstance.loadingPromise;
@@ -30,6 +38,21 @@ async function getUserContext() {
     }
     return userContextPromise;
 }
+/**
+ * Return the process user context if {@link setUserContext} has already run.
+ *
+ * Does not wait. Callers that must not hang (role checks, contract tools)
+ * should treat `undefined` as fail-closed.
+ */
+function peekUserContext() {
+    return userContextInstance;
+}
+/**
+ * Install the process-wide user context. Throws if one is already set, except
+ * in a browser/PWA where HMR and navigations may replace it.
+ *
+ * @param userContext - Context that owns local personal and group data.
+ */
 function setUserContext(userContext) {
     if (userContextInstance) {
         if (typeof window !== "undefined") {
@@ -51,10 +74,18 @@ function setUserContext(userContext) {
         window.userContext = userContext;
     }
 }
+/**
+ * Return the current user's default data context after the singleton is ready.
+ */
 async function getDefaultDataContext() {
     const userContext = await getUserContext();
     return userContext.defaultDataContext();
 }
+/**
+ * Return the table container for `dataContext`, or the singleton default.
+ *
+ * @param dataContext - Context to read tables from. Falls back to the singleton.
+ */
 function getTableContainer(dataContext) {
     dataContext ??= userContextInstance?.defaultDataContext();
     if (!dataContext) {
@@ -62,6 +93,13 @@ function getTableContainer(dataContext) {
     }
     return dataContext.tableContainer;
 }
+/**
+ * Install a client-proxy user context for renderer/RPC processes.
+ *
+ * No-ops when a real server-side context is already set in-process.
+ *
+ * @param userId - Local user id used as the personal data-context id.
+ */
 function setDefaultClientUserContext(userId) {
     // If a real (server-side) user context is already set in the same process
     // (e.g. PWA where peers-device runs in the browser), don't overwrite it
@@ -83,6 +121,10 @@ function setDefaultClientUserContext(userId) {
     })();
     setUserContext(userContext);
 }
+/**
+ * Return every table currently loaded in the default table container, keyed by
+ * full table name.
+ */
 function getAllTables() {
     const tables = getTableContainer().getAllTables();
     const tableMap = {};
@@ -117,6 +159,9 @@ if (!rpc_types_1.isClient) {
         return table[methodName](...args);
     };
 }
+/**
+ * Return the singleton user's id. Throws if {@link setUserContext} has not run.
+ */
 const myUserId = () => {
     if (!userContextInstance) {
         throw new Error(`myUserId called before userContext singleton was initialized`);

package/dist/contracts/__tests__/contract-proxy.test.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const groupPermissions = require("../../data/group-permissions");
 const decorators_1 = require("../../data/orm/decorators");
 const observable_1 = require("../../observable");
 const field_type_1 = require("../../types/field-type");
@@ -76,7 +77,7 @@ function makeResolution() {
         tables: { Widgets: table },
         tools: {
             "make-widget": {
-                tool: { toolId: (0, utils_1.newid)(), name: "make-widget" },
+                tool: { toolId: (0, utils_1.newid)(), name: "make-widget", accessLevel: 0 },
                 toolFn: makeWidget,
             },
         },
@@ -147,6 +148,55 @@ describe("contract proxy — consumer/provider round-trip", () => {
         expect(makeWidget).toHaveBeenCalledWith({ color: "blue" });
         expect(result.color).toBe("blue");
     });
+    it("allows a classified tool when the provider data context grants access", async () => {
+        const getUserAccessLevel = jest
+            .spyOn(groupPermissions, "getUserAccessLevel")
+            .mockResolvedValue(100);
+        const contract = makeContract();
+        const { resolution, makeWidget } = makeResolution();
+        const makeWidgetTool = resolution.tools?.["make-widget"];
+        if (!makeWidgetTool) {
+            throw new Error("expected make-widget tool");
+        }
+        makeWidgetTool.tool.accessLevel = 80;
+        const provider = (0, contract_proxy_1.createContractProvider)(resolution);
+        const dataContext = { userContext: { userId: "u1" } };
+        const consumer = consumerVia(contract, provider, {
+            callerUserId: "u1",
+            localUserId: "u1",
+            dataContext,
+        });
+        await expect(consumer.tools["make-widget"]({ color: "blue" })).resolves.toEqual(expect.objectContaining({ color: "blue" }));
+        expect(makeWidget).toHaveBeenCalledWith({ color: "blue" });
+        expect(getUserAccessLevel).toHaveBeenCalledWith(dataContext, "u1");
+    });
+    it("fails closed quickly when a classified tool has no user context", async () => {
+        const contract = makeContract();
+        const { resolution } = makeResolution();
+        const makeWidgetTool = resolution.tools?.["make-widget"];
+        if (!makeWidgetTool) {
+            throw new Error("expected make-widget tool");
+        }
+        makeWidgetTool.tool.accessLevel = 20;
+        const provider = (0, contract_proxy_1.createContractProvider)(resolution);
+        const consumer = consumerVia(contract, provider, {
+            callerUserId: (0, utils_1.newid)(),
+            localUserId: (0, utils_1.newid)(),
+        });
+        await expect(consumer.tools["make-widget"]({ color: "blue" })).rejects.toThrow("User context is not available");
+    });
+    it("denies unclassified tools when the caller identity is missing", async () => {
+        const contract = makeContract();
+        const { resolution } = makeResolution();
+        const makeWidgetTool = resolution.tools?.["make-widget"];
+        if (!makeWidgetTool) {
+            throw new Error("expected make-widget tool");
+        }
+        makeWidgetTool.tool.accessLevel = undefined;
+        const provider = (0, contract_proxy_1.createContractProvider)(resolution);
+        const consumer = consumerVia(contract, provider, {});
+        await expect(consumer.tools["make-widget"]({ color: "blue" })).rejects.toThrow("missing caller identity");
+    });
     it("forwards dataContextId on methods, tools, observables, and subscriptions", async () => {
         const dataContextId = (0, utils_1.newid)();
         const calls = [];

package/dist/contracts/__tests__/contract-resolvers.test.js

@@ -5,8 +5,16 @@ const user_trust_levels_1 = require("../../data/user-trust-levels");
 const users_1 = require("../../data/users");
 const socket_type_1 = require("../../device/socket.type");
 const keys_1 = require("../../keys");
+const system_ids_1 = require("../../system-ids");
 const utils_1 = require("../../utils");
 const index_1 = require("../index");
+jest.mock("../../data/group-permissions", () => {
+    const actual = jest.requireActual("../../data/group-permissions");
+    return {
+        ...actual,
+        getUserRole: jest.fn(async () => actual.GroupMemberRole.Founder),
+    };
+});
 jest.mock("../../data/user-trust-levels", () => ({
     UserTrustLevels: jest.fn(),
 }));
@@ -145,6 +153,26 @@ describe("Self-trusted contract caller authorization", () => {
         })).rejects.toThrow("Permission denied");
         router.dispose();
     });
+    it("rejects remote Tool Access Control as local-only", async () => {
+        const { remoteIdentity, user } = makeIdentity();
+        const records = new Map();
+        const { personalContext, userContext } = setupUserContext(remoteIdentity.userId, records);
+        records.set(personalContext, user);
+        mockTrustGet.mockResolvedValue({ trustLevel: socket_type_1.TrustLevel.Self });
+        const [consumerTransport, providerTransport] = (0, index_1.inProcessTransportPair)();
+        const router = (0, index_1.createUserContextContractProviderRouter)(providerTransport, {
+            userContext,
+            remoteIdentity,
+        });
+        await expect(consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, {
+            ...call,
+            contractId: system_ids_1.toolAccessControlContractId,
+            member: "tool",
+            name: "approve",
+            operation: "run",
+        })).rejects.toThrow("local-only");
+        router.dispose();
+    });
 });
 describe("local user-context contract routing", () => {
     function setupLocalRouter() {
@@ -180,6 +208,7 @@ describe("local user-context contract routing", () => {
                         outputSchema: { type: "simple", fields: [] },
                         code: "",
                         packageId: (0, utils_1.newid)(),
+                        accessLevel: 0,
                     },
                     toolFn: () => dataContext.dataContextId,
                 },
@@ -239,4 +268,40 @@ describe("local user-context contract routing", () => {
         await expect(setup.consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, makeToolCall(setup.contractId))).rejects.toThrow("contract");
         router.dispose();
     });
+    it("appends host-only variable access to local package tool calls", async () => {
+        const setup = setupLocalRouter();
+        const resolveVariable = jest.fn(async ({ dataContext, variableName, requestingToolId }) => [dataContext.dataContextId, variableName, requestingToolId].join(":"));
+        (0, index_1.registerContractResolver)(setup.contractId, 1, () => ({
+            contractId: setup.contractId,
+            version: 1,
+            tools: {
+                inspect: {
+                    tool: {
+                        toolId: "00localcontractsecrettool",
+                        name: "inspect",
+                        usageDescription: "Resolve a local variable.",
+                        inputSchema: { type: "simple", fields: [] },
+                        outputSchema: { type: "simple", fields: [] },
+                        code: "",
+                        accessLevel: 0,
+                    },
+                    toolFn: async (variableName, context) => context.getVariable(variableName, "00localcontractsecrettool"),
+                },
+            },
+        }));
+        const router = (0, index_1.createLocalUserContextContractProviderRouter)(setup.providerTransport, {
+            getUserContext: async () => setup.userContext,
+            resolveVariable,
+        });
+        await expect(setup.consumerTransport.emit(index_1.CONTRACT_REQUEST_CHANNEL, {
+            ...makeToolCall(setup.contractId),
+            args: ["OPENAI_API_KEY"],
+        })).resolves.toBe(`${setup.userId}:OPENAI_API_KEY:00localcontractsecrettool`);
+        expect(resolveVariable).toHaveBeenCalledWith(expect.objectContaining({
+            dataContext: expect.objectContaining({ dataContextId: setup.userId }),
+            variableName: "OPENAI_API_KEY",
+            requestingToolId: "00localcontractsecrettool",
+        }));
+        router.dispose();
+    });
 });

package/dist/contracts/__tests__/playground.test.js

@@ -154,7 +154,10 @@ describe("playground", () => {
             contractId: CONTRACT_ID,
             version: 1,
             tools: {
-                logText: { tool: { toolId: "", name: "logText" }, toolFn: logTextFn },
+                logText: {
+                    tool: { toolId: "", name: "logText", accessLevel: 0 },
+                    toolFn: logTextFn,
+                },
             },
             observables: { logCount: logCountObs },
             observableWritability: { logCount: false },
@@ -208,6 +211,6 @@ describe("playground", () => {
         expect(logs).toEqual(["log1", "log2"]);
         expect(observedLogCount).toBe(2);
         // TODO test tables so we can see what this looks like and how it works for both providers and consumers
-        // TODO consider renaming ContractResolution to ContractProviderInstance or something like that.  ContractResolution is awkward.  
+        // TODO consider renaming ContractResolution to ContractProviderInstance or something like that.  ContractResolution is awkward.
     });
 });

package/dist/contracts/__tests__/system-contracts.test.js

@@ -17,6 +17,7 @@ describe("system contract catalog", () => {
             system_ids_1.deviceOperationsContractId,
             system_ids_1.networkDiagnosticsContractId,
             system_ids_1.networkControlContractId,
+            system_ids_1.toolAccessControlContractId,
         ]));
     });
     it("registers the Logs live resolver", async () => {
@@ -34,6 +35,8 @@ describe("system contract catalog", () => {
         expect(registry.getProviderPackageId(system_ids_1.networkDiagnosticsContractId, 1)).toBe(system_ids_1.peersSystemPackageId);
         expect(registry.resolve(system_ids_1.networkControlContractId, 1)?.name).toBe("System Network Control");
         expect(registry.getProviderPackageId(system_ids_1.networkControlContractId, 1)).toBe(system_ids_1.peersSystemPackageId);
+        expect(registry.resolve(system_ids_1.toolAccessControlContractId, 1)?.name).toBe("System Tool Access Control");
+        expect(registry.getProviderPackageId(system_ids_1.toolAccessControlContractId, 1)).toBe(system_ids_1.peersSystemPackageId);
     });
     it("registerSystemContract makes new contracts installable without loader changes", () => {
         const fakeContractId = (0, utils_1.newid)();

package/dist/contracts/contract-proxy.d.ts

@@ -1,3 +1,4 @@
+import type { DataContext } from "../context/data-context";
 import type { Table } from "../data/orm/table";
 import type { IToolInstance } from "../data/tools";
 import type { Event, ISubscriptionResult } from "../events";
@@ -195,6 +196,22 @@ export interface IContractConsumer extends IContractConsumerBase {
         subscribe: (handler: (value: any) => void) => ISubscriptionResult;
     }>;
 }
+/**
+ * Trusted host capabilities appended to local package-contract tool calls.
+ *
+ * The context is constructed by the provider host after it authorizes the data-context
+ * route. It is never serialized to the consumer and is intentionally absent for remote
+ * contract calls unless a host explicitly opts in.
+ */
+export interface IContractToolContext {
+    /** Authorized data context in which the tool is executing. */
+    dataContextId: string;
+    /**
+     * Resolve a persistent variable in the authorized context. Secret values are decrypted
+     * by the host and returned only to the provider-side tool implementation.
+     */
+    getVariable(variableName: string, requestingToolId: string): Promise<string>;
+}
 /**
  * Build the **consumer** side of a contract proxy from a contract definition and a
  * transport. Member names come from the contract shape; table members are backed by a
@@ -234,6 +251,11 @@ export interface IContractResolution {
     version: number;
     tables?: Record<string, Table<any>>;
     tools?: Record<string, IToolInstance>;
+    /**
+     * Host-only capabilities appended as the final argument to provider tool functions.
+     * Omit this for remote or otherwise untrusted provider routes.
+     */
+    toolContext?: IContractToolContext;
     observables?: Record<string, Observable<any>>;
     /**
      * Provider-owned write policy for live observables. A `set` is allowed only when the
@@ -254,6 +276,11 @@ export interface IContractCallContext {
     callerUserId?: string;
     /** User id of the local device executing the call. */
     localUserId?: string;
+    /**
+     * Provider-side data context used to resolve the caller's group/personal role.
+     * In-process only — never serialized across a connection.
+     */
+    dataContext?: DataContext;
 }
 /**
  * A gate that decides whether a given call is allowed. Runs before dispatch on the

package/dist/contracts/contract-proxy.js

@@ -5,6 +5,8 @@ exports.createContractConsumer = createContractConsumer;
 exports.createContractProvider = createContractProvider;
 exports.createContractProviderEndpoint = createContractProviderEndpoint;
 exports.createContractProviderSession = createContractProviderSession;
+const access_level_1 = require("../data/access-level");
+const group_permissions_1 = require("../data/group-permissions");
 const decorators_1 = require("../data/orm/decorators");
 const observable_1 = require("../observable");
 const utils_1 = require("../utils");
@@ -340,6 +342,37 @@ const sameUserContractPermissionCheck = (_call, context) => {
     return Boolean(context.localUserId) && context.callerUserId === context.localUserId;
 };
 exports.sameUserContractPermissionCheck = sameUserContractPermissionCheck;
+/**
+ * Deny a contract tool when the caller’s group/personal access is below the tool.
+ *
+ * Tools at {@link AccessLevel.None} are unrestricted and do not need a caller
+ * identity. Higher levels fail closed if the transport omitted `callerUserId`
+ * and `localUserId`. Role lookup uses {@link IContractCallContext.dataContext}
+ * when the host attached one, so multi-device processes do not wait on the
+ * user-context singleton.
+ *
+ * Remote Self-trust is a separate, stricter gate applied by the connection router.
+ *
+ * @param tool - Live tool instance being dispatched.
+ * @param call - Inbound contract call (provides dataContextId).
+ * @param context - Caller identity from the transport.
+ */
+async function assertContractToolAccess(tool, call, context) {
+    const required = (0, access_level_1.resolveAccessLevel)(tool.tool.accessLevel);
+    if (required <= access_level_1.AccessLevel.None) {
+        return;
+    }
+    const userId = context.callerUserId ?? context.localUserId;
+    if (!userId) {
+        throw new Error(`Permission denied: missing caller identity for tool '${tool.tool.name}'`);
+    }
+    const userLevel = context.dataContext
+        ? await (0, group_permissions_1.getUserAccessLevel)(context.dataContext, userId)
+        : (0, access_level_1.accessLevelFromGroupRole)(await (0, group_permissions_1.getUserRole)(call.dataContextId || context.localUserId || userId, userId));
+    if (userLevel < required) {
+        throw new Error(`Permission denied: ${tool.tool.name} requires ${(0, access_level_1.getAccessLevelLabel)(required)} (${required})`);
+    }
+}
 /**
  * Build the **provider** side of a contract proxy: an async handler that permission-checks
  * an {@link IContractCall} and dispatches it to the live table method / tool fn / observable
@@ -394,7 +427,10 @@ function createContractProvider(resolution, opts = {}) {
                 if (!tool) {
                     throw new Error(`Contract ${call.contractId} does not provide tool '${call.name}'`);
                 }
-                return tool.toolFn(...call.args);
+                await assertContractToolAccess(tool, call, context);
+                return resolution.toolContext
+                    ? tool.toolFn(...call.args, resolution.toolContext)
+                    : tool.toolFn(...call.args);
             }
             case "observable": {
                 const obs = resolution.observables?.[call.name];

package/dist/contracts/contract-resolvers.d.ts

@@ -12,6 +12,14 @@ import type { IContractTransport } from "./contract-transport";
 export type ContractResolver = (ctx: {
     dataContext: DataContext;
 }) => IContractResolution | Promise<IContractResolution>;
+/** Input supplied to a trusted local host when a package tool resolves a pvar. */
+export interface ILocalContractVariableRequest {
+    dataContext: DataContext;
+    variableName: string;
+    requestingToolId: string;
+}
+/** Host callback that resolves plaintext only inside a local provider process. */
+export type LocalContractVariableResolver = (request: ILocalContractVariableRequest) => Promise<string>;
 /** Connection-authenticated identity fields used to authorize remote contract calls. */
 export type ContractRemoteIdentity = Pick<IDeviceInfo, "deviceId" | "userId" | "publicKey" | "publicBoxKey">;
 /**
@@ -45,10 +53,12 @@ export declare function isSelfTrustedContractCaller(userContext: UserContext, re
  * @param transport Contract transport backed by an authenticated local session.
  * @param opts.getUserContext Lazy accessor for the host's loaded user context.
  * @param opts.allowedContractIds Optional contract allowlist for this session.
+ * @param opts.resolveVariable Optional host-only pvar resolver exposed to local package tools.
  */
 export declare function createLocalUserContextContractProviderRouter(transport: IContractTransport, opts: {
     getUserContext: () => Promise<UserContext>;
     allowedContractIds?: ReadonlySet<string>;
+    resolveVariable?: LocalContractVariableResolver;
 }): IContractProviderRouter;
 /**
  * Create the local-object provider router for one verified device connection.

package/dist/contracts/contract-resolvers.js

@@ -10,6 +10,7 @@ const user_permissions_1 = require("../data/user-permissions");
 const user_trust_levels_1 = require("../data/user-trust-levels");
 const users_1 = require("../data/users");
 const socket_type_1 = require("../device/socket.type");
+const system_ids_1 = require("../system-ids");
 const contract_provider_router_1 = require("./contract-provider-router");
 const contract_proxy_1 = require("./contract-proxy");
 const types_1 = require("./types");
@@ -63,15 +64,20 @@ async function isSelfTrustedContractCaller(userContext, remoteIdentity) {
     return trustLevel === socket_type_1.TrustLevel.Self;
 }
 async function authorizeUserContextCall(call, userContext, remoteIdentity) {
+    if (call.contractId === system_ids_1.toolAccessControlContractId) {
+        throw new Error("Permission denied: tool access control is local-only");
+    }
+    const dataContextId = call.dataContextId || userContext.userId;
     const context = {
         callerUserId: remoteIdentity.userId,
         localUserId: userContext.userId,
+        dataContext: userContext.getDataContext(dataContextId),
     };
     if (!(await isSelfTrustedContractCaller(userContext, remoteIdentity))) {
         throw new Error(`Permission denied: ${call.member} '${call.name}'.${call.operation} on contract ${call.contractId}`);
     }
     return {
-        dataContextId: call.dataContextId || userContext.userId,
+        dataContextId,
         context,
     };
 }
@@ -100,9 +106,10 @@ function getAuthorizedLocalDataContext(userContext, requestedId) {
  * @param transport Contract transport backed by an authenticated local session.
  * @param opts.getUserContext Lazy accessor for the host's loaded user context.
  * @param opts.allowedContractIds Optional contract allowlist for this session.
+ * @param opts.resolveVariable Optional host-only pvar resolver exposed to local package tools.
  */
 function createLocalUserContextContractProviderRouter(transport, opts) {
-    const { getUserContext, allowedContractIds } = opts;
+    const { getUserContext, allowedContractIds, resolveVariable } = opts;
     return (0, contract_provider_router_1.createContractProviderRouter)(transport, {
         authorizeCall: async (call) => {
             if (allowedContractIds && !allowedContractIds.has(call.contractId)) {
@@ -113,6 +120,7 @@ function createLocalUserContextContractProviderRouter(transport, opts) {
             const context = {
                 callerUserId: userContext.userId,
                 localUserId: userContext.userId,
+                dataContext,
             };
             return {
                 dataContextId: dataContext.dataContextId,
@@ -127,7 +135,16 @@ function createLocalUserContextContractProviderRouter(transport, opts) {
             }
             const dataContext = getAuthorizedLocalDataContext(userContext, dataContextId);
             const resolution = await resolver({ dataContext });
-            return (0, contract_proxy_1.createContractProviderEndpoint)(resolution, { context, notify });
+            const localResolution = resolveVariable
+                ? {
+                    ...resolution,
+                    toolContext: {
+                        dataContextId: dataContext.dataContextId,
+                        getVariable: (variableName, requestingToolId) => resolveVariable({ dataContext, variableName, requestingToolId }),
+                    },
+                }
+                : resolution;
+            return (0, contract_proxy_1.createContractProviderEndpoint)(localResolution, { context, notify });
         },
     });
 }
@@ -150,6 +167,7 @@ function createUserContextContractProviderRouter(transport, opts) {
     const context = {
         callerUserId: remoteIdentity.userId,
         localUserId: userContext.userId,
+        dataContext: userContext.userDataContext,
     };
     return (0, contract_provider_router_1.createContractProviderRouter)(transport, {
         context,

package/dist/contracts/index.d.ts

@@ -1,8 +1,8 @@
 export { ContractBuilder, definePackage, PackageBuilder } from "./builder";
 export { type ContractCallAuthorizer, type ContractProviderEndpointResolver, createContractProviderRouter, type IAuthorizedContractRoute, type IContractProviderEndpointRequest, type IContractProviderRouter, type IContractProviderRouterOptions, } from "./contract-provider-router";
 export { ContractProviders, ContractProvidersTable, contractProvidersMetaData, contractProvidersSchema, type IContractProviderRecord, } from "./contract-providers.table";
-export { CONTRACT_CALL_RPC, type ContractMemberType, type ContractNotificationSink, type ContractPermissionCheck, createContractConsumer, createContractProvider, createContractProviderEndpoint, createContractProviderSession, type IContractCall, type IContractCallContext, type IContractConsumer, type IContractConsumerBase, type IContractNotification, type IContractProviderEndpoint, type IContractProviderEndpointOptions, type IContractProviderSession, type IContractProviderSessionOptions, type IContractResolution, type IContractTableProxy, type ITableProxy, sameUserContractPermissionCheck, } from "./contract-proxy";
-export { type ContractRemoteIdentity, type ContractResolver, createLocalUserContextContractProviderRouter, createUserContextContractProviderRouter, getContractResolver, handleContractCall, isSelfTrustedContractCaller, registerContractResolver, } from "./contract-resolvers";
+export { CONTRACT_CALL_RPC, type ContractMemberType, type ContractNotificationSink, type ContractPermissionCheck, createContractConsumer, createContractProvider, createContractProviderEndpoint, createContractProviderSession, type IContractCall, type IContractCallContext, type IContractConsumer, type IContractConsumerBase, type IContractNotification, type IContractProviderEndpoint, type IContractProviderEndpointOptions, type IContractProviderSession, type IContractProviderSessionOptions, type IContractResolution, type IContractTableProxy, type IContractToolContext, type ITableProxy, sameUserContractPermissionCheck, } from "./contract-proxy";
+export { type ContractRemoteIdentity, type ContractResolver, createLocalUserContextContractProviderRouter, createUserContextContractProviderRouter, getContractResolver, handleContractCall, type ILocalContractVariableRequest, isSelfTrustedContractCaller, type LocalContractVariableResolver, registerContractResolver, } from "./contract-resolvers";
 export { CONTRACT_NOTIFY_CHANNEL, CONTRACT_REQUEST_CHANNEL, connectionContractTransport, type IContractTransport, type IDuplexEmitter, inProcessTransportPair, } from "./contract-transport";
 export { Contracts, ContractsTable, contractsMetaData, contractsSchema, type IContractRecord, } from "./contracts.table";
 export { createLocalContractConsumer } from "./create-local-consumer";
@@ -13,6 +13,7 @@ export { ContractRegistry } from "./registry";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./system/device-operations-contract";
 export { getLogsContractDefinition, type ILogsConsumer, LOGS_CONTRACT_VERSION, resolveLogsContract, } from "./system/logs-contract";
 export * from "./system/network-contracts";
+export { getToolAccessControlContractDefinition, type IToolAccessControlConsumer, TOOL_ACCESS_CONTROL_CONTRACT_VERSION, } from "./system/tool-access-control-contract";
 export { type ISystemContractRegistration, installSystemContracts, listSystemContracts, registerSystemContract, } from "./system-contracts";
 export type { IAlsoImplementsDeclaration, IConsumedContract, IConsumedContractHandle, IConsumedContractOptions, IContractDefinition, IContractEvent, IContractObservable, IContractTable, IContractTool, IPackageDefinitionResult, IResolvedContract, IValidationError, IValidationResult, } from "./types";
 export { contractKey } from "./types";

package/dist/contracts/index.js

@@ -14,8 +14,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.installSystemContracts = exports.resolveLogsContract = exports.LOGS_CONTRACT_VERSION = exports.getLogsContractDefinition = exports.getDeviceOperationsContractDefinition = exports.deviceOperationsToolIds = exports.deviceOperationsProviderPackageId = exports.DEVICE_OPERATIONS_MAX_TOOLS = exports.DEVICE_OPERATIONS_MAX_ROWS = exports.DEVICE_OPERATIONS_MAX_RESULT_BYTES = exports.DEVICE_OPERATIONS_MAX_QUERY_LENGTH = exports.DEVICE_OPERATIONS_CONTRACT_VERSION = exports.ContractRegistry = exports.PersistentContractRegistry = exports.waitForHostContractTransport = exports.subscribeHostContractTransport = exports.registerHostContractTransport = exports.getHostContractTransport = exports.setSchemaToFieldsFn = exports.extractToolShape = exports.extractTableShape = exports.createLocalContractConsumer = exports.contractsSchema = exports.contractsMetaData = exports.ContractsTable = exports.Contracts = exports.inProcessTransportPair = exports.connectionContractTransport = exports.CONTRACT_REQUEST_CHANNEL = exports.CONTRACT_NOTIFY_CHANNEL = exports.registerContractResolver = exports.isSelfTrustedContractCaller = exports.handleContractCall = exports.getContractResolver = exports.createUserContextContractProviderRouter = exports.createLocalUserContextContractProviderRouter = exports.sameUserContractPermissionCheck = exports.createContractProviderSession = exports.createContractProviderEndpoint = exports.createContractProvider = exports.createContractConsumer = exports.CONTRACT_CALL_RPC = exports.contractProvidersSchema = exports.contractProvidersMetaData = exports.ContractProvidersTable = exports.ContractProviders = exports.createContractProviderRouter = exports.PackageBuilder = exports.definePackage = exports.ContractBuilder = void 0;
-exports.validateProviderSatisfiesContract = exports.validateImmutability = exports.validateAlsoImplements = exports.contractKey = exports.registerSystemContract = exports.listSystemContracts = void 0;
+exports.getToolAccessControlContractDefinition = exports.resolveLogsContract = exports.LOGS_CONTRACT_VERSION = exports.getLogsContractDefinition = exports.getDeviceOperationsContractDefinition = exports.deviceOperationsToolIds = exports.deviceOperationsProviderPackageId = exports.DEVICE_OPERATIONS_MAX_TOOLS = exports.DEVICE_OPERATIONS_MAX_ROWS = exports.DEVICE_OPERATIONS_MAX_RESULT_BYTES = exports.DEVICE_OPERATIONS_MAX_QUERY_LENGTH = exports.DEVICE_OPERATIONS_CONTRACT_VERSION = exports.ContractRegistry = exports.PersistentContractRegistry = exports.waitForHostContractTransport = exports.subscribeHostContractTransport = exports.registerHostContractTransport = exports.getHostContractTransport = exports.setSchemaToFieldsFn = exports.extractToolShape = exports.extractTableShape = exports.createLocalContractConsumer = exports.contractsSchema = exports.contractsMetaData = exports.ContractsTable = exports.Contracts = exports.inProcessTransportPair = exports.connectionContractTransport = exports.CONTRACT_REQUEST_CHANNEL = exports.CONTRACT_NOTIFY_CHANNEL = exports.registerContractResolver = exports.isSelfTrustedContractCaller = exports.handleContractCall = exports.getContractResolver = exports.createUserContextContractProviderRouter = exports.createLocalUserContextContractProviderRouter = exports.sameUserContractPermissionCheck = exports.createContractProviderSession = exports.createContractProviderEndpoint = exports.createContractProvider = exports.createContractConsumer = exports.CONTRACT_CALL_RPC = exports.contractProvidersSchema = exports.contractProvidersMetaData = exports.ContractProvidersTable = exports.ContractProviders = exports.createContractProviderRouter = exports.PackageBuilder = exports.definePackage = exports.ContractBuilder = void 0;
+exports.validateProviderSatisfiesContract = exports.validateImmutability = exports.validateAlsoImplements = exports.contractKey = exports.registerSystemContract = exports.listSystemContracts = exports.installSystemContracts = exports.TOOL_ACCESS_CONTROL_CONTRACT_VERSION = void 0;
 var builder_1 = require("./builder");
 Object.defineProperty(exports, "ContractBuilder", { enumerable: true, get: function () { return builder_1.ContractBuilder; } });
 Object.defineProperty(exports, "definePackage", { enumerable: true, get: function () { return builder_1.definePackage; } });
@@ -80,6 +80,9 @@ Object.defineProperty(exports, "getLogsContractDefinition", { enumerable: true,
 Object.defineProperty(exports, "LOGS_CONTRACT_VERSION", { enumerable: true, get: function () { return logs_contract_1.LOGS_CONTRACT_VERSION; } });
 Object.defineProperty(exports, "resolveLogsContract", { enumerable: true, get: function () { return logs_contract_1.resolveLogsContract; } });
 __exportStar(require("./system/network-contracts"), exports);
+var tool_access_control_contract_1 = require("./system/tool-access-control-contract");
+Object.defineProperty(exports, "getToolAccessControlContractDefinition", { enumerable: true, get: function () { return tool_access_control_contract_1.getToolAccessControlContractDefinition; } });
+Object.defineProperty(exports, "TOOL_ACCESS_CONTROL_CONTRACT_VERSION", { enumerable: true, get: function () { return tool_access_control_contract_1.TOOL_ACCESS_CONTROL_CONTRACT_VERSION; } });
 var system_contracts_1 = require("./system-contracts");
 Object.defineProperty(exports, "installSystemContracts", { enumerable: true, get: function () { return system_contracts_1.installSystemContracts; } });
 Object.defineProperty(exports, "listSystemContracts", { enumerable: true, get: function () { return system_contracts_1.listSystemContracts; } });

package/dist/contracts/system/index.d.ts

@@ -5,6 +5,8 @@
 import "./device-operations-contract";
 import "./logs-contract";
 import "./network-contracts";
+import "./tool-access-control-contract";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./device-operations-contract";
 export { getLogsContractDefinition, type ILogsConsumer, LOGS_CONTRACT_VERSION, resolveLogsContract, } from "./logs-contract";
 export * from "./network-contracts";
+export { getToolAccessControlContractDefinition, type IToolAccessControlConsumer, TOOL_ACCESS_CONTROL_CONTRACT_VERSION, } from "./tool-access-control-contract";