@proofhound/core 0.1.6

package/dist/server/channels/mcp/release-line.tools.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createReleaseLineTools = createReleaseLineTools;
+/**
+ * MCP tool definitions for unified release lines.
+ * Mirrors the REST surface for release line read APIs, traffic-ratio adjustment,
+ * and run config changes.
+ * See docs/specs/00-overview.md §5 (three-channel parity) + docs/specs/27-releases.md.
+ */
+const shared_1 = require("@proofhound/shared");
+const zod_1 = require("zod");
+const mcp_context_1 = require("./mcp-context");
+const uuidParam = zod_1.z.string().uuid();
+function createReleaseLineTools(service) {
+    return [
+        {
+            name: 'release_line_list',
+            description: '列出统一发布线及当前生产 / 灰度 lane',
+            inputSchema: { type: 'object', properties: {} },
+            handler: async (_input, ctx) => {
+                const { projectId } = (0, mcp_context_1.resolveMcpProjectContext)(ctx);
+                return service.list(projectId, (0, mcp_context_1.getMcpActor)(ctx));
+            },
+        },
+        {
+            name: 'release_line_get',
+            description: '读取单条发布线详情',
+            inputSchema: {
+                type: 'object',
+                required: ['releaseLineId'],
+                properties: {
+                    releaseLineId: { type: 'string', format: 'uuid' },
+                },
+            },
+            handler: async (input, ctx) => {
+                const { projectId } = (0, mcp_context_1.resolveMcpProjectContext)(ctx);
+                const releaseLineId = uuidParam.parse(input.releaseLineId);
+                return service.get(projectId, releaseLineId, (0, mcp_context_1.getMcpActor)(ctx));
+            },
+        },
+        {
+            name: 'release_line_event_list',
+            description: '列出发布线操作历史事件',
+            inputSchema: {
+                type: 'object',
+                required: ['releaseLineId'],
+                properties: {
+                    releaseLineId: { type: 'string', format: 'uuid' },
+                },
+            },
+            handler: async (input, ctx) => {
+                const { projectId } = (0, mcp_context_1.resolveMcpProjectContext)(ctx);
+                const releaseLineId = uuidParam.parse(input.releaseLineId);
+                return service.listEvents(projectId, releaseLineId, (0, mcp_context_1.getMcpActor)(ctx));
+            },
+        },
+        {
+            name: 'release_line_update_traffic_ratio',
+            description: '调整发布线当前灰度 lane 的流量比例',
+            inputSchema: {
+                type: 'object',
+                required: ['releaseLineId', 'trafficRatio'],
+                properties: {
+                    releaseLineId: { type: 'string', format: 'uuid' },
+                    trafficRatio: { type: 'number', minimum: 0, maximum: 1 },
+                },
+            },
+            handler: async (input, ctx) => {
+                const { projectId } = (0, mcp_context_1.resolveMcpProjectContext)(ctx);
+                const releaseLineId = uuidParam.parse(input.releaseLineId);
+                const body = shared_1.updateReleaseLineTrafficRatioInputSchema.parse({ trafficRatio: input.trafficRatio });
+                return service.updateTrafficRatio(projectId, releaseLineId, body, (0, mcp_context_1.getMcpActor)(ctx));
+            },
+        },
+        {
+            name: 'release_line_update_run_config',
+            description: '通过配置变更事件更新发布线当前 production 或灰度 lane 的模型与运行配置',
+            inputSchema: {
+                type: 'object',
+                required: ['releaseLineId', 'laneType', 'runConfig'],
+                properties: {
+                    releaseLineId: { type: 'string', format: 'uuid' },
+                    laneType: { type: 'string', enum: ['production', 'canary'] },
+                    modelId: { type: 'string', format: 'uuid' },
+                    runConfig: { type: 'object', additionalProperties: true },
+                },
+            },
+            handler: async (input, ctx) => {
+                const { projectId } = (0, mcp_context_1.resolveMcpProjectContext)(ctx);
+                const releaseLineId = uuidParam.parse(input.releaseLineId);
+                const body = shared_1.updateReleaseLineRunConfigInputSchema.parse({
+                    laneType: input.laneType,
+                    modelId: input.modelId,
+                    runConfig: input.runConfig,
+                });
+                return service.updateRunConfig(projectId, releaseLineId, body, (0, mcp_context_1.getMcpActor)(ctx));
+            },
+        },
+    ];
+}
+//# sourceMappingURL=release-line.tools.js.map

package/dist/server/channels/mcp/release-line.tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-line.tools.js","sourceRoot":"","sources":["../../../../src/server/channels/mcp/release-line.tools.ts"],"names":[],"mappings":";;AAcA,wDAsFC;AApGD;;;;;GAKG;AACH,+CAAqH;AACrH,6BAAwB;AACxB,+CAAsE;AAItE,MAAM,SAAS,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAEpC,SAAgB,sBAAsB,CAAC,OAA2B;IAChE,OAAO;QACL;YACE,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,wBAAwB;YACrC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;YAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;gBAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sCAAwB,EAAC,GAAG,CAAC,CAAC;gBACpD,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;YACnD,CAAC;SACF;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,WAAW;YACxB,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,eAAe,CAAC;gBAC3B,UAAU,EAAE;oBACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;iBAClD;aACF;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sCAAwB,EAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;YACjE,CAAC;SACF;QACD;YACE,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EAAE,aAAa;YAC1B,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,eAAe,CAAC;gBAC3B,UAAU,EAAE;oBACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;iBAClD;aACF;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sCAAwB,EAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC3D,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,aAAa,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;YACxE,CAAC;SACF;QACD;YACE,IAAI,EAAE,mCAAmC;YACzC,WAAW,EAAE,sBAAsB;YACnC,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC;gBAC3C,UAAU,EAAE;oBACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;oBACjD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;iBACzD;aACF;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sCAAwB,EAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC3D,MAAM,IAAI,GAAG,iDAAwC,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBAClG,OAAO,OAAO,CAAC,kBAAkB,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;YACtF,CAAC;SACF;QACD;YACE,IAAI,EAAE,gCAAgC;YACtC,WAAW,EAAE,8CAA8C;YAC3D,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,WAAW,CAAC;gBACpD,UAAU,EAAE;oBACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;oBACjD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE;oBAC5D,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;oBAC3C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE;iBAC1D;aACF;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sCAAwB,EAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC3D,MAAM,IAAI,GAAG,8CAAqC,CAAC,KAAK,CAAC;oBACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;YACnF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/server/channels/mcp/run-result.tools.d.ts

@@ -0,0 +1,4 @@
+import type { RunResultService } from '../../modules/run-result/run-result.service';
+import type { McpToolDefinition } from './mcp.types';
+export declare function createRunResultTools(runResultService: RunResultService): McpToolDefinition[];
+//# sourceMappingURL=run-result.tools.d.ts.map

package/dist/server/channels/mcp/run-result.tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-result.tools.d.ts","sourceRoot":"","sources":["../../../../src/server/channels/mcp/run-result.tools.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIrD,wBAAgB,oBAAoB,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,iBAAiB,EAAE,CAwG5F"}

package/dist/server/channels/mcp/run-result.tools.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRunResultTools = createRunResultTools;
+/**
+ * MCP tool definitions for the run-result domain.
+ * Each tool delegates to RunResultService, matching the REST surface 1:1.
+ * See docs/specs/00-overview.md §5 (three-channel parity).
+ */
+const shared_1 = require("@proofhound/shared");
+const zod_1 = require("zod");
+const mcp_context_1 = require("./mcp-context");
+const runResultIdParamSchema = zod_1.z.string().uuid();
+function createRunResultTools(runResultService) {
+    return [
+        {
+            name: 'run_result_list_for_experiment',
+            description: '按实验查询运行结果列表（分页 / 按 status / judgmentStatus / isCorrect / search 过滤，含输入变量与模型输出预览字段）',
+            inputSchema: {
+                type: 'object',
+                required: ['experimentId'],
+                properties: {
+                    experimentId: { type: 'string', format: 'uuid' },
+                    page: { type: 'integer', minimum: 1 },
+                    pageSize: { type: 'integer', minimum: 1, maximum: 200 },
+                    status: { type: 'array', items: { type: 'string', enum: ['success', 'error', 'timeout', 'rate_limited'] } },
+                    judgmentStatus: {
+                        type: 'array',
+                        items: { type: 'string', enum: ['correct', 'incorrect', 'parse_error', 'judge_error'] },
+                    },
+                    isCorrect: { type: 'boolean' },
+                    search: { type: 'string' },
+                    sort: { type: 'string', enum: ['created_desc', 'latency_desc', 'tokens_desc'] },
+                },
+            },
+            handler: async (input, ctx) => {
+                const { projectId } = (0, mcp_context_1.resolveMcpProjectContext)(ctx);
+                const experimentId = shared_1.experimentIdParamSchema.parse(input.experimentId);
+                const query = shared_1.runResultListQuerySchema.parse({
+                    page: input.page,
+                    pageSize: input.pageSize,
+                    status: input.status,
+                    judgmentStatus: input.judgmentStatus,
+                    isCorrect: input.isCorrect,
+                    search: input.search,
+                    sort: input.sort,
+                });
+                return runResultService.listExperimentRunResults(projectId, experimentId, (0, mcp_context_1.getMcpActor)(ctx), query);
+            },
+        },
+        {
+            name: 'run_result_get',
+            description: '读取单个运行结果详情（含 raw_response / parsed_output / rendered_prompt 等大字段）',
+            inputSchema: {
+                type: 'object',
+                required: ['experimentId', 'runResultId'],
+                properties: {
+                    experimentId: { type: 'string', format: 'uuid' },
+                    runResultId: { type: 'string', format: 'uuid' },
+                },
+            },
+            handler: async (input, ctx) => {
+                const { projectId } = (0, mcp_context_1.resolveMcpProjectContext)(ctx);
+                const experimentId = shared_1.experimentIdParamSchema.parse(input.experimentId);
+                const runResultId = runResultIdParamSchema.parse(input.runResultId);
+                return runResultService.getExperimentRunResult(projectId, experimentId, runResultId, (0, mcp_context_1.getMcpActor)(ctx));
+            },
+        },
+        {
+            name: 'run_result_list_for_release',
+            description: '按发布维度查询运行结果列表（production / canary lane，支持发布组合 / sourceIds / promptVersionIds / externalId / 状态 / 时间窗过滤）',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    sourceIds: { type: 'array', items: { type: 'string', format: 'uuid' } },
+                    releaseVariantIds: { type: 'array', items: { type: 'string', format: 'uuid' } },
+                    promptVersionIds: { type: 'array', items: { type: 'string', format: 'uuid' } },
+                    lane: { type: 'array', items: { type: 'string', enum: ['production', 'canary'] } },
+                    externalId: { type: 'string' },
+                    from: { type: 'string', format: 'date-time' },
+                    to: { type: 'string', format: 'date-time' },
+                    page: { type: 'integer', minimum: 1 },
+                    pageSize: { type: 'integer', minimum: 1, maximum: 200 },
+                    status: { type: 'array', items: { type: 'string', enum: ['success', 'error', 'timeout', 'rate_limited'] } },
+                    judgmentStatus: {
+                        type: 'array',
+                        items: { type: 'string', enum: ['correct', 'incorrect', 'parse_error', 'judge_error'] },
+                    },
+                    isCorrect: { type: 'boolean' },
+                    search: { type: 'string' },
+                    sort: { type: 'string', enum: ['created_desc', 'latency_desc', 'tokens_desc'] },
+                },
+            },
+            handler: async (input, ctx) => {
+                const { projectId } = (0, mcp_context_1.resolveMcpProjectContext)(ctx);
+                const query = shared_1.runResultReleaseListQuerySchema.parse({
+                    sourceIds: input.sourceIds,
+                    releaseVariantIds: input.releaseVariantIds,
+                    promptVersionIds: input.promptVersionIds,
+                    lane: input.lane,
+                    externalId: input.externalId,
+                    from: input.from,
+                    to: input.to,
+                    page: input.page,
+                    pageSize: input.pageSize,
+                    status: input.status,
+                    judgmentStatus: input.judgmentStatus,
+                    isCorrect: input.isCorrect,
+                    search: input.search,
+                    sort: input.sort,
+                });
+                return runResultService.listReleaseRunResults(projectId, (0, mcp_context_1.getMcpActor)(ctx), query);
+            },
+        },
+    ];
+}
+//# sourceMappingURL=run-result.tools.js.map

package/dist/server/channels/mcp/run-result.tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-result.tools.js","sourceRoot":"","sources":["../../../../src/server/channels/mcp/run-result.tools.ts"],"names":[],"mappings":";;AAaA,oDAwGC;AArHD;;;;GAIG;AACH,+CAAwH;AACxH,6BAAwB;AACxB,+CAAsE;AAItE,MAAM,sBAAsB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAEjD,SAAgB,oBAAoB,CAAC,gBAAkC;IACrE,OAAO;QACL;YACE,IAAI,EAAE,gCAAgC;YACtC,WAAW,EACT,oFAAoF;YACtF,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,cAAc,CAAC;gBAC1B,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;oBAChD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;oBACrC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;oBACvD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE;oBAC3G,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE;qBACxF;oBACD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE;iBAChF;aACF;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sCAAwB,EAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,YAAY,GAAG,gCAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,iCAAwB,CAAC,KAAK,CAAC;oBAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC,CAAC;gBACH,OAAO,gBAAgB,CAAC,wBAAwB,CAAC,SAAS,EAAE,YAAY,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YACrG,CAAC;SACF;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,mEAAmE;YAChF,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC;gBACzC,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;oBAChD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;iBAChD;aACF;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sCAAwB,EAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,YAAY,GAAG,gCAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACvE,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBACpE,OAAO,gBAAgB,CAAC,sBAAsB,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;YACzG,CAAC;SACF;QACD;YACE,IAAI,EAAE,6BAA6B;YACnC,WAAW,EACT,yGAAyG;YAC3G,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;oBACvE,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;oBAC/E,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;oBAC9E,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE;oBAClF,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;oBAC7C,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;oBAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;oBACrC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;oBACvD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE;oBAC3G,cAAc,EAAE;wBACd,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE;qBACxF;oBACD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE;iBAChF;aACF;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sCAAwB,EAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,KAAK,GAAG,wCAA+B,CAAC,KAAK,CAAC;oBAClD,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC,CAAC;gBACH,OAAO,gBAAgB,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YACpF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/server/channels/mcp/token.tools.d.ts

@@ -0,0 +1,4 @@
+import type { TokenService } from '../../common/contracts/token.service';
+import type { McpToolDefinition } from './mcp.types';
+export declare function createTokenTools(service: TokenService): McpToolDefinition[];
+//# sourceMappingURL=token.tools.d.ts.map

package/dist/server/channels/mcp/token.tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.tools.d.ts","sourceRoot":"","sources":["../../../../src/server/channels/mcp/token.tools.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,iBAAiB,EAAE,CA4E3E"}

package/dist/server/channels/mcp/token.tools.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTokenTools = createTokenTools;
+/**
+ * MCP tool definitions for user tokens (local-admin-console credentials; the same token can be used for both the HTTP API and MCP).
+ * Token plaintext is only returned by explicit create / reveal operations.
+ *
+ * See docs/specs/06-database-schema.md §3.2 / docs/specs/08-saas-adapter-boundary.md §3.5.
+ */
+const shared_1 = require("@proofhound/shared");
+const mcp_context_1 = require("./mcp-context");
+function createTokenTools(service) {
+    return [
+        {
+            name: 'token_list',
+            description: '列出本地管理端用户 Token（只返回 prefix，不返回明文）',
+            inputSchema: { type: 'object', properties: {} },
+            handler: async (_input, ctx) => service.listUserTokens((0, mcp_context_1.getMcpActor)(ctx)),
+        },
+        {
+            name: 'token_create',
+            description: '创建用户 Token（返回明文；同一 Token 可用于 HTTP API 与 MCP 调用）',
+            inputSchema: {
+                type: 'object',
+                required: ['name'],
+                properties: {
+                    name: { type: 'string' },
+                    ipWhitelist: { type: 'array', items: { type: 'string' } },
+                    expiresAt: { type: 'string', format: 'date-time' },
+                },
+            },
+            handler: async (input, ctx) => {
+                const dto = shared_1.createUserTokenSchema.parse({
+                    name: input.name,
+                    ipWhitelist: input.ipWhitelist,
+                    expiresAt: input.expiresAt,
+                });
+                return service.createUserToken(dto, (0, mcp_context_1.getMcpActor)(ctx), 'mcp');
+            },
+        },
+        {
+            name: 'token_reveal',
+            description: '查看用户 Token 明文；仅对已加密保存明文的 Token 返回 plaintext',
+            inputSchema: {
+                type: 'object',
+                required: ['tokenId'],
+                properties: {
+                    tokenId: { type: 'string', format: 'uuid' },
+                },
+            },
+            handler: async (input, ctx) => service.revealUserToken(shared_1.tokenIdParamSchema.parse(input.tokenId), (0, mcp_context_1.getMcpActor)(ctx), 'mcp'),
+        },
+        {
+            name: 'token_update',
+            description: '更新用户 Token 名称和失效时间；不改变明文、前缀、hash 或 IP 白名单',
+            inputSchema: {
+                type: 'object',
+                required: ['tokenId', 'name'],
+                properties: {
+                    tokenId: { type: 'string', format: 'uuid' },
+                    name: { type: 'string' },
+                    expiresAt: { type: ['string', 'null'], format: 'date-time' },
+                },
+            },
+            handler: async (input, ctx) => {
+                const dto = shared_1.updateUserTokenSchema.parse({
+                    name: input.name,
+                    expiresAt: input.expiresAt,
+                });
+                return service.updateUserToken(shared_1.tokenIdParamSchema.parse(input.tokenId), dto, (0, mcp_context_1.getMcpActor)(ctx), 'mcp');
+            },
+        },
+        {
+            name: 'token_delete',
+            description: '删除用户 Token；实际执行为吊销 revoked_at，Token 将立即失效',
+            inputSchema: {
+                type: 'object',
+                required: ['tokenId'],
+                properties: {
+                    tokenId: { type: 'string', format: 'uuid' },
+                },
+            },
+            handler: async (input, ctx) => service.deleteUserToken(shared_1.tokenIdParamSchema.parse(input.tokenId), (0, mcp_context_1.getMcpActor)(ctx), 'mcp'),
+        },
+    ];
+}
+//# sourceMappingURL=token.tools.js.map

package/dist/server/channels/mcp/token.tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.tools.js","sourceRoot":"","sources":["../../../../src/server/channels/mcp/token.tools.ts"],"names":[],"mappings":";;AAWA,4CA4EC;AAvFD;;;;;GAKG;AACH,+CAAsG;AACtG,+CAA4C;AAI5C,SAAgB,gBAAgB,CAAC,OAAqB;IACpD,OAAO;QACL;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,mCAAmC;YAChD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;YAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,IAAA,yBAAW,EAAC,GAAG,CAAC,CAAC;SACzE;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,iDAAiD;YAC9D,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACzD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;iBACnD;aACF;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,GAAG,GAAG,8BAAqB,CAAC,KAAK,CAAC;oBACtC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAC/D,CAAC;SACF;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,6CAA6C;YAC1D,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,SAAS,CAAC;gBACrB,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;iBAC5C;aACF;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5B,OAAO,CAAC,eAAe,CAAC,2BAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,EAAE,KAAK,CAAC;SAC5F;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,2CAA2C;YACxD,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;gBAC7B,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;oBAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE;iBAC7D;aACF;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5B,MAAM,GAAG,GAAG,8BAAqB,CAAC,KAAK,CAAC;oBACtC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,eAAe,CAAC,2BAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YACxG,CAAC;SACF;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,2CAA2C;YACxD,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,SAAS,CAAC;gBACrB,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;iBAC5C;aACF;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAC5B,OAAO,CAAC,eAAe,CAAC,2BAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAA,yBAAW,EAAC,GAAG,CAAC,EAAE,KAAK,CAAC;SAC5F;KACF,CAAC;AACJ,CAAC"}

package/dist/server/common/access-control.d.ts

@@ -0,0 +1,5 @@
+import type { ActorContext } from './actor-context';
+import type { CurrentUserPayload } from './decorators/current-user.decorator';
+export type AccessAction = 'project_read' | 'project_write' | 'release_manage' | 'platform_manage' | 'user_token_manage' | 'mcp_tool';
+export declare function toActorContext(actor: CurrentUserPayload | ActorContext): ActorContext;
+//# sourceMappingURL=access-control.d.ts.map

package/dist/server/common/access-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../../../src/server/common/access-control.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,MAAM,MAAM,YAAY,GACpB,cAAc,GACd,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,mBAAmB,GACnB,UAAU,CAAC;AAKf,wBAAgB,cAAc,CAAC,KAAK,EAAE,kBAAkB,GAAG,YAAY,GAAG,YAAY,CAiBrF"}

package/dist/server/common/access-control.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toActorContext = toActorContext;
+// Normalize the HTTP CurrentUserPayload (or an already-resolved ActorContext) into a plain ActorContext.
+// Call sites pass the result into AccessControlService.assertCan, whose contract takes ActorContext
+// (the clean cross-channel identity, not the OSS-specific HTTP payload).
+function toActorContext(actor) {
+    const maybeContext = actor;
+    if (maybeContext.actorId && maybeContext.actorKind) {
+        return {
+            actorId: maybeContext.actorId,
+            actorKind: maybeContext.actorKind,
+            projectId: maybeContext.projectId,
+            orgId: maybeContext.orgId,
+        };
+    }
+    const current = actor;
+    return {
+        actorId: current.sub,
+        actorKind: current.actorKind ?? 'local_user',
+        projectId: current.projectId,
+        orgId: current.orgId,
+    };
+}
+//# sourceMappingURL=access-control.js.map

package/dist/server/common/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../../../src/server/common/access-control.ts"],"names":[],"mappings":";;AAcA,wCAiBC;AApBD,yGAAyG;AACzG,oGAAoG;AACpG,yEAAyE;AACzE,SAAgB,cAAc,CAAC,KAAwC;IACrE,MAAM,YAAY,GAAG,KAA8B,CAAC;IACpD,IAAI,YAAY,CAAC,OAAO,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,KAAK,EAAE,YAAY,CAAC,KAAK;SAC1B,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAA2B,CAAC;IAC5C,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,YAAY;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC"}

package/dist/server/common/actor-context.d.ts

@@ -0,0 +1,11 @@
+export type ActorKind = 'script' | 'local_user' | 'system_mcp' | 'system_webhook' | 'system_release_runner' | 'system_workflow_recovery';
+export interface ActorContext {
+    actorId: string;
+    actorKind: ActorKind;
+    projectId?: string;
+    /** SaaS-only: the org this actor is pinned to (e.g. an org-scoped API token). OSS never sets it. */
+    orgId?: string;
+}
+export declare const LOCAL_ACTOR_ID = "00000000-0000-4000-8000-000000000001";
+export type { ProjectContext } from '@proofhound/shared';
+//# sourceMappingURL=actor-context.d.ts.map

package/dist/server/common/actor-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-context.d.ts","sourceRoot":"","sources":["../../../src/server/common/actor-context.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,SAAS,GACjB,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,gBAAgB,GAChB,uBAAuB,GACvB,0BAA0B,CAAC;AAE/B,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAKD,eAAO,MAAM,cAAc,yCAAyC,CAAC;AAErE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/server/common/actor-context.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCAL_ACTOR_ID = void 0;
+// Stable UUID used as the synthetic local-user actor in OSS self-hosted deployments.
+// Lives here (not in guard.ts) so the resolver and other low-level layers can import it
+// without taking a reverse dependency on the guard.
+exports.LOCAL_ACTOR_ID = '00000000-0000-4000-8000-000000000001';
+//# sourceMappingURL=actor-context.js.map

package/dist/server/common/actor-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-context.js","sourceRoot":"","sources":["../../../src/server/common/actor-context.ts"],"names":[],"mappings":";;;AA2BA,qFAAqF;AACrF,wFAAwF;AACxF,oDAAoD;AACvC,QAAA,cAAc,GAAG,sCAAsC,CAAC"}

package/dist/server/common/contracts/access-control.service.d.ts

@@ -0,0 +1,6 @@
+import type { ActorContext, ProjectContext } from '../actor-context';
+import type { AccessAction } from '../access-control';
+export declare abstract class AccessControlService {
+    abstract assertCan(actor: ActorContext, project: ProjectContext, action: AccessAction): Promise<void>;
+}
+//# sourceMappingURL=access-control.service.d.ts.map

package/dist/server/common/contracts/access-control.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.service.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/access-control.service.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,8BAAsB,oBAAoB;IACxC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CACtG"}

package/dist/server/common/contracts/access-control.service.js

@@ -0,0 +1,13 @@
+"use strict";
+// AccessControlService — adapter extension point
+// See docs/specs/08-saas-adapter-boundary.md §3.6
+//
+// Decides whether `actor + project + action` is allowed. The OSS default `LocalAccessControlService`
+// applies coarse actorKind rules and ignores `project`; the SaaS form (`RbacAccessControl`, in a separate
+// repo) reads actor org membership / role + project and may perform async lookups — hence the async signature.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessControlService = void 0;
+class AccessControlService {
+}
+exports.AccessControlService = AccessControlService;
+//# sourceMappingURL=access-control.service.js.map

package/dist/server/common/contracts/access-control.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.service.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/access-control.service.ts"],"names":[],"mappings":";AAAA,iDAAiD;AACjD,kDAAkD;AAClD,EAAE;AACF,qGAAqG;AACrG,0GAA0G;AAC1G,+GAA+G;;;AAK/G,MAAsB,oBAAoB;CAEzC;AAFD,oDAEC"}

package/dist/server/common/contracts/actor-context.resolver.d.ts

@@ -0,0 +1,7 @@
+import type { ActorContext } from '../actor-context';
+import type { HttpRequestLike } from './types';
+export declare abstract class ActorContextResolver {
+    abstract resolveFromHttp(req: HttpRequestLike): Promise<ActorContext>;
+    abstract resolveFromUserToken(token: string): Promise<ActorContext>;
+}
+//# sourceMappingURL=actor-context.resolver.d.ts.map

package/dist/server/common/contracts/actor-context.resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-context.resolver.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/actor-context.resolver.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,8BAAsB,oBAAoB;IACxC,QAAQ,CAAC,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;IAErE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CACpE"}

package/dist/server/common/contracts/actor-context.resolver.js

@@ -0,0 +1,15 @@
+"use strict";
+// ActorContextResolver — HTTP-entry adapter extension point
+// See docs/specs/08-saas-adapter-boundary.md §3.2
+//
+// HTTP controllers complete user-token validation via HttpActorGuard → resolveFromHttp;
+// the same token pool is validated independently by McpAuthResolver, but this resolver MUST NOT call McpAuthResolver
+// (SPEC §8 red line: the three entry resolvers never call each other).
+//
+// `resolveFromUserToken` is the shared entrypoint for HTTP paths and unit tests; it must not be reused directly by the MCP entry.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActorContextResolver = void 0;
+class ActorContextResolver {
+}
+exports.ActorContextResolver = ActorContextResolver;
+//# sourceMappingURL=actor-context.resolver.js.map

package/dist/server/common/contracts/actor-context.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-context.resolver.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/actor-context.resolver.ts"],"names":[],"mappings":";AAAA,4DAA4D;AAC5D,kDAAkD;AAClD,EAAE;AACF,wFAAwF;AACxF,qHAAqH;AACrH,uEAAuE;AACvE,EAAE;AACF,kIAAkI;;;AAKlI,MAAsB,oBAAoB;CAIzC;AAJD,oDAIC"}

package/dist/server/common/contracts/connector-context.resolver.d.ts

@@ -0,0 +1,19 @@
+import type { ActorContext, ProjectContext } from '../actor-context';
+export interface ConnectorRecord {
+    id: string;
+    projectId: string;
+    name: string;
+    config: Record<string, unknown>;
+    webhookPath: string | null;
+    ipWhitelist: string[] | null;
+}
+export interface ConnectorResolveResult {
+    connector: ConnectorRecord;
+    projectContext: ProjectContext;
+    actorContext: ActorContext;
+    webhookTokenId: string;
+}
+export declare abstract class ConnectorContextResolver {
+    abstract resolveFromWebhookToken(webhookSlug: string, pathName: string, token: string): Promise<ConnectorResolveResult>;
+}
+//# sourceMappingURL=connector-context.resolver.d.ts.map

package/dist/server/common/contracts/connector-context.resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-context.resolver.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/connector-context.resolver.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,8BAAsB,wBAAwB;IAC5C,QAAQ,CAAC,uBAAuB,CAC9B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sBAAsB,CAAC;CACnC"}

package/dist/server/common/contracts/connector-context.resolver.js

@@ -0,0 +1,23 @@
+"use strict";
+// ConnectorContextResolver — adapter extension point
+// See docs/specs/08-saas-adapter-boundary.md §3.4
+//
+// Resolves `(:webhookSlug, :pathName) + webhook token` into a connector context, then produces a
+// ProjectContext + a system actor in one shot. The webhook entry does NOT go through
+// ProjectContextResolver (§3.1): a webhook credential is a per-consumer channel credential, not the
+// project administrator, so this resolver produces the ProjectContext directly.
+//
+// Independent of ActorContextResolver (§3.2) / McpAuthResolver (§3.3) — the three entry resolvers
+// never call each other (§8 red line).
+//
+// OSS default `LocalConnectorContextResolver` lives in the webhook runtime (it depends on
+// WebhookRepository); SaaS `RemoteConnectorContextResolver` may add HMAC / multi-tenant isolation.
+//
+// `ConnectorRecord` is defined structurally here so this abstract stays free of any webhook-runtime
+// import (keeping the dependency acyclic); the webhook runtime's connector row satisfies it.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectorContextResolver = void 0;
+class ConnectorContextResolver {
+}
+exports.ConnectorContextResolver = ConnectorContextResolver;
+//# sourceMappingURL=connector-context.resolver.js.map

package/dist/server/common/contracts/connector-context.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-context.resolver.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/connector-context.resolver.ts"],"names":[],"mappings":";AAAA,qDAAqD;AACrD,kDAAkD;AAClD,EAAE;AACF,iGAAiG;AACjG,qFAAqF;AACrF,oGAAoG;AACpG,gFAAgF;AAChF,EAAE;AACF,kGAAkG;AAClG,uCAAuC;AACvC,EAAE;AACF,0FAA0F;AAC1F,mGAAmG;AACnG,EAAE;AACF,oGAAoG;AACpG,6FAA6F;;;AAoB7F,MAAsB,wBAAwB;CAM7C;AAND,4DAMC"}

package/dist/server/common/contracts/http-actor.guard.d.ts

@@ -0,0 +1,13 @@
+import type { CanActivate, ExecutionContext } from '@nestjs/common';
+import type { ActorContext } from '../actor-context';
+import type { CurrentUserPayload } from '../decorators/current-user.decorator';
+import { ActorContextResolver } from './actor-context.resolver';
+import { ProjectContextResolver } from './project-context.resolver';
+export declare class HttpActorGuard implements CanActivate {
+    private readonly resolver;
+    private readonly projectResolver;
+    constructor(resolver: ActorContextResolver, projectResolver: ProjectContextResolver);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+export declare function toCurrentUserPayload(actor: ActorContext): CurrentUserPayload;
+//# sourceMappingURL=http-actor.guard.d.ts.map

package/dist/server/common/contracts/http-actor.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-actor.guard.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/http-actor.guard.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAA4B,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE9F,qBACa,cAAe,YAAW,WAAW;IAE9C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,eAAe;gBADf,QAAQ,EAAE,oBAAoB,EAC9B,eAAe,EAAE,sBAAsB;IAGpD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAuB/D;AAQD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,kBAAkB,CAc5E"}