@proofhound/core 0.1.6

package/dist/server/common/contracts/http-actor.guard.js

@@ -0,0 +1,87 @@
+"use strict";
+// HttpActorGuard — HTTP entry guard adapter extension point
+// See docs/specs/08-saas-adapter-boundary.md §3
+//
+// HTTP controllers attach @UseGuards(HttpActorGuard). Nest treats class guards in metadata as
+// enhancer injectables, so this class must be executable at runtime rather than an abstract shell.
+//
+// The guard's responsibility is to resolve the request actor and attach it to request.user
+// as CurrentUserPayload. Real credential parsing lives in ActorContextResolver, so Controllers
+// still don't reference a Local* concrete by name.
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpActorGuard = void 0;
+exports.toCurrentUserPayload = toCurrentUserPayload;
+const common_1 = require("@nestjs/common");
+const actor_context_resolver_1 = require("./actor-context.resolver");
+const project_context_resolver_1 = require("./project-context.resolver");
+let HttpActorGuard = class HttpActorGuard {
+    constructor(resolver, projectResolver) {
+        this.resolver = resolver;
+        this.projectResolver = projectResolver;
+    }
+    async canActivate(context) {
+        const request = context
+            .switchToHttp()
+            .getRequest();
+        const actor = await this.resolver.resolveFromHttp(request);
+        request.user = toCurrentUserPayload(actor);
+        // Resolve the request's ProjectContext via the DI resolver and attach it for @CurrentProject.
+        // OSS LocalProjectContextResolver ignores the hint and returns LOCAL_PROJECT_CONTEXT; SaaS reads
+        // the X-Project-Id header and validates the actor's access to the project.
+        try {
+            request.projectContext = await this.projectResolver.resolve(actor, {
+                projectIdHeader: readProjectIdHeader(request),
+            });
+        }
+        catch (error) {
+            if (error instanceof project_context_resolver_1.ProjectAccessDeniedError) {
+                throw new common_1.ForbiddenException(error.message);
+            }
+            throw error;
+        }
+        return true;
+    }
+};
+exports.HttpActorGuard = HttpActorGuard;
+exports.HttpActorGuard = HttpActorGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [actor_context_resolver_1.ActorContextResolver,
+        project_context_resolver_1.ProjectContextResolver])
+], HttpActorGuard);
+function readProjectIdHeader(request) {
+    const raw = request.headers['x-project-id'];
+    const value = Array.isArray(raw) ? raw[0] : raw;
+    return value && value.length > 0 ? value : undefined;
+}
+function toCurrentUserPayload(actor) {
+    const payload = {
+        sub: actor.actorId,
+        actorId: actor.actorId,
+        actorKind: actor.actorKind,
+        projectId: actor.projectId,
+        // OSS user tokens have no email / role metadata; the field is kept for backward compatibility.
+        // SaaS-specific claims should be exposed through a dedicated adapter/decorator, not read by OSS business code.
+        email: '',
+        isSuperAdmin: isOwnerActor(actor.actorKind),
+        isActive: true,
+    };
+    if (actor.orgId !== undefined)
+        payload.orgId = actor.orgId;
+    return payload;
+}
+// OSS single-workspace: UI session user and API-token script both represent the local owner,
+// so both bypass project-ownership checks via isSuperAdmin. system_* actors do NOT — they
+// flow through access-control's SYSTEM_KINDS bypass instead.
+function isOwnerActor(kind) {
+    return kind === 'local_user' || kind === 'script';
+}
+//# sourceMappingURL=http-actor.guard.js.map

package/dist/server/common/contracts/http-actor.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-actor.guard.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/http-actor.guard.ts"],"names":[],"mappings":";AAAA,4DAA4D;AAC5D,gDAAgD;AAChD,EAAE;AACF,8FAA8F;AAC9F,mGAAmG;AACnG,EAAE;AACF,2FAA2F;AAC3F,+FAA+F;AAC/F,mDAAmD;;;;;;;;;;;;AAgDnD,oDAcC;AA5DD,2CAAgE;AAKhE,qEAAgE;AAChE,yEAA8F;AAGvF,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YACmB,QAA8B,EAC9B,eAAuC;QADvC,aAAQ,GAAR,QAAQ,CAAsB;QAC9B,oBAAe,GAAf,eAAe,CAAwB;IACvD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO;aACpB,YAAY,EAAE;aACd,UAAU,EAA0E,CAAC;QAExF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAE3C,8FAA8F;QAC9F,iGAAiG;QACjG,2EAA2E;QAC3E,IAAI,CAAC;YACH,OAAO,CAAC,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE;gBACjE,eAAe,EAAE,mBAAmB,CAAC,OAAO,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mDAAwB,EAAE,CAAC;gBAC9C,MAAM,IAAI,2BAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7BY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;qCAGkB,6CAAoB;QACb,iDAAsB;GAH/C,cAAc,CA6B1B;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAAmB;IACtD,MAAM,OAAO,GAAuB;QAClC,GAAG,EAAE,KAAK,CAAC,OAAO;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,+FAA+F;QAC/F,+GAA+G;QAC/G,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC;QAC3C,QAAQ,EAAE,IAAI;KACf,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6FAA6F;AAC7F,0FAA0F;AAC1F,6DAA6D;AAC7D,SAAS,YAAY,CAAC,IAA+B;IACnD,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,QAAQ,CAAC;AACpD,CAAC"}

package/dist/server/common/contracts/index.d.ts

@@ -0,0 +1,23 @@
+export * from './types';
+export * from './project-context.resolver';
+export * from './actor-context.resolver';
+export * from './mcp-auth.resolver';
+export * from './access-control.service';
+export * from './connector-context.resolver';
+export * from './token.service';
+export * from './limiter-key.strategy';
+export * from './runtime-limits.provider';
+export * from './quota-policy.hook';
+export * from './workflow-authorization.hook';
+export * from './http-actor.guard';
+export * from './local-project-context.resolver';
+export * from './local-actor-context.resolver';
+export * from './local-mcp-auth.resolver';
+export * from './local-access-control.service';
+export * from './local-user-token.verifier';
+export { LocalTokenService } from '../../modules/token/token.service';
+export * from '../../modules/token/token.repository';
+export { LocalConnectorContextResolver } from '../../../webhook/channels/webhook/local-connector-context.resolver';
+export * from '../../../webhook/channels/webhook/webhook.repository';
+export { LocalContractsModule } from './local-contracts.module';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/common/contracts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/index.ts"],"names":[],"mappings":"AAGA,cAAc,SAAS,CAAC;AACxB,cAAc,4BAA4B,CAAC;AAC3C,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oBAAoB,CAAC;AACnC,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,cAAc,sCAAsC,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,oEAAoE,CAAC;AACnH,cAAc,sDAAsD,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/server/common/contracts/index.js

@@ -0,0 +1,45 @@
+"use strict";
+// Adapter extension point barrel — abstract class + default implementations + types
+// See docs/specs/08-saas-adapter-boundary.md
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalContractsModule = exports.LocalConnectorContextResolver = exports.LocalTokenService = void 0;
+__exportStar(require("./types"), exports);
+__exportStar(require("./project-context.resolver"), exports);
+__exportStar(require("./actor-context.resolver"), exports);
+__exportStar(require("./mcp-auth.resolver"), exports);
+__exportStar(require("./access-control.service"), exports);
+__exportStar(require("./connector-context.resolver"), exports);
+__exportStar(require("./token.service"), exports);
+__exportStar(require("./limiter-key.strategy"), exports);
+__exportStar(require("./runtime-limits.provider"), exports);
+__exportStar(require("./quota-policy.hook"), exports);
+__exportStar(require("./workflow-authorization.hook"), exports);
+__exportStar(require("./http-actor.guard"), exports);
+__exportStar(require("./local-project-context.resolver"), exports);
+__exportStar(require("./local-actor-context.resolver"), exports);
+__exportStar(require("./local-mcp-auth.resolver"), exports);
+__exportStar(require("./local-access-control.service"), exports);
+__exportStar(require("./local-user-token.verifier"), exports);
+var token_service_1 = require("../../modules/token/token.service");
+Object.defineProperty(exports, "LocalTokenService", { enumerable: true, get: function () { return token_service_1.LocalTokenService; } });
+__exportStar(require("../../modules/token/token.repository"), exports);
+var local_connector_context_resolver_1 = require("../../../webhook/channels/webhook/local-connector-context.resolver");
+Object.defineProperty(exports, "LocalConnectorContextResolver", { enumerable: true, get: function () { return local_connector_context_resolver_1.LocalConnectorContextResolver; } });
+__exportStar(require("../../../webhook/channels/webhook/webhook.repository"), exports);
+var local_contracts_module_1 = require("./local-contracts.module");
+Object.defineProperty(exports, "LocalContractsModule", { enumerable: true, get: function () { return local_contracts_module_1.LocalContractsModule; } });
+//# sourceMappingURL=index.js.map

package/dist/server/common/contracts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/index.ts"],"names":[],"mappings":";AAAA,oFAAoF;AACpF,6CAA6C;;;;;;;;;;;;;;;;;AAE7C,0CAAwB;AACxB,6DAA2C;AAC3C,2DAAyC;AACzC,sDAAoC;AACpC,2DAAyC;AACzC,+DAA6C;AAC7C,kDAAgC;AAChC,yDAAuC;AACvC,4DAA0C;AAC1C,sDAAoC;AACpC,gEAA8C;AAC9C,qDAAmC;AACnC,mEAAiD;AACjD,iEAA+C;AAC/C,4DAA0C;AAC1C,iEAA+C;AAC/C,8DAA4C;AAC5C,mEAAsE;AAA7D,kHAAA,iBAAiB,OAAA;AAC1B,uEAAqD;AACrD,uHAAmH;AAA1G,iJAAA,6BAA6B,OAAA;AACtC,uFAAqE;AACrE,mEAAgE;AAAvD,8HAAA,oBAAoB,OAAA"}

package/dist/server/common/contracts/limiter-key.strategy.d.ts

@@ -0,0 +1,8 @@
+import type { ProjectContext } from '../actor-context';
+export declare abstract class LimiterKeyStrategy {
+    abstract buildModelKey(project: ProjectContext, modelId: string): string;
+}
+export declare class LocalLimiterKeyStrategy extends LimiterKeyStrategy {
+    buildModelKey(_project: ProjectContext, modelId: string): string;
+}
+//# sourceMappingURL=limiter-key.strategy.d.ts.map

package/dist/server/common/contracts/limiter-key.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limiter-key.strategy.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/limiter-key.strategy.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,8BAAsB,kBAAkB;IACtC,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;CACzE;AAED,qBAAa,uBAAwB,SAAQ,kBAAkB;IAC7D,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;CAGjE"}

package/dist/server/common/contracts/limiter-key.strategy.js

@@ -0,0 +1,24 @@
+"use strict";
+// LimiterKeyStrategy — adapter extension point
+// See docs/specs/08-saas-adapter-boundary.md §3.7
+//
+// Generates the rate-limit key for a model call. Runtime LLM/probe callers build the key via this
+// strategy and pass it down as an OPAQUE string; `@proofhound/limiter` and
+// `@proofhound/llm-client` never learn the project (§8 red line) — they only see the composed key.
+//
+// Keyed by (project, modelId): actor is intentionally NOT part of the key. OSS default
+// `LocalLimiterKeyStrategy` returns `model:<modelId>` (per-model counting space, ignoring project).
+// SaaS may return `org:<orgId>:model:<modelId>` (deriving org from the project) to isolate the
+// counting space per tenant.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalLimiterKeyStrategy = exports.LimiterKeyStrategy = void 0;
+class LimiterKeyStrategy {
+}
+exports.LimiterKeyStrategy = LimiterKeyStrategy;
+class LocalLimiterKeyStrategy extends LimiterKeyStrategy {
+    buildModelKey(_project, modelId) {
+        return `model:${modelId}`;
+    }
+}
+exports.LocalLimiterKeyStrategy = LocalLimiterKeyStrategy;
+//# sourceMappingURL=limiter-key.strategy.js.map

package/dist/server/common/contracts/limiter-key.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limiter-key.strategy.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/limiter-key.strategy.ts"],"names":[],"mappings":";AAAA,+CAA+C;AAC/C,kDAAkD;AAClD,EAAE;AACF,kGAAkG;AAClG,2EAA2E;AAC3E,mGAAmG;AACnG,EAAE;AACF,uFAAuF;AACvF,oGAAoG;AACpG,+FAA+F;AAC/F,6BAA6B;;;AAI7B,MAAsB,kBAAkB;CAEvC;AAFD,gDAEC;AAED,MAAa,uBAAwB,SAAQ,kBAAkB;IAC7D,aAAa,CAAC,QAAwB,EAAE,OAAe;QACrD,OAAO,SAAS,OAAO,EAAE,CAAC;IAC5B,CAAC;CACF;AAJD,0DAIC"}

package/dist/server/common/contracts/local-access-control.service.d.ts

@@ -0,0 +1,7 @@
+import type { AccessAction } from '../access-control';
+import type { ActorContext, ProjectContext } from '../actor-context';
+import { AccessControlService } from './access-control.service';
+export declare class LocalAccessControlService extends AccessControlService {
+    assertCan(actor: ActorContext, _project: ProjectContext, action: AccessAction): Promise<void>;
+}
+//# sourceMappingURL=local-access-control.service.d.ts.map

package/dist/server/common/contracts/local-access-control.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-access-control.service.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-access-control.service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAa,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAUhE,qBACa,yBAA0B,SAAQ,oBAAoB;IAC3D,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CASpG"}

package/dist/server/common/contracts/local-access-control.service.js

@@ -0,0 +1,41 @@
+"use strict";
+// LocalAccessControlService — OSS default implementation of AccessControlService
+// See docs/specs/08-saas-adapter-boundary.md §3.6
+//
+// OSS self-hosted single workspace: local_user (UI session) and system_* (MCP / webhook) pass everything;
+// script (API token) is also a local-owner credential but cannot manage platform-level resources (e.g. token
+// CRUD) to avoid token-laundering. `project` is ignored here; the SaaS RbacAccessControl reads it.
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalAccessControlService = void 0;
+const common_1 = require("@nestjs/common");
+const access_control_service_1 = require("./access-control.service");
+// Actors produced by system entry resolvers or internal runners. In OSS these bypass all access checks.
+const SYSTEM_ACTOR_KINDS = [
+    'system_mcp',
+    'system_webhook',
+    'system_release_runner',
+    'system_workflow_recovery',
+];
+let LocalAccessControlService = class LocalAccessControlService extends access_control_service_1.AccessControlService {
+    async assertCan(actor, _project, action) {
+        if (SYSTEM_ACTOR_KINDS.includes(actor.actorKind) || actor.actorKind === 'local_user')
+            return;
+        if (actor.actorKind === 'script') {
+            if (action === 'platform_manage')
+                throw new common_1.ForbiddenException('platform_manage_forbidden');
+            return;
+        }
+        throw new common_1.ForbiddenException('actor_forbidden');
+    }
+};
+exports.LocalAccessControlService = LocalAccessControlService;
+exports.LocalAccessControlService = LocalAccessControlService = __decorate([
+    (0, common_1.Injectable)()
+], LocalAccessControlService);
+//# sourceMappingURL=local-access-control.service.js.map

package/dist/server/common/contracts/local-access-control.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-access-control.service.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-access-control.service.ts"],"names":[],"mappings":";AAAA,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,0GAA0G;AAC1G,6GAA6G;AAC7G,mGAAmG;;;;;;;;;AAEnG,2CAAgE;AAGhE,qEAAgE;AAEhE,wGAAwG;AACxG,MAAM,kBAAkB,GAA6B;IACnD,YAAY;IACZ,gBAAgB;IAChB,uBAAuB;IACvB,0BAA0B;CAC3B,CAAC;AAGK,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,6CAAoB;IACjE,KAAK,CAAC,SAAS,CAAC,KAAmB,EAAE,QAAwB,EAAE,MAAoB;QACjF,IAAI,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY;YAAE,OAAO;QAC7F,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,MAAM,KAAK,iBAAiB;gBAAE,MAAM,IAAI,2BAAkB,CAAC,2BAA2B,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,iBAAiB,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAVY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;GACA,yBAAyB,CAUrC"}

package/dist/server/common/contracts/local-actor-context.resolver.d.ts

@@ -0,0 +1,13 @@
+import { ActorContextResolver } from './actor-context.resolver';
+import { LocalUserTokenVerifier } from './local-user-token.verifier';
+import type { HttpRequestLike } from './types';
+import { type ActorContext } from '../actor-context';
+export declare class LocalActorContextResolver extends ActorContextResolver {
+    private readonly verifier;
+    constructor(verifier: LocalUserTokenVerifier);
+    resolveFromHttp(req: HttpRequestLike): Promise<ActorContext>;
+    resolveFromUserToken(token: string): Promise<ActorContext>;
+    private readHeader;
+    private parseBearer;
+}
+//# sourceMappingURL=local-actor-context.resolver.d.ts.map

package/dist/server/common/contracts/local-actor-context.resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-actor-context.resolver.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-actor-context.resolver.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrE,qBACa,yBAA0B,SAAQ,oBAAoB;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,sBAAsB;IAIvD,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;IA6B5D,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAOhE,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,WAAW;CAOpB"}

package/dist/server/common/contracts/local-actor-context.resolver.js

@@ -0,0 +1,102 @@
+"use strict";
+// LocalActorContextResolver — default implementation for the HTTP entry
+// See docs/specs/08-saas-adapter-boundary.md §3.2 (channel-aware dual entry)
+//
+// HTTP entry handles two channels in one resolver (per-request dispatch):
+//   1. API channel (Authorization: Bearer ph_*):
+//      - sha256 hash compare against ph_core.tokens scope='user' via LocalUserTokenVerifier
+//      - JWT-shape token (Bearer eyJ*) is rejected with 401 unsupported_credential
+//        (SaaS adapter override path; OSS does not issue JWTs)
+//      - Returns actorKind='script', actorId=tokenId
+//   2. UI channel:
+//      - Reads trusted deployment header (default X-Forwarded-User; configurable via
+//        PH_TRUSTED_USER_HEADER), set when behind oauth2-proxy / Cloudflare Access /
+//        Tailscale / Authelia (deployment formation B in SPEC §3.2.1)
+//      - Falls back to LOCAL_ACTOR_ID (deployment formation A: single-user self-hosted) when
+//        no Authorization and no trusted header
+//      - Returns actorKind='local_user', actorId=LOCAL_ACTOR_ID
+//
+// OSS browsers do NOT carry Authorization or session cookies; the UI channel never accepts
+// user tokens posing as session credentials (SPEC §8 red line).
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalActorContextResolver = void 0;
+const common_1 = require("@nestjs/common");
+const actor_context_resolver_1 = require("./actor-context.resolver");
+const local_user_token_verifier_1 = require("./local-user-token.verifier");
+const actor_context_1 = require("../actor-context");
+const DEFAULT_TRUSTED_USER_HEADER = 'X-Forwarded-User';
+let LocalActorContextResolver = class LocalActorContextResolver extends actor_context_resolver_1.ActorContextResolver {
+    constructor(verifier) {
+        super();
+        this.verifier = verifier;
+    }
+    async resolveFromHttp(req) {
+        const authHeader = this.readHeader(req, 'authorization');
+        // 1. API channel
+        if (authHeader) {
+            const token = this.parseBearer(authHeader);
+            // JWT shape: OSS does not validate JWTs — that path belongs to SaaS RemoteActorContextResolver
+            if (looksLikeJwt(token)) {
+                throw new common_1.UnauthorizedException('unsupported_credential');
+            }
+            const clientIp = req.ip ?? req.socket?.remoteAddress;
+            return this.verifier.verify(token, { clientIp, actorKind: 'script' });
+        }
+        // 2. UI channel — trusted deployment header (formation B) or LOCAL_ACTOR fallback (formation A)
+        const trustedHeaderName = (process.env.PH_TRUSTED_USER_HEADER ?? DEFAULT_TRUSTED_USER_HEADER).toLowerCase();
+        const trustedHeader = this.readHeader(req, trustedHeaderName);
+        // Trusted header presence is enough; its value is the upstream-proxy-asserted user identity
+        // (recorded for audit by the proxy). OSS single-user does not further validate the value.
+        void trustedHeader;
+        return {
+            actorId: actor_context_1.LOCAL_ACTOR_ID,
+            actorKind: 'local_user',
+        };
+    }
+    async resolveFromUserToken(token) {
+        // ip_whitelist skip: this entry does not carry the request IP; SPEC §3.2 explicitly states this path does not check IP.
+        // actorKind='script' because resolveFromUserToken is the HTTP-side shared entrypoint
+        // (unit tests + future API token CLI flows). MCP uses LocalMcpAuthResolver.resolveFromUserToken instead.
+        return this.verifier.verify(token, { actorKind: 'script' });
+    }
+    readHeader(req, name) {
+        const lower = name.toLowerCase();
+        const raw = req.headers[lower] ?? req.headers[name] ?? req.headers[name.charAt(0).toUpperCase() + name.slice(1)];
+        if (!raw)
+            return undefined;
+        const value = Array.isArray(raw) ? raw[0] : raw;
+        return value && value.length > 0 ? value : undefined;
+    }
+    parseBearer(header) {
+        const match = /^Bearer\s+(.+)$/i.exec(header);
+        if (!match)
+            throw new common_1.UnauthorizedException('invalid_authorization_header');
+        const token = match[1]?.trim();
+        if (!token)
+            throw new common_1.UnauthorizedException('invalid_authorization_header');
+        return token;
+    }
+};
+exports.LocalActorContextResolver = LocalActorContextResolver;
+exports.LocalActorContextResolver = LocalActorContextResolver = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [local_user_token_verifier_1.LocalUserTokenVerifier])
+], LocalActorContextResolver);
+// JWT detection: header.payload.signature, each segment base64url; header always starts with `{"`
+// which base64-encodes to `eyJ`. This is a structural sniff, not validation — OSS rejects on shape alone.
+function looksLikeJwt(token) {
+    if (!token.startsWith('eyJ'))
+        return false;
+    const dots = token.split('.').length - 1;
+    return dots === 2;
+}
+//# sourceMappingURL=local-actor-context.resolver.js.map

package/dist/server/common/contracts/local-actor-context.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-actor-context.resolver.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-actor-context.resolver.ts"],"names":[],"mappings":";AAAA,wEAAwE;AACxE,6EAA6E;AAC7E,EAAE;AACF,0EAA0E;AAC1E,iDAAiD;AACjD,4FAA4F;AAC5F,mFAAmF;AACnF,+DAA+D;AAC/D,qDAAqD;AACrD,mBAAmB;AACnB,qFAAqF;AACrF,qFAAqF;AACrF,sEAAsE;AACtE,6FAA6F;AAC7F,gDAAgD;AAChD,gEAAgE;AAChE,EAAE;AACF,2FAA2F;AAC3F,gEAAgE;;;;;;;;;;;;AAEhE,2CAAmE;AACnE,qEAAgE;AAChE,2EAAqE;AAErE,oDAAqE;AAErE,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AAGhD,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,6CAAoB;IACjE,YAA6B,QAAgC;QAC3D,KAAK,EAAE,CAAC;QADmB,aAAQ,GAAR,QAAQ,CAAwB;IAE7D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAoB;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAEzD,iBAAiB;QACjB,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAE3C,+FAA+F;YAC/F,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;YACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,gGAAgG;QAChG,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,2BAA2B,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5G,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,4FAA4F;QAC5F,0FAA0F;QAC1F,KAAK,aAAa,CAAC;QAEnB,OAAO;YACL,OAAO,EAAE,8BAAc;YACvB,SAAS,EAAE,YAAY;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAa;QACtC,wHAAwH;QACxH,qFAAqF;QACrF,yGAAyG;QACzG,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IAEO,UAAU,CAAC,GAAoB,EAAE,IAAY;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,GAAG,GACP,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAChD,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAEO,WAAW,CAAC,MAAc;QAChC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAzDY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;qCAE4B,kDAAsB;GADlD,yBAAyB,CAyDrC;AAED,kGAAkG;AAClG,0GAA0G;AAC1G,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACzC,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/server/common/contracts/local-contracts.module.d.ts

@@ -0,0 +1,3 @@
+export declare class LocalContractsModule {
+}
+//# sourceMappingURL=local-contracts.module.d.ts.map

package/dist/server/common/contracts/local-contracts.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-contracts.module.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-contracts.module.ts"],"names":[],"mappings":"AAiCA,qBAgCa,oBAAoB;CAAG"}

package/dist/server/common/contracts/local-contracts.module.js

@@ -0,0 +1,78 @@
+"use strict";
+// LocalContractsModule — the OSS default `contracts` module: binds each adapter extension-point
+// token to its Local* implementation.
+// See docs/specs/08-saas-adapter-boundary.md §2 + §3.
+//
+// Supplied to the root `AppModule.forRoot({ contracts })` at assembly time. A SaaS shell passes its
+// own `SaasContractsModule` (binding Remote* implementations) the same way; OSS mainline is unaware
+// of which contracts module was supplied. `overrideProvider` stays a test-only primitive (§2).
+//
+// @Global() ensures every feature module can inject these resolvers without a per-module import.
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalContractsModule = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_module_1 = require("../../../shared/crypto/crypto.module");
+const database_module_1 = require("../../../shared/database/database.module");
+const local_connector_context_resolver_1 = require("../../../webhook/channels/webhook/local-connector-context.resolver");
+const webhook_repository_1 = require("../../../webhook/channels/webhook/webhook.repository");
+const token_repository_1 = require("../../modules/token/token.repository");
+const token_service_1 = require("../../modules/token/token.service");
+const access_control_service_1 = require("./access-control.service");
+const actor_context_resolver_1 = require("./actor-context.resolver");
+const connector_context_resolver_1 = require("./connector-context.resolver");
+const limiter_key_strategy_1 = require("./limiter-key.strategy");
+const local_access_control_service_1 = require("./local-access-control.service");
+const local_actor_context_resolver_1 = require("./local-actor-context.resolver");
+const local_mcp_auth_resolver_1 = require("./local-mcp-auth.resolver");
+const local_project_context_resolver_1 = require("./local-project-context.resolver");
+const local_user_token_verifier_1 = require("./local-user-token.verifier");
+const mcp_auth_resolver_1 = require("./mcp-auth.resolver");
+const project_context_resolver_1 = require("./project-context.resolver");
+const quota_policy_hook_1 = require("./quota-policy.hook");
+const runtime_limits_provider_1 = require("./runtime-limits.provider");
+const token_service_2 = require("./token.service");
+const workflow_authorization_hook_1 = require("./workflow-authorization.hook");
+let LocalContractsModule = class LocalContractsModule {
+};
+exports.LocalContractsModule = LocalContractsModule;
+exports.LocalContractsModule = LocalContractsModule = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        imports: [crypto_module_1.CryptoModule, database_module_1.DatabaseModule],
+        providers: [
+            webhook_repository_1.WebhookRepository,
+            token_repository_1.TokenRepository,
+            local_user_token_verifier_1.LocalUserTokenVerifier,
+            { provide: project_context_resolver_1.ProjectContextResolver, useClass: local_project_context_resolver_1.LocalProjectContextResolver },
+            { provide: actor_context_resolver_1.ActorContextResolver, useClass: local_actor_context_resolver_1.LocalActorContextResolver },
+            { provide: mcp_auth_resolver_1.McpAuthResolver, useClass: local_mcp_auth_resolver_1.LocalMcpAuthResolver },
+            { provide: connector_context_resolver_1.ConnectorContextResolver, useClass: local_connector_context_resolver_1.LocalConnectorContextResolver },
+            { provide: token_service_2.TokenService, useClass: token_service_1.LocalTokenService },
+            { provide: access_control_service_1.AccessControlService, useClass: local_access_control_service_1.LocalAccessControlService },
+            { provide: limiter_key_strategy_1.LimiterKeyStrategy, useClass: limiter_key_strategy_1.LocalLimiterKeyStrategy },
+            { provide: runtime_limits_provider_1.RuntimeLimitsProvider, useClass: runtime_limits_provider_1.LocalRuntimeLimitsProvider },
+            { provide: quota_policy_hook_1.QuotaPolicyHook, useClass: quota_policy_hook_1.LocalQuotaPolicyHook },
+            { provide: workflow_authorization_hook_1.WorkflowAuthorizationHook, useClass: workflow_authorization_hook_1.LocalWorkflowAuthorizationHook },
+        ],
+        exports: [
+            project_context_resolver_1.ProjectContextResolver,
+            actor_context_resolver_1.ActorContextResolver,
+            mcp_auth_resolver_1.McpAuthResolver,
+            connector_context_resolver_1.ConnectorContextResolver,
+            token_service_2.TokenService,
+            access_control_service_1.AccessControlService,
+            limiter_key_strategy_1.LimiterKeyStrategy,
+            runtime_limits_provider_1.RuntimeLimitsProvider,
+            quota_policy_hook_1.QuotaPolicyHook,
+            workflow_authorization_hook_1.WorkflowAuthorizationHook,
+            local_user_token_verifier_1.LocalUserTokenVerifier,
+        ],
+    })
+], LocalContractsModule);
+//# sourceMappingURL=local-contracts.module.js.map

package/dist/server/common/contracts/local-contracts.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-contracts.module.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-contracts.module.ts"],"names":[],"mappings":";AAAA,gGAAgG;AAChG,sCAAsC;AACtC,sDAAsD;AACtD,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,+FAA+F;AAC/F,EAAE;AACF,iGAAiG;;;;;;;;;AAEjG,2CAAgD;AAChD,wEAAoE;AACpE,8EAA0E;AAC1E,yHAAmH;AACnH,6FAAyF;AACzF,2EAAuE;AACvE,qEAAsE;AACtE,qEAAgE;AAChE,qEAAgE;AAChE,6EAAwE;AACxE,iEAAqF;AACrF,iFAA2E;AAC3E,iFAA2E;AAC3E,uEAAiE;AACjE,qFAA+E;AAC/E,2EAAqE;AACrE,2DAAsD;AACtD,yEAAoE;AACpE,2DAA4E;AAC5E,uEAA8F;AAC9F,mDAA+C;AAC/C,+EAA0G;AAkCnG,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;CAAG,CAAA;AAAvB,oDAAoB;+BAApB,oBAAoB;IAhChC,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,4BAAY,EAAE,gCAAc,CAAC;QACvC,SAAS,EAAE;YACT,sCAAiB;YACjB,kCAAe;YACf,kDAAsB;YACtB,EAAE,OAAO,EAAE,iDAAsB,EAAE,QAAQ,EAAE,4DAA2B,EAAE;YAC1E,EAAE,OAAO,EAAE,6CAAoB,EAAE,QAAQ,EAAE,wDAAyB,EAAE;YACtE,EAAE,OAAO,EAAE,mCAAe,EAAE,QAAQ,EAAE,8CAAoB,EAAE;YAC5D,EAAE,OAAO,EAAE,qDAAwB,EAAE,QAAQ,EAAE,gEAA6B,EAAE;YAC9E,EAAE,OAAO,EAAE,4BAAY,EAAE,QAAQ,EAAE,iCAAiB,EAAE;YACtD,EAAE,OAAO,EAAE,6CAAoB,EAAE,QAAQ,EAAE,wDAAyB,EAAE;YACtE,EAAE,OAAO,EAAE,yCAAkB,EAAE,QAAQ,EAAE,8CAAuB,EAAE;YAClE,EAAE,OAAO,EAAE,+CAAqB,EAAE,QAAQ,EAAE,oDAA0B,EAAE;YACxE,EAAE,OAAO,EAAE,mCAAe,EAAE,QAAQ,EAAE,wCAAoB,EAAE;YAC5D,EAAE,OAAO,EAAE,uDAAyB,EAAE,QAAQ,EAAE,4DAA8B,EAAE;SACjF;QACD,OAAO,EAAE;YACP,iDAAsB;YACtB,6CAAoB;YACpB,mCAAe;YACf,qDAAwB;YACxB,4BAAY;YACZ,6CAAoB;YACpB,yCAAkB;YAClB,+CAAqB;YACrB,mCAAe;YACf,uDAAyB;YACzB,kDAAsB;SACvB;KACF,CAAC;GACW,oBAAoB,CAAG"}

package/dist/server/common/contracts/local-mcp-auth.resolver.d.ts

@@ -0,0 +1,12 @@
+import { McpAuthResolver } from './mcp-auth.resolver';
+import { LocalUserTokenVerifier } from './local-user-token.verifier';
+import type { ActorContext } from '../actor-context';
+import type { McpRequestMetadataLike } from './types';
+export declare class LocalMcpAuthResolver extends McpAuthResolver {
+    private readonly verifier;
+    constructor(verifier: LocalUserTokenVerifier);
+    resolveFromMcp(metadata: McpRequestMetadataLike): Promise<ActorContext>;
+    resolveFromUserToken(token: string): Promise<ActorContext>;
+    private extractToken;
+}
+//# sourceMappingURL=local-mcp-auth.resolver.d.ts.map

package/dist/server/common/contracts/local-mcp-auth.resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-mcp-auth.resolver.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-mcp-auth.resolver.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEtD,qBACa,oBAAqB,SAAQ,eAAe;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,sBAAsB;IAIvD,cAAc,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,YAAY,CAAC;IAMvE,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIhE,OAAO,CAAC,YAAY;CAoBrB"}

package/dist/server/common/contracts/local-mcp-auth.resolver.js

@@ -0,0 +1,66 @@
+"use strict";
+// LocalMcpAuthResolver — default implementation for the MCP channel
+// See docs/specs/08-saas-adapter-boundary.md §3.3 and docs/specs/09-mcp-server.md.
+//
+// The MCP server transport (channels/mcp/mcp.transport.ts) calls resolveFromMcp(metadata) on every
+// request before dispatching a tool. This resolver:
+//   - resolveFromMcp(metadata): extracts the user token from metadata.authInfo.token /
+//     headers.authorization (`Bearer ph_*`) / meta.token; if found, runs the verifier; otherwise 401.
+//   - resolveFromUserToken(token): verifier check directly (same as the HTTP path, skipping IP check).
+//
+// SaaS overrides this resolver (e.g. per-org MCP token / JWT) without touching the transport.
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalMcpAuthResolver = void 0;
+const common_1 = require("@nestjs/common");
+const mcp_auth_resolver_1 = require("./mcp-auth.resolver");
+const local_user_token_verifier_1 = require("./local-user-token.verifier");
+let LocalMcpAuthResolver = class LocalMcpAuthResolver extends mcp_auth_resolver_1.McpAuthResolver {
+    constructor(verifier) {
+        super();
+        this.verifier = verifier;
+    }
+    async resolveFromMcp(metadata) {
+        const token = this.extractToken(metadata);
+        if (!token)
+            throw new common_1.UnauthorizedException('missing_user_token');
+        return this.verifier.verify(token, { actorKind: 'system_mcp' });
+    }
+    async resolveFromUserToken(token) {
+        return this.verifier.verify(token, { actorKind: 'system_mcp' });
+    }
+    extractToken(metadata) {
+        // The Streamable-HTTP transport passes req.headers, so the `Bearer ph_*` header is the live path;
+        // authInfo / meta.token are accepted too for SDK shapes that pre-extract the credential.
+        if (metadata.authInfo?.token)
+            return metadata.authInfo.token;
+        const headers = metadata.headers ?? {};
+        const auth = headers['authorization'] ?? headers['Authorization'];
+        if (auth) {
+            const header = Array.isArray(auth) ? auth[0] : auth;
+            if (header) {
+                const match = /^Bearer\s+(.+)$/i.exec(header);
+                if (match?.[1])
+                    return match[1].trim();
+            }
+        }
+        const metaToken = metadata.meta?.['token'];
+        if (typeof metaToken === 'string' && metaToken.length > 0)
+            return metaToken;
+        return null;
+    }
+};
+exports.LocalMcpAuthResolver = LocalMcpAuthResolver;
+exports.LocalMcpAuthResolver = LocalMcpAuthResolver = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [local_user_token_verifier_1.LocalUserTokenVerifier])
+], LocalMcpAuthResolver);
+//# sourceMappingURL=local-mcp-auth.resolver.js.map

package/dist/server/common/contracts/local-mcp-auth.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-mcp-auth.resolver.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-mcp-auth.resolver.ts"],"names":[],"mappings":";AAAA,oEAAoE;AACpE,mFAAmF;AACnF,EAAE;AACF,mGAAmG;AACnG,oDAAoD;AACpD,uFAAuF;AACvF,sGAAsG;AACtG,uGAAuG;AACvG,EAAE;AACF,8FAA8F;;;;;;;;;;;;AAE9F,2CAAmE;AACnE,2DAAsD;AACtD,2EAAqE;AAK9D,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,mCAAe;IACvD,YAA6B,QAAgC;QAC3D,KAAK,EAAE,CAAC;QADmB,aAAQ,GAAR,QAAQ,CAAwB;IAE7D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAa;QACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IAEO,YAAY,CAAC,QAAgC;QACnD,kGAAkG;QAClG,yFAAyF;QACzF,IAAI,QAAQ,CAAC,QAAQ,EAAE,KAAK;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAE7D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;QAClE,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAE5E,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAnCY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAE4B,kDAAsB;GADlD,oBAAoB,CAmChC"}

package/dist/server/common/contracts/local-project-context.resolver.d.ts

@@ -0,0 +1,8 @@
+import { type ProjectContext } from '@proofhound/shared';
+import type { ActorContext } from '../actor-context';
+import { ProjectContextResolver } from './project-context.resolver';
+import type { ProjectContextHint } from './types';
+export declare class LocalProjectContextResolver extends ProjectContextResolver {
+    resolve(_actor: ActorContext, _hint?: ProjectContextHint): Promise<ProjectContext>;
+}
+//# sourceMappingURL=local-project-context.resolver.d.ts.map

package/dist/server/common/contracts/local-project-context.resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-project-context.resolver.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-project-context.resolver.ts"],"names":[],"mappings":"AAOA,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,qBACa,2BAA4B,SAAQ,sBAAsB;IAC/D,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC;CAGzF"}