@proofhound/core 0.1.6

package/dist/server/common/contracts/local-project-context.resolver.js

@@ -0,0 +1,27 @@
+"use strict";
+// LocalProjectContextResolver — OSS default implementation
+// See docs/specs/08-saas-adapter-boundary.md §3.1
+//
+// OSS has a single workspace; ignore all hints and always return LOCAL_PROJECT_CONTEXT.
+// The SaaS form is overridden by RemoteProjectContextResolver in a separate repo.
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalProjectContextResolver = void 0;
+const common_1 = require("@nestjs/common");
+const shared_1 = require("@proofhound/shared");
+const project_context_resolver_1 = require("./project-context.resolver");
+let LocalProjectContextResolver = class LocalProjectContextResolver extends project_context_resolver_1.ProjectContextResolver {
+    async resolve(_actor, _hint) {
+        return shared_1.LOCAL_PROJECT_CONTEXT;
+    }
+};
+exports.LocalProjectContextResolver = LocalProjectContextResolver;
+exports.LocalProjectContextResolver = LocalProjectContextResolver = __decorate([
+    (0, common_1.Injectable)()
+], LocalProjectContextResolver);
+//# sourceMappingURL=local-project-context.resolver.js.map

package/dist/server/common/contracts/local-project-context.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-project-context.resolver.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-project-context.resolver.ts"],"names":[],"mappings":";AAAA,2DAA2D;AAC3D,kDAAkD;AAClD,EAAE;AACF,wFAAwF;AACxF,kFAAkF;;;;;;;;;AAElF,2CAA4C;AAC5C,+CAAgF;AAEhF,yEAAoE;AAI7D,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,iDAAsB;IACrE,KAAK,CAAC,OAAO,CAAC,MAAoB,EAAE,KAA0B;QAC5D,OAAO,8BAAqB,CAAC;IAC/B,CAAC;CACF,CAAA;AAJY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;GACA,2BAA2B,CAIvC"}

package/dist/server/common/contracts/local-user-token.verifier.d.ts

@@ -0,0 +1,26 @@
+import type { DbClient } from '@proofhound/db';
+import type { ActorContext, ActorKind } from '../actor-context';
+export interface VerifyUserTokenOptions {
+    /**
+     * Client IP of the current request (provided only on the HTTP path).
+     * When provided and the token has an ip_whitelist that does not match, throws `ip_not_allowed`.
+     * When not provided, IP validation is skipped (resolveFromUserToken / MCP paths).
+     */
+    clientIp?: string;
+    /**
+     * Channel that the caller is verifying for. The verifier itself does not have
+     * channel semantics — the resolver decides whether this token verification
+     * produces a 'script' (HTTP API) or 'system_mcp' (MCP channel) actor.
+     * Must be one of the channels that consume the user-token pool.
+     */
+    actorKind: Extract<ActorKind, 'script' | 'system_mcp'>;
+}
+export declare class LocalUserTokenVerifier {
+    private readonly db;
+    private readonly logger;
+    constructor(db: DbClient);
+    verify(token: string, options: VerifyUserTokenOptions): Promise<ActorContext>;
+    private hashToken;
+    private touchLastUsed;
+}
+//# sourceMappingURL=local-user-token.verifier.d.ts.map

package/dist/server/common/contracts/local-user-token.verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-user-token.verifier.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-user-token.verifier.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG/C,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIhE,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,GAAG,YAAY,CAAC,CAAC;CACxD;AAQD,qBACa,sBAAsB;IAGI,OAAO,CAAC,QAAQ,CAAC,EAAE;IAFxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgE;gBAEjC,EAAE,EAAE,QAAQ;IAE5D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,YAAY,CAAC;IAoCnF,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,aAAa;CAUtB"}

package/dist/server/common/contracts/local-user-token.verifier.js

@@ -0,0 +1,96 @@
+"use strict";
+// LocalUserTokenVerifier
+// Shared bottom layer: sha256 hash → look up `ph_core.tokens where scope='user'` → expiry / IP check → async touch last_used_at.
+//
+// Design trade-off: this is an infra-layer helper, not a resolver.
+// LocalActorContextResolver (HTTP) and LocalMcpAuthResolver (MCP) each hold their own verifier instance;
+// the two resolvers do not reference each other (SPEC §8 red line).
+//
+// IP whitelist boundary: the verifier exposes a `verify(token, { clientIp? })` interface;
+// IP validation only takes effect when the caller provides clientIp.
+// - The HTTP resolver parses it from req.ip / socket.remoteAddress and passes it in;
+// - MCP / direct `resolveFromUserToken(token)` paths do not pass it, meaning IP validation is skipped.
+//   This matches SPEC §3.2 "ip_whitelist is checked in resolveFromHttp; resolveFromUserToken does not check it".
+//
+// Last-used touch: fire-and-forget; errors are swallowed with a warning and never block the response.
+//
+// See docs/specs/08-saas-adapter-boundary.md §3.2 / §3.3 / §3.5
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalUserTokenVerifier = void 0;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const drizzle_orm_1 = require("drizzle-orm");
+const logger_1 = require("@proofhound/logger");
+const db_1 = require("@proofhound/db");
+const database_constants_1 = require("../../../shared/database/database.constants");
+const { tokens } = db_1.schema;
+let LocalUserTokenVerifier = class LocalUserTokenVerifier {
+    constructor(db) {
+        this.db = db;
+        this.logger = (0, logger_1.createLogger)('auth.user-token-verifier', { service: 'api' });
+    }
+    async verify(token, options) {
+        if (!token || typeof token !== 'string') {
+            throw new common_1.UnauthorizedException('invalid_user_token');
+        }
+        const tokenHash = this.hashToken(token);
+        const rows = await this.db
+            .select({
+            id: tokens.id,
+            ipWhitelist: tokens.ipWhitelist,
+            expiresAt: tokens.expiresAt,
+        })
+            .from(tokens)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(tokens.tokenHash, tokenHash), (0, drizzle_orm_1.eq)(tokens.scope, 'user'), (0, drizzle_orm_1.isNull)(tokens.revokedAt)))
+            .limit(1);
+        const row = rows[0];
+        if (!row)
+            throw new common_1.UnauthorizedException('invalid_user_token');
+        if (row.expiresAt && row.expiresAt.getTime() <= Date.now()) {
+            throw new common_1.UnauthorizedException('expired_user_token');
+        }
+        if (options.clientIp && Array.isArray(row.ipWhitelist) && row.ipWhitelist.length > 0) {
+            const allow = row.ipWhitelist.includes(options.clientIp);
+            if (!allow)
+                throw new common_1.UnauthorizedException('ip_not_allowed');
+        }
+        // Fire-and-forget touch last_used_at
+        this.touchLastUsed(row.id);
+        return {
+            actorId: row.id,
+            actorKind: options.actorKind,
+        };
+    }
+    hashToken(plaintext) {
+        return (0, node_crypto_1.createHash)('sha256').update(plaintext).digest('hex');
+    }
+    touchLastUsed(tokenId) {
+        this.db
+            .update(tokens)
+            .set({ lastUsedAt: (0, drizzle_orm_1.sql) `now()` })
+            .where((0, drizzle_orm_1.eq)(tokens.id, tokenId))
+            .then(() => undefined)
+            .catch((err) => {
+            this.logger.warn({ tokenId, err }, 'user_token_last_used_touch_failed');
+        });
+    }
+};
+exports.LocalUserTokenVerifier = LocalUserTokenVerifier;
+exports.LocalUserTokenVerifier = LocalUserTokenVerifier = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(database_constants_1.DATABASE_CLIENT)),
+    __metadata("design:paramtypes", [Object])
+], LocalUserTokenVerifier);
+//# sourceMappingURL=local-user-token.verifier.js.map

package/dist/server/common/contracts/local-user-token.verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-user-token.verifier.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/local-user-token.verifier.ts"],"names":[],"mappings":";AAAA,yBAAyB;AACzB,iIAAiI;AACjI,EAAE;AACF,mEAAmE;AACnE,yGAAyG;AACzG,oEAAoE;AACpE,EAAE;AACF,0FAA0F;AAC1F,qEAAqE;AACrE,qFAAqF;AACrF,uGAAuG;AACvG,iHAAiH;AACjH,EAAE;AACF,sGAAsG;AACtG,EAAE;AACF,gEAAgE;;;;;;;;;;;;;;;AAEhE,6CAAyC;AACzC,2CAA2E;AAC3E,6CAAmD;AACnD,+CAAkD;AAElD,uCAAwC;AACxC,oFAA8E;AAG9E,MAAM,EAAE,MAAM,EAAE,GAAG,WAAM,CAAC;AAyBnB,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAGjC,YAAqC,EAA6B;QAAZ,OAAE,GAAF,EAAE,CAAU;QAFjD,WAAM,GAAG,IAAA,qBAAY,EAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAElB,CAAC;IAEtE,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAA+B;QACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC;YACN,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;aACD,IAAI,CAAC,MAAM,CAAC;aACZ,KAAK,CAAC,IAAA,iBAAG,EAAC,IAAA,gBAAE,EAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAA,gBAAE,EAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAA,oBAAM,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;aAC/F,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,MAAM,GAAG,GAAoC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;QAEhE,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3D,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrF,MAAM,KAAK,GAAI,GAAG,CAAC,WAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QAChE,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE3B,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,SAAiB;QACjC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAEO,aAAa,CAAC,OAAe;QACnC,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,MAAM,CAAC;aACd,GAAG,CAAC,EAAE,UAAU,EAAE,IAAA,iBAAG,EAAA,OAAO,EAAE,CAAC;aAC/B,KAAK,CAAC,IAAA,gBAAE,EAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;aAC7B,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACrB,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACP,CAAC;CACF,CAAA;AAvDY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAIE,WAAA,IAAA,eAAM,EAAC,oCAAe,CAAC,CAAA;;GAHzB,sBAAsB,CAuDlC"}

package/dist/server/common/contracts/mcp-auth.resolver.d.ts

@@ -0,0 +1,7 @@
+import type { ActorContext } from '../actor-context';
+import type { McpRequestMetadataLike } from './types';
+export declare abstract class McpAuthResolver {
+    abstract resolveFromMcp(metadata: McpRequestMetadataLike): Promise<ActorContext>;
+    abstract resolveFromUserToken(token: string): Promise<ActorContext>;
+}
+//# sourceMappingURL=mcp-auth.resolver.d.ts.map

package/dist/server/common/contracts/mcp-auth.resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.resolver.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/mcp-auth.resolver.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEtD,8BAAsB,eAAe;IACnC,QAAQ,CAAC,cAAc,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,YAAY,CAAC;IAEhF,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CACpE"}

package/dist/server/common/contracts/mcp-auth.resolver.js

@@ -0,0 +1,12 @@
+"use strict";
+// McpAuthResolver — MCP channel adapter extension point
+// See docs/specs/08-saas-adapter-boundary.md §3.3
+//
+// In OSS, the MCP entry and HTTP entry share the `ph_core.tokens where scope='user'` resource pool,
+// but the two resolvers override independently. MUST NOT call ActorContextResolver.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpAuthResolver = void 0;
+class McpAuthResolver {
+}
+exports.McpAuthResolver = McpAuthResolver;
+//# sourceMappingURL=mcp-auth.resolver.js.map

package/dist/server/common/contracts/mcp-auth.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.resolver.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/mcp-auth.resolver.ts"],"names":[],"mappings":";AAAA,wDAAwD;AACxD,kDAAkD;AAClD,EAAE;AACF,oGAAoG;AACpG,oFAAoF;;;AAKpF,MAAsB,eAAe;CAIpC;AAJD,0CAIC"}

package/dist/server/common/contracts/project-context.resolver.d.ts

@@ -0,0 +1,11 @@
+import type { ProjectContext } from '@proofhound/shared';
+import type { ActorContext } from '../actor-context';
+import type { ProjectContextHint } from './types';
+export declare class ProjectAccessDeniedError extends Error {
+    readonly code = "project_access_denied";
+    constructor(message?: string);
+}
+export declare abstract class ProjectContextResolver {
+    abstract resolve(actor: ActorContext, hint?: ProjectContextHint): Promise<ProjectContext>;
+}
+//# sourceMappingURL=project-context.resolver.d.ts.map

package/dist/server/common/contracts/project-context.resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-context.resolver.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/project-context.resolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,2BAA2B;gBAE5B,OAAO,SAA0B;CAK9C;AAED,8BAAsB,sBAAsB;IAC1C,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC;CAC1F"}

package/dist/server/common/contracts/project-context.resolver.js

@@ -0,0 +1,22 @@
+"use strict";
+// ProjectContextResolver — adapter extension point
+// See docs/specs/08-saas-adapter-boundary.md §3.1
+//
+// The OSS default implementation `LocalProjectContextResolver` ignores all hints and always returns LOCAL_PROJECT_CONTEXT;
+// in the SaaS form, `RemoteProjectContextResolver` overrides this in a separate repo and resolves the
+// real projectId from actor.claims / hint and validates access rights.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProjectContextResolver = exports.ProjectAccessDeniedError = void 0;
+class ProjectAccessDeniedError extends Error {
+    constructor(message = 'project_access_denied') {
+        super(message);
+        this.code = 'project_access_denied';
+        this.name = 'ProjectAccessDeniedError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+exports.ProjectAccessDeniedError = ProjectAccessDeniedError;
+class ProjectContextResolver {
+}
+exports.ProjectContextResolver = ProjectContextResolver;
+//# sourceMappingURL=project-context.resolver.js.map

package/dist/server/common/contracts/project-context.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-context.resolver.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/project-context.resolver.ts"],"names":[],"mappings":";AAAA,mDAAmD;AACnD,kDAAkD;AAClD,EAAE;AACF,2HAA2H;AAC3H,sGAAsG;AACtG,uEAAuE;;;AAMvE,MAAa,wBAAyB,SAAQ,KAAK;IAGjD,YAAY,OAAO,GAAG,uBAAuB;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,SAAI,GAAG,uBAAuB,CAAC;QAItC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AARD,4DAQC;AAED,MAAsB,sBAAsB;CAE3C;AAFD,wDAEC"}

package/dist/server/common/contracts/quota-policy.hook.d.ts

@@ -0,0 +1,24 @@
+import type { ActorContext, ProjectContext } from '../actor-context';
+export type StorageQuotaSource = 'dataset_upload' | 'dataset_import' | 'dataset_import_batch' | 'run_result';
+export interface StorageQuotaInput {
+    project: ProjectContext;
+    source: StorageQuotaSource;
+    actor?: ActorContext;
+    /** Best-effort expected bytes for the incoming write. */
+    bytes?: number;
+}
+export interface ExecutionSlotInput {
+    project: ProjectContext;
+    source: string;
+    modelId?: string;
+    requestId?: string;
+}
+export declare abstract class QuotaPolicyHook {
+    abstract assertCanStore(input: StorageQuotaInput): Promise<void>;
+    abstract withExecutionSlot<T>(input: ExecutionSlotInput, run: () => Promise<T>): Promise<T>;
+}
+export declare class LocalQuotaPolicyHook extends QuotaPolicyHook {
+    assertCanStore(_input: StorageQuotaInput): Promise<void>;
+    withExecutionSlot<T>(_input: ExecutionSlotInput, run: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=quota-policy.hook.d.ts.map

package/dist/server/common/contracts/quota-policy.hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-policy.hook.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/quota-policy.hook.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,sBAAsB,GAAG,YAAY,CAAC;AAE7G,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,8BAAsB,eAAe;IACnC,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAChE,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAC5F;AAED,qBAAa,oBAAqB,SAAQ,eAAe;IACjD,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAG1F"}

package/dist/server/common/contracts/quota-policy.hook.js

@@ -0,0 +1,22 @@
+"use strict";
+// QuotaPolicyHook — adapter extension point
+// See docs/specs/08-saas-adapter-boundary.md §3.11
+//
+// OSS has no hosted plan envelope, so the local implementation is a no-op.
+// Hosted deployments can override this hook to enforce resource quotas at the
+// actual write / execution points without embedding billing semantics in OSS.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalQuotaPolicyHook = exports.QuotaPolicyHook = void 0;
+class QuotaPolicyHook {
+}
+exports.QuotaPolicyHook = QuotaPolicyHook;
+class LocalQuotaPolicyHook extends QuotaPolicyHook {
+    async assertCanStore(_input) {
+        // Local OSS has no hosted quota envelope.
+    }
+    async withExecutionSlot(_input, run) {
+        return run();
+    }
+}
+exports.LocalQuotaPolicyHook = LocalQuotaPolicyHook;
+//# sourceMappingURL=quota-policy.hook.js.map

package/dist/server/common/contracts/quota-policy.hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-policy.hook.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/quota-policy.hook.ts"],"names":[],"mappings":";AAAA,4CAA4C;AAC5C,mDAAmD;AACnD,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;;;AAqB9E,MAAsB,eAAe;CAGpC;AAHD,0CAGC;AAED,MAAa,oBAAqB,SAAQ,eAAe;IACvD,KAAK,CAAC,cAAc,CAAC,MAAyB;QAC5C,0CAA0C;IAC5C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAI,MAA0B,EAAE,GAAqB;QAC1E,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;CACF;AARD,oDAQC"}

package/dist/server/common/contracts/runtime-limits.provider.d.ts

@@ -0,0 +1,17 @@
+import type { RuntimeLimits } from '@proofhound/orchestration-shared';
+import type { ProjectContext } from '../actor-context';
+export interface RuntimeLimitsInput {
+    project: ProjectContext;
+    modelId: string;
+    /** The LLM job source (`experiment` / `optimization_*` / `release`) or a probe / synchronous caller tag. */
+    source: string;
+    /** The per-call limits the caller already derived (e.g. from runConfig); may be undefined. */
+    limits?: RuntimeLimits;
+}
+export declare abstract class RuntimeLimitsProvider {
+    abstract mergeLlmLimits(input: RuntimeLimitsInput): Promise<RuntimeLimits | undefined>;
+}
+export declare class LocalRuntimeLimitsProvider extends RuntimeLimitsProvider {
+    mergeLlmLimits(input: RuntimeLimitsInput): Promise<RuntimeLimits | undefined>;
+}
+//# sourceMappingURL=runtime-limits.provider.d.ts.map

package/dist/server/common/contracts/runtime-limits.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-limits.provider.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/runtime-limits.provider.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,4GAA4G;IAC5G,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,8BAAsB,qBAAqB;IACzC,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;CACvF;AAED,qBAAa,0BAA2B,SAAQ,qBAAqB;IAE7D,cAAc,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;CAGpF"}

package/dist/server/common/contracts/runtime-limits.provider.js

@@ -0,0 +1,23 @@
+"use strict";
+// RuntimeLimitsProvider — adapter extension point
+// See docs/specs/08-saas-adapter-boundary.md §3.10
+//
+// Lets a deployment fold deployment-level runtime caps into a call's per-call RPM/TPM/concurrency
+// limits before enqueueing or direct invocation — e.g. a SaaS org plan's concurrency ceiling. It carries NO billing
+// semantics: it only translates an already-resolved ProjectContext (+ model / source) into an optional
+// limits override. The OSS default `LocalRuntimeLimitsProvider` is a genuine pass-through (returns the
+// caller's limits unchanged) and is invoked before every LLM enqueue/direct call, so OSS behavior is identical.
+// Mirrors LimiterKeyStrategy: abstract class as DI token + Local* default implementation.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalRuntimeLimitsProvider = exports.RuntimeLimitsProvider = void 0;
+class RuntimeLimitsProvider {
+}
+exports.RuntimeLimitsProvider = RuntimeLimitsProvider;
+class LocalRuntimeLimitsProvider extends RuntimeLimitsProvider {
+    // OSS knows nothing about plans/quotas: return the caller's limits verbatim.
+    async mergeLlmLimits(input) {
+        return input.limits;
+    }
+}
+exports.LocalRuntimeLimitsProvider = LocalRuntimeLimitsProvider;
+//# sourceMappingURL=runtime-limits.provider.js.map

package/dist/server/common/contracts/runtime-limits.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-limits.provider.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/runtime-limits.provider.ts"],"names":[],"mappings":";AAAA,kDAAkD;AAClD,mDAAmD;AACnD,EAAE;AACF,kGAAkG;AAClG,oHAAoH;AACpH,uGAAuG;AACvG,uGAAuG;AACvG,gHAAgH;AAChH,0FAA0F;;;AAc1F,MAAsB,qBAAqB;CAE1C;AAFD,sDAEC;AAED,MAAa,0BAA2B,SAAQ,qBAAqB;IACnE,6EAA6E;IAC7E,KAAK,CAAC,cAAc,CAAC,KAAyB;QAC5C,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;CACF;AALD,gEAKC"}

package/dist/server/common/contracts/token.service.d.ts

@@ -0,0 +1,11 @@
+import type { CreateUserTokenDto, CreateUserTokenResponseDto, DeleteUserTokenResponseDto, ListUserTokensResponseDto, RevealUserTokenResponseDto, UpdateUserTokenDto, UpdateUserTokenResponseDto } from '@proofhound/shared';
+import type { CurrentUserPayload } from '../decorators/current-user.decorator';
+export type ActionSource = 'api' | 'mcp';
+export declare abstract class TokenService {
+    abstract listUserTokens(actor: CurrentUserPayload): Promise<ListUserTokensResponseDto>;
+    abstract createUserToken(dto: CreateUserTokenDto, actor: CurrentUserPayload, source?: ActionSource): Promise<CreateUserTokenResponseDto>;
+    abstract updateUserToken(tokenId: string, dto: UpdateUserTokenDto, actor: CurrentUserPayload, source?: ActionSource): Promise<UpdateUserTokenResponseDto>;
+    abstract revealUserToken(tokenId: string, actor: CurrentUserPayload, source?: ActionSource): Promise<RevealUserTokenResponseDto>;
+    abstract deleteUserToken(tokenId: string, actor: CurrentUserPayload, source?: ActionSource): Promise<DeleteUserTokenResponseDto>;
+}
+//# sourceMappingURL=token.service.d.ts.map

package/dist/server/common/contracts/token.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/token.service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,kBAAkB,EAClB,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE/E,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,KAAK,CAAC;AAEzC,8BAAsB,YAAY;IAChC,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IACtF,QAAQ,CAAC,eAAe,CACtB,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,kBAAkB,EACzB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,0BAA0B,CAAC;IACtC,QAAQ,CAAC,eAAe,CACtB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,kBAAkB,EACzB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,0BAA0B,CAAC;IACtC,QAAQ,CAAC,eAAe,CACtB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,kBAAkB,EACzB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,0BAA0B,CAAC;IACtC,QAAQ,CAAC,eAAe,CACtB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,kBAAkB,EACzB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,0BAA0B,CAAC;CACvC"}

package/dist/server/common/contracts/token.service.js

@@ -0,0 +1,12 @@
+"use strict";
+// TokenService — adapter extension point (DI token) for user-token CRUD.
+// See docs/specs/08-saas-adapter-boundary.md §3.5.
+//
+// Handles only `scope='user'` rows; `scope='webhook'` is managed by the connector resource (§3.4).
+// Token → ActorContext validation (hash / expiry) lives in LocalUserTokenVerifier, not here.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenService = void 0;
+class TokenService {
+}
+exports.TokenService = TokenService;
+//# sourceMappingURL=token.service.js.map

package/dist/server/common/contracts/token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/token.service.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,mDAAmD;AACnD,EAAE;AACF,mGAAmG;AACnG,6FAA6F;;;AAe7F,MAAsB,YAAY;CAuBjC;AAvBD,oCAuBC"}

package/dist/server/common/contracts/types.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Abstract HTTP request shape. express.Request satisfies this structure.
+ */
+export interface HttpRequestLike {
+    headers: Record<string, string | string[] | undefined>;
+    ip?: string;
+    socket?: {
+        remoteAddress?: string;
+    };
+}
+/**
+ * Abstract MCP request metadata. OSS does not actually wire MCP transport yet,
+ * so this type is a placeholder; the real SDK shape will be more refined when SaaS lands,
+ * and the implementation side chooses to extract token from headers / meta / authInfo.
+ */
+export interface McpRequestMetadataLike {
+    /**
+     * MCP protocol metadata field (compatible with the SDK's Meta / authInfo bag).
+     * For example `{ token: 'ph_tok_xxx' }` or `{ headers: { authorization: 'Bearer ...' } }`.
+     */
+    headers?: Record<string, string | string[] | undefined>;
+    meta?: Record<string, unknown>;
+    /**
+     * Some MCP transports allow attaching authInfo directly (e.g. middleware extraction result in streamable HTTP mode).
+     */
+    authInfo?: {
+        token?: string;
+    } | undefined;
+}
+/**
+ * Hint for ProjectContextResolver.resolve.
+ * The OSS default implementation ignores all hints and always returns LOCAL_PROJECT_CONTEXT;
+ * SaaS RemoteProjectContextResolver reads projectId / projectIdHeader / mcpMetadata.
+ */
+export interface ProjectContextHint {
+    /** Already-resolved project id from an internal row or trusted runtime boundary. */
+    projectId?: string;
+    /** HTTP `X-Project-Id` header */
+    projectIdHeader?: string;
+    /** MCP metadata (same source as McpAuthResolver) */
+    mcpMetadata?: McpRequestMetadataLike;
+    /** Webhook entry: populated by ConnectorContextResolver */
+    connectorId?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/server/common/contracts/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/types.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;;OAEG;IACH,QAAQ,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/server/common/contracts/types.js

@@ -0,0 +1,8 @@
+"use strict";
+// Thin transport-agnostic shapes consumed by the resolver abstract classes.
+// See docs/specs/08-saas-adapter-boundary.md §3.1-3.3
+//
+// Stays decoupled from concrete express / @modelcontextprotocol SDK types; both OSS / SaaS
+// resolver implementations must avoid importing third-party transport-layer types directly.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/server/common/contracts/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/types.ts"],"names":[],"mappings":";AAAA,4EAA4E;AAC5E,sDAAsD;AACtD,EAAE;AACF,2FAA2F;AAC3F,4FAA4F"}

package/dist/server/common/contracts/workflow-authorization.hook.d.ts

@@ -0,0 +1,9 @@
+import type { ActorContext, ProjectContext } from '../actor-context';
+export type WorkflowKind = 'experiment' | 'optimization' | 'release' | 'llm' | 'probe';
+export declare abstract class WorkflowAuthorizationHook {
+    abstract assertCanStart(actor: ActorContext, project: ProjectContext, workflow: WorkflowKind): Promise<void>;
+}
+export declare class LocalWorkflowAuthorizationHook extends WorkflowAuthorizationHook {
+    assertCanStart(_actor: ActorContext, _project: ProjectContext, _workflow: WorkflowKind): Promise<void>;
+}
+//# sourceMappingURL=workflow-authorization.hook.d.ts.map

package/dist/server/common/contracts/workflow-authorization.hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-authorization.hook.d.ts","sourceRoot":"","sources":["../../../../src/server/common/contracts/workflow-authorization.hook.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC;AAEvF,8BAAsB,yBAAyB;IAC7C,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAC7G;AAED,qBAAa,8BAA+B,SAAQ,yBAAyB;IACrE,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAG7G"}

package/dist/server/common/contracts/workflow-authorization.hook.js

@@ -0,0 +1,27 @@
+"use strict";
+// WorkflowAuthorizationHook — adapter extension point
+// See docs/specs/08-saas-adapter-boundary.md §3.8
+//
+// Called once before a DBOS workflow / BullMQ job is started or enqueued, to validate whether the
+// actor may start that workflow kind on that project. This is the only OSS-trunk boundary where the
+// entry's authentication is trusted: once a payload is written it is considered already authorized,
+// and the worker / runner do not re-authorize.
+//
+// OSS default `LocalWorkflowAuthorizationHook` passes everything (the single local project authorizes
+// all workflow starts). SaaS `RbacWorkflowAuthorizationHook` validates the actor's role on the project.
+//
+// `WorkflowKind` is reconciled with the workflow / queue list in docs/specs/03-orchestration.md:
+// DBOS workflows `ExperimentWorkflow` / `OptimizationWorkflow`, BullMQ queues `llm` / `probe`, and the
+// in-server release runner (`release`). It is a coarse enum and is not coupled to roles or resource ids.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalWorkflowAuthorizationHook = exports.WorkflowAuthorizationHook = void 0;
+class WorkflowAuthorizationHook {
+}
+exports.WorkflowAuthorizationHook = WorkflowAuthorizationHook;
+class LocalWorkflowAuthorizationHook extends WorkflowAuthorizationHook {
+    async assertCanStart(_actor, _project, _workflow) {
+        // OSS no-op: the single local project authorizes all workflow starts.
+    }
+}
+exports.LocalWorkflowAuthorizationHook = LocalWorkflowAuthorizationHook;
+//# sourceMappingURL=workflow-authorization.hook.js.map

package/dist/server/common/contracts/workflow-authorization.hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-authorization.hook.js","sourceRoot":"","sources":["../../../../src/server/common/contracts/workflow-authorization.hook.ts"],"names":[],"mappings":";AAAA,sDAAsD;AACtD,kDAAkD;AAClD,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,oGAAoG;AACpG,+CAA+C;AAC/C,EAAE;AACF,sGAAsG;AACtG,wGAAwG;AACxG,EAAE;AACF,iGAAiG;AACjG,uGAAuG;AACvG,yGAAyG;;;AAMzG,MAAsB,yBAAyB;CAE9C;AAFD,8DAEC;AAED,MAAa,8BAA+B,SAAQ,yBAAyB;IAC3E,KAAK,CAAC,cAAc,CAAC,MAAoB,EAAE,QAAwB,EAAE,SAAuB;QAC1F,sEAAsE;IACxE,CAAC;CACF;AAJD,wEAIC"}

package/dist/server/common/decorators/current-project.decorator.d.ts

@@ -0,0 +1,5 @@
+import { type ExecutionContext } from '@nestjs/common';
+import { type ProjectContext } from '@proofhound/shared';
+export declare function extractCurrentProject(_data: unknown, ctx: ExecutionContext): ProjectContext;
+export declare const CurrentProject: (...dataOrPipes: unknown[]) => ParameterDecorator;
+//# sourceMappingURL=current-project.decorator.d.ts.map

package/dist/server/common/decorators/current-project.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-project.decorator.d.ts","sourceRoot":"","sources":["../../../../src/server/common/decorators/current-project.decorator.ts"],"names":[],"mappings":"AAUA,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,GAAG,cAAc,CAI3F;AAED,eAAO,MAAM,cAAc,mDAA8C,CAAC"}

package/dist/server/common/decorators/current-project.decorator.js

@@ -0,0 +1,22 @@
+"use strict";
+// @CurrentProject — HTTP Controller param decorator
+// See docs/specs/08-saas-adapter-boundary.md §3.1
+//
+// `HttpActorGuard` resolves the request's ProjectContext (via the DI ProjectContextResolver) and
+// attaches it to `request.projectContext`. This decorator is a thin synchronous reader of that value,
+// so Controllers obtain the project without importing the resolver or the legacy sync helper.
+//
+// `extractCurrentProject` is exported separately so it can be unit-tested without the Nest param-decorator
+// machinery.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentProject = void 0;
+exports.extractCurrentProject = extractCurrentProject;
+const common_1 = require("@nestjs/common");
+const shared_1 = require("@proofhound/shared");
+function extractCurrentProject(_data, ctx) {
+    const request = ctx.switchToHttp().getRequest();
+    // Fallback keeps unit tests / non-guarded routes working; guarded routes always have it set.
+    return request.projectContext ?? shared_1.LOCAL_PROJECT_CONTEXT;
+}
+exports.CurrentProject = (0, common_1.createParamDecorator)(extractCurrentProject);
+//# sourceMappingURL=current-project.decorator.js.map

package/dist/server/common/decorators/current-project.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-project.decorator.js","sourceRoot":"","sources":["../../../../src/server/common/decorators/current-project.decorator.ts"],"names":[],"mappings":";AAAA,oDAAoD;AACpD,kDAAkD;AAClD,EAAE;AACF,iGAAiG;AACjG,sGAAsG;AACtG,8FAA8F;AAC9F,EAAE;AACF,2GAA2G;AAC3G,aAAa;;;AAKb,sDAIC;AAPD,2CAA6E;AAC7E,+CAAgF;AAEhF,SAAgB,qBAAqB,CAAC,KAAc,EAAE,GAAqB;IACzE,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAuC,CAAC;IACrF,6FAA6F;IAC7F,OAAO,OAAO,CAAC,cAAc,IAAI,8BAAqB,CAAC;AACzD,CAAC;AAEY,QAAA,cAAc,GAAG,IAAA,6BAAoB,EAAC,qBAAqB,CAAC,CAAC"}

package/dist/server/common/decorators/current-user.decorator.d.ts

@@ -0,0 +1,13 @@
+import type { ActorKind } from '../actor-context';
+export interface CurrentUserPayload {
+    sub: string;
+    actorId?: string;
+    actorKind?: ActorKind;
+    projectId?: string;
+    orgId?: string;
+    email: string;
+    isSuperAdmin: boolean;
+    isActive: boolean;
+}
+export declare const CurrentUser: (...dataOrPipes: unknown[]) => ParameterDecorator;
+//# sourceMappingURL=current-user.decorator.d.ts.map

package/dist/server/common/decorators/current-user.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.d.ts","sourceRoot":"","sources":["../../../../src/server/common/decorators/current-user.decorator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,eAAO,MAAM,WAAW,mDAGtB,CAAC"}

package/dist/server/common/decorators/current-user.decorator.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentUser = void 0;
+const common_1 = require("@nestjs/common");
+exports.CurrentUser = (0, common_1.createParamDecorator)((_data, ctx) => {
+    const request = ctx.switchToHttp().getRequest();
+    return request.user;
+});
+//# sourceMappingURL=current-user.decorator.js.map

package/dist/server/common/decorators/current-user.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.js","sourceRoot":"","sources":["../../../../src/server/common/decorators/current-user.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AAe3D,QAAA,WAAW,GAAG,IAAA,6BAAoB,EAAC,CAAC,KAAc,EAAE,GAAqB,EAAsB,EAAE;IAC5G,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAA0C,CAAC;IACxF,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC,CAAC,CAAC"}

package/dist/server/common/errors/db-error.d.ts

@@ -0,0 +1,2 @@
+export declare function isUniqueViolation(error: unknown, constraintPattern: RegExp): boolean;
+//# sourceMappingURL=db-error.d.ts.map

package/dist/server/common/errors/db-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-error.d.ts","sourceRoot":"","sources":["../../../../src/server/common/errors/db-error.ts"],"names":[],"mappings":"AAAA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAOpF"}

package/dist/server/common/errors/db-error.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isUniqueViolation = isUniqueViolation;
+function isUniqueViolation(error, constraintPattern) {
+    const err = error;
+    if (err?.code !== '23505')
+        return false;
+    const constraint = typeof err.constraint === 'string' ? err.constraint : '';
+    const message = typeof err.message === 'string' ? err.message : '';
+    return constraintPattern.test(constraint) || constraintPattern.test(message);
+}
+//# sourceMappingURL=db-error.js.map

package/dist/server/common/errors/db-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-error.js","sourceRoot":"","sources":["../../../../src/server/common/errors/db-error.ts"],"names":[],"mappings":";;AAAA,8CAOC;AAPD,SAAgB,iBAAiB,CAAC,KAAc,EAAE,iBAAyB;IACzE,MAAM,GAAG,GAAG,KAAgF,CAAC;IAC7F,IAAI,GAAG,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAExC,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/E,CAAC"}