@liangjie559567/ultrapower 6.0.0 → 7.0.2

package/dist/reliability/retry-manager.d.ts

@@ -0,0 +1,20 @@
+export interface RetryOptions {
+    maxRetries?: number;
+    baseDelay?: number;
+    operation?: string;
+}
+export interface RetryResult<T> {
+    success: boolean;
+    result?: T;
+    error?: Error;
+    attempts: number;
+}
+export declare class RetryManager {
+    private maxRetries;
+    private baseDelay;
+    private operation?;
+    constructor(options?: RetryOptions);
+    execute<T>(fn: () => Promise<T>): Promise<RetryResult<T>>;
+    private sleep;
+}
+//# sourceMappingURL=retry-manager.d.ts.map

package/dist/reliability/retry-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-manager.d.ts","sourceRoot":"","sources":["../../src/reliability/retry-manager.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,CAAC,CAAC;IACX,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAC,CAAS;gBAEf,OAAO,GAAE,YAAiB;IAMhC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAgC/D,OAAO,CAAC,KAAK;CAGd"}

package/dist/reliability/retry-manager.js

@@ -0,0 +1,45 @@
+import { RetryClassifier } from './retry-classifier.js';
+export class RetryManager {
+    maxRetries;
+    baseDelay;
+    operation;
+    constructor(options = {}) {
+        this.maxRetries = options.maxRetries ?? 3;
+        this.baseDelay = options.baseDelay ?? 1000;
+        this.operation = options.operation;
+    }
+    async execute(fn) {
+        if (this.operation && !RetryClassifier.isRetryable(this.operation)) {
+            try {
+                const result = await fn();
+                return { success: true, result, attempts: 1 };
+            }
+            catch (error) {
+                const err = error instanceof Error ? error : new Error(String(error));
+                return { success: false, error: err, attempts: 1 };
+            }
+        }
+        let lastError;
+        for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+            try {
+                const result = await fn();
+                console.log(`[RetryManager] Success on attempt ${attempt + 1}`);
+                return { success: true, result, attempts: attempt + 1 };
+            }
+            catch (error) {
+                lastError = error instanceof Error ? error : new Error(String(error));
+                console.log(`[RetryManager] Attempt ${attempt + 1} failed: ${lastError.message}`);
+                if (attempt < this.maxRetries) {
+                    const delay = this.baseDelay * Math.pow(2, attempt);
+                    console.log(`[RetryManager] Retrying in ${delay}ms...`);
+                    await this.sleep(delay);
+                }
+            }
+        }
+        return { success: false, error: lastError, attempts: this.maxRetries + 1 };
+    }
+    sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+}
+//# sourceMappingURL=retry-manager.js.map

package/dist/reliability/retry-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-manager.js","sourceRoot":"","sources":["../../src/reliability/retry-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAexD,MAAM,OAAO,YAAY;IACf,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,SAAS,CAAU;IAE3B,YAAY,UAAwB,EAAE;QACpC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,EAAoB;QACnC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,SAA4B,CAAC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,qCAAqC,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,CAAC,EAAE,CAAC;YAC1D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtE,OAAO,CAAC,GAAG,CAAC,0BAA0B,OAAO,GAAG,CAAC,YAAY,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;gBAElF,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACpD,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,OAAO,CAAC,CAAC;oBACxD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/security/audit-logger.d.ts

@@ -0,0 +1,21 @@
+export interface AuditEvent {
+    timestamp: number;
+    userId: string;
+    action: string;
+    resource: string;
+    result: 'success' | 'failure';
+    previousHash?: string;
+    hash?: string;
+}
+export declare class AuditLogger {
+    private logPath;
+    private events;
+    constructor(logPath?: string);
+    log(event: Omit<AuditEvent, 'timestamp' | 'hash' | 'previousHash'>): void;
+    query(filters: Partial<Omit<AuditEvent, 'hash' | 'previousHash'>>): AuditEvent[];
+    verify(): boolean;
+    private computeHash;
+    private load;
+    private save;
+}
+//# sourceMappingURL=audit-logger.d.ts.map

package/dist/security/audit-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/security/audit-logger.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAoB;gBAEtB,OAAO,GAAE,MAA+B;IAKpD,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,MAAM,GAAG,cAAc,CAAC,GAAG,IAAI;IAYzE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,CAAC,CAAC,GAAG,UAAU,EAAE;IAMhF,MAAM,IAAI,OAAO;IAUjB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,IAAI;CAOb"}

package/dist/security/audit-logger.js

@@ -0,0 +1,58 @@
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+export class AuditLogger {
+    logPath;
+    events = [];
+    constructor(logPath = '.omc/logs/audit.json') {
+        this.logPath = path.resolve(logPath);
+        this.load();
+    }
+    log(event) {
+        const previousHash = this.events.length > 0 ? this.events[this.events.length - 1].hash : undefined;
+        const newEvent = {
+            ...event,
+            timestamp: Date.now(),
+            previousHash,
+        };
+        newEvent.hash = this.computeHash(newEvent);
+        this.events.push(newEvent);
+        this.save();
+    }
+    query(filters) {
+        return this.events.filter(event => {
+            return Object.entries(filters).every(([key, value]) => event[key] === value);
+        });
+    }
+    verify() {
+        for (let i = 0; i < this.events.length; i++) {
+            const event = this.events[i];
+            const expectedHash = this.computeHash(event);
+            if (event.hash !== expectedHash)
+                return false;
+            if (i > 0 && event.previousHash !== this.events[i - 1].hash)
+                return false;
+        }
+        return true;
+    }
+    computeHash(event) {
+        const data = `${event.timestamp}:${event.userId}:${event.action}:${event.resource}:${event.result}:${event.previousHash || ''}`;
+        return crypto.createHash('sha256').update(data).digest('hex');
+    }
+    load() {
+        // eslint-disable-next-line no-restricted-syntax
+        if (fs.existsSync(this.logPath)) {
+            // eslint-disable-next-line no-restricted-syntax
+            this.events = JSON.parse(fs.readFileSync(this.logPath, 'utf-8'));
+        }
+    }
+    save() {
+        const dir = path.dirname(this.logPath);
+        // eslint-disable-next-line no-restricted-syntax
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+        // eslint-disable-next-line no-restricted-syntax
+        fs.writeFileSync(this.logPath, JSON.stringify(this.events, null, 2));
+    }
+}
+//# sourceMappingURL=audit-logger.js.map

package/dist/security/audit-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/security/audit-logger.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,MAAM,OAAO,WAAW;IACd,OAAO,CAAS;IAChB,MAAM,GAAiB,EAAE,CAAC;IAElC,YAAY,UAAkB,sBAAsB;QAClD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAA8D;QAChE,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnG,MAAM,QAAQ,GAAe;YAC3B,GAAG,KAAK;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,YAAY;SACb,CAAC;QACF,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAA2D;QAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YAChC,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAuB,CAAC,KAAK,KAAK,CAAC,CAAC;QACnG,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM;QACJ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,KAAK,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CAAC,KAAiB;QACnC,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAChI,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAEO,IAAI;QACV,gDAAgD;QAChD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,gDAAgD;YAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAEO,IAAI;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,gDAAgD;QAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,gDAAgD;QAChD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;CACF"}

package/dist/security/budget-controller.d.ts

@@ -0,0 +1,23 @@
+/**
+ * T-013: Budget Control
+ * - maxTokens/maxCost enforcement
+ * - Auto-stop on limit exceeded
+ */
+export interface BudgetConfig {
+    maxTokens?: number;
+    maxCost?: number;
+}
+export interface UsageStats {
+    tokens: number;
+    cost: number;
+}
+export declare class BudgetController {
+    private config;
+    private usage;
+    constructor(config: BudgetConfig);
+    track(tokens: number, cost: number): void;
+    check(): void;
+    getUsage(): UsageStats;
+    reset(): void;
+}
+//# sourceMappingURL=budget-controller.d.ts.map

package/dist/security/budget-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget-controller.d.ts","sourceRoot":"","sources":["../../src/security/budget-controller.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,gBAAgB;IAGf,OAAO,CAAC,MAAM;IAF1B,OAAO,CAAC,KAAK,CAAsC;gBAE/B,MAAM,EAAE,YAAY;IAExC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAKzC,KAAK,IAAI,IAAI;IASb,QAAQ,IAAI,UAAU;IAItB,KAAK,IAAI,IAAI;CAGd"}

package/dist/security/budget-controller.js

@@ -0,0 +1,31 @@
+/**
+ * T-013: Budget Control
+ * - maxTokens/maxCost enforcement
+ * - Auto-stop on limit exceeded
+ */
+export class BudgetController {
+    config;
+    usage = { tokens: 0, cost: 0 };
+    constructor(config) {
+        this.config = config;
+    }
+    track(tokens, cost) {
+        this.usage.tokens += tokens;
+        this.usage.cost += cost;
+    }
+    check() {
+        if (this.config.maxTokens && this.usage.tokens > this.config.maxTokens) {
+            throw new Error(`Token budget exceeded: ${this.usage.tokens}/${this.config.maxTokens}`);
+        }
+        if (this.config.maxCost && this.usage.cost > this.config.maxCost) {
+            throw new Error(`Cost budget exceeded: $${this.usage.cost.toFixed(2)}/$${this.config.maxCost.toFixed(2)}`);
+        }
+    }
+    getUsage() {
+        return { ...this.usage };
+    }
+    reset() {
+        this.usage = { tokens: 0, cost: 0 };
+    }
+}
+//# sourceMappingURL=budget-controller.js.map

package/dist/security/budget-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget-controller.js","sourceRoot":"","sources":["../../src/security/budget-controller.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,MAAM,OAAO,gBAAgB;IAGP;IAFZ,KAAK,GAAe,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAEnD,YAAoB,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAE5C,KAAK,CAAC,MAAc,EAAE,IAAY;QAChC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACtC,CAAC;CACF"}

package/dist/security/concurrency-control.d.ts

@@ -0,0 +1,42 @@
+/**
+ * T-019: Concurrency Control Mechanism
+ * - Version checking
+ * - Conflict retry with exponential backoff
+ * - Deadlock detection
+ */
+export interface VersionedState {
+    version: number;
+    data: any;
+    timestamp: number;
+}
+export interface ConcurrencyConfig {
+    maxRetries?: number;
+    baseDelayMs?: number;
+    deadlockTimeoutMs?: number;
+}
+export declare class ConcurrencyControl {
+    private locks;
+    private config;
+    constructor(config?: ConcurrencyConfig);
+    /**
+     * Version check: ensure state hasn't changed
+     */
+    checkVersion(current: number, expected: number): void;
+    /**
+     * Retry with exponential backoff on conflict
+     */
+    retryOnConflict<T>(operation: () => Promise<T>, resourceId: string): Promise<T>;
+    /**
+     * Acquire lock with deadlock detection
+     */
+    acquireLock(resourceId: string, holderId: string): Promise<void>;
+    /**
+     * Release lock
+     */
+    releaseLock(resourceId: string, holderId: string): void;
+    /**
+     * Check for deadlocks
+     */
+    detectDeadlocks(): string[];
+}
+//# sourceMappingURL=concurrency-control.d.ts.map

package/dist/security/concurrency-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency-control.d.ts","sourceRoot":"","sources":["../../src/security/concurrency-control.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,GAAG,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAQD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,KAAK,CAA4D;IACzE,OAAO,CAAC,MAAM,CAA8B;gBAEhC,MAAM,GAAE,iBAAsB;IAI1C;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAMrD;;OAEG;IACG,eAAe,CAAC,CAAC,EACrB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC;IAsBb;;OAEG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBtE;;OAEG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAQvD;;OAEG;IACH,eAAe,IAAI,MAAM,EAAE;CAY5B"}

package/dist/security/concurrency-control.js

@@ -0,0 +1,87 @@
+/**
+ * T-019: Concurrency Control Mechanism
+ * - Version checking
+ * - Conflict retry with exponential backoff
+ * - Deadlock detection
+ */
+const DEFAULT_CONFIG = {
+    maxRetries: 3,
+    baseDelayMs: 100,
+    deadlockTimeoutMs: 30000,
+};
+export class ConcurrencyControl {
+    locks = new Map();
+    config;
+    constructor(config = {}) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+    }
+    /**
+     * Version check: ensure state hasn't changed
+     */
+    checkVersion(current, expected) {
+        if (current !== expected) {
+            throw new Error(`Version conflict: expected ${expected}, got ${current}`);
+        }
+    }
+    /**
+     * Retry with exponential backoff on conflict
+     */
+    async retryOnConflict(operation, resourceId) {
+        let lastError;
+        for (let attempt = 0; attempt < this.config.maxRetries; attempt++) {
+            try {
+                return await operation();
+            }
+            catch (error) {
+                if (error instanceof Error && error.message.includes('Version conflict')) {
+                    lastError = error;
+                    const delay = this.config.baseDelayMs * Math.pow(2, attempt);
+                    await new Promise(resolve => setTimeout(resolve, delay));
+                    continue;
+                }
+                throw error;
+            }
+        }
+        throw new Error(`Max retries (${this.config.maxRetries}) exceeded for ${resourceId}: ${lastError?.message}`);
+    }
+    /**
+     * Acquire lock with deadlock detection
+     */
+    async acquireLock(resourceId, holderId) {
+        const existing = this.locks.get(resourceId);
+        if (existing) {
+            const elapsed = Date.now() - existing.timestamp;
+            if (elapsed > this.config.deadlockTimeoutMs) {
+                // Deadlock detected, force release
+                this.locks.delete(resourceId);
+            }
+            else if (existing.holder !== holderId) {
+                throw new Error(`Resource ${resourceId} locked by ${existing.holder}`);
+            }
+        }
+        this.locks.set(resourceId, { holder: holderId, timestamp: Date.now() });
+    }
+    /**
+     * Release lock
+     */
+    releaseLock(resourceId, holderId) {
+        const existing = this.locks.get(resourceId);
+        if (existing && existing.holder === holderId) {
+            this.locks.delete(resourceId);
+        }
+    }
+    /**
+     * Check for deadlocks
+     */
+    detectDeadlocks() {
+        const deadlocked = [];
+        const now = Date.now();
+        for (const [resourceId, lock] of this.locks.entries()) {
+            if (now - lock.timestamp > this.config.deadlockTimeoutMs) {
+                deadlocked.push(resourceId);
+            }
+        }
+        return deadlocked;
+    }
+}
+//# sourceMappingURL=concurrency-control.js.map

package/dist/security/concurrency-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency-control.js","sourceRoot":"","sources":["../../src/security/concurrency-control.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAcH,MAAM,cAAc,GAAgC;IAClD,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,GAAG;IAChB,iBAAiB,EAAE,KAAK;CACzB,CAAC;AAEF,MAAM,OAAO,kBAAkB;IACrB,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACjE,MAAM,CAA8B;IAE5C,YAAY,SAA4B,EAAE;QACxC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAe,EAAE,QAAgB;QAC5C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,SAAS,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,SAA2B,EAC3B,UAAkB;QAElB,IAAI,SAA4B,CAAC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YAClE,IAAI,CAAC;gBACH,OAAO,MAAM,SAAS,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBACzE,SAAS,GAAG,KAAK,CAAC;oBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBAC7D,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBACzD,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,MAAM,CAAC,UAAU,kBAAkB,UAAU,KAAK,SAAS,EAAE,OAAO,EAAE,CAC5F,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,UAAkB,EAAE,QAAgB;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE5C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC;YAEhD,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,mCAAmC;gBACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,cAAc,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,UAAkB,EAAE,QAAgB;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe;QACb,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACtD,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBACzD,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/security/resource-guard.d.ts

@@ -0,0 +1,25 @@
+/**
+ * T-020: Resource Exhaustion Protection
+ * - Rate limiting
+ * - Concurrency limiting
+ * - Disk quota checking
+ */
+export interface ResourceConfig {
+    rateLimit?: {
+        perSecond?: number;
+        perMinute?: number;
+    };
+    maxConcurrency?: number;
+    diskQuotaMB?: number;
+}
+export declare class ResourceGuard {
+    private config;
+    private rates;
+    private concurrency;
+    constructor(config: ResourceConfig);
+    checkRateLimit(userId: string, operation: string): void;
+    acquireConcurrencySlot(userId: string): void;
+    releaseConcurrencySlot(userId: string): void;
+    checkDiskQuota(userId: string, usedMB: number): void;
+}
+//# sourceMappingURL=resource-guard.d.ts.map

package/dist/security/resource-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-guard.d.ts","sourceRoot":"","sources":["../../src/security/resource-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAOD,qBAAa,aAAa;IAIZ,OAAO,CAAC,MAAM;IAH1B,OAAO,CAAC,KAAK,CAAiC;IAC9C,OAAO,CAAC,WAAW,CAA6B;gBAE5B,MAAM,EAAE,cAAc;IAE1C,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IA8BvD,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAU5C,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAK5C,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;CAKrD"}

package/dist/security/resource-guard.js

@@ -0,0 +1,57 @@
+/**
+ * T-020: Resource Exhaustion Protection
+ * - Rate limiting
+ * - Concurrency limiting
+ * - Disk quota checking
+ */
+export class ResourceGuard {
+    config;
+    rates = new Map();
+    concurrency = new Map();
+    constructor(config) {
+        this.config = config;
+    }
+    checkRateLimit(userId, operation) {
+        const key = `${userId}:${operation}`;
+        const now = Date.now();
+        const record = this.rates.get(key) || {
+            second: { count: 0, timestamp: now },
+            minute: { count: 0, timestamp: now },
+        };
+        // Reset counters if time window passed
+        if (now - record.second.timestamp >= 1000) {
+            record.second = { count: 0, timestamp: now };
+        }
+        if (now - record.minute.timestamp >= 60000) {
+            record.minute = { count: 0, timestamp: now };
+        }
+        // Check limits
+        if (this.config.rateLimit?.perSecond && record.second.count >= this.config.rateLimit.perSecond) {
+            throw new Error(`Rate limit exceeded: ${this.config.rateLimit.perSecond}/sec`);
+        }
+        if (this.config.rateLimit?.perMinute && record.minute.count >= this.config.rateLimit.perMinute) {
+            throw new Error(`Rate limit exceeded: ${this.config.rateLimit.perMinute}/min`);
+        }
+        // Increment counters
+        record.second.count++;
+        record.minute.count++;
+        this.rates.set(key, record);
+    }
+    acquireConcurrencySlot(userId) {
+        const current = this.concurrency.get(userId) || 0;
+        if (this.config.maxConcurrency && current >= this.config.maxConcurrency) {
+            throw new Error(`Concurrency limit exceeded: ${this.config.maxConcurrency}`);
+        }
+        this.concurrency.set(userId, current + 1);
+    }
+    releaseConcurrencySlot(userId) {
+        const current = this.concurrency.get(userId) || 0;
+        this.concurrency.set(userId, Math.max(0, current - 1));
+    }
+    checkDiskQuota(userId, usedMB) {
+        if (this.config.diskQuotaMB && usedMB > this.config.diskQuotaMB) {
+            throw new Error(`Disk quota exceeded: ${usedMB}MB/${this.config.diskQuotaMB}MB`);
+        }
+    }
+}
+//# sourceMappingURL=resource-guard.js.map

package/dist/security/resource-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-guard.js","sourceRoot":"","sources":["../../src/security/resource-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,MAAM,OAAO,aAAa;IAIJ;IAHZ,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhD,YAAoB,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;IAAG,CAAC;IAE9C,cAAc,CAAC,MAAc,EAAE,SAAiB;QAC9C,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;YACpC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;YACpC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;SACrC,CAAC;QAEF,uCAAuC;QACvC,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YAC1C,MAAM,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;YAC3C,MAAM,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC/C,CAAC;QAED,eAAe;QACf,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,MAAM,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,MAAM,CAAC,CAAC;QACjF,CAAC;QAED,qBAAqB;QACrB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,sBAAsB,CAAC,MAAc;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAElD,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,sBAAsB,CAAC,MAAc;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,cAAc,CAAC,MAAc,EAAE,MAAc;QAC3C,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF"}

package/dist/security/tenant-isolator.d.ts

@@ -0,0 +1,27 @@
+/**
+ * T-021: Multi-tenant Resource Isolation
+ * - ResourceQuota enforcement
+ * - Tenant isolation
+ * - Resource usage monitoring
+ */
+export interface ResourceQuota {
+    maxMemory: number;
+    maxCPU: number;
+    maxDisk: number;
+}
+export interface ResourceUsage {
+    memory: number;
+    cpu: number;
+    disk: number;
+}
+export declare class TenantIsolator {
+    private quotas;
+    private usage;
+    private guards;
+    private concurrency;
+    enforceQuota(userId: string, quota: ResourceQuota): void;
+    checkResourceUsage(userId: string): ResourceUsage;
+    isolateTenant(userId: string): void;
+    updateUsage(userId: string, usage: Partial<ResourceUsage>): void;
+}
+//# sourceMappingURL=tenant-isolator.d.ts.map

package/dist/security/tenant-isolator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-isolator.d.ts","sourceRoot":"","sources":["../../src/security/tenant-isolator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAoC;IAClD,OAAO,CAAC,KAAK,CAAoC;IACjD,OAAO,CAAC,MAAM,CAAoC;IAClD,OAAO,CAAC,WAAW,CAA4B;IAE/C,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IASxD,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa;IAwBjD,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAMnC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;CAIjE"}

package/dist/security/tenant-isolator.js

@@ -0,0 +1,52 @@
+/**
+ * T-021: Multi-tenant Resource Isolation
+ * - ResourceQuota enforcement
+ * - Tenant isolation
+ * - Resource usage monitoring
+ */
+import { ResourceGuard } from './resource-guard.js';
+import { ConcurrencyControl } from './concurrency-control.js';
+export class TenantIsolator {
+    quotas = new Map();
+    usage = new Map();
+    guards = new Map();
+    concurrency = new ConcurrencyControl();
+    enforceQuota(userId, quota) {
+        this.quotas.set(userId, quota);
+        this.guards.set(userId, new ResourceGuard({
+            maxConcurrency: 10,
+            diskQuotaMB: quota.maxDisk,
+            rateLimit: { perSecond: 100, perMinute: 1000 }
+        }));
+    }
+    checkResourceUsage(userId) {
+        const usage = this.usage.get(userId);
+        if (!usage) {
+            throw new Error(`No usage data for user ${userId}`);
+        }
+        const quota = this.quotas.get(userId);
+        if (!quota) {
+            throw new Error(`No quota set for user ${userId}`);
+        }
+        if (usage.memory > quota.maxMemory) {
+            throw new Error(`Memory quota exceeded: ${usage.memory}MB/${quota.maxMemory}MB`);
+        }
+        if (usage.cpu > quota.maxCPU) {
+            throw new Error(`CPU quota exceeded: ${usage.cpu}%/${quota.maxCPU}%`);
+        }
+        if (usage.disk > quota.maxDisk) {
+            throw new Error(`Disk quota exceeded: ${usage.disk}MB/${quota.maxDisk}MB`);
+        }
+        return usage;
+    }
+    isolateTenant(userId) {
+        if (!this.usage.has(userId)) {
+            this.usage.set(userId, { memory: 0, cpu: 0, disk: 0 });
+        }
+    }
+    updateUsage(userId, usage) {
+        const current = this.usage.get(userId) || { memory: 0, cpu: 0, disk: 0 };
+        this.usage.set(userId, { ...current, ...usage });
+    }
+}
+//# sourceMappingURL=tenant-isolator.js.map

package/dist/security/tenant-isolator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-isolator.js","sourceRoot":"","sources":["../../src/security/tenant-isolator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAc9D,MAAM,OAAO,cAAc;IACjB,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1C,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IACzC,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1C,WAAW,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAE/C,YAAY,CAAC,MAAc,EAAE,KAAoB;QAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,aAAa,CAAC;YACxC,cAAc,EAAE,EAAE;YAClB,WAAW,EAAE,KAAK,CAAC,OAAO;YAC1B,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE;SAC/C,CAAC,CAAC,CAAC;IACN,CAAC;IAED,kBAAkB,CAAC,MAAc;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,aAAa,CAAC,MAAc;QAC1B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,KAA6B;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/state/backup-manager.d.ts

@@ -0,0 +1,56 @@
+/**
+ * 灾难恢复机制 - BackupManager
+ *
+ * 提供定期自动备份和 restore 命令
+ */
+import type { ValidMode } from '../lib/validateMode.js';
+export interface BackupOptions {
+    directory: string;
+    maxBackups?: number;
+    backupInterval?: number;
+}
+export declare class BackupManager {
+    private directory;
+    private maxBackups;
+    private backupInterval;
+    private backupTimer?;
+    constructor(options: BackupOptions);
+    /**
+     * 获取备份目录路径
+     */
+    private getBackupDir;
+    /**
+     * 确保备份目录存在
+     */
+    private ensureBackupDir;
+    /**
+     * 获取状态文件路径
+     */
+    private getStatePath;
+    /**
+     * 创建备份
+     */
+    backup(mode: ValidMode, sessionId?: string): boolean;
+    /**
+     * 恢复备份
+     */
+    restore(mode: ValidMode, timestamp?: string, sessionId?: string): boolean;
+    /**
+     * 清理旧备份
+     */
+    private cleanOldBackups;
+    /**
+     * 列出所有备份
+     */
+    listBackups(mode?: ValidMode, sessionId?: string): string[];
+    /**
+     * 启动自动备份
+     */
+    startAutoBackup(modes: ValidMode[]): void;
+    /**
+     * 停止自动备份
+     */
+    stopAutoBackup(): void;
+}
+export declare function createBackupManager(options: BackupOptions): BackupManager;
+//# sourceMappingURL=backup-manager.d.ts.map

package/dist/state/backup-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-manager.d.ts","sourceRoot":"","sources":["../../src/state/backup-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGxD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAiB;gBAEzB,OAAO,EAAE,aAAa;IAMlC;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAQpB;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO;IAsBpD;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO;IAuCzE;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB;;OAEG;IACH,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE;IAoB3D;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI;IAYzC;;OAEG;IACH,cAAc,IAAI,IAAI;CAMvB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,aAAa,CAEzE"}