anantham-v2 2.0.0-alpha.1 → 2.0.2

package/dist/saas/rbac-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-engine.d.ts","sourceRoot":"","sources":["../../src/saas/rbac-engine.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE1E,MAAM,MAAM,UAAU,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,cAAc,GACd,gBAAgB,GAChB,aAAa,CAAC;AAElB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,iBAAiB,CAAC,EAAE,UAAU,EAAE,CAAC;CAClC;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CA2B9C;IAEK,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO;CAY/D"}

package/dist/saas/rbac-engine.js

@@ -0,0 +1,45 @@
+/**
+ * Role-Based Access Control (RBAC) Engine
+ * PRD-SAAS-002: Role-Based Access Control (RBAC) Engine
+ */
+export class RbacEngine {
+    static DEFAULT_ROLE_PERMISSIONS = {
+        owner: [
+            "project:create",
+            "project:delete",
+            "session:execute",
+            "session:read",
+            "policy:write",
+            "billing:manage",
+            "team:invite",
+        ],
+        admin: [
+            "project:create",
+            "project:delete",
+            "session:execute",
+            "session:read",
+            "policy:write",
+            "team:invite",
+        ],
+        member: [
+            "project:create",
+            "session:execute",
+            "session:read",
+        ],
+        viewer: [
+            "session:read",
+        ],
+        custom: [],
+    };
+    can(user, permission) {
+        const rolePermissions = RbacEngine.DEFAULT_ROLE_PERMISSIONS[user.role] ?? [];
+        if (rolePermissions.includes(permission)) {
+            return true;
+        }
+        if (user.customPermissions?.includes(permission)) {
+            return true;
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=rbac-engine.js.map

package/dist/saas/rbac-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-engine.js","sourceRoot":"","sources":["../../src/saas/rbac-engine.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,MAAM,OAAO,UAAU;IACb,MAAM,CAAU,wBAAwB,GAAmC;QACjF,KAAK,EAAE;YACL,gBAAgB;YAChB,gBAAgB;YAChB,iBAAiB;YACjB,cAAc;YACd,cAAc;YACd,gBAAgB;YAChB,aAAa;SACd;QACD,KAAK,EAAE;YACL,gBAAgB;YAChB,gBAAgB;YAChB,iBAAiB;YACjB,cAAc;YACd,cAAc;YACd,aAAa;SACd;QACD,MAAM,EAAE;YACN,gBAAgB;YAChB,iBAAiB;YACjB,cAAc;SACf;QACD,MAAM,EAAE;YACN,cAAc;SACf;QACD,MAAM,EAAE,EAAE;KACX,CAAC;IAEK,GAAG,CAAC,IAAiB,EAAE,UAAsB;QAClD,MAAM,eAAe,GAAG,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7E,IAAI,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC"}

package/dist/saas/sso-authenticator.d.ts

@@ -0,0 +1,22 @@
+/**
+ * SSO & Identity Federation Authenticator
+ * PRD-SAAS-003: Single Sign-On (SSO) & Identity Federation
+ */
+export interface FederatedIdentity {
+    provider: "oidc" | "saml" | "oauth2";
+    issuer: string;
+    subject: string;
+    email: string;
+    name?: string;
+    groups?: string[];
+}
+export declare class SsoAuthenticator {
+    private allowedIssuers;
+    constructor(allowedIssuers?: string[]);
+    validateFederatedToken(provider: "oidc" | "saml" | "oauth2", tokenOrAssertion: string): {
+        valid: boolean;
+        identity?: FederatedIdentity;
+        error?: string;
+    };
+}
+//# sourceMappingURL=sso-authenticator.d.ts.map

package/dist/saas/sso-authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-authenticator.d.ts","sourceRoot":"","sources":["../../src/saas/sso-authenticator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,cAAc,CAAc;gBAExB,cAAc,GAAE,MAAM,EAAyE;IAIpG,sBAAsB,CAC3B,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,EACpC,gBAAgB,EAAE,MAAM,GACvB;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;CAqDpE"}

package/dist/saas/sso-authenticator.js

@@ -0,0 +1,60 @@
+/**
+ * SSO & Identity Federation Authenticator
+ * PRD-SAAS-003: Single Sign-On (SSO) & Identity Federation
+ */
+export class SsoAuthenticator {
+    allowedIssuers;
+    constructor(allowedIssuers = ["https://accounts.google.com", "https://login.microsoftonline.com"]) {
+        this.allowedIssuers = new Set(allowedIssuers);
+    }
+    validateFederatedToken(provider, tokenOrAssertion) {
+        if (!tokenOrAssertion || tokenOrAssertion.trim().length === 0) {
+            return { valid: false, error: "Empty token or assertion provided" };
+        }
+        // Mock/lightweight JWT decoding for testing and integration
+        try {
+            if (provider === "oidc" || provider === "oauth2") {
+                const parts = tokenOrAssertion.split(".");
+                if (parts.length < 2) {
+                    return { valid: false, error: "Malformed JWT structure" };
+                }
+                const payloadStr = Buffer.from(parts[1], "base64").toString("utf-8");
+                const payload = JSON.parse(payloadStr);
+                if (payload.iss && !this.allowedIssuers.has(payload.iss)) {
+                    return { valid: false, error: `Unauthorized identity provider issuer: '${payload.iss}'` };
+                }
+                return {
+                    valid: true,
+                    identity: {
+                        provider,
+                        issuer: payload.iss ?? "https://accounts.google.com",
+                        subject: payload.sub ?? "user_sub",
+                        email: payload.email ?? "user@example.com",
+                        name: payload.name,
+                        groups: payload.groups,
+                    },
+                };
+            }
+            if (provider === "saml") {
+                // Parse SAML XML assertion snippet
+                if (!tokenOrAssertion.includes("<saml:Assertion") && !tokenOrAssertion.includes("<Assertion")) {
+                    return { valid: false, error: "Invalid SAML assertion structure" };
+                }
+                return {
+                    valid: true,
+                    identity: {
+                        provider: "saml",
+                        issuer: "https://idp.saml.enterprise.com",
+                        subject: "saml_user_1",
+                        email: "saml_user@enterprise.com",
+                    },
+                };
+            }
+            return { valid: false, error: "Unsupported SSO provider" };
+        }
+        catch (err) {
+            return { valid: false, error: err instanceof Error ? err.message : String(err) };
+        }
+    }
+}
+//# sourceMappingURL=sso-authenticator.js.map

package/dist/saas/sso-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-authenticator.js","sourceRoot":"","sources":["../../src/saas/sso-authenticator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,MAAM,OAAO,gBAAgB;IACnB,cAAc,CAAc;IAEpC,YAAY,iBAA2B,CAAC,6BAA6B,EAAE,mCAAmC,CAAC;QACzG,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IAChD,CAAC;IAEM,sBAAsB,CAC3B,QAAoC,EACpC,gBAAwB;QAExB,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACtE,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;gBAC5D,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAEvC,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;gBAC5F,CAAC;gBAED,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE;wBACR,QAAQ;wBACR,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,6BAA6B;wBACpD,OAAO,EAAE,OAAO,CAAC,GAAG,IAAI,UAAU;wBAClC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,kBAAkB;wBAC1C,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;qBACvB;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,mCAAmC;gBACnC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC9F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;gBACrE,CAAC;gBACD,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,QAAQ,EAAE;wBACR,QAAQ,EAAE,MAAM;wBAChB,MAAM,EAAE,iCAAiC;wBACzC,OAAO,EAAE,aAAa;wBACtB,KAAK,EAAE,0BAA0B;qBAClC;iBACF,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;CACF"}

package/dist/saas/team-workspace-manager.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Team Management & Shared Workspaces
+ * PRD-SAAS-004: Team Management & Shared Workspaces
+ */
+import type { UserRole } from "./rbac-engine.js";
+export interface TeamMember {
+    userId: string;
+    role: UserRole;
+    joinedAt: string;
+}
+export interface Team {
+    teamId: string;
+    name: string;
+    ownerId: string;
+    members: TeamMember[];
+    sharedProjectIds: string[];
+}
+export declare class TeamWorkspaceManager {
+    private teams;
+    createTeam(teamId: string, name: string, ownerId: string): Team;
+    addMember(teamId: string, userId: string, role?: UserRole): void;
+    removeMember(teamId: string, userId: string): void;
+    shareProject(teamId: string, projectId: string): void;
+    getTeam(teamId: string): Team | undefined;
+}
+//# sourceMappingURL=team-workspace-manager.d.ts.map

package/dist/saas/team-workspace-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-workspace-manager.d.ts","sourceRoot":"","sources":["../../src/saas/team-workspace-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,KAAK,CAAgC;IAEtC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAY/D,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,QAAmB,GAAG,IAAI;IAS1E,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAMlD,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAQrD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS;CAGjD"}

package/dist/saas/team-workspace-manager.js

@@ -0,0 +1,44 @@
+/**
+ * Team Management & Shared Workspaces
+ * PRD-SAAS-004: Team Management & Shared Workspaces
+ */
+export class TeamWorkspaceManager {
+    teams = new Map();
+    createTeam(teamId, name, ownerId) {
+        const team = {
+            teamId,
+            name,
+            ownerId,
+            members: [{ userId: ownerId, role: "owner", joinedAt: new Date().toISOString() }],
+            sharedProjectIds: [],
+        };
+        this.teams.set(teamId, team);
+        return team;
+    }
+    addMember(teamId, userId, role = "member") {
+        const team = this.teams.get(teamId);
+        if (!team)
+            throw new Error(`Team ${teamId} not found`);
+        if (!team.members.some((m) => m.userId === userId)) {
+            team.members.push({ userId, role, joinedAt: new Date().toISOString() });
+        }
+    }
+    removeMember(teamId, userId) {
+        const team = this.teams.get(teamId);
+        if (!team)
+            throw new Error(`Team ${teamId} not found`);
+        team.members = team.members.filter((m) => m.userId !== userId);
+    }
+    shareProject(teamId, projectId) {
+        const team = this.teams.get(teamId);
+        if (!team)
+            throw new Error(`Team ${teamId} not found`);
+        if (!team.sharedProjectIds.includes(projectId)) {
+            team.sharedProjectIds.push(projectId);
+        }
+    }
+    getTeam(teamId) {
+        return this.teams.get(teamId);
+    }
+}
+//# sourceMappingURL=team-workspace-manager.js.map

package/dist/saas/team-workspace-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-workspace-manager.js","sourceRoot":"","sources":["../../src/saas/team-workspace-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH,MAAM,OAAO,oBAAoB;IACvB,KAAK,GAAsB,IAAI,GAAG,EAAE,CAAC;IAEtC,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;QAC7D,MAAM,IAAI,GAAS;YACjB,MAAM;YACN,IAAI;YACJ,OAAO;YACP,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACjF,gBAAgB,EAAE,EAAE;SACrB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,OAAiB,QAAQ;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC;QAEvD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAEM,YAAY,CAAC,MAAc,EAAE,MAAc;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACjE,CAAC;IAEM,YAAY,CAAC,MAAc,EAAE,SAAiB;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAEM,OAAO,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/saas/tenant-isolation-manager.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Multi-Tenant Data Isolation & Organization Scoping
+ * PRD-SAAS-001: Multi-Tenant Isolation & Architecture
+ */
+export interface TenantContext {
+    tenantId: string;
+    organizationId: string;
+    name: string;
+    isolationMode: "schema" | "row_level" | "dedicated";
+}
+export declare class TenantIsolationManager {
+    private tenants;
+    registerTenant(tenant: TenantContext): void;
+    getTenant(tenantId: string): TenantContext | undefined;
+    validateAccess(requestTenantId: string, resourceTenantId: string): {
+        allowed: boolean;
+        reason?: string;
+    };
+    scopeQuery(baseQuery: string, tenantId: string): string;
+}
+//# sourceMappingURL=tenant-isolation-manager.d.ts.map

package/dist/saas/tenant-isolation-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-isolation-manager.d.ts","sourceRoot":"","sources":["../../src/saas/tenant-isolation-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC;CACrD;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,OAAO,CAAyC;IAEjD,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAI3C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAItD,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAUxG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAO/D"}

package/dist/saas/tenant-isolation-manager.js

@@ -0,0 +1,30 @@
+/**
+ * Multi-Tenant Data Isolation & Organization Scoping
+ * PRD-SAAS-001: Multi-Tenant Isolation & Architecture
+ */
+export class TenantIsolationManager {
+    tenants = new Map();
+    registerTenant(tenant) {
+        this.tenants.set(tenant.tenantId, tenant);
+    }
+    getTenant(tenantId) {
+        return this.tenants.get(tenantId);
+    }
+    validateAccess(requestTenantId, resourceTenantId) {
+        if (requestTenantId !== resourceTenantId) {
+            return {
+                allowed: false,
+                reason: `Cross-tenant access forbidden: Requesting tenant '${requestTenantId}' cannot access resource owned by tenant '${resourceTenantId}'`,
+            };
+        }
+        return { allowed: true };
+    }
+    scopeQuery(baseQuery, tenantId) {
+        const cleanTenantId = tenantId.replace(/'/g, "''");
+        if (baseQuery.toLowerCase().includes("where")) {
+            return `${baseQuery} AND tenant_id = '${cleanTenantId}'`;
+        }
+        return `${baseQuery} WHERE tenant_id = '${cleanTenantId}'`;
+    }
+}
+//# sourceMappingURL=tenant-isolation-manager.js.map

package/dist/saas/tenant-isolation-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-isolation-manager.js","sourceRoot":"","sources":["../../src/saas/tenant-isolation-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,OAAO,sBAAsB;IACzB,OAAO,GAA+B,IAAI,GAAG,EAAE,CAAC;IAEjD,cAAc,CAAC,MAAqB;QACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAEM,SAAS,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAEM,cAAc,CAAC,eAAuB,EAAE,gBAAwB;QACrE,IAAI,eAAe,KAAK,gBAAgB,EAAE,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,qDAAqD,eAAe,6CAA6C,gBAAgB,GAAG;aAC7I,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEM,UAAU,CAAC,SAAiB,EAAE,QAAgB;QACnD,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,OAAO,GAAG,SAAS,qBAAqB,aAAa,GAAG,CAAC;QAC3D,CAAC;QACD,OAAO,GAAG,SAAS,uBAAuB,aAAa,GAAG,CAAC;IAC7D,CAAC;CACF"}

package/dist/search/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./universal-content-search-engine.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/search/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/search/index.ts"],"names":[],"mappings":"AAAA,cAAc,sCAAsC,CAAC"}

package/dist/search/index.js

@@ -0,0 +1,2 @@
+export * from "./universal-content-search-engine.js";
+//# sourceMappingURL=index.js.map

package/dist/search/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/search/index.ts"],"names":[],"mappings":"AAAA,cAAc,sCAAsC,CAAC"}

package/dist/search/universal-content-search-engine.d.ts

@@ -0,0 +1,185 @@
+import { z } from "zod";
+import { SqliteEngine } from "../persistence/sqlite-engine.js";
+import { EventStore } from "../event-state/event-store.js";
+import { MemoryRepository } from "../persistence/repositories/memory-repository.js";
+import { type SensitivityLevel } from "../domain/security.js";
+export declare const ContentModalitySchema: z.ZodEnum<["code", "document", "transcript", "memory", "artifact", "event"]>;
+export type ContentModality = z.infer<typeof ContentModalitySchema>;
+export declare const UnifiedSearchQuerySchema: z.ZodObject<{
+    query: z.ZodString;
+    projectId: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
+    modalities: z.ZodOptional<z.ZodArray<z.ZodEnum<["code", "document", "transcript", "memory", "artifact", "event"]>, "many">>;
+    timeRange: z.ZodOptional<z.ZodObject<{
+        from: z.ZodOptional<z.ZodString>;
+        to: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        from?: string | undefined;
+        to?: string | undefined;
+    }, {
+        from?: string | undefined;
+        to?: string | undefined;
+    }>>;
+    sensitivityCap: z.ZodDefault<z.ZodEnum<["public", "normal", "sensitive", "secret"]>>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    offset: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    offset: number;
+    projectId: string;
+    limit: number;
+    query: string;
+    sensitivityCap: "public" | "normal" | "sensitive" | "secret";
+    sessionId?: string | undefined;
+    modalities?: ("code" | "document" | "artifact" | "transcript" | "memory" | "event")[] | undefined;
+    timeRange?: {
+        from?: string | undefined;
+        to?: string | undefined;
+    } | undefined;
+}, {
+    projectId: string;
+    query: string;
+    offset?: number | undefined;
+    sessionId?: string | undefined;
+    limit?: number | undefined;
+    modalities?: ("code" | "document" | "artifact" | "transcript" | "memory" | "event")[] | undefined;
+    timeRange?: {
+        from?: string | undefined;
+        to?: string | undefined;
+    } | undefined;
+    sensitivityCap?: "public" | "normal" | "sensitive" | "secret" | undefined;
+}>;
+export type UnifiedSearchQuery = z.infer<typeof UnifiedSearchQuerySchema>;
+export declare const SearchResultItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    modality: z.ZodEnum<["code", "document", "transcript", "memory", "artifact", "event"]>;
+    projectId: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
+    title: z.ZodString;
+    snippet: z.ZodString;
+    uri: z.ZodOptional<z.ZodString>;
+    relevanceScore: z.ZodNumber;
+    sensitivity: z.ZodEnum<["public", "normal", "sensitive", "secret"]>;
+    timestamp: z.ZodString;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    sensitivity: "public" | "normal" | "sensitive" | "secret";
+    id: string;
+    projectId: string;
+    timestamp: string;
+    title: string;
+    modality: "code" | "document" | "artifact" | "transcript" | "memory" | "event";
+    snippet: string;
+    relevanceScore: number;
+    metadata?: Record<string, unknown> | undefined;
+    uri?: string | undefined;
+    sessionId?: string | undefined;
+}, {
+    sensitivity: "public" | "normal" | "sensitive" | "secret";
+    id: string;
+    projectId: string;
+    timestamp: string;
+    title: string;
+    modality: "code" | "document" | "artifact" | "transcript" | "memory" | "event";
+    snippet: string;
+    relevanceScore: number;
+    metadata?: Record<string, unknown> | undefined;
+    uri?: string | undefined;
+    sessionId?: string | undefined;
+}>;
+export type SearchResultItem = z.infer<typeof SearchResultItemSchema>;
+export declare const UnifiedSearchResultSchema: z.ZodObject<{
+    query: z.ZodString;
+    totalHits: z.ZodNumber;
+    results: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        modality: z.ZodEnum<["code", "document", "transcript", "memory", "artifact", "event"]>;
+        projectId: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+        title: z.ZodString;
+        snippet: z.ZodString;
+        uri: z.ZodOptional<z.ZodString>;
+        relevanceScore: z.ZodNumber;
+        sensitivity: z.ZodEnum<["public", "normal", "sensitive", "secret"]>;
+        timestamp: z.ZodString;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        sensitivity: "public" | "normal" | "sensitive" | "secret";
+        id: string;
+        projectId: string;
+        timestamp: string;
+        title: string;
+        modality: "code" | "document" | "artifact" | "transcript" | "memory" | "event";
+        snippet: string;
+        relevanceScore: number;
+        metadata?: Record<string, unknown> | undefined;
+        uri?: string | undefined;
+        sessionId?: string | undefined;
+    }, {
+        sensitivity: "public" | "normal" | "sensitive" | "secret";
+        id: string;
+        projectId: string;
+        timestamp: string;
+        title: string;
+        modality: "code" | "document" | "artifact" | "transcript" | "memory" | "event";
+        snippet: string;
+        relevanceScore: number;
+        metadata?: Record<string, unknown> | undefined;
+        uri?: string | undefined;
+        sessionId?: string | undefined;
+    }>, "many">;
+    modalitiesSearched: z.ZodArray<z.ZodEnum<["code", "document", "transcript", "memory", "artifact", "event"]>, "many">;
+    durationMs: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    durationMs: number;
+    results: {
+        sensitivity: "public" | "normal" | "sensitive" | "secret";
+        id: string;
+        projectId: string;
+        timestamp: string;
+        title: string;
+        modality: "code" | "document" | "artifact" | "transcript" | "memory" | "event";
+        snippet: string;
+        relevanceScore: number;
+        metadata?: Record<string, unknown> | undefined;
+        uri?: string | undefined;
+        sessionId?: string | undefined;
+    }[];
+    query: string;
+    totalHits: number;
+    modalitiesSearched: ("code" | "document" | "artifact" | "transcript" | "memory" | "event")[];
+}, {
+    durationMs: number;
+    results: {
+        sensitivity: "public" | "normal" | "sensitive" | "secret";
+        id: string;
+        projectId: string;
+        timestamp: string;
+        title: string;
+        modality: "code" | "document" | "artifact" | "transcript" | "memory" | "event";
+        snippet: string;
+        relevanceScore: number;
+        metadata?: Record<string, unknown> | undefined;
+        uri?: string | undefined;
+        sessionId?: string | undefined;
+    }[];
+    query: string;
+    totalHits: number;
+    modalitiesSearched: ("code" | "document" | "artifact" | "transcript" | "memory" | "event")[];
+}>;
+export type UnifiedSearchResult = z.infer<typeof UnifiedSearchResultSchema>;
+export interface UniversalContentSearchEngineOptions {
+    engine: SqliteEngine;
+    eventStore?: EventStore;
+    memoryRepo?: MemoryRepository;
+}
+export declare class UniversalContentSearchEngine {
+    private readonly engine;
+    constructor(options: UniversalContentSearchEngineOptions);
+    private computeScore;
+    private makeSnippet;
+    searchMemories(projectId: string, term: string, maxSensitivity?: SensitivityLevel): Promise<SearchResultItem[]>;
+    searchEvents(projectId: string, term: string): Promise<SearchResultItem[]>;
+    searchArtifacts(projectId: string, term: string): Promise<SearchResultItem[]>;
+    search(query: UnifiedSearchQuery): Promise<UnifiedSearchResult>;
+}
+//# sourceMappingURL=universal-content-search-engine.d.ts.map

package/dist/search/universal-content-search-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"universal-content-search-engine.d.ts","sourceRoot":"","sources":["../../src/search/universal-content-search-engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AACpF,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEtF,eAAO,MAAM,qBAAqB,8EAOhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAS5E,MAAM,WAAW,mCAAmC;IAClD,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;gBAE1B,OAAO,EAAE,mCAAmC;IAIxD,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,WAAW;IAaN,cAAc,CACzB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,gBAA2B,GAC1C,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAqCjB,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAgCjB,eAAe,CAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyCjB,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAmD7E"}