dartmind 17.0.0

package/dist/whitelabel/isolation.d.ts

@@ -0,0 +1,211 @@
+/**
+ * FlutterAI V16 - Tenant Isolation
+ *
+ * Request-scoped tenant context isolation using AsyncLocalStorage.
+ *
+ * @module whitelabel/isolation
+ * @version 16.0.0
+ */
+import type { TenantId, TenantConfig, TenantContext, IsolationOptions, TenantRateLimits } from './types.js';
+/**
+ * Rate limit result
+ */
+export interface RateLimitResult {
+    allowed: boolean;
+    remaining: {
+        minute: number;
+        hour: number;
+        day: number;
+        concurrent: number;
+    };
+    retryAfter?: number;
+    limit: {
+        minute: number;
+        hour: number;
+        day: number;
+        concurrent: number;
+    };
+}
+/**
+ * Get current tenant context
+ */
+export declare function getTenantContext(): TenantContext | undefined;
+/**
+ * Get current tenant ID
+ */
+export declare function getCurrentTenantId(): TenantId | undefined;
+/**
+ * Get current tenant config
+ */
+export declare function getCurrentTenant(): TenantConfig | undefined;
+/**
+ * Run with tenant context
+ */
+export declare function runWithTenant<T>(context: TenantContext, fn: () => T): T;
+/**
+ * Run async with tenant context
+ */
+export declare function runWithTenantAsync<T>(context: TenantContext, fn: () => Promise<T>): Promise<T>;
+/**
+ * Create tenant context
+ */
+export declare function createTenantContext(config: TenantConfig, options?: {
+    requestId?: string;
+    userId?: string;
+    roles?: string[];
+    metadata?: Record<string, unknown>;
+}): TenantContext;
+/**
+ * Tenant isolation guard
+ */
+export declare class TenantIsolationGuard {
+    private options;
+    constructor(options?: Partial<IsolationOptions>);
+    /**
+     * Ensure tenant context exists
+     */
+    ensureContext(): TenantContext;
+    /**
+     * Ensure tenant is active
+     */
+    ensureActive(): TenantContext;
+    /**
+     * Ensure tenant has feature
+     */
+    ensureFeature(feature: keyof TenantConfig['features']): TenantContext;
+    /**
+     * Ensure user has role
+     */
+    ensureRole(role: string): TenantContext;
+    /**
+     * Get isolated database schema
+     */
+    getDatabaseSchema(): string;
+    /**
+     * Get isolated storage path
+     */
+    getStoragePath(subpath?: string): string;
+    /**
+     * Get isolated cache key
+     */
+    getCacheKey(key: string): string;
+    /**
+     * Get log metadata
+     */
+    getLogMetadata(): Record<string, unknown>;
+    /**
+     * Validate tenant access to resource
+     */
+    validateAccess(resourceTenantId: TenantId): void;
+}
+/**
+ * Tenant-aware rate limiter
+ */
+export declare class TenantRateLimiter {
+    private buckets;
+    private cleanupInterval;
+    constructor();
+    /**
+     * Check rate limit
+     */
+    checkLimit(tenantId: TenantId, limits: TenantRateLimits): RateLimitResult;
+    /**
+     * Record request
+     */
+    recordRequest(tenantId: TenantId): void;
+    /**
+     * Release concurrent slot
+     */
+    releaseRequest(tenantId: TenantId): void;
+    /**
+     * Create initial state
+     */
+    private createState;
+    /**
+     * Reset expired buckets
+     */
+    private resetExpiredBuckets;
+    /**
+     * Cleanup old buckets
+     */
+    private cleanup;
+    /**
+     * Dispose rate limiter
+     */
+    dispose(): void;
+}
+/**
+ * Tenant isolation middleware
+ */
+export interface TenantMiddleware {
+    (context: TenantContext, next: () => Promise<void>): Promise<void>;
+}
+/**
+ * Create rate limit middleware
+ */
+export declare function createRateLimitMiddleware(rateLimiter: TenantRateLimiter): TenantMiddleware;
+/**
+ * Create feature guard middleware
+ */
+export declare function createFeatureGuardMiddleware(feature: keyof TenantConfig['features']): TenantMiddleware;
+/**
+ * Create status guard middleware
+ */
+export declare function createStatusGuardMiddleware(): TenantMiddleware;
+/**
+ * Base tenant isolation error
+ */
+export declare class TenantIsolationError extends Error {
+    readonly tenantId?: TenantId | undefined;
+    constructor(message: string, tenantId?: TenantId | undefined);
+}
+/**
+ * Tenant feature not enabled error
+ */
+export declare class TenantFeatureError extends TenantIsolationError {
+    readonly feature: string;
+    constructor(feature: string, tenantId?: TenantId);
+}
+/**
+ * Tenant permission error
+ */
+export declare class TenantPermissionError extends TenantIsolationError {
+    readonly requiredRole: string;
+    constructor(requiredRole: string, tenantId?: TenantId);
+}
+/**
+ * Tenant access error (cross-tenant access attempt)
+ */
+export declare class TenantAccessError extends TenantIsolationError {
+    readonly resourceTenantId: TenantId;
+    readonly requestTenantId: TenantId;
+    constructor(resourceTenantId: TenantId, requestTenantId: TenantId);
+}
+/**
+ * Tenant rate limit error
+ */
+export declare class TenantRateLimitError extends TenantIsolationError {
+    readonly retryAfter: number;
+    constructor(tenantId: TenantId, retryAfter: number);
+}
+/**
+ * Create isolation guard
+ */
+export declare function createIsolationGuard(options?: Partial<IsolationOptions>): TenantIsolationGuard;
+/**
+ * Create rate limiter
+ */
+export declare function createRateLimiter(): TenantRateLimiter;
+/**
+ * Require tenant context decorator
+ */
+export declare function RequireTenant(): MethodDecorator;
+/**
+ * Require feature decorator
+ */
+export declare function RequireFeature(feature: keyof TenantConfig['features']): MethodDecorator;
+/**
+ * Require role decorator
+ */
+export declare function RequireRole(role: string): MethodDecorator;
+//# sourceMappingURL=isolation.d.ts.map

package/dist/whitelabel/isolation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation.d.ts","sourceRoot":"","sources":["../../src/whitelabel/isolation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAwBpB;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAWD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,GAAG,SAAS,CAE5D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,QAAQ,GAAG,SAAS,CAEzD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,GAAG,SAAS,CAE3D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEvE;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,OAAO,EAAE,aAAa,EACtB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE;IACP,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,GACL,aAAa,CAUf;AAeD;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,OAAO,CAA6B;gBAEhC,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM;IAWnD;;OAEG;IACH,aAAa,IAAI,aAAa;IAQ9B;;OAEG;IACH,YAAY,IAAI,aAAa;IAW7B;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,YAAY,CAAC,UAAU,CAAC,GAAG,aAAa;IAQrE;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IAQvC;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAQ3B;;OAEG;IACH,cAAc,CAAC,OAAO,GAAE,MAAW,GAAG,MAAM;IAQ5C;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAQhC;;OAEG;IACH,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAgBzC;;OAEG;IACH,cAAc,CAAC,gBAAgB,EAAE,QAAQ,GAAG,IAAI;CASjD;AAMD;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,OAAO,CAA4C;IAC3D,OAAO,CAAC,eAAe,CAAiC;;IAOxD;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,GAAG,eAAe;IAiDzE;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAUvC;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAOxC;;OAEG;IACH,OAAO,CAAC,WAAW;IASnB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;IACH,OAAO,CAAC,OAAO;IAef;;OAEG;IACH,OAAO,IAAI,IAAI;CAIhB;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,CACE,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GACxB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,iBAAiB,GAC7B,gBAAgB,CAkBlB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,YAAY,CAAC,UAAU,CAAC,GACtC,gBAAgB,CAOlB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,gBAAgB,CAU9D;AAMD;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAG3B,QAAQ,CAAC,EAAE,QAAQ;gBADnC,OAAO,EAAE,MAAM,EACC,QAAQ,CAAC,EAAE,QAAQ,YAAA;CAKtC;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,oBAAoB;aAExC,OAAO,EAAE,MAAM;gBAAf,OAAO,EAAE,MAAM,EAC/B,QAAQ,CAAC,EAAE,QAAQ;CAKtB;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,oBAAoB;aAE3C,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM,EACpC,QAAQ,CAAC,EAAE,QAAQ;CAKtB;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,oBAAoB;aAEvC,gBAAgB,EAAE,QAAQ;aAC1B,eAAe,EAAE,QAAQ;gBADzB,gBAAgB,EAAE,QAAQ,EAC1B,eAAe,EAAE,QAAQ;CAQ5C;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,oBAAoB;aAG1C,UAAU,EAAE,MAAM;gBADlC,QAAQ,EAAE,QAAQ,EACF,UAAU,EAAE,MAAM;CAKrC;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,oBAAoB,CAE9F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,iBAAiB,CAErD;AAMD;;GAEG;AACH,wBAAgB,aAAa,IAAI,eAAe,CAkB/C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,YAAY,CAAC,UAAU,CAAC,GAAG,eAAe,CAqBvF;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAqBzD"}

package/dist/whitelabel/isolation.js

@@ -0,0 +1,489 @@
+/**
+ * FlutterAI V16 - Tenant Isolation
+ *
+ * Request-scoped tenant context isolation using AsyncLocalStorage.
+ *
+ * @module whitelabel/isolation
+ * @version 16.0.0
+ */
+import { AsyncLocalStorage } from 'async_hooks';
+// ============================================================================
+// TENANT CONTEXT STORAGE
+// ============================================================================
+/**
+ * Async local storage for tenant context
+ */
+const tenantStorage = new AsyncLocalStorage();
+/**
+ * Get current tenant context
+ */
+export function getTenantContext() {
+    return tenantStorage.getStore();
+}
+/**
+ * Get current tenant ID
+ */
+export function getCurrentTenantId() {
+    return tenantStorage.getStore()?.tenantId;
+}
+/**
+ * Get current tenant config
+ */
+export function getCurrentTenant() {
+    return tenantStorage.getStore()?.config;
+}
+/**
+ * Run with tenant context
+ */
+export function runWithTenant(context, fn) {
+    return tenantStorage.run(context, fn);
+}
+/**
+ * Run async with tenant context
+ */
+export async function runWithTenantAsync(context, fn) {
+    return tenantStorage.run(context, fn);
+}
+/**
+ * Create tenant context
+ */
+export function createTenantContext(config, options = {}) {
+    return {
+        tenantId: config.id,
+        config,
+        requestId: options.requestId || generateRequestId(),
+        userId: options.userId,
+        roles: options.roles || [],
+        timestamp: new Date(),
+        metadata: options.metadata || {},
+    };
+}
+/**
+ * Generate request ID
+ */
+function generateRequestId() {
+    const timestamp = Date.now().toString(36);
+    const random = Math.random().toString(36).substring(2, 10);
+    return `req_${timestamp}${random}`;
+}
+// ============================================================================
+// ISOLATION GUARD
+// ============================================================================
+/**
+ * Tenant isolation guard
+ */
+export class TenantIsolationGuard {
+    options;
+    constructor(options = {}) {
+        this.options = {
+            databaseIsolation: options.databaseIsolation ?? true,
+            storageIsolation: options.storageIsolation ?? true,
+            cacheIsolation: options.cacheIsolation ?? true,
+            logIsolation: options.logIsolation ?? true,
+            tenantHeader: options.tenantHeader ?? 'x-tenant-id',
+            strictMode: options.strictMode ?? true,
+        };
+    }
+    /**
+     * Ensure tenant context exists
+     */
+    ensureContext() {
+        const context = getTenantContext();
+        if (!context) {
+            throw new TenantIsolationError('No tenant context available');
+        }
+        return context;
+    }
+    /**
+     * Ensure tenant is active
+     */
+    ensureActive() {
+        const context = this.ensureContext();
+        if (context.config.status !== 'active') {
+            throw new TenantIsolationError(`Tenant is not active: ${context.config.status}`, context.tenantId);
+        }
+        return context;
+    }
+    /**
+     * Ensure tenant has feature
+     */
+    ensureFeature(feature) {
+        const context = this.ensureActive();
+        if (!context.config.features[feature]) {
+            throw new TenantFeatureError(feature, context.tenantId);
+        }
+        return context;
+    }
+    /**
+     * Ensure user has role
+     */
+    ensureRole(role) {
+        const context = this.ensureContext();
+        if (!context.roles.includes(role)) {
+            throw new TenantPermissionError(role, context.tenantId);
+        }
+        return context;
+    }
+    /**
+     * Get isolated database schema
+     */
+    getDatabaseSchema() {
+        if (!this.options.databaseIsolation) {
+            return 'public';
+        }
+        const context = this.ensureContext();
+        return `tenant_${context.tenantId}`;
+    }
+    /**
+     * Get isolated storage path
+     */
+    getStoragePath(subpath = '') {
+        if (!this.options.storageIsolation) {
+            return subpath;
+        }
+        const context = this.ensureContext();
+        return `tenants/${context.tenantId}/${subpath}`.replace(/\/+/g, '/');
+    }
+    /**
+     * Get isolated cache key
+     */
+    getCacheKey(key) {
+        if (!this.options.cacheIsolation) {
+            return key;
+        }
+        const context = this.ensureContext();
+        return `${context.tenantId}:${key}`;
+    }
+    /**
+     * Get log metadata
+     */
+    getLogMetadata() {
+        if (!this.options.logIsolation) {
+            return {};
+        }
+        const context = getTenantContext();
+        if (!context) {
+            return {};
+        }
+        return {
+            tenantId: context.tenantId,
+            tenantName: context.config.name,
+            requestId: context.requestId,
+            userId: context.userId,
+        };
+    }
+    /**
+     * Validate tenant access to resource
+     */
+    validateAccess(resourceTenantId) {
+        if (!this.options.strictMode) {
+            return;
+        }
+        const context = this.ensureContext();
+        if (context.tenantId !== resourceTenantId) {
+            throw new TenantAccessError(resourceTenantId, context.tenantId);
+        }
+    }
+}
+// ============================================================================
+// RATE LIMITER
+// ============================================================================
+/**
+ * Tenant-aware rate limiter
+ */
+export class TenantRateLimiter {
+    buckets = new Map();
+    cleanupInterval;
+    constructor() {
+        // Cleanup expired buckets every minute
+        this.cleanupInterval = setInterval(() => this.cleanup(), 60000);
+    }
+    /**
+     * Check rate limit
+     */
+    checkLimit(tenantId, limits) {
+        const now = Date.now();
+        let state = this.buckets.get(tenantId);
+        if (!state) {
+            state = this.createState(now);
+            this.buckets.set(tenantId, state);
+        }
+        // Reset expired buckets
+        this.resetExpiredBuckets(state, now);
+        // Check limits
+        const minuteAllowed = state.minute.count < limits.requestsPerMinute;
+        const hourAllowed = state.hour.count < limits.requestsPerHour;
+        const dayAllowed = state.day.count < limits.requestsPerDay;
+        const concurrentAllowed = state.concurrent < limits.concurrentRequests;
+        const allowed = minuteAllowed && hourAllowed && dayAllowed && concurrentAllowed;
+        let retryAfter;
+        if (!allowed) {
+            if (!minuteAllowed) {
+                retryAfter = Math.ceil((state.minute.resetAt - now) / 1000);
+            }
+            else if (!hourAllowed) {
+                retryAfter = Math.ceil((state.hour.resetAt - now) / 1000);
+            }
+            else if (!dayAllowed) {
+                retryAfter = Math.ceil((state.day.resetAt - now) / 1000);
+            }
+        }
+        return {
+            allowed,
+            remaining: {
+                minute: Math.max(0, limits.requestsPerMinute - state.minute.count),
+                hour: Math.max(0, limits.requestsPerHour - state.hour.count),
+                day: Math.max(0, limits.requestsPerDay - state.day.count),
+                concurrent: Math.max(0, limits.concurrentRequests - state.concurrent),
+            },
+            retryAfter,
+            limit: {
+                minute: limits.requestsPerMinute,
+                hour: limits.requestsPerHour,
+                day: limits.requestsPerDay,
+                concurrent: limits.concurrentRequests,
+            },
+        };
+    }
+    /**
+     * Record request
+     */
+    recordRequest(tenantId) {
+        const state = this.buckets.get(tenantId);
+        if (state) {
+            state.minute.count++;
+            state.hour.count++;
+            state.day.count++;
+            state.concurrent++;
+        }
+    }
+    /**
+     * Release concurrent slot
+     */
+    releaseRequest(tenantId) {
+        const state = this.buckets.get(tenantId);
+        if (state && state.concurrent > 0) {
+            state.concurrent--;
+        }
+    }
+    /**
+     * Create initial state
+     */
+    createState(now) {
+        return {
+            minute: { count: 0, resetAt: now + 60000 },
+            hour: { count: 0, resetAt: now + 3600000 },
+            day: { count: 0, resetAt: now + 86400000 },
+            concurrent: 0,
+        };
+    }
+    /**
+     * Reset expired buckets
+     */
+    resetExpiredBuckets(state, now) {
+        if (now >= state.minute.resetAt) {
+            state.minute = { count: 0, resetAt: now + 60000 };
+        }
+        if (now >= state.hour.resetAt) {
+            state.hour = { count: 0, resetAt: now + 3600000 };
+        }
+        if (now >= state.day.resetAt) {
+            state.day = { count: 0, resetAt: now + 86400000 };
+        }
+    }
+    /**
+     * Cleanup old buckets
+     */
+    cleanup() {
+        const now = Date.now();
+        for (const [tenantId, state] of this.buckets.entries()) {
+            // Remove if all buckets are expired and no concurrent requests
+            if (now >= state.day.resetAt &&
+                now >= state.hour.resetAt &&
+                now >= state.minute.resetAt &&
+                state.concurrent === 0) {
+                this.buckets.delete(tenantId);
+            }
+        }
+    }
+    /**
+     * Dispose rate limiter
+     */
+    dispose() {
+        clearInterval(this.cleanupInterval);
+        this.buckets.clear();
+    }
+}
+/**
+ * Create rate limit middleware
+ */
+export function createRateLimitMiddleware(rateLimiter) {
+    return async (context, next) => {
+        const result = rateLimiter.checkLimit(context.tenantId, context.config.rateLimits);
+        if (!result.allowed) {
+            throw new TenantRateLimitError(context.tenantId, result.retryAfter || 60);
+        }
+        rateLimiter.recordRequest(context.tenantId);
+        try {
+            await next();
+        }
+        finally {
+            rateLimiter.releaseRequest(context.tenantId);
+        }
+    };
+}
+/**
+ * Create feature guard middleware
+ */
+export function createFeatureGuardMiddleware(feature) {
+    return async (context, next) => {
+        if (!context.config.features[feature]) {
+            throw new TenantFeatureError(feature, context.tenantId);
+        }
+        await next();
+    };
+}
+/**
+ * Create status guard middleware
+ */
+export function createStatusGuardMiddleware() {
+    return async (context, next) => {
+        if (context.config.status !== 'active') {
+            throw new TenantIsolationError(`Tenant is ${context.config.status}`, context.tenantId);
+        }
+        await next();
+    };
+}
+// ============================================================================
+// ERRORS
+// ============================================================================
+/**
+ * Base tenant isolation error
+ */
+export class TenantIsolationError extends Error {
+    tenantId;
+    constructor(message, tenantId) {
+        super(message);
+        this.tenantId = tenantId;
+        this.name = 'TenantIsolationError';
+    }
+}
+/**
+ * Tenant feature not enabled error
+ */
+export class TenantFeatureError extends TenantIsolationError {
+    feature;
+    constructor(feature, tenantId) {
+        super(`Feature not enabled: ${feature}`, tenantId);
+        this.feature = feature;
+        this.name = 'TenantFeatureError';
+    }
+}
+/**
+ * Tenant permission error
+ */
+export class TenantPermissionError extends TenantIsolationError {
+    requiredRole;
+    constructor(requiredRole, tenantId) {
+        super(`Missing required role: ${requiredRole}`, tenantId);
+        this.requiredRole = requiredRole;
+        this.name = 'TenantPermissionError';
+    }
+}
+/**
+ * Tenant access error (cross-tenant access attempt)
+ */
+export class TenantAccessError extends TenantIsolationError {
+    resourceTenantId;
+    requestTenantId;
+    constructor(resourceTenantId, requestTenantId) {
+        super(`Cross-tenant access denied: tenant ${requestTenantId} cannot access resources of tenant ${resourceTenantId}`, requestTenantId);
+        this.resourceTenantId = resourceTenantId;
+        this.requestTenantId = requestTenantId;
+        this.name = 'TenantAccessError';
+    }
+}
+/**
+ * Tenant rate limit error
+ */
+export class TenantRateLimitError extends TenantIsolationError {
+    retryAfter;
+    constructor(tenantId, retryAfter) {
+        super(`Rate limit exceeded. Retry after ${retryAfter} seconds`, tenantId);
+        this.retryAfter = retryAfter;
+        this.name = 'TenantRateLimitError';
+    }
+}
+// ============================================================================
+// FACTORY
+// ============================================================================
+/**
+ * Create isolation guard
+ */
+export function createIsolationGuard(options) {
+    return new TenantIsolationGuard(options);
+}
+/**
+ * Create rate limiter
+ */
+export function createRateLimiter() {
+    return new TenantRateLimiter();
+}
+// ============================================================================
+// DECORATORS (for class methods)
+// ============================================================================
+/**
+ * Require tenant context decorator
+ */
+export function RequireTenant() {
+    return function (_target, _propertyKey, descriptor) {
+        const originalMethod = descriptor.value;
+        descriptor.value = function (...args) {
+            const context = getTenantContext();
+            if (!context) {
+                throw new TenantIsolationError('No tenant context available');
+            }
+            return originalMethod.apply(this, args);
+        };
+        return descriptor;
+    };
+}
+/**
+ * Require feature decorator
+ */
+export function RequireFeature(feature) {
+    return function (_target, _propertyKey, descriptor) {
+        const originalMethod = descriptor.value;
+        descriptor.value = function (...args) {
+            const context = getTenantContext();
+            if (!context) {
+                throw new TenantIsolationError('No tenant context available');
+            }
+            if (!context.config.features[feature]) {
+                throw new TenantFeatureError(feature, context.tenantId);
+            }
+            return originalMethod.apply(this, args);
+        };
+        return descriptor;
+    };
+}
+/**
+ * Require role decorator
+ */
+export function RequireRole(role) {
+    return function (_target, _propertyKey, descriptor) {
+        const originalMethod = descriptor.value;
+        descriptor.value = function (...args) {
+            const context = getTenantContext();
+            if (!context) {
+                throw new TenantIsolationError('No tenant context available');
+            }
+            if (!context.roles.includes(role)) {
+                throw new TenantPermissionError(role, context.tenantId);
+            }
+            return originalMethod.apply(this, args);
+        };
+        return descriptor;
+    };
+}
+//# sourceMappingURL=isolation.js.map