@synoi/gateway-lite 0.1.0

package/dist/shadow-mode.js

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * shadow-mode.ts
+ *
+ * SYNOI_MODE controls whether governance blocks are enforced or only observed.
+ *
+ *   observe  (default) — decisions evaluated, receipts generated, nothing blocked.
+ *                        Dashboard shows "would have blocked X actions this week."
+ *   enforce             — Class C (high-risk) actions hard-block without a human-approved
+ *                         receipt. Class B (medium-risk) soft-blocks with a 429-style
+ *                         "approval required" response. Class A (low) passes through.
+ *
+ * Shadow mode is the default. Enforcement requires explicit opt-in via SYNOI_MODE=enforce.
+ *
+ * Class C DOCTRINE: the machine never auto-approves. It waits. It does not time out to allow.
+ *
+ * State-drift enforce gate (#119):
+ *   The state-drift subsystem has a two-key enforce gate:
+ *     1. Global: SYNOI_MODE=enforce  (isEnforce)
+ *     2. Per-tenant: state_drift.mode setting = { mode: 'enforce' }
+ *   Both keys must be set before a divergent target can trigger a hard block.
+ *   This prevents state-drift from blocking live traffic while the operator
+ *   believes the gateway is in shadow mode. Default is observe on both axes.
+ *   Use stateDriftEnforceActive(tenantId) as the single predicate.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isEnforce = exports.isObserve = exports.MODE = void 0;
+exports.shouldBlock = shouldBlock;
+exports.requiresApprovedReceipt = requiresApprovedReceipt;
+exports.stateDriftMode = stateDriftMode;
+exports.stateDriftEnforceActive = stateDriftEnforceActive;
+const tenant_store_1 = require("./tenant-store");
+exports.MODE = (process.env.SYNOI_MODE ?? 'observe') === 'enforce' ? 'enforce' : 'observe';
+exports.isObserve = exports.MODE === 'observe';
+exports.isEnforce = exports.MODE === 'enforce';
+/**
+ * Returns true when the request should be hard-blocked (403).
+ * In observe mode: never blocks.
+ * In enforce mode: blocks high (Class C) and medium (Class B) risk.
+ * Low (Class A) always passes through even in enforce mode.
+ */
+function shouldBlock(riskLevel) {
+    if (exports.isObserve)
+        return false;
+    return riskLevel === 'high' || riskLevel === 'medium';
+}
+/**
+ * Returns true when the risk level requires a human-approved receipt to proceed.
+ * Only Class C (high) has this requirement — the machine waits for explicit approval.
+ * Class B (medium) is blocked but does not require a pre-approved receipt.
+ */
+function requiresApprovedReceipt(riskLevel) {
+    return exports.isEnforce && riskLevel === 'high';
+}
+/**
+ * Per-tenant state-drift mode. Reads the 'state_drift.mode' tenant setting.
+ * Default is 'observe' when absent or unreadable.
+ *
+ * Write via: settingsPut(tenantId, 'state_drift.mode', { mode: 'enforce' })
+ */
+function stateDriftMode(tenantId) {
+    try {
+        const s = (0, tenant_store_1.settingsGet)(tenantId, 'state_drift.mode');
+        if (s?.mode === 'enforce')
+            return 'enforce';
+    }
+    catch {
+        // Storage error: default observe (fail-safe).
+    }
+    return 'observe';
+}
+/**
+ * Two-key enforce gate for state-drift (#119).
+ *
+ * Returns true ONLY when:
+ *   - The global gateway mode is enforce (SYNOI_MODE=enforce), AND
+ *   - The per-tenant state_drift.mode setting is 'enforce'.
+ *
+ * Either key being 'observe' keeps the state-drift path in observe mode.
+ * This prevents state-drift from hard-blocking while the operator believes
+ * the gateway is globally in shadow.
+ */
+function stateDriftEnforceActive(tenantId) {
+    return exports.isEnforce && stateDriftMode(tenantId) === 'enforce';
+}

package/dist/state-drift/quantize.js

@@ -0,0 +1,107 @@
+"use strict";
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-FileCopyrightText: 2026 SynOI Inc.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isQuantizedValue = isQuantizedValue;
+exports.quantizeFloat = quantizeFloat;
+exports.dequantize = dequantize;
+exports.quantizeObservationValue = quantizeObservationValue;
+exports.quantizeObservationBody = quantizeObservationBody;
+/** True iff `x` is a QuantizedValue shape. */
+function isQuantizedValue(x) {
+    if (typeof x !== 'object' || x === null)
+        return false;
+    const q = x;
+    return typeof q['value_int'] === 'number' && Number.isInteger(q['value_int']) &&
+        typeof q['scale'] === 'number' && Number.isInteger(q['scale']) && q['scale'] >= 1 &&
+        typeof q['unit'] === 'string';
+}
+/**
+ * Well-known field -> (scale, unit). The temp_f entry is the ADR worked example.
+ * Extend as real sensors land; an unknown field uses DEFAULT_SCALE below.
+ */
+const FIELD_QUANTIZATION = {
+    temp_f: { scale: 1000, unit: 'millidegf' },
+    temp_c: { scale: 1000, unit: 'millidegc' },
+    lat: { scale: 1_000_000, unit: 'microdeg' },
+    lon: { scale: 1_000_000, unit: 'microdeg' },
+    ratio: { scale: 10_000, unit: 'basis_points' },
+    // Inference result payloads (broker resultOid preimage). Model outputs are
+    // float32; a fixed 1e6 scale is finer than fp32 mantissa precision at the
+    // [0,1)/[-1,1] magnitudes these fields occupy, so the quantized integer
+    // preimage is a lossless-to-fp32 content address across languages.
+    embedding: { scale: 1_000_000, unit: 'fp32_micro' },
+    logit: { scale: 1_000_000, unit: 'fp32_micro' },
+    tensor: { scale: 1_000_000, unit: 'fp32_micro' },
+    score: { scale: 1_000_000, unit: 'fp32_micro' },
+    confidence: { scale: 1_000_000, unit: 'fp32_micro' },
+};
+/** Fallback scale/unit for a float field with no table entry (milli precision). */
+const DEFAULT_QUANT = { scale: 1000, unit: 'milli' };
+/** Round half away from zero (deterministic, cross-language reproducible). */
+function roundHalfAwayFromZero(x) {
+    return x < 0 ? -Math.round(-x) : Math.round(x);
+}
+/**
+ * Quantize one float to a QuantizedValue at an explicit (scale, unit). Throws on
+ * a non-finite input (NaN/Infinity have no integer representation). An already-
+ * integer input is quantized identically (value_int = v*scale), so the shape is
+ * uniform regardless of whether the source happened to be integral.
+ */
+function quantizeFloat(v, scale, unit) {
+    if (!Number.isFinite(v)) {
+        throw new TypeError(`quantizeFloat: cannot quantize non-finite value ${String(v)}`);
+    }
+    if (!Number.isInteger(scale) || scale < 1) {
+        throw new TypeError(`quantizeFloat: scale must be an integer >= 1, got ${String(scale)}`);
+    }
+    return { value_int: roundHalfAwayFromZero(v * scale), scale, unit };
+}
+/** Recover the (lossy-to-scale) original number from a QuantizedValue. */
+function dequantize(q) {
+    return q.value_int / q.scale;
+}
+/**
+ * Recursively quantize every non-integer number in an observation/sensor body so
+ * it is safe to canonicalize/sign. An integer number is left AS-IS (integers are
+ * legal). A float number is replaced with a QuantizedValue using the FIELD_
+ * QUANTIZATION scale for the KEY it sits under, or DEFAULT_QUANT otherwise. A
+ * value that is already a QuantizedValue (idempotency) is left unchanged. Arrays,
+ * nested objects, strings, booleans, null are walked / preserved. Returns a NEW
+ * value; the input is not mutated.
+ *
+ * `keyHint` is the object key the value sits under (used to pick the scale/unit).
+ * Top-level scalar callers can pass undefined -> DEFAULT_QUANT.
+ */
+function quantizeObservationValue(value, keyHint) {
+    if (typeof value === 'number') {
+        if (Number.isInteger(value))
+            return value; // integers are already legal
+        const q = keyHint !== undefined && FIELD_QUANTIZATION[keyHint]
+            ? FIELD_QUANTIZATION[keyHint]
+            : DEFAULT_QUANT;
+        return quantizeFloat(value, q.scale, q.unit);
+    }
+    if (Array.isArray(value)) {
+        return value.map(el => quantizeObservationValue(el, keyHint));
+    }
+    if (typeof value === 'object' && value !== null) {
+        // Already-quantized subtree: leave it (idempotent).
+        if (isQuantizedValue(value))
+            return value;
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = quantizeObservationValue(v, k);
+        }
+        return out;
+    }
+    return value; // string / boolean / null / undefined
+}
+/**
+ * Quantize a full observation body (the JSON object a sensor reports). Thin
+ * wrapper over quantizeObservationValue that guarantees an object in / object
+ * out, so an ingest path can call it on `state` before building the CDRO.
+ */
+function quantizeObservationBody(body) {
+    return quantizeObservationValue(body);
+}

package/dist/tenant-store.js

@@ -0,0 +1,366 @@
+"use strict";
+/**
+ * tenant-store.ts — synoi-gateway#16 Phase 1
+ *
+ * Multi-tenant foundation: tenant records + per-tenant K/V settings.
+ *
+ * Phase 1 (this file): tables, CRUD, resolver, default `founder` tenant.
+ * Phase 2 (follow-up): wire each Phase 0 feature (kb-local, house-style,
+ * conversation-prune, embedder, arbitrage-decision) to read from settingsGet()
+ * with the existing env vars as fallback. Phase 1 doesn't change runtime
+ * behavior — it only adds the infrastructure for tenant-scoped config.
+ *
+ * Storage co-locates in `~/.synoi/local-cache.db` (same SQLite file as
+ * anthropic-cache). Splits to its own DB / Postgres only when scale demands.
+ *
+ * Distinct from `src/tenant.ts` which manages per-tenant CDRO stores + HNSW
+ * indexes (data isolation, not config storage).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tenantGet = tenantGet;
+exports.tenantList = tenantList;
+exports.tenantPut = tenantPut;
+exports.tenantDelete = tenantDelete;
+exports.settingsGet = settingsGet;
+exports.settingsPut = settingsPut;
+exports.settingsDelete = settingsDelete;
+exports.settingsList = settingsList;
+exports.apiKeyIssue = apiKeyIssue;
+exports.apiKeyList = apiKeyList;
+exports.apiKeyRevoke = apiKeyRevoke;
+exports.resolveTenant = resolveTenant;
+exports.resolveTenantStrict = resolveTenantStrict;
+exports.resolveAuthContext = resolveAuthContext;
+exports.tenantStoreStats = tenantStoreStats;
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const crypto_1 = require("crypto");
+const keys_1 = require("./keys");
+const SYNOI_DIR = process.env.SYNOI_DATA_DIR ?? path.join(os.homedir(), '.synoi');
+const DB_PATH = path.join(SYNOI_DIR, 'local-cache.db');
+const db = new better_sqlite3_1.default(DB_PATH);
+db.pragma('journal_mode = WAL');
+db.exec(`
+  CREATE TABLE IF NOT EXISTS tenants (
+    tenant_id   TEXT PRIMARY KEY,
+    name        TEXT NOT NULL,
+    plan        TEXT NOT NULL DEFAULT 'free',
+    status      TEXT NOT NULL DEFAULT 'active',
+    created_at  INTEGER NOT NULL,
+    updated_at  INTEGER NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_tenants_status ON tenants(status);
+
+  CREATE TABLE IF NOT EXISTS tenant_settings (
+    tenant_id   TEXT NOT NULL,
+    key         TEXT NOT NULL,
+    value_json  TEXT NOT NULL,
+    updated_at  INTEGER NOT NULL,
+    PRIMARY KEY (tenant_id, key)
+  );
+  CREATE INDEX IF NOT EXISTS idx_tenant_settings_key ON tenant_settings(key);
+
+  -- API-key → tenant resolution (Phase 2 of #16)
+  -- Stored as SHA-256 hash of the raw key + a short prefix for human display.
+  -- Raw key returned ONCE at creation time; never recoverable after that.
+  CREATE TABLE IF NOT EXISTS tenant_api_keys (
+    key_hash    TEXT PRIMARY KEY,
+    tenant_id   TEXT NOT NULL,
+    key_prefix  TEXT NOT NULL,
+    label       TEXT NOT NULL DEFAULT '',
+    created_at  INTEGER NOT NULL,
+    last_used_at INTEGER,
+    revoked_at  INTEGER
+  );
+  CREATE INDEX IF NOT EXISTS idx_tenant_api_keys_tenant ON tenant_api_keys(tenant_id);
+  CREATE INDEX IF NOT EXISTS idx_tenant_api_keys_prefix ON tenant_api_keys(key_prefix);
+`);
+// Default founder tenant — exists so the gateway has a place to resolve to
+// in dev / single-user mode where no auth header carries a tenant id.
+db.prepare(`
+  INSERT INTO tenants (tenant_id, name, plan, status, created_at, updated_at)
+  VALUES ('founder', 'Founder (default)', 'founder', 'active', ?, ?)
+  ON CONFLICT(tenant_id) DO NOTHING
+`).run(Date.now(), Date.now());
+// ─── Tenant CRUD ──────────────────────────────────────────────────────────────
+const STMT_GET = db.prepare(`SELECT * FROM tenants WHERE tenant_id = ?`);
+const STMT_LIST = db.prepare(`SELECT * FROM tenants ORDER BY created_at ASC`);
+const STMT_PUT = db.prepare(`
+  INSERT INTO tenants (tenant_id, name, plan, status, created_at, updated_at)
+  VALUES (?, ?, ?, ?, ?, ?)
+  ON CONFLICT(tenant_id) DO UPDATE SET
+    name       = excluded.name,
+    plan       = excluded.plan,
+    status     = excluded.status,
+    updated_at = excluded.updated_at
+`);
+const STMT_DELETE = db.prepare(`DELETE FROM tenants WHERE tenant_id = ?`);
+function tenantGet(tenantId) {
+    const row = STMT_GET.get(tenantId);
+    return row ?? null;
+}
+function tenantList() {
+    return STMT_LIST.all();
+}
+function tenantPut(input) {
+    const existing = tenantGet(input.tenant_id);
+    const now = Date.now();
+    const created_at = existing?.created_at ?? now;
+    const name = input.name ?? existing?.name ?? input.tenant_id;
+    const plan = input.plan ?? existing?.plan ?? 'free';
+    const status = input.status ?? existing?.status ?? 'active';
+    STMT_PUT.run(input.tenant_id, name, plan, status, created_at, now);
+    return tenantGet(input.tenant_id);
+}
+function tenantDelete(tenantId) {
+    if (tenantId === 'founder')
+        return false; // protect default tenant
+    const info = STMT_DELETE.run(tenantId);
+    // Cascading settings cleanup
+    db.prepare(`DELETE FROM tenant_settings WHERE tenant_id = ?`).run(tenantId);
+    return info.changes > 0;
+}
+// ─── Settings CRUD ────────────────────────────────────────────────────────────
+const STMT_SET_GET = db.prepare(`SELECT value_json FROM tenant_settings WHERE tenant_id = ? AND key = ?`);
+const STMT_SET_LIST = db.prepare(`SELECT key, value_json FROM tenant_settings WHERE tenant_id = ? ORDER BY key`);
+const STMT_SET_PUT = db.prepare(`
+  INSERT INTO tenant_settings (tenant_id, key, value_json, updated_at)
+  VALUES (?, ?, ?, ?)
+  ON CONFLICT(tenant_id, key) DO UPDATE SET
+    value_json = excluded.value_json,
+    updated_at = excluded.updated_at
+`);
+const STMT_SET_DELETE = db.prepare(`DELETE FROM tenant_settings WHERE tenant_id = ? AND key = ?`);
+/**
+ * settingsGet — fetch a per-tenant setting. Returns null if absent so callers
+ * can fall back to env vars or built-in defaults. Type parameter is for
+ * caller convenience; the underlying JSON.parse always returns `unknown`.
+ */
+function settingsGet(tenantId, key) {
+    const row = STMT_SET_GET.get(tenantId, key);
+    if (!row)
+        return null;
+    try {
+        return JSON.parse(row.value_json);
+    }
+    catch {
+        return null;
+    }
+}
+function settingsPut(tenantId, key, value) {
+    STMT_SET_PUT.run(tenantId, key, JSON.stringify(value), Date.now());
+}
+function settingsDelete(tenantId, key) {
+    return STMT_SET_DELETE.run(tenantId, key).changes > 0;
+}
+function settingsList(tenantId) {
+    const rows = STMT_SET_LIST.all(tenantId);
+    const out = {};
+    for (const r of rows) {
+        try {
+            out[r.key] = JSON.parse(r.value_json);
+        }
+        catch {
+            out[r.key] = r.value_json;
+        }
+    }
+    return out;
+}
+// ─── API keys ────────────────────────────────────────────────────────────────
+const API_KEY_PREFIX = 'synoi-sk-';
+function hashApiKey(raw) {
+    return (0, crypto_1.createHash)('sha256').update(raw, 'utf8').digest('hex');
+}
+/**
+ * Issue a fresh API key for a tenant. Returns the raw key ONCE — caller is
+ * responsible for showing it to the operator. Only the hash is persisted.
+ */
+function apiKeyIssue(tenantId, label = '') {
+    if (!tenantGet(tenantId))
+        throw new Error(`tenant not found: ${tenantId}`);
+    const rand = (0, crypto_1.randomBytes)(24).toString('hex'); // 48 hex chars
+    const raw = `${API_KEY_PREFIX}${rand}`;
+    const hash = hashApiKey(raw);
+    const prefix = raw.slice(0, 12);
+    const now = Date.now();
+    db.prepare(`
+    INSERT INTO tenant_api_keys (key_hash, tenant_id, key_prefix, label, created_at)
+    VALUES (?, ?, ?, ?, ?)
+  `).run(hash, tenantId, prefix, label, now);
+    return {
+        raw_key: raw,
+        record: { key_hash: hash, tenant_id: tenantId, key_prefix: prefix, label, created_at: now, last_used_at: null, revoked_at: null },
+    };
+}
+function apiKeyList(tenantId) {
+    return db.prepare(`SELECT * FROM tenant_api_keys WHERE tenant_id = ? ORDER BY created_at DESC`).all(tenantId);
+}
+function apiKeyRevoke(keyHash) {
+    const r = db.prepare(`UPDATE tenant_api_keys SET revoked_at = ? WHERE key_hash = ? AND revoked_at IS NULL`).run(Date.now(), keyHash);
+    return r.changes > 0;
+}
+const STMT_API_LOOKUP = db.prepare(`
+  SELECT tenant_id, revoked_at FROM tenant_api_keys WHERE key_hash = ? LIMIT 1
+`);
+const STMT_API_TOUCH = db.prepare(`
+  UPDATE tenant_api_keys SET last_used_at = ? WHERE key_hash = ?
+`);
+/** Resolve a raw API key to a tenant_id, or null if unknown / revoked. */
+function lookupApiKey(rawKey) {
+    const hash = hashApiKey(rawKey);
+    const row = STMT_API_LOOKUP.get(hash);
+    if (!row || row.revoked_at !== null)
+        return null;
+    STMT_API_TOUCH.run(Date.now(), hash);
+    return row.tenant_id;
+}
+// ─── Resolver ─────────────────────────────────────────────────────────────────
+/**
+ * resolveTenant — derive a tenant_id from an inbound request.
+ *
+ * Phase 1 strategy (simple, defensive):
+ *   1. Explicit `X-SynOI-Tenant: <id>` header (admin / test override)
+ *   2. `x-api-key` Anthropic header — if it maps to a tenant in our table
+ *      via a stored API-key alias (NOT YET — table for this is Phase 2)
+ *   3. `Authorization: Bearer synoi-sk-<key>` — synoi key store
+ *      (also Phase 2 wire-in)
+ *   4. Default: 'founder'
+ *
+ * For Phase 1 only #1 and #4 are functional. Other paths return 'founder'
+ * with a debug log so we can see what fallbacks fired without changing
+ * behavior.
+ */
+function resolveTenant(req) {
+    // 1. Explicit X-SynOI-Tenant header (admin override; falls through if invalid)
+    const explicit = req.header('x-synoi-tenant');
+    if (explicit) {
+        const t = tenantGet(explicit);
+        if (t && t.status === 'active')
+            return t.tenant_id;
+    }
+    // 2. `Authorization: Bearer synoi-sk-...` — gateway-issued tenant API key
+    const auth = req.header('authorization');
+    if (auth?.startsWith('Bearer ')) {
+        const token = auth.slice(7).trim();
+        if (token.startsWith(API_KEY_PREFIX)) {
+            const tid = lookupApiKey(token);
+            if (tid) {
+                const t = tenantGet(tid);
+                if (t && t.status === 'active')
+                    return t.tenant_id;
+            }
+        }
+    }
+    // 3. `x-api-key: synoi-sk-...` — same tenant key, alternate header
+    // (Anthropic clients pass their key here; if it happens to be a synoi-sk-*
+    // key we resolve from it. Otherwise it's an upstream-Anthropic key and we
+    // fall through to founder.)
+    const apiKey = req.header('x-api-key');
+    if (apiKey?.startsWith(API_KEY_PREFIX)) {
+        const tid = lookupApiKey(apiKey);
+        if (tid) {
+            const t = tenantGet(tid);
+            if (t && t.status === 'active')
+                return t.tenant_id;
+        }
+    }
+    // 4. Default for dev / unauthenticated requests
+    return 'founder';
+}
+/**
+ * CR-2: strict tenant resolution for routes that must REJECT anonymous callers
+ * (e.g. /v1/risk, /mcp — which mint signed receipts and proxy outbound). Unlike
+ * resolveTenant, this requires a real `synoi-sk-*` key (Authorization Bearer or
+ * x-api-key) and returns null otherwise — it does NOT honor a bare X-SynOI-Tenant
+ * header (which is spoofable) and never defaults to 'founder'.
+ */
+function resolveTenantStrict(req) {
+    const fromKey = (token) => {
+        if (!token || !token.startsWith(API_KEY_PREFIX))
+            return null;
+        const tid = lookupApiKey(token); // a valid synoi-sk key IS the credential
+        if (!tid)
+            return null;
+        const t = tenantGet(tid);
+        if (t && t.status !== 'active')
+            return null; // only reject an explicitly-suspended tenant
+        return tid; // (a /keys-minted key may have no separate tenant record)
+    };
+    const auth = req.header('authorization');
+    const bearer = auth?.startsWith('Bearer ') ? auth.slice(7).trim() : undefined;
+    return fromKey(bearer) ?? fromKey(req.header('x-api-key'));
+}
+/**
+ * PR 4 — like resolveTenant, but also returns the license's profile binding
+ * when the inbound bearer is a `synoi-sk-...` key recognised by keyStore.
+ * Used by anthropic-inbound (which doesn't go through authMiddleware) so
+ * per-license profile enforcement applies equally to the Anthropic-native
+ * inbound path.
+ */
+function resolveAuthContext(req) {
+    // Reuse resolveTenant's lookup paths for tenant_id, then add a parallel
+    // KeyStore lookup to pull profile_id if the bearer is a synoi-sk-* token.
+    const tenant_id = resolveTenant(req);
+    let profile_id = null;
+    const tokens = [];
+    const auth = req.header('authorization');
+    if (auth?.startsWith('Bearer '))
+        tokens.push(auth.slice(7).trim());
+    const apiKey = req.header('x-api-key');
+    if (apiKey)
+        tokens.push(apiKey);
+    for (const t of tokens) {
+        if (!t.startsWith('synoi-sk-'))
+            continue;
+        const v = keys_1.keyStore.validate(t);
+        if (v?.profile_id) {
+            profile_id = v.profile_id;
+            break;
+        }
+    }
+    return { tenant_id, profile_id };
+}
+// ─── Stats ────────────────────────────────────────────────────────────────────
+function tenantStoreStats() {
+    const tenants = db.prepare(`SELECT COUNT(*) AS n FROM tenants`).get().n;
+    const active_tenants = db.prepare(`SELECT COUNT(*) AS n FROM tenants WHERE status = 'active'`).get().n;
+    const total_settings = db.prepare(`SELECT COUNT(*) AS n FROM tenant_settings`).get().n;
+    return { tenants, active_tenants, total_settings, default_tenant: tenantGet('founder') };
+}