nlm-memory 0.20.1 → 0.21.12

package/dist/core/storage/supersedence-log.d.ts

@@ -4,10 +4,13 @@
  * supersedence at ingest time is not logged here — that lineage is already
  * implicit in the session_edges row's predecessor reference.
  *
- * Path defaults to ~/.nlm/supersedence-log.jsonl, overridable via
- * NLM_SUPERSEDENCE_LOG. Telemetry path — never raises, but on failure it
- * emits one warning line to stderr so a silent disk-full or permission
- * issue doesn't leave the operator believing their audit trail is intact.
+ * Path is tenant-derived (core/tenancy/tenant-state-path.ts): the default
+ * team's log is ~/.nlm/supersedence-log.jsonl, overridable via
+ * NLM_SUPERSEDENCE_LOG; every other tenant is isolated under
+ * ~/.nlm/tenants/<tenantId>/supersedence-log.jsonl and ignores the env
+ * override. Telemetry path — never raises, but on failure it emits one
+ * warning line to stderr so a silent disk-full or permission issue doesn't
+ * leave the operator believing their audit trail is intact.
  */
 export interface SupersedenceEntry {
     readonly predecessorId: string;
@@ -16,7 +19,7 @@ export interface SupersedenceEntry {
     readonly source?: string;
 }
 /** Read all supersedence log entries. Never raises — returns [] on missing file. */
-export declare function readSupersedenceLog(): Promise<ReadonlyArray<SupersedenceEntry & {
+export declare function readSupersedenceLog(tenantId: string, logPath?: string): Promise<ReadonlyArray<SupersedenceEntry & {
     ts: string;
     source?: string;
 }>>;
@@ -27,5 +30,5 @@ export interface FactSupersedenceEntry {
 }
 /** Append a fact-level supersedence event to the shared audit JSONL.
  *  Entries carry `kind: "fact"` so the session-scoped reader skips them. */
-export declare function appendFactSupersedence(entry: FactSupersedenceEntry, logPath?: string): Promise<void>;
-export declare function appendSupersedence(entry: SupersedenceEntry, logPath?: string): Promise<void>;
+export declare function appendFactSupersedence(tenantId: string, entry: FactSupersedenceEntry, logPath?: string): Promise<void>;
+export declare function appendSupersedence(tenantId: string, entry: SupersedenceEntry, logPath?: string): Promise<void>;

package/dist/core/storage/supersedence-log.js

@@ -4,26 +4,32 @@
  * supersedence at ingest time is not logged here — that lineage is already
  * implicit in the session_edges row's predecessor reference.
  *
- * Path defaults to ~/.nlm/supersedence-log.jsonl, overridable via
- * NLM_SUPERSEDENCE_LOG. Telemetry path — never raises, but on failure it
- * emits one warning line to stderr so a silent disk-full or permission
- * issue doesn't leave the operator believing their audit trail is intact.
+ * Path is tenant-derived (core/tenancy/tenant-state-path.ts): the default
+ * team's log is ~/.nlm/supersedence-log.jsonl, overridable via
+ * NLM_SUPERSEDENCE_LOG; every other tenant is isolated under
+ * ~/.nlm/tenants/<tenantId>/supersedence-log.jsonl and ignores the env
+ * override. Telemetry path — never raises, but on failure it emits one
+ * warning line to stderr so a silent disk-full or permission issue doesn't
+ * leave the operator believing their audit trail is intact.
  */
 import { appendFile, mkdir, readFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { homedir } from "node:os";
-function defaultLogPath() {
-    return (process.env["NLM_SUPERSEDENCE_LOG"] ??
-        join(homedir(), ".nlm", "supersedence-log.jsonl"));
+import { dirname } from "node:path";
+import { tenantStatePath } from "../tenancy/tenant-state-path.js";
+import { DEFAULT_TEAM_ID } from "../tenancy/default-team.js";
+function defaultLogPath(tenantId) {
+    if (tenantId === DEFAULT_TEAM_ID) {
+        return process.env["NLM_SUPERSEDENCE_LOG"] ?? tenantStatePath(tenantId, "supersedence-log.jsonl");
+    }
+    return tenantStatePath(tenantId, "supersedence-log.jsonl");
 }
 /** Read all supersedence log entries. Never raises — returns [] on missing file. */
-export async function readSupersedenceLog() {
-    const path = defaultLogPath();
+export async function readSupersedenceLog(tenantId, logPath = defaultLogPath(tenantId)) {
     let raw;
     try {
-        raw = await readFile(path, "utf8");
+        raw = await readFile(logPath, "utf8");
     }
     catch {
+        // Log file missing or unreadable - no supersedence history recovered.
         return [];
     }
     const results = [];
@@ -44,6 +50,7 @@ export async function readSupersedenceLog() {
             });
         }
         catch {
+            // Malformed entry in log - skip and continue parsing.
             continue;
         }
     }
@@ -51,7 +58,7 @@ export async function readSupersedenceLog() {
 }
 /** Append a fact-level supersedence event to the shared audit JSONL.
  *  Entries carry `kind: "fact"` so the session-scoped reader skips them. */
-export async function appendFactSupersedence(entry, logPath = defaultLogPath()) {
+export async function appendFactSupersedence(tenantId, entry, logPath = defaultLogPath(tenantId)) {
     try {
         await mkdir(dirname(logPath), { recursive: true });
         const payload = {
@@ -68,7 +75,7 @@ export async function appendFactSupersedence(entry, logPath = defaultLogPath())
         process.stderr.write(`nlm-memory: failed to append fact-supersedence-log entry at ${logPath}: ${msg}\n`);
     }
 }
-export async function appendSupersedence(entry, logPath = defaultLogPath()) {
+export async function appendSupersedence(tenantId, entry, logPath = defaultLogPath(tenantId)) {
     try {
         await mkdir(dirname(logPath), { recursive: true });
         const payload = {

package/dist/core/storage/supersedence-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"supersedence-log.js","sourceRoot":"","sources":["../../../src/core/storage/supersedence-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AASlC,SAAS,cAAc;IACrB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAGvC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAA+D,EAAE,CAAC;IAC/E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YACxD,IACE,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ;gBACzC,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ;gBAEvC,SAAS;YACX,OAAO,CAAC,IAAI,CAAC;gBACX,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC;gBACpC,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC;gBAChC,EAAE,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAClD,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD;4EAC4E;AAC5E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA4B,EAC5B,UAAkB,cAAc,EAAE;IAElC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+DAA+D,OAAO,KAAK,GAAG,IAAI,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAwB,EACxB,UAAkB,cAAc,EAAE;IAElC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,cAAc,EAAE,KAAK,CAAC,aAAa;YACnC,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,OAAO,KAAK,GAAG,IAAI,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"supersedence-log.js","sourceRoot":"","sources":["../../../src/core/storage/supersedence-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAShE,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,eAAe,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;AAC7D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,UAAkB,cAAc,CAAC,QAAQ,CAAC;IAI1C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAA+D,EAAE,CAAC;IAC/E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YACxD,IACE,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ;gBACzC,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ;gBAEvC,SAAS;YACX,OAAO,CAAC,IAAI,CAAC;gBACX,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC;gBACpC,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC;gBAChC,EAAE,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAClD,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;YACtD,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD;4EAC4E;AAC5E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,KAA4B,EAC5B,UAAkB,cAAc,CAAC,QAAQ,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+DAA+D,OAAO,KAAK,GAAG,IAAI,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,KAAwB,EACxB,UAAkB,cAAc,CAAC,QAAQ,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,cAAc,EAAE,KAAK,CAAC,aAAa;YACnC,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;QACF,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,OAAO,KAAK,GAAG,IAAI,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/telemetry/probe-filter.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Probe and test traffic filter.
+ *
+ * Single source of truth for classifying recall queries as probe/test traffic.
+ * Used by the digest composer (to strip probes from displayed counters) and by
+ * the pull-usefulness eval script (to strip probes from the scored baseline).
+ *
+ * Two match strategies with different trade-offs:
+ *
+ * Substring match (PROBE_SUBSTRINGS / isProbe):
+ *   Catches probe traffic regardless of surrounding words. Accepted trade-off:
+ *   any query containing the word "probe" -- including "how did we probe the API"
+ *   -- will be stripped. In practice, probe traffic is always labelled with the
+ *   bare word; real agent queries rarely include "probe" as a term. The
+ *   alternative (exact-match "probe") would miss operational variants like
+ *   "system probe" and "probing X", so substring is the right default for the
+ *   digest composer path.
+ *
+ * Exact match (PROBE_EXACT_QUERIES):
+ *   Required for pull-usefulness.ts. That script was baseline-calibrated at
+ *   72.4% genuine-pull using this exact set. Switching it to substring matching
+ *   would silently change the denominator and invalidate historical comparisons.
+ *   "x" and "" cannot be substring-matched -- a single character would strip
+ *   virtually every query. They live here as exact entries only.
+ */
+/** Substrings that mark a recall query as probe/test traffic. */
+export declare const PROBE_SUBSTRINGS: ReadonlyArray<string>;
+/**
+ * Queries that are probe traffic only when the full query (trimmed, lowercased)
+ * is an exact match. "x" and "" are single-character or empty -- substring
+ * matching them would strip real queries.
+ */
+export declare const PROBE_EXACT_QUERIES: ReadonlySet<string>;
+/** True when the query is recognisably probe/test traffic by either strategy. */
+export declare function isProbe(query: string | null | undefined): boolean;

package/dist/core/telemetry/probe-filter.js

@@ -0,0 +1,56 @@
+/**
+ * Probe and test traffic filter.
+ *
+ * Single source of truth for classifying recall queries as probe/test traffic.
+ * Used by the digest composer (to strip probes from displayed counters) and by
+ * the pull-usefulness eval script (to strip probes from the scored baseline).
+ *
+ * Two match strategies with different trade-offs:
+ *
+ * Substring match (PROBE_SUBSTRINGS / isProbe):
+ *   Catches probe traffic regardless of surrounding words. Accepted trade-off:
+ *   any query containing the word "probe" -- including "how did we probe the API"
+ *   -- will be stripped. In practice, probe traffic is always labelled with the
+ *   bare word; real agent queries rarely include "probe" as a term. The
+ *   alternative (exact-match "probe") would miss operational variants like
+ *   "system probe" and "probing X", so substring is the right default for the
+ *   digest composer path.
+ *
+ * Exact match (PROBE_EXACT_QUERIES):
+ *   Required for pull-usefulness.ts. That script was baseline-calibrated at
+ *   72.4% genuine-pull using this exact set. Switching it to substring matching
+ *   would silently change the denominator and invalidate historical comparisons.
+ *   "x" and "" cannot be substring-matched -- a single character would strip
+ *   virtually every query. They live here as exact entries only.
+ */
+/** Substrings that mark a recall query as probe/test traffic. */
+export const PROBE_SUBSTRINGS = [
+    // "concurrency probe" and "test probe" are redundant: "probe" covers both.
+    "probe",
+    "beacon",
+    "smoke",
+    "path test",
+    "recall test",
+    "cutover-test",
+];
+/**
+ * Queries that are probe traffic only when the full query (trimmed, lowercased)
+ * is an exact match. "x" and "" are single-character or empty -- substring
+ * matching them would strip real queries.
+ */
+export const PROBE_EXACT_QUERIES = new Set([
+    "pgvector",
+    "hono",
+    "x",
+    "",
+]);
+/** True when the query is recognisably probe/test traffic by either strategy. */
+export function isProbe(query) {
+    if (query === null || query === undefined)
+        return false;
+    const q = query.trim().toLowerCase();
+    if (PROBE_EXACT_QUERIES.has(q))
+        return true;
+    return PROBE_SUBSTRINGS.some((p) => q.includes(p));
+}
+//# sourceMappingURL=probe-filter.js.map

package/dist/core/telemetry/probe-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-filter.js","sourceRoot":"","sources":["../../../src/core/telemetry/probe-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAA0B;IACrD,2EAA2E;IAC3E,OAAO;IACP,QAAQ;IACR,OAAO;IACP,WAAW;IACX,aAAa;IACb,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,UAAU;IACV,MAAM;IACN,GAAG;IACH,EAAE;CACH,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,UAAU,OAAO,CAAC,KAAgC;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/core/tenancy/default-team.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The fixed id of the single-tenant local deployment's team, seeded by
+ * migrations 034 (both lanes). A literal — never generated — so it can appear
+ * in sqlite column DEFAULTs (tenancy design doc, kept privately in .superpowers/).
+ */
+export declare const DEFAULT_TEAM_ID = "team_local";

package/dist/core/tenancy/default-team.js

@@ -0,0 +1,7 @@
+/**
+ * The fixed id of the single-tenant local deployment's team, seeded by
+ * migrations 034 (both lanes). A literal — never generated — so it can appear
+ * in sqlite column DEFAULTs (tenancy design doc, kept privately in .superpowers/).
+ */
+export const DEFAULT_TEAM_ID = "team_local";
+//# sourceMappingURL=default-team.js.map

package/dist/core/tenancy/default-team.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-team.js","sourceRoot":"","sources":["../../../src/core/tenancy/default-team.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC"}

package/dist/core/tenancy/hosted-mode.d.ts

@@ -0,0 +1,9 @@
+/**
+ * NLM_HOSTED=1 switches the daemon to hosted posture. Under hosted mode,
+ * LOCAL-dispositioned routes (whole-DB dataset/backup/restore/stats,
+ * process-global classifier swap) and M6-FILTER routes (citation events,
+ * recall/facts stats+recent, hook-memo trio — file-state surfaces not yet
+ * tenant-attributed) return 403 before touching any handler (program spec
+ * §4.6). Local mode (the default, no env set) is unaffected.
+ */
+export declare function isHostedMode(): boolean;

package/dist/core/tenancy/hosted-mode.js

@@ -0,0 +1,12 @@
+/**
+ * NLM_HOSTED=1 switches the daemon to hosted posture. Under hosted mode,
+ * LOCAL-dispositioned routes (whole-DB dataset/backup/restore/stats,
+ * process-global classifier swap) and M6-FILTER routes (citation events,
+ * recall/facts stats+recent, hook-memo trio — file-state surfaces not yet
+ * tenant-attributed) return 403 before touching any handler (program spec
+ * §4.6). Local mode (the default, no env set) is unaffected.
+ */
+export function isHostedMode() {
+    return process.env["NLM_HOSTED"] === "1";
+}
+//# sourceMappingURL=hosted-mode.js.map

package/dist/core/tenancy/hosted-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-mode.js","sourceRoot":"","sources":["../../../src/core/tenancy/hosted-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC;AAC3C,CAAC"}

package/dist/core/tenancy/team-auth.d.ts

@@ -0,0 +1,16 @@
+/**
+ * resolveTeamByToken — the one auth-only tenant-resolution function every
+ * gated network transport routes through (program spec §3: "The tenant is
+ * resolved from the authenticated credential and from nothing else").
+ *
+ * Mechanism: sha256-hex the presented bearer token, look up
+ * `team_tokens WHERE token_hash = $hash AND revoked_at IS NULL`, return the
+ * team_id. No ambient derivation, no request parameter, no fallback chain —
+ * a token that doesn't resolve returns null and the caller denies.
+ */
+import type { TeamTokenStorePort } from "./team-token-store.js";
+export interface ResolvedTeam {
+    readonly teamId: string;
+}
+export declare function hashTeamToken(token: string): string;
+export declare function resolveTeamByToken(store: TeamTokenStorePort, presentedToken: string | undefined | null): Promise<ResolvedTeam | null>;

package/dist/core/tenancy/team-auth.js

@@ -0,0 +1,22 @@
+/**
+ * resolveTeamByToken — the one auth-only tenant-resolution function every
+ * gated network transport routes through (program spec §3: "The tenant is
+ * resolved from the authenticated credential and from nothing else").
+ *
+ * Mechanism: sha256-hex the presented bearer token, look up
+ * `team_tokens WHERE token_hash = $hash AND revoked_at IS NULL`, return the
+ * team_id. No ambient derivation, no request parameter, no fallback chain —
+ * a token that doesn't resolve returns null and the caller denies.
+ */
+import { createHash } from "node:crypto";
+export function hashTeamToken(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+export async function resolveTeamByToken(store, presentedToken) {
+    if (!presentedToken)
+        return null;
+    const hash = hashTeamToken(presentedToken);
+    const row = await store.findActiveByHash(hash);
+    return row ? { teamId: row.teamId } : null;
+}
+//# sourceMappingURL=team-auth.js.map

package/dist/core/tenancy/team-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-auth.js","sourceRoot":"","sources":["../../../src/core/tenancy/team-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAyB,EACzB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC"}

package/dist/core/tenancy/team-token-store.d.ts

@@ -0,0 +1,45 @@
+/**
+ * TeamTokenStore / PgTeamTokenStore — CRUD over the `team_tokens` table
+ * (program spec §2 M1, §3 M3). This IS the tenancy registry, not corpus
+ * data: methods take no `tenantId` param by design, same pinned exception as
+ * SourceRegistry.findByToken (src/core/sources/source-registry.ts) — the
+ * whole point of this store is to RESOLVE a tenant from a presented token,
+ * not to be scoped by one. team_tokens is TENANT-NEUTRAL and exempt from the
+ * tenantClause guard (tests/integration/tenant-guard.test.ts) for the same
+ * reason findByToken is exempt.
+ */
+import type Database from "better-sqlite3";
+import type { Pool } from "pg";
+export interface ResolvedTeamToken {
+    readonly teamId: string;
+}
+export interface TeamTokenStorePort {
+    /** AUTH lookup: resolves an active (non-revoked) token hash to its team. */
+    findActiveByHash(hash: string): Promise<ResolvedTeamToken | null>;
+    insert(hash: string, teamId: string): Promise<void>;
+    revoke(hash: string): Promise<void>;
+    /**
+     * Idempotent insert-if-absent. Used for local-mode boot continuity (M3
+     * §3): an existing NLM_MCP_TOKEN's hash is seeded once for the default
+     * team so it keeps authenticating through the same resolveTeamByToken
+     * path as any future per-team token. A no-op if the hash already has a
+     * row (active OR revoked) — never resurrects a deliberately revoked token.
+     */
+    ensureActive(hash: string, teamId: string): Promise<void>;
+}
+export declare class TeamTokenStore implements TeamTokenStorePort {
+    private readonly db;
+    constructor(db: Database.Database);
+    findActiveByHash(hash: string): Promise<ResolvedTeamToken | null>;
+    insert(hash: string, teamId: string): Promise<void>;
+    revoke(hash: string): Promise<void>;
+    ensureActive(hash: string, teamId: string): Promise<void>;
+}
+export declare class PgTeamTokenStore implements TeamTokenStorePort {
+    private readonly pool;
+    constructor(pool: Pool);
+    findActiveByHash(hash: string): Promise<ResolvedTeamToken | null>;
+    insert(hash: string, teamId: string): Promise<void>;
+    revoke(hash: string): Promise<void>;
+    ensureActive(hash: string, teamId: string): Promise<void>;
+}

package/dist/core/tenancy/team-token-store.js

@@ -0,0 +1,52 @@
+/**
+ * TeamTokenStore / PgTeamTokenStore — CRUD over the `team_tokens` table
+ * (program spec §2 M1, §3 M3). This IS the tenancy registry, not corpus
+ * data: methods take no `tenantId` param by design, same pinned exception as
+ * SourceRegistry.findByToken (src/core/sources/source-registry.ts) — the
+ * whole point of this store is to RESOLVE a tenant from a presented token,
+ * not to be scoped by one. team_tokens is TENANT-NEUTRAL and exempt from the
+ * tenantClause guard (tests/integration/tenant-guard.test.ts) for the same
+ * reason findByToken is exempt.
+ */
+export class TeamTokenStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async findActiveByHash(hash) {
+        const row = this.db.prepare("SELECT team_id FROM team_tokens WHERE token_hash = ? AND revoked_at IS NULL").get(hash);
+        return row ? { teamId: row.team_id } : null;
+    }
+    async insert(hash, teamId) {
+        this.db.prepare("INSERT INTO team_tokens (token_hash, team_id) VALUES (?, ?)").run(hash, teamId);
+    }
+    async revoke(hash) {
+        this.db.prepare("UPDATE team_tokens SET revoked_at = datetime('now') WHERE token_hash = ?").run(hash);
+    }
+    async ensureActive(hash, teamId) {
+        const existing = this.db.prepare("SELECT token_hash FROM team_tokens WHERE token_hash = ?").get(hash);
+        if (existing)
+            return;
+        await this.insert(hash, teamId);
+    }
+}
+export class PgTeamTokenStore {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async findActiveByHash(hash) {
+        const result = await this.pool.query("SELECT team_id FROM team_tokens WHERE token_hash = $1 AND revoked_at IS NULL", [hash]);
+        return result.rows[0] ? { teamId: result.rows[0].team_id } : null;
+    }
+    async insert(hash, teamId) {
+        await this.pool.query("INSERT INTO team_tokens (token_hash, team_id) VALUES ($1, $2)", [hash, teamId]);
+    }
+    async revoke(hash) {
+        await this.pool.query("UPDATE team_tokens SET revoked_at = NOW() WHERE token_hash = $1", [hash]);
+    }
+    async ensureActive(hash, teamId) {
+        await this.pool.query("INSERT INTO team_tokens (token_hash, team_id) VALUES ($1, $2) ON CONFLICT (token_hash) DO NOTHING", [hash, teamId]);
+    }
+}
+//# sourceMappingURL=team-token-store.js.map

package/dist/core/tenancy/team-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-token-store.js","sourceRoot":"","sources":["../../../src/core/tenancy/team-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA4BH,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,EAAqB;QAArB,OAAE,GAAF,EAAE,CAAmB;IAAG,CAAC;IAEtD,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,6EAA6E,CAC9E,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,MAAc;QACvC,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,6DAA6D,CAC9D,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,0EAA0E,CAC3E,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,MAAc;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC9B,yDAAyD,CAC1D,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAClC,8EAA8E,EAC9E,CAAC,IAAI,CAAC,CACP,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,MAAc;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,+DAA+D,EAC/D,CAAC,IAAI,EAAE,MAAM,CAAC,CACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,iEAAiE,EACjE,CAAC,IAAI,CAAC,CACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,MAAc;QAC7C,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,mGAAmG,EACnG,CAAC,IAAI,EAAE,MAAM,CAAC,CACf,CAAC;IACJ,CAAC;CACF"}

package/dist/core/tenancy/tenant-clause.d.ts

@@ -0,0 +1,37 @@
+/**
+ * tenantClause / tenantClausePg — the single WHERE-fragment builder every
+ * corpus SQL string routes through (program spec §4.2). Wave C's guard test
+ * (tests/integration/tenant-guard.test.ts) scans src/core/storage/*.ts,
+ * actions-log.ts, build-dataset.ts, and http/app.ts for the literal text
+ * `tenant_id =`; the invariant this file exists to hold is that the literal
+ * appears ONLY here (migrations excepted).
+ *
+ * Two entry points because the two backends bind params differently, and
+ * both existing store idioms build a WHERE clause the same way — a
+ * `where: string[]` of fragments joined with " AND ", pushed alongside a
+ * parallel `params: unknown[]` array (see SqliteFactStore.list / .listBySessions,
+ * PgFactStore.list) — so a helper that returns one `{sql, param}` pair slots
+ * directly into that pattern for both:
+ *
+ *   sqlite (better-sqlite3, positional `?`):
+ *     const c = tenantClause(tenantId);
+ *     where.push(c.sql); params.push(c.param);
+ *
+ *   pg (node-postgres, numbered `$n`, tracked via a running `idx`):
+ *     const c = tenantClausePg(tenantId, idx++);
+ *     where.push(c.sql); params.push(c.param);
+ *
+ * For single-fragment templates (SqliteSessionStore.getById et al., built as
+ * a fixed template literal rather than a where[]/params[] pair), the fragment
+ * still composes: interpolate `c.sql` at the right spot in the template and
+ * append `c.param` to the positional argument list in the matching order.
+ *
+ * `column` defaults to the bare column name but accepts an alias-qualified
+ * form (e.g. "s.tenant_id") for joined queries.
+ */
+export interface TenantClause {
+    readonly sql: string;
+    readonly param: string;
+}
+export declare function tenantClause(tenantId: string, column?: string): TenantClause;
+export declare function tenantClausePg(tenantId: string, paramIndex: number, column?: string): TenantClause;

package/dist/core/tenancy/tenant-clause.js

@@ -0,0 +1,11 @@
+export function tenantClause(tenantId, column = "tenant_id") {
+    if (!tenantId)
+        throw new Error("tenantClause: tenantId is required");
+    return { sql: `${column} = ?`, param: tenantId };
+}
+export function tenantClausePg(tenantId, paramIndex, column = "tenant_id") {
+    if (!tenantId)
+        throw new Error("tenantClausePg: tenantId is required");
+    return { sql: `${column} = $${paramIndex}`, param: tenantId };
+}
+//# sourceMappingURL=tenant-clause.js.map

package/dist/core/tenancy/tenant-clause.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-clause.js","sourceRoot":"","sources":["../../../src/core/tenancy/tenant-clause.ts"],"names":[],"mappings":"AAoCA,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAM,GAAG,WAAW;IACjE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,UAAkB,EAAE,MAAM,GAAG,WAAW;IACvF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,OAAO,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC"}

package/dist/core/tenancy/tenant-state-path.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Path derivation for the shared file-state modules (hook memo, hook log,
+ * query/citation/miss logs — the JSONL/JSON telemetry that predates
+ * per-tenant SQLite rows). The default team's paths are byte-identical to
+ * the pre-M6 layout (~/.nlm/<segments>); every other tenant is isolated
+ * under ~/.nlm/tenants/<sanitized-tenantId>/<same segments>, so file state
+ * stops leaking across tenants the way a shared ~/.nlm/query_log.jsonl did.
+ *
+ * Sanitization mirrors the conversation-id rule in core/hook/memo.ts
+ * ([^A-Za-z0-9_-] -> "_", with "unknown" as the fallback for an id that
+ * sanitizes to nothing) but is not injective on its own — "acme.co" and
+ * "acme_co" both sanitize to "acme_co", which would collide the two
+ * tenants' directories. An id already safe (matches [A-Za-z0-9_-]+) is used
+ * as-is; any other id gets the sanitized form plus an 8-hex-char sha256
+ * digest of the *raw* (pre-sanitization) id appended, so two ids that
+ * collide after sanitization always land in distinct directories.
+ *
+ * NLM_STATE_ROOT overrides the ~/.nlm base directory for every tenant,
+ * default team included (the two branches below share the same `base`).
+ * This is a root move, not a per-tenant redirect: it does not reintroduce
+ * the leak the per-file overrides (NLM_QUERY_LOG et al., which apply to the
+ * default team's file only) were scoped away from — every tenant's
+ * directory keeps moving together under the new root, so isolation between
+ * tenants is unaffected. Test-only; production leaves it unset.
+ */
+export declare const TENANTS_DIRNAME = "tenants";
+/** ~/.nlm/<segments> for the default team; ~/.nlm/tenants/<t>/<segments> otherwise. */
+export declare function tenantStatePath(tenantId: string, ...segments: string[]): string;

package/dist/core/tenancy/tenant-state-path.js

@@ -0,0 +1,49 @@
+/**
+ * Path derivation for the shared file-state modules (hook memo, hook log,
+ * query/citation/miss logs — the JSONL/JSON telemetry that predates
+ * per-tenant SQLite rows). The default team's paths are byte-identical to
+ * the pre-M6 layout (~/.nlm/<segments>); every other tenant is isolated
+ * under ~/.nlm/tenants/<sanitized-tenantId>/<same segments>, so file state
+ * stops leaking across tenants the way a shared ~/.nlm/query_log.jsonl did.
+ *
+ * Sanitization mirrors the conversation-id rule in core/hook/memo.ts
+ * ([^A-Za-z0-9_-] -> "_", with "unknown" as the fallback for an id that
+ * sanitizes to nothing) but is not injective on its own — "acme.co" and
+ * "acme_co" both sanitize to "acme_co", which would collide the two
+ * tenants' directories. An id already safe (matches [A-Za-z0-9_-]+) is used
+ * as-is; any other id gets the sanitized form plus an 8-hex-char sha256
+ * digest of the *raw* (pre-sanitization) id appended, so two ids that
+ * collide after sanitization always land in distinct directories.
+ *
+ * NLM_STATE_ROOT overrides the ~/.nlm base directory for every tenant,
+ * default team included (the two branches below share the same `base`).
+ * This is a root move, not a per-tenant redirect: it does not reintroduce
+ * the leak the per-file overrides (NLM_QUERY_LOG et al., which apply to the
+ * default team's file only) were scoped away from — every tenant's
+ * directory keeps moving together under the new root, so isolation between
+ * tenants is unaffected. Test-only; production leaves it unset.
+ */
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { DEFAULT_TEAM_ID } from "./default-team.js";
+export const TENANTS_DIRNAME = "tenants";
+const SAFE_TENANT_ID = /^[A-Za-z0-9_-]+$/;
+function sanitizeTenantId(tenantId) {
+    if (SAFE_TENANT_ID.test(tenantId))
+        return tenantId;
+    const sanitized = tenantId.replace(/[^A-Za-z0-9_-]/g, "_") || "unknown";
+    const hash = createHash("sha256").update(tenantId).digest("hex").slice(0, 8);
+    return `${sanitized}_${hash}`;
+}
+function stateRoot() {
+    return process.env["NLM_STATE_ROOT"] || join(homedir(), ".nlm");
+}
+/** ~/.nlm/<segments> for the default team; ~/.nlm/tenants/<t>/<segments> otherwise. */
+export function tenantStatePath(tenantId, ...segments) {
+    const base = stateRoot();
+    if (tenantId === DEFAULT_TEAM_ID)
+        return join(base, ...segments);
+    return join(base, TENANTS_DIRNAME, sanitizeTenantId(tenantId), ...segments);
+}
+//# sourceMappingURL=tenant-state-path.js.map

package/dist/core/tenancy/tenant-state-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-state-path.js","sourceRoot":"","sources":["../../../src/core/tenancy/tenant-state-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AAEzC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAE1C,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,GAAG,QAAkB;IACrE,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC9E,CAAC"}

package/dist/core/update-check/check.d.ts

@@ -41,6 +41,12 @@ export interface UpdateCheckDeps {
     readonly fetchImpl?: typeof fetch;
 }
 export declare function getUpdateStatus(deps: UpdateCheckDeps): Promise<UpdateStatus>;
+/**
+ * Cache-only read: never fetches the registry, even on a miss or a stale
+ * (>24h) entry. For request paths (like GET /api/health) that must stay
+ * fast and never depend on npm being reachable.
+ */
+export declare function getCachedUpdateStatus(deps: Pick<UpdateCheckDeps, "currentVersion" | "cachePath" | "now">): Promise<UpdateStatus>;
 /**
  * Strict semver-newer check on simple `X.Y.Z` versions. Pre-release tags
  * (`-rc.1`, `-beta`) sort BEFORE the bare version per semver, which is

package/dist/core/update-check/check.js

@@ -74,6 +74,41 @@ export async function getUpdateStatus(deps) {
     });
     return status;
 }
+/**
+ * Cache-only read: never fetches the registry, even on a miss or a stale
+ * (>24h) entry. For request paths (like GET /api/health) that must stay
+ * fast and never depend on npm being reachable.
+ */
+export async function getCachedUpdateStatus(deps) {
+    const now = (deps.now ?? (() => new Date()))();
+    const current = deps.currentVersion;
+    if (isOptedOut()) {
+        return {
+            current,
+            latest: null,
+            behind: false,
+            checkedAt: now.toISOString(),
+            disabled: "user-opt-out",
+        };
+    }
+    const cachePath = deps.cachePath ?? defaultCachePath();
+    const cached = await readCache(cachePath);
+    if (!cached) {
+        return {
+            current,
+            latest: null,
+            behind: false,
+            checkedAt: now.toISOString(),
+            disabled: "unknown-error",
+        };
+    }
+    return {
+        current,
+        latest: cached.latest,
+        behind: cached.latest !== null && isStrictlyNewer(cached.latest, current),
+        checkedAt: cached.checkedAt,
+    };
+}
 async function readCache(path) {
     try {
         const raw = await readFile(path, "utf8");