@cerefox/memory 0.7.2 → 0.8.1

package/dist/bin/cerefox.js

@@ -182,6 +182,10 @@ function printTable(rows, emptyMessage = "(no rows)") {
     println(line(headers.map((h) => String(row[h] ?? ""))));
   }
 }
+function localTimestamp(d = new Date) {
+  const p = (n, w = 2) => String(n).padStart(w, "0");
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ` + `${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}.${p(d.getMilliseconds(), 3)}`;
+}
 function eprintln(line = "") {
   process.stderr.write(line + `
 `);
@@ -5315,6 +5319,7 @@ __export(exports_cli_core, {
   parseFloat01: () => parseFloat01,
   ok: () => ok,
   notFound: () => notFound,
+  localTimestamp: () => localTimestamp,
   info: () => info,
   errorln: () => errorln,
   eprintln: () => eprintln,
@@ -7179,7 +7184,7 @@ var exports_meta = {};
 __export(exports_meta, {
   PKG_VERSION: () => PKG_VERSION
 });
-var PKG_VERSION = "0.7.2";
+var PKG_VERSION = "0.8.1";
 var init_meta = () => {};
 
 // ../../node_modules/.bun/tslib@2.8.1/node_modules/tslib/tslib.js
@@ -22585,6 +22590,7 @@ function loadSettings(opts = {}) {
   return {
     supabaseUrl: env2.CEREFOX_SUPABASE_URL ?? "",
     supabaseKey: env2.CEREFOX_SUPABASE_KEY ?? "",
+    supabaseAnonKey: env2.CEREFOX_SUPABASE_ANON_KEY ?? "",
     databaseUrl: env2.CEREFOX_DATABASE_URL ?? "",
     openaiApiKey: env2.CEREFOX_OPENAI_API_KEY ?? env2.OPENAI_API_KEY ?? "",
     fireworksApiKey: env2.CEREFOX_FIREWORKS_API_KEY ?? ""
@@ -22631,99 +22637,6 @@ var init_client = __esm(() => {
   init_cli_core();
 });
 
-// src/cli/util/bundled-docs.ts
-import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
-import { dirname as dirname2, join as join4, resolve as resolve2 } from "node:path";
-import { fileURLToPath } from "node:url";
-function findPackageRoot() {
-  let dir = dirname2(fileURLToPath(import.meta.url));
-  for (let i = 0;i < 10; i++) {
-    const pkgJson = join4(dir, "package.json");
-    if (existsSync4(pkgJson)) {
-      try {
-        const parsed = JSON.parse(readFileSync4(pkgJson, "utf8"));
-        if (parsed.name === "@cerefox/memory")
-          return dir;
-      } catch {}
-    }
-    const parent = dirname2(dir);
-    if (parent === dir)
-      break;
-    dir = parent;
-  }
-  return resolve2(dirname2(fileURLToPath(import.meta.url)), "..", "..", "..");
-}
-function bundledDocsDir() {
-  const inPackage = join4(PACKAGE_ROOT, "docs");
-  if (existsSync4(inPackage))
-    return inPackage;
-  return resolve2(PACKAGE_ROOT, "..", "..", "docs");
-}
-function agentGuidePath() {
-  const candidates = [
-    join4(PACKAGE_ROOT, "AGENT_GUIDE.md"),
-    resolve2(PACKAGE_ROOT, "..", "..", "AGENT_GUIDE.md")
-  ];
-  for (const c2 of candidates)
-    if (existsSync4(c2))
-      return c2;
-  return null;
-}
-function agentQuickReferencePath() {
-  const candidates = [
-    join4(PACKAGE_ROOT, "AGENT_QUICK_REFERENCE.md"),
-    resolve2(PACKAGE_ROOT, "..", "..", "AGENT_QUICK_REFERENCE.md")
-  ];
-  for (const c2 of candidates)
-    if (existsSync4(c2))
-      return c2;
-  return null;
-}
-function listBundledDocs() {
-  const entries = [];
-  const docsDir = bundledDocsDir();
-  const guidesDir = join4(docsDir, "guides");
-  if (existsSync4(guidesDir) && statSync(guidesDir).isDirectory()) {
-    for (const name of readdirSync(guidesDir)) {
-      if (!name.endsWith(".md"))
-        continue;
-      const full = join4(guidesDir, name);
-      entries.push({
-        topic: name.replace(/\.md$/, ""),
-        path: full,
-        size: statSync(full).size
-      });
-    }
-  }
-  const ag = agentGuidePath();
-  if (ag)
-    entries.push({ topic: "agent-guide", path: ag, size: statSync(ag).size });
-  const aqr = agentQuickReferencePath();
-  if (aqr) {
-    entries.push({
-      topic: "agent-quick-reference",
-      path: aqr,
-      size: statSync(aqr).size
-    });
-  }
-  entries.sort((a, b) => a.topic.localeCompare(b.topic));
-  return entries;
-}
-function readBundledDoc(topic) {
-  const entry = listBundledDocs().find((d) => d.topic === topic);
-  if (!entry)
-    return null;
-  return {
-    topic: entry.topic,
-    path: entry.path,
-    content: readFileSync4(entry.path, "utf8")
-  };
-}
-var PACKAGE_ROOT;
-var init_bundled_docs = __esm(() => {
-  PACKAGE_ROOT = findPackageRoot();
-});
-
 // ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/query.js
 function cachedError(xs) {
   if (originCache.has(xs))
@@ -22742,9 +22655,9 @@ var init_query = __esm(() => {
   CLOSE = {};
   Query = class Query extends Promise {
     constructor(strings, args, handler, canceller, options = {}) {
-      let resolve3, reject;
+      let resolve2, reject;
       super((a, b) => {
-        resolve3 = a;
+        resolve2 = a;
         reject = b;
       });
       this.tagged = Array.isArray(strings.raw);
@@ -22755,7 +22668,7 @@ var init_query = __esm(() => {
       this.options = options;
       this.state = null;
       this.statement = null;
-      this.resolve = (x) => (this.active = false, resolve3(x));
+      this.resolve = (x) => (this.active = false, resolve2(x));
       this.reject = (x) => (this.active = false, reject(x));
       this.active = false;
       this.cancelled = null;
@@ -22803,12 +22716,12 @@ var init_query = __esm(() => {
             if (this.executed && !this.active)
               return { done: true };
             prev && prev();
-            const promise = new Promise((resolve3, reject) => {
+            const promise = new Promise((resolve2, reject) => {
               this.cursorFn = (value) => {
-                resolve3({ value, done: false });
+                resolve2({ value, done: false });
                 return new Promise((r) => prev = r);
               };
-              this.resolve = () => (this.active = false, resolve3({ done: true }));
+              this.resolve = () => (this.active = false, resolve2({ done: true }));
               this.reject = (x) => (this.active = false, reject(x));
             });
             this.execute();
@@ -22867,31 +22780,31 @@ var init_query = __esm(() => {
 // ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/errors.js
 function connection(x, options, socket) {
   const { host, port } = socket || options;
-  const error2 = Object.assign(new Error("write " + x + " " + (options.path || host + ":" + port)), {
+  const error = Object.assign(new Error("write " + x + " " + (options.path || host + ":" + port)), {
     code: x,
     errno: x,
     address: options.path || host
   }, options.path ? {} : { port });
-  Error.captureStackTrace(error2, connection);
-  return error2;
+  Error.captureStackTrace(error, connection);
+  return error;
 }
 function postgres(x) {
-  const error2 = new PostgresError(x);
-  Error.captureStackTrace(error2, postgres);
-  return error2;
+  const error = new PostgresError(x);
+  Error.captureStackTrace(error, postgres);
+  return error;
 }
 function generic(code, message) {
-  const error2 = Object.assign(new Error(code + ": " + message), { code });
-  Error.captureStackTrace(error2, generic);
-  return error2;
+  const error = Object.assign(new Error(code + ": " + message), { code });
+  Error.captureStackTrace(error, generic);
+  return error;
 }
 function notSupported(x) {
-  const error2 = Object.assign(new Error(x + " (B) is not supported"), {
+  const error = Object.assign(new Error(x + " (B) is not supported"), {
     code: "MESSAGE_NOT_SUPPORTED",
     name: x
   });
-  Error.captureStackTrace(error2, notSupported);
-  return error2;
+  Error.captureStackTrace(error, notSupported);
+  return error;
 }
 var PostgresError, Errors;
 var init_errors2 = __esm(() => {
@@ -23239,7 +23152,7 @@ function fit(x) {
     prev.copy(buffer);
   }
 }
-function reset2() {
+function reset() {
   b.i = 0;
   return b;
 }
@@ -23255,7 +23168,7 @@ var init_bytes = __esm(() => {
     };
     return acc;
   }, {});
-  b = Object.assign(reset2, messages, {
+  b = Object.assign(reset, messages, {
     N: String.fromCharCode(0),
     i: 0,
     inc(x) {
@@ -23354,22 +23267,22 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     try {
       x = options.socket ? await Promise.resolve(options.socket(options)) : new net.Socket;
     } catch (e) {
-      error2(e);
+      error(e);
       return;
     }
-    x.on("error", error2);
+    x.on("error", error);
     x.on("close", closed);
     x.on("drain", drain);
     return x;
   }
-  async function cancel({ pid, secret }, resolve3, reject) {
+  async function cancel({ pid, secret }, resolve2, reject) {
     try {
       cancelMessage = bytes_default().i32(16).i32(80877102).i32(pid).i32(secret).end(16);
       await connect();
       socket.once("error", reject);
-      socket.once("close", resolve3);
-    } catch (error3) {
-      reject(error3);
+      socket.once("close", resolve2);
+    } catch (error2) {
+      reject(error2);
     }
   }
   function execute(q) {
@@ -23384,9 +23297,9 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
       query ? sent.push(q) : (query = q, query.active = true);
       build(q);
       return write(toBuffer(q)) && !q.describeFirst && !q.cursorFn && sent.length < max_pipeline && (!q.options.onexecute || q.options.onexecute(connection2));
-    } catch (error3) {
+    } catch (error2) {
       sent.length === 0 && write(Sync);
-      errored(error3);
+      errored(error2);
       return true;
     }
   }
@@ -23465,7 +23378,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     socket.removeAllListeners();
     socket = tls.connect(options2);
     socket.on("secureConnect", connected);
-    socket.on("error", error2);
+    socket.on("error", error);
     socket.on("close", closed);
     socket.on("drain", drain);
   }
@@ -23531,10 +23444,10 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
       const s = StartupMessage();
       write(s);
     } catch (err) {
-      error2(err);
+      error(err);
     }
   }
-  function error2(err) {
+  function error(err) {
     if (connection2.queue === queues.connecting && options.host[retries + 1])
       return;
     errored(err);
@@ -23567,7 +23480,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
   function terminate() {
     terminated = true;
     if (stream || query || initial || sent.length)
-      error2(Errors.connection("CONNECTION_DESTROYED", options));
+      error(Errors.connection("CONNECTION_DESTROYED", options));
     clearImmediate(nextWriteTimer);
     if (socket) {
       socket.removeListener("data", data);
@@ -23590,7 +23503,7 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     socket = null;
     if (initial)
       return reconnect();
-    !hadError && (query || sent.length) && error2(Errors.connection("CONNECTION_CLOSED", options, socket));
+    !hadError && (query || sent.length) && error(Errors.connection("CONNECTION_CLOSED", options, socket));
     closedTime = performance.now();
     hadError && options.shared.retries++;
     delay = (typeof backoff === "function" ? backoff(options.shared.retries) : backoff) * 1000;
@@ -23814,9 +23727,9 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
       errored(Errors.postgres(parseError(x)));
     }
   }
-  function retry(q, error3) {
+  function retry(q, error2) {
     delete statements[q.signature];
-    q.retried = error3;
+    q.retried = error2;
     execute(q);
   }
   function NotificationResponse(x) {
@@ -23847,9 +23760,9 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
       write(chunk2, encoding, callback) {
         socket.write(bytes_default().d().raw(chunk2).end(), callback);
       },
-      destroy(error3, callback) {
-        callback(error3);
-        socket.write(bytes_default().f().str(error3 + bytes_default.N).end());
+      destroy(error2, callback) {
+        callback(error2);
+        socket.write(bytes_default().f().str(error2 + bytes_default.N).end());
         stream = null;
       },
       final(callback) {
@@ -23877,9 +23790,9 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
       write(chunk2, encoding, callback) {
         socket.write(bytes_default().d().raw(chunk2).end(), callback);
       },
-      destroy(error3, callback) {
-        callback(error3);
-        socket.write(bytes_default().f().str(error3 + bytes_default.N).end());
+      destroy(error2, callback) {
+        callback(error2);
+        socket.write(bytes_default().f().str(error2 + bytes_default.N).end());
         stream = null;
       },
       final(callback) {
@@ -23955,15 +23868,15 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
   }
 }
 function parseError(x) {
-  const error2 = {};
+  const error = {};
   let start = 5;
   for (let i = 5;i < x.length - 1; i++) {
     if (x[i] === 0) {
-      error2[errorFields[x[start]]] = x.toString("utf8", start + 1, i);
+      error[errorFields[x[start]]] = x.toString("utf8", start + 1, i);
       start = i + 1;
     }
   }
-  return error2;
+  return error;
 }
 function md5(x) {
   return crypto2.createHash("md5").update(x).digest("hex");
@@ -24109,10 +24022,10 @@ function Subscribe(postgres2, options) {
       lsn: Buffer.concat(x.consistent_point.split("/").map((x2) => Buffer.from(("00000000" + x2).slice(-8), "hex")))
     };
     stream2.on("data", data);
-    stream2.on("error", error2);
+    stream2.on("error", error);
     stream2.on("close", sql2.close);
     return { stream: stream2, state: xs.state };
-    function error2(e) {
+    function error(e) {
       console.error("Unexpected error during logical streaming - reconnecting", e);
     }
     function data(x2) {
@@ -24240,7 +24153,7 @@ var noop2 = () => {};
 // ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/large.js
 import Stream2 from "stream";
 function largeObject(sql, oid, mode = 131072 | 262144) {
-  return new Promise(async (resolve3, reject) => {
+  return new Promise(async (resolve2, reject) => {
     await sql.begin(async (sql2) => {
       let finish;
       !oid && ([{ oid }] = await sql2`select lo_creat(-1) as oid`);
@@ -24266,7 +24179,7 @@ function largeObject(sql, oid, mode = 131072 | 262144) {
           ) seek
         `
       };
-      resolve3(lo);
+      resolve2(lo);
       return new Promise(async (r) => finish = r);
       async function readable({
         highWaterMark = 2048 * 8,
@@ -24309,7 +24222,7 @@ var exports_src = {};
 __export(exports_src, {
   default: () => src_default
 });
-import os2 from "os";
+import os from "os";
 import fs from "fs";
 function Postgres(a, b2) {
   const options = parseOptions(a, b2), subscribe = options.no_subscribe || Subscribe(Postgres, { ...options });
@@ -24426,8 +24339,8 @@ function Postgres(a, b2) {
   }
   async function reserve() {
     const queue = queue_default();
-    const c2 = open.length ? open.shift() : await new Promise((resolve3, reject) => {
-      const query = { reserve: resolve3, reject };
+    const c2 = open.length ? open.shift() : await new Promise((resolve2, reject) => {
+      const query = { reserve: resolve2, reject };
       queries.push(query);
       closed.length && connect(closed.shift(), query);
     });
@@ -24454,8 +24367,8 @@ function Postgres(a, b2) {
         scope(connection2, fn),
         new Promise((_, reject) => connection2.onclose = reject)
       ]);
-    } catch (error2) {
-      throw error2;
+    } catch (error) {
+      throw error;
     }
     async function scope(c2, fn2, name) {
       const sql2 = Sql(handler2);
@@ -24464,9 +24377,9 @@ function Postgres(a, b2) {
       let uncaughtError, result;
       name && await sql2`savepoint ${sql2(name)}`;
       try {
-        result = await new Promise((resolve3, reject) => {
+        result = await new Promise((resolve2, reject) => {
           const x = fn2(sql2);
-          Promise.resolve(Array.isArray(x) ? Promise.all(x) : x).then(resolve3, reject);
+          Promise.resolve(Array.isArray(x) ? Promise.all(x) : x).then(resolve2, reject);
         });
         if (uncaughtError)
           throw uncaughtError;
@@ -24523,8 +24436,8 @@ function Postgres(a, b2) {
     return c2.execute(query) ? move(c2, busy) : move(c2, full);
   }
   function cancel(query) {
-    return new Promise((resolve3, reject) => {
-      query.state ? query.active ? connection_default(options).cancel(query.state, resolve3, reject) : query.cancelled = { resolve: resolve3, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve3());
+    return new Promise((resolve2, reject) => {
+      query.state ? query.active ? connection_default(options).cancel(query.state, resolve2, reject) : query.cancelled = { resolve: resolve2, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve2());
     });
   }
   async function end({ timeout = null } = {}) {
@@ -24540,11 +24453,11 @@ function Postgres(a, b2) {
   async function close() {
     await Promise.all(connections.map((c2) => c2.end()));
   }
-  async function destroy(resolve3) {
+  async function destroy(resolve2) {
     await Promise.all(connections.map((c2) => c2.terminate()));
     while (queries.length)
       queries.shift().reject(Errors.connection("CONNECTION_DESTROYED", options));
-    resolve3();
+    resolve2();
   }
   function connect(c2, query) {
     move(c2, connecting);
@@ -24577,7 +24490,7 @@ function Postgres(a, b2) {
 function parseOptions(a, b2) {
   if (a && a.shared)
     return a;
-  const env4 = process.env, o = (!a || typeof a === "string" ? b2 : a) || {}, { url, multihost } = parseUrl(a), query = [...url.searchParams].reduce((a2, [b3, c2]) => (a2[b3] = c2, a2), {}), host = o.hostname || o.host || multihost || url.hostname || env4.PGHOST || "localhost", port = o.port || url.port || env4.PGPORT || 5432, user = o.user || o.username || url.username || env4.PGUSERNAME || env4.PGUSER || osUsername();
+  const env3 = process.env, o = (!a || typeof a === "string" ? b2 : a) || {}, { url, multihost } = parseUrl(a), query = [...url.searchParams].reduce((a2, [b3, c2]) => (a2[b3] = c2, a2), {}), host = o.hostname || o.host || multihost || url.hostname || env3.PGHOST || "localhost", port = o.port || url.port || env3.PGPORT || 5432, user = o.user || o.username || url.username || env3.PGUSERNAME || env3.PGUSER || osUsername();
   o.no_prepare && (o.prepare = false);
   query.sslmode && (query.ssl = query.sslmode, delete query.sslmode);
   "timeout" in o && (console.log("The timeout option is deprecated, use idle_timeout instead"), o.idle_timeout = o.timeout);
@@ -24603,21 +24516,21 @@ function parseOptions(a, b2) {
     host: Array.isArray(host) ? host : host.split(",").map((x) => x.split(":")[0]),
     port: Array.isArray(port) ? port : host.split(",").map((x) => parseInt(x.split(":")[1] || port)),
     path: o.path || host.indexOf("/") > -1 && host + "/.s.PGSQL." + port,
-    database: o.database || o.db || (url.pathname || "").slice(1) || env4.PGDATABASE || user,
+    database: o.database || o.db || (url.pathname || "").slice(1) || env3.PGDATABASE || user,
     user,
-    pass: o.pass || o.password || url.password || env4.PGPASSWORD || "",
+    pass: o.pass || o.password || url.password || env3.PGPASSWORD || "",
     ...Object.entries(defaults).reduce((acc, [k, d]) => {
-      const value = k in o ? o[k] : (k in query) ? query[k] === "disable" || query[k] === "false" ? false : query[k] : env4["PG" + k.toUpperCase()] || d;
+      const value = k in o ? o[k] : (k in query) ? query[k] === "disable" || query[k] === "false" ? false : query[k] : env3["PG" + k.toUpperCase()] || d;
       acc[k] = typeof value === "string" && ints.includes(k) ? +value : value;
       return acc;
     }, {}),
     connection: {
-      application_name: env4.PGAPPNAME || "postgres.js",
+      application_name: env3.PGAPPNAME || "postgres.js",
       ...o.connection,
       ...Object.entries(query).reduce((acc, [k, v]) => ((k in defaults) || (acc[k] = v), acc), {})
     },
     types: o.types || {},
-    target_session_attrs: tsa(o, url, env4),
+    target_session_attrs: tsa(o, url, env3),
     onnotice: o.onnotice,
     onnotify: o.onnotify,
     onclose: o.onclose,
@@ -24629,8 +24542,8 @@ function parseOptions(a, b2) {
     ...mergeUserTypes(o.types)
   };
 }
-function tsa(o, url, env4) {
-  const x = o.target_session_attrs || url.searchParams.get("target_session_attrs") || env4.PGTARGETSESSIONATTRS;
+function tsa(o, url, env3) {
+  const x = o.target_session_attrs || url.searchParams.get("target_session_attrs") || env3.PGTARGETSESSIONATTRS;
   if (!x || ["read-write", "read-only", "primary", "standby", "prefer-standby"].includes(x))
     return x;
   throw new Error("target_session_attrs " + x + " is not supported");
@@ -24680,7 +24593,7 @@ function parseUrl(url) {
 }
 function osUsername() {
   try {
-    return os2.userInfo().username;
+    return os.userInfo().username;
   } catch (_) {
     return process.env.USERNAME || process.env.USER || process.env.LOGNAME;
   }
@@ -24714,6 +24627,99 @@ var init_src = __esm(() => {
   src_default = Postgres;
 });
 
+// src/cli/util/bundled-docs.ts
+import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync5, statSync } from "node:fs";
+import { dirname as dirname3, join as join6, resolve as resolve2 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function findPackageRoot() {
+  let dir = dirname3(fileURLToPath2(import.meta.url));
+  for (let i = 0;i < 10; i++) {
+    const pkgJson = join6(dir, "package.json");
+    if (existsSync7(pkgJson)) {
+      try {
+        const parsed = JSON.parse(readFileSync5(pkgJson, "utf8"));
+        if (parsed.name === "@cerefox/memory")
+          return dir;
+      } catch {}
+    }
+    const parent = dirname3(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return resolve2(dirname3(fileURLToPath2(import.meta.url)), "..", "..", "..");
+}
+function bundledDocsDir() {
+  const inPackage = join6(PACKAGE_ROOT, "docs");
+  if (existsSync7(inPackage))
+    return inPackage;
+  return resolve2(PACKAGE_ROOT, "..", "..", "docs");
+}
+function agentGuidePath() {
+  const candidates = [
+    join6(PACKAGE_ROOT, "AGENT_GUIDE.md"),
+    resolve2(PACKAGE_ROOT, "..", "..", "AGENT_GUIDE.md")
+  ];
+  for (const c2 of candidates)
+    if (existsSync7(c2))
+      return c2;
+  return null;
+}
+function agentQuickReferencePath() {
+  const candidates = [
+    join6(PACKAGE_ROOT, "AGENT_QUICK_REFERENCE.md"),
+    resolve2(PACKAGE_ROOT, "..", "..", "AGENT_QUICK_REFERENCE.md")
+  ];
+  for (const c2 of candidates)
+    if (existsSync7(c2))
+      return c2;
+  return null;
+}
+function listBundledDocs() {
+  const entries = [];
+  const docsDir = bundledDocsDir();
+  const guidesDir = join6(docsDir, "guides");
+  if (existsSync7(guidesDir) && statSync(guidesDir).isDirectory()) {
+    for (const name of readdirSync3(guidesDir)) {
+      if (!name.endsWith(".md"))
+        continue;
+      const full = join6(guidesDir, name);
+      entries.push({
+        topic: name.replace(/\.md$/, ""),
+        path: full,
+        size: statSync(full).size
+      });
+    }
+  }
+  const ag = agentGuidePath();
+  if (ag)
+    entries.push({ topic: "agent-guide", path: ag, size: statSync(ag).size });
+  const aqr = agentQuickReferencePath();
+  if (aqr) {
+    entries.push({
+      topic: "agent-quick-reference",
+      path: aqr,
+      size: statSync(aqr).size
+    });
+  }
+  entries.sort((a, b2) => a.topic.localeCompare(b2.topic));
+  return entries;
+}
+function readBundledDoc(topic) {
+  const entry = listBundledDocs().find((d) => d.topic === topic);
+  if (!entry)
+    return null;
+  return {
+    topic: entry.topic,
+    path: entry.path,
+    content: readFileSync5(entry.path, "utf8")
+  };
+}
+var PACKAGE_ROOT;
+var init_bundled_docs = __esm(() => {
+  PACKAGE_ROOT = findPackageRoot();
+});
+
 // ../../_shared/embeddings/index.ts
 async function getEmbedding(text, apiKey) {
   let lastError = null;
@@ -26752,7 +26758,7 @@ __export(exports_sync_self_docs, {
   runSyncSelfDocs: () => runSyncSelfDocs,
   registerSyncSelfDocs: () => registerSyncSelfDocs
 });
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import { basename as basename4, extname as extname4 } from "node:path";
 async function runSyncSelfDocs(options = {}) {
   const project = options.project ?? "_cerefox-self-docs";
@@ -26779,7 +26785,7 @@ async function runSyncSelfDocs(options = {}) {
   const authorType = resolveAuthorType("agent");
   const outcomes = [];
   for (const doc of docs) {
-    const content = readFileSync8(doc.path, "utf8");
+    const content = readFileSync9(doc.path, "utf8");
     const m = content.match(/^#\s+(.+)$/m);
     const title = m ? m[1].trim() : basename4(doc.path, extname4(doc.path));
     try {
@@ -26813,11 +26819,11 @@ async function runSyncSelfDocs(options = {}) {
     printTable(outcomes.filter((o) => o.status === "error").map((o) => ({ topic: o.topic, error: o.detail.slice(0, 100) })));
   }
 }
-async function action13(options) {
+async function action15(options) {
   await runSyncSelfDocs(options);
 }
 function registerSyncSelfDocs(program2) {
-  program2.command("sync-self-docs").description("Ingest bundled Cerefox docs under the _cerefox-self-docs project.").option("--dry-run", "List what would be ingested without writing.").option("--project <name>", "Override the target project name.", "_cerefox-self-docs").action(action13);
+  program2.command("sync-self-docs").description("Ingest bundled Cerefox docs under the _cerefox-self-docs project.").option("--dry-run", "List what would be ingested without writing.").option("--project <name>", "Override the target project name.", "_cerefox-self-docs").action(action15);
 }
 var init_sync_self_docs = __esm(() => {
   init_cli_core();
@@ -41527,18 +41533,472 @@ function registerDeleteDoc(program2) {
   program2.command("delete-doc").description("Soft-delete a document (recoverable via the web UI trash).").argument("<document-id>", "UUID of the document to delete.").option("--reason <text>", "Optional reason recorded in the audit log.").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").option("--yes", "Skip the confirmation prompt.").action(action6);
 }
 
+// src/cli/commands/delete-project.ts
+init_cli_core();
+init_client();
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function action7(target, options) {
+  const client = getClient();
+  const isUuid = UUID_RE.test(target);
+  const lookup = isUuid ? client.raw.from("cerefox_projects").select("id, name, description").eq("id", target).maybeSingle() : client.raw.from("cerefox_projects").select("id, name, description").eq("name", target).maybeSingle();
+  const { data: project, error } = await lookup;
+  if (error) {
+    throw systemError(`Project lookup failed: ${error.message}`);
+  }
+  if (!project) {
+    throw notFound(`Project "${target}" not found.`);
+  }
+  const { count, error: countErr } = await client.raw.from("cerefox_document_projects").select("*", { count: "exact", head: true }).eq("project_id", project.id);
+  if (countErr) {
+    throw systemError(`Could not count documents in project: ${countErr.message}`);
+  }
+  const docCount = count ?? 0;
+  if (docCount > 0 && !options.force) {
+    throw userError(`Project "${project.name}" still has ${docCount} document link(s).`, "Pass --force to delete the project anyway (documents remain; only the project row is removed).");
+  }
+  println(c.yellow("About to delete project:"));
+  println(`  ${project.name}`);
+  println(c.dim(`  ${project.id} · ${docCount} doc link(s)`));
+  if (!options.yes) {
+    const ok2 = await confirm("Continue?", true);
+    if (!ok2) {
+      println(c.dim("Aborted."));
+      return;
+    }
+  }
+  const { error: delErr } = await client.raw.from("cerefox_projects").delete().eq("id", project.id);
+  if (delErr) {
+    throw systemError(`Delete failed: ${delErr.message}`);
+  }
+  println(c.green(`✓ Deleted project "${project.name}" (id: ${project.id}).`));
+}
+function registerDeleteProject(program2) {
+  program2.command("delete-project").description("Delete an empty project (use --force to remove a non-empty one).").argument("<name-or-id>", "Project name (exact match) or UUID.").option("--yes", "Skip the confirmation prompt.").option("--force", "Allow deletion when documents are still linked to the project.").action(action7);
+}
+
+// src/cli/commands/deploy-server.ts
+init_cli_core();
+init_config();
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync6 } from "node:fs";
+import { readdirSync as readdirSync2 } from "node:fs";
+
+// ../../_shared/server-assets/index.ts
+import { existsSync as existsSync4 } from "node:fs";
+import { dirname as dirname2, join as join4 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { cwd as processCwd2 } from "node:process";
+function moduleDir() {
+  return dirname2(fileURLToPath(import.meta.url));
+}
+function bundledServerAssets(serverAssetsRoot) {
+  return {
+    schemaFile: join4(serverAssetsRoot, "db", "schema.sql"),
+    rpcsFile: join4(serverAssetsRoot, "db", "rpcs.sql"),
+    migrationsDir: join4(serverAssetsRoot, "db", "migrations"),
+    functionsDir: join4(serverAssetsRoot, "supabase", "functions"),
+    layout: "bundled"
+  };
+}
+function sourceServerAssets(repoRoot) {
+  const dbDir = join4(repoRoot, "src", "cerefox", "db");
+  return {
+    schemaFile: join4(dbDir, "schema.sql"),
+    rpcsFile: join4(dbDir, "rpcs.sql"),
+    migrationsDir: join4(dbDir, "migrations"),
+    functionsDir: join4(repoRoot, "supabase", "functions"),
+    layout: "source"
+  };
+}
+function serverAssetsUsable(p) {
+  return existsSync4(p.schemaFile) && existsSync4(p.rpcsFile);
+}
+function resolveServerAssets(opts = {}) {
+  if (opts.assetsDir) {
+    return { ...bundledServerAssets(opts.assetsDir), layout: "explicit" };
+  }
+  const here = opts.moduleDirOverride ?? moduleDir();
+  const cwd = opts.cwd ?? processCwd2();
+  const candidates = [
+    bundledServerAssets(join4(here, "..", "server-assets")),
+    sourceServerAssets(join4(here, "..", "..")),
+    sourceServerAssets(cwd)
+  ];
+  for (const candidate of candidates) {
+    if (serverAssetsUsable(candidate))
+      return candidate;
+  }
+  return sourceServerAssets(join4(here, "..", ".."));
+}
+
+// ../../_shared/db-deploy/index.ts
+init_src();
+import { existsSync as existsSync5, readFileSync as readFileSync4, readdirSync } from "node:fs";
+import { join as join5 } from "node:path";
+var RESET_SQL = `
+DROP TABLE IF EXISTS cerefox_chunks      CASCADE;
+DROP TABLE IF EXISTS cerefox_documents   CASCADE;
+DROP TABLE IF EXISTS cerefox_projects    CASCADE;
+DROP TABLE IF EXISTS cerefox_migrations  CASCADE;
+DROP FUNCTION IF EXISTS cerefox_set_updated_at CASCADE;
+DROP FUNCTION IF EXISTS cerefox_hybrid_search   CASCADE;
+DROP FUNCTION IF EXISTS cerefox_fts_search      CASCADE;
+DROP FUNCTION IF EXISTS cerefox_semantic_search CASCADE;
+DROP FUNCTION IF EXISTS cerefox_reconstruct_doc CASCADE;
+`;
+var EXTENSIONS_SQL = `
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "vector";
+`;
+function listMigrationFiles(migrationsDir) {
+  if (!existsSync5(migrationsDir))
+    return [];
+  return readdirSync(migrationsDir).filter((n) => n.endsWith(".sql")).sort();
+}
+function buildDeploySteps(assets, opts = {}) {
+  const schemaSql = readFileSync4(assets.schemaFile, "utf8");
+  const rpcsSql = readFileSync4(assets.rpcsFile, "utf8");
+  const steps = [];
+  if (opts.reset) {
+    steps.push({ label: "Reset: drop existing Cerefox objects", sql: RESET_SQL });
+  }
+  steps.push({ label: "Enable extensions (uuid-ossp, vector/pgvector)", sql: EXTENSIONS_SQL }, { label: "Apply schema (tables, indexes, triggers)", sql: schemaSql }, { label: "Apply RPCs (search functions)", sql: rpcsSql });
+  const migrationFiles = listMigrationFiles(assets.migrationsDir);
+  if (migrationFiles.length > 0) {
+    const values2 = migrationFiles.map((n) => `('${n.replace(/'/g, "''")}')`).join(", ");
+    steps.push({
+      label: "Stamp migration files as already applied",
+      sql: `INSERT INTO cerefox_migrations (filename) VALUES ${values2} ON CONFLICT (filename) DO NOTHING;`
+    });
+  }
+  return steps;
+}
+async function runDbDeploy(opts) {
+  const log = opts.log ?? (() => {});
+  const steps = buildDeploySteps(opts.assets, { reset: opts.reset });
+  if (opts.dryRun) {
+    for (const step of steps) {
+      log(`▶  ${step.label}… (dry-run, not executed)`);
+    }
+    return { ok: true, stepsRun: steps.length };
+  }
+  const sql = src_default(opts.dbUrl, { prepare: false, onnotice: () => {} });
+  let stepsRun = 0;
+  try {
+    for (const step of steps) {
+      log(`▶  ${step.label}…`);
+      try {
+        await sql.unsafe(step.sql);
+        stepsRun++;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { ok: false, stepsRun, failedStep: step.label, error: message };
+      }
+    }
+    return { ok: true, stepsRun };
+  } finally {
+    await sql.end({ timeout: 5 }).catch(() => {});
+  }
+}
+var BOOTSTRAP_MIGRATIONS_SQL = `
+CREATE TABLE IF NOT EXISTS cerefox_migrations (
+    id         SERIAL      PRIMARY KEY,
+    filename   TEXT        NOT NULL UNIQUE,
+    applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+`;
+async function detectExistingSchema(dbUrl) {
+  const sql = src_default(dbUrl, { prepare: false, onnotice: () => {} });
+  try {
+    const rows = await sql`SELECT to_regclass('public.cerefox_documents') AS t`;
+    return rows[0]?.t != null;
+  } finally {
+    await sql.end({ timeout: 5 }).catch(() => {});
+  }
+}
+async function migrationStatus(opts) {
+  const sql = src_default(opts.dbUrl, { prepare: false, onnotice: () => {} });
+  try {
+    await sql.unsafe(BOOTSTRAP_MIGRATIONS_SQL);
+    const all = listMigrationFiles(opts.assets.migrationsDir);
+    const appliedRows = await sql`SELECT filename FROM cerefox_migrations ORDER BY filename`;
+    const appliedSet = new Set(appliedRows.map((r) => r.filename));
+    return {
+      all,
+      applied: all.filter((f) => appliedSet.has(f)),
+      pending: all.filter((f) => !appliedSet.has(f))
+    };
+  } finally {
+    await sql.end({ timeout: 5 }).catch(() => {});
+  }
+}
+async function runDbMigrate(opts) {
+  const log = opts.log ?? (() => {});
+  const sql = src_default(opts.dbUrl, { prepare: false, onnotice: () => {} });
+  try {
+    await sql.unsafe(BOOTSTRAP_MIGRATIONS_SQL);
+    const allFiles = listMigrationFiles(opts.assets.migrationsDir);
+    const appliedRows = await sql`SELECT filename FROM cerefox_migrations ORDER BY filename`;
+    const appliedSet = new Set(appliedRows.map((r) => r.filename));
+    const pending = allFiles.filter((f) => !appliedSet.has(f));
+    if (pending.length === 0)
+      return { ok: true, applied: [], pending: [] };
+    if (opts.dryRun) {
+      for (const f of pending)
+        log(`Would apply ${f}`);
+      return { ok: true, applied: [], pending };
+    }
+    const applied = [];
+    for (const f of pending) {
+      const body = readFileSync4(join5(opts.assets.migrationsDir, f), "utf8");
+      log(`Applying ${f}…`);
+      try {
+        await sql.begin(async (tx) => {
+          await tx.unsafe(body);
+          await tx`INSERT INTO cerefox_migrations (filename) VALUES (${f}) ON CONFLICT DO NOTHING`;
+        });
+        applied.push(f);
+      } catch (err) {
+        return {
+          ok: false,
+          applied,
+          pending,
+          failedFile: f,
+          error: err instanceof Error ? err.message : String(err)
+        };
+      }
+    }
+    return { ok: true, applied, pending };
+  } finally {
+    await sql.end({ timeout: 5 }).catch(() => {});
+  }
+}
+async function applyRpcs(opts) {
+  const log = opts.log ?? (() => {});
+  log("Refresh RPCs (rpcs.sql)…");
+  if (opts.dryRun)
+    return { ok: true };
+  const rpcsSql = readFileSync4(opts.assets.rpcsFile, "utf8");
+  const sql = src_default(opts.dbUrl, { prepare: false, onnotice: () => {} });
+  try {
+    await sql.unsafe(rpcsSql);
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    await sql.end({ timeout: 5 }).catch(() => {});
+  }
+}
+
+// src/cli/commands/deploy-server.ts
+function commandSucceeds(cmd, args) {
+  try {
+    const r = spawnSync2(cmd, args, { encoding: "utf8", timeout: 15000 });
+    return r.status === 0;
+  } catch {
+    return false;
+  }
+}
+function listEdgeFunctions(functionsDir) {
+  if (!existsSync6(functionsDir))
+    return [];
+  return readdirSync2(functionsDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("cerefox-")).map((e) => e.name).sort();
+}
+async function action8(options) {
+  const settings = loadSettings();
+  const assets = resolveServerAssets();
+  const doSchema = !options.functionsOnly;
+  const doFunctions = !options.schemaOnly;
+  const checks = [];
+  if (doSchema) {
+    checks.push({
+      label: "CEREFOX_DATABASE_URL is set (Session Pooler, port 5432)",
+      ok: Boolean(settings.databaseUrl),
+      remediation: "Set CEREFOX_DATABASE_URL in your .env. Use the Session Pooler URI " + "(port 5432, username postgres.<project-ref>, ?sslmode=require). " + "See docs/guides/setup-supabase.md → Connection pooling."
+    });
+    checks.push({
+      label: "Bundled schema assets present",
+      ok: existsSync6(assets.schemaFile) && existsSync6(assets.rpcsFile),
+      remediation: "Schema files not found. Reinstall the package, or run from a repo " + "clone (src/cerefox/db/)."
+    });
+  }
+  let efNames = [];
+  if (doFunctions) {
+    efNames = listEdgeFunctions(assets.functionsDir);
+    checks.push({
+      label: "Bundled Edge Function sources present",
+      ok: efNames.length > 0,
+      remediation: "Edge Function sources not found under the bundled assets. Reinstall " + "the package, or run from a repo clone (supabase/functions/)."
+    });
+    checks.push({
+      label: "Supabase CLI reachable (`npx supabase --version`)",
+      ok: commandSucceeds("npx", ["--yes", "supabase", "--version"]),
+      remediation: "Install Node 20+ (npx ships with it) from nodejs.org, then re-run. " + "`cerefox deploy-server` shells out to the Supabase CLI via npx."
+    });
+    checks.push({
+      label: "Supabase project linked (`npx supabase link`)",
+      ok: existsSync6("supabase/config.toml") || existsSync6(".supabase/config.toml"),
+      remediation: `Authenticate + link your project (one-time, from any working dir):
+` + `      npx supabase login
+` + `      npx supabase link --project-ref <your-project-ref>
+` + "    Your project ref is in the dashboard URL: " + "https://supabase.com/dashboard/project/<project-ref>"
+    });
+  }
+  const failed = checks.filter((ch) => !ch.ok);
+  println(c.bold("Cerefox deploy-server — pre-flight"));
+  for (const ch of checks) {
+    println(`  ${ch.ok ? c.green("✓") : c.red("✗")} ${ch.label}`);
+  }
+  if (failed.length > 0) {
+    eprintln("");
+    eprintln(c.red(`Cannot deploy yet — ${failed.length} prerequisite(s) missing:`));
+    for (const ch of failed) {
+      eprintln(`
+  ${c.red("✗")} ${ch.label}`);
+      eprintln(c.dim(`    → ${ch.remediation}`));
+    }
+    eprintln("\nFix the above and re-run `cerefox deploy-server` (it's idempotent).");
+    process.exit(1);
+  }
+  println(c.green(`
+✓ All prerequisites satisfied.`));
+  let schemaMode = "unknown";
+  let pending = [];
+  if (doSchema) {
+    try {
+      const exists = await detectExistingSchema(settings.databaseUrl);
+      schemaMode = exists ? "existing" : "fresh";
+      if (exists) {
+        pending = (await migrationStatus({ dbUrl: settings.databaseUrl, assets })).pending;
+      }
+    } catch (err) {
+      if (!options.dryRun) {
+        eprintln(c.red(`
+✗ Could not connect to the database: ${err instanceof Error ? err.message : String(err)}`));
+        eprintln(c.dim("   Verify CEREFOX_DATABASE_URL (Session Pooler, port 5432)."));
+        process.exit(1);
+      }
+    }
+  }
+  const planLines = [];
+  if (doSchema) {
+    if (schemaMode === "fresh") {
+      planLines.push(`  • Deploy fresh schema + RPCs to ${settings.supabaseUrl || "your Supabase database"}`);
+    } else if (schemaMode === "existing") {
+      planLines.push(`  • Update existing schema: apply ${pending.length} pending migration(s) + refresh RPCs`);
+      for (const f of pending)
+        planLines.push(c.dim(`      – ${f}`));
+    } else {
+      planLines.push(`  • Schema + RPCs (fresh or update — couldn't probe the DB)`);
+    }
+  }
+  if (doFunctions) {
+    planLines.push(`  • Deploy ${efNames.length} Edge Function(s): ${efNames.join(", ")}`);
+  }
+  println(c.bold(`
+Plan:`));
+  for (const line of planLines)
+    println(line);
+  if (options.dryRun) {
+    println(c.yellow(`
+⚠  --dry-run: nothing was deployed.`));
+    process.exit(0);
+  }
+  const proceed = await confirm(`
+Proceed with deployment to Supabase?`, true);
+  if (!proceed) {
+    println(c.dim("Aborted."));
+    process.exit(0);
+  }
+  if (doSchema) {
+    if (schemaMode === "fresh") {
+      println(c.bold(`
+▶  Deploying fresh schema + RPCs…`));
+      const result = await runDbDeploy({
+        dbUrl: settings.databaseUrl,
+        assets,
+        log: (line) => println(c.dim(`   ${line}`))
+      });
+      if (!result.ok) {
+        eprintln(c.red(`
+✗ Schema deploy failed at "${result.failedStep}": ${result.error}`));
+        process.exit(1);
+      }
+      println(c.green(`   ✓ Fresh schema deployed (${result.stepsRun} steps).`));
+    } else {
+      println(c.bold(`
+▶  Updating existing schema (migrations + RPC refresh)…`));
+      const mig = await runDbMigrate({
+        dbUrl: settings.databaseUrl,
+        assets,
+        log: (line) => println(c.dim(`   ${line}`))
+      });
+      if (!mig.ok) {
+        eprintln(c.red(`
+✗ Migration "${mig.failedFile}" failed: ${mig.error}`));
+        eprintln(c.dim("   Earlier migrations in this run were committed. Fix + re-run."));
+        process.exit(1);
+      }
+      const rpcs = await applyRpcs({
+        dbUrl: settings.databaseUrl,
+        assets,
+        log: (line) => println(c.dim(`   ${line}`))
+      });
+      if (!rpcs.ok) {
+        eprintln(c.red(`
+✗ RPC refresh failed: ${rpcs.error}`));
+        process.exit(1);
+      }
+      println(c.green(`   ✓ Applied ${mig.applied.length} migration(s); RPCs refreshed.`));
+    }
+  }
+  if (doFunctions) {
+    println(c.bold(`
+▶  Deploying ${efNames.length} Edge Function(s)…`));
+    let efOk = 0;
+    const efFailed = [];
+    for (const ef of efNames) {
+      info(`   deploying ${ef}…`);
+      const workdir = assets.functionsDir.replace(/\/functions$/, "").replace(/\/supabase$/, "");
+      const r = spawnSync2("npx", ["--yes", "supabase", "functions", "deploy", ef], {
+        encoding: "utf8",
+        stdio: "inherit",
+        cwd: workdir,
+        timeout: 120000
+      });
+      if (r.status === 0)
+        efOk++;
+      else
+        efFailed.push(ef);
+    }
+    if (efFailed.length > 0) {
+      eprintln(c.red(`
+✗ ${efFailed.length} Edge Function(s) failed: ${efFailed.join(", ")}`));
+      eprintln(c.dim("   Re-run `cerefox deploy-server --functions-only` after fixing the cause."));
+      process.exit(1);
+    }
+    println(c.green(`   ✓ Deployed ${efOk} Edge Function(s).`));
+  }
+  println(c.green(`
+✓ Server deploy complete.`));
+  println(c.dim("Verify with: cerefox doctor"));
+}
+function registerDeployServer(program2) {
+  program2.command("deploy-server").description("Deploy/update the Cerefox server side (schema + RPCs + Edge Functions) on Supabase.").option("--dry-run", "Print the plan + pre-flight without deploying.").option("--schema-only", "Deploy/update only the schema + RPCs (skip Edge Functions).").option("--functions-only", "Deploy only the Edge Functions (skip the schema/RPCs).").action(action8);
+}
+
 // src/cli/commands/docs.ts
 init_cli_core();
 init_bundled_docs();
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 function openInBrowser(path) {
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  const result = spawnSync2(cmd, [path], { stdio: "ignore" });
+  const result = spawnSync3(cmd, [path], { stdio: "ignore" });
   if (result.status !== 0) {
     println(c.dim(`(could not auto-open; the file is at: ${path})`));
   }
 }
-function action7(topic, options) {
+function action9(topic, options) {
   const docs = listBundledDocs();
   if (options.list || !topic && !options.print) {
     if (docs.length === 0) {
@@ -41567,7 +42027,7 @@ function action7(topic, options) {
   openInBrowser(doc.path);
 }
 function registerDocs(program2) {
-  program2.command("docs").description("Open bundled Cerefox docs in your browser (or print to stdout).").argument("[topic]", "Doc topic (e.g. quickstart, connect-agents). Omit for the index.").option("--print", "Print to stdout instead of opening a browser.").option("--list", "List available topics.").action(action7);
+  program2.command("docs").description("Open bundled Cerefox docs in your browser (or print to stdout).").argument("[topic]", "Doc topic (e.g. quickstart, connect-agents). Omit for the index.").option("--print", "Print to stdout instead of opening a browser.").option("--list", "List available topics.").action(action9);
 }
 
 // ../../node_modules/.bun/ora@9.4.0/node_modules/ora/index.js
@@ -41753,7 +42213,7 @@ var ansi_styles_default = ansiStyles;
 
 // ../../node_modules/.bun/chalk@5.6.2/node_modules/chalk/source/vendor/supports-color/index.js
 import process2 from "node:process";
-import os from "node:os";
+import os2 from "node:os";
 import tty from "node:tty";
 function hasFlag(flag, argv = globalThis.Deno ? globalThis.Deno.args : process2.argv) {
   const prefix = flag.startsWith("-") ? "" : flag.length === 1 ? "-" : "--";
@@ -41818,7 +42278,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return min;
   }
   if (process2.platform === "win32") {
-    const osRelease = os.release().split(".");
+    const osRelease = os2.release().split(".");
     if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
       return Number(osRelease[2]) >= 14931 ? 3 : 2;
     }
@@ -44132,7 +44592,7 @@ var format = (open, close) => {
     return result;
   };
 };
-var reset = format(0, 0);
+var reset2 = format(0, 0);
 var bold = format(1, 22);
 var dim = format(2, 22);
 var italic = format(3, 23);
@@ -44959,9 +45419,105 @@ init_cli_core();
 init_meta();
 init_config();
 init_config();
-import { existsSync as existsSync5, readFileSync as readFileSync5, realpathSync, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6, realpathSync, statSync as statSync2 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join7 } from "node:path";
+
+// ../../_shared/compatibility/index.ts
+var COMPATIBILITY = {
+  minSchema: "0.3.1",
+  minEdgeFunctions: "0.6.0"
+};
+function compareSemver(a, b2) {
+  const norm = (v) => v.split(/[.-]/).slice(0, 3).map((p) => Number.parseInt(p, 10)).map((n) => Number.isFinite(n) ? n : 0);
+  const pa = norm(a);
+  const pb = norm(b2);
+  for (let i = 0;i < 3; i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x !== y)
+      return x < y ? -1 : 1;
+  }
+  return 0;
+}
+function classifyCompat(deployed, min, bundled) {
+  if (!deployed)
+    return "unknown";
+  if (compareSemver(deployed, min) < 0)
+    return "below-min";
+  if (bundled && compareSemver(deployed, bundled) < 0)
+    return "above-min-but-old";
+  return "ok";
+}
+function aggregatorUrlFor(supabaseUrl) {
+  const base = supabaseUrl.replace(/\/$/, "");
+  return `${base}/functions/v1/cerefox-mcp/version?peers=true`;
+}
+async function checkServerCompatibility(opts) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const result = {
+    schema: { deployed: null, min: COMPATIBILITY.minSchema, level: "unknown" },
+    edgeFunctions: {
+      deployed: null,
+      min: COMPATIBILITY.minEdgeFunctions,
+      level: "unknown",
+      errors: []
+    },
+    blocking: false,
+    efProbeSkipped: false
+  };
+  if (!opts.bearer) {
+    result.efProbeSkipped = true;
+    result.efSkipReason = "No anon JWT (CEREFOX_SUPABASE_ANON_KEY) configured; Edge Function version check skipped.";
+    return result;
+  }
+  let agg = null;
+  try {
+    const ctrl = new AbortController;
+    const timer2 = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 6000);
+    try {
+      const resp = await fetchImpl(opts.aggregatorUrl, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${opts.bearer}`, apikey: opts.bearer },
+        signal: ctrl.signal
+      });
+      if (resp.ok) {
+        agg = await resp.json();
+      } else {
+        result.efProbeSkipped = true;
+        result.efSkipReason = resp.status === 404 || resp.status === 405 ? "Edge Functions predate v0.8 (no /version route). Redeploy with `cerefox deploy-server --functions-only` to enable version checks." : `Aggregator returned HTTP ${resp.status}; Edge Function version check skipped.`;
+      }
+    } finally {
+      clearTimeout(timer2);
+    }
+  } catch (err) {
+    result.efProbeSkipped = true;
+    result.efSkipReason = `Could not reach the version aggregator: ${err instanceof Error ? err.message : String(err)}`;
+  }
+  if (!agg)
+    return result;
+  result.schema.deployed = agg.schema ?? null;
+  result.schema.level = classifyCompat(result.schema.deployed, COMPATIBILITY.minSchema, opts.bundledSchema);
+  const versions = [];
+  if (agg.version)
+    versions.push(agg.version);
+  for (const ef of agg.efs ?? [])
+    versions.push(ef.version);
+  result.edgeFunctions.errors = agg.errors ?? [];
+  if (versions.length > 0) {
+    const weakest = versions.reduce((lo, v) => compareSemver(v, lo) < 0 ? v : lo);
+    result.edgeFunctions.deployed = weakest;
+    result.edgeFunctions.level = classifyCompat(weakest, COMPATIBILITY.minEdgeFunctions, opts.bundledEf);
+  } else {
+    result.edgeFunctions.level = "unknown";
+    result.efProbeSkipped = true;
+    result.efSkipReason = "Aggregator reported no Edge Function versions; check skipped.";
+  }
+  result.blocking = result.schema.level === "below-min" || result.edgeFunctions.level === "below-min";
+  return result;
+}
+
+// src/cli/util/checks.ts
 function checkBinary() {
   return {
     name: "binary",
@@ -45012,7 +45568,7 @@ function checkConfig() {
       hint: "Run `cerefox init` to bootstrap."
     };
   }
-  if (!existsSync5(envPath)) {
+  if (!existsSync8(envPath)) {
     return {
       name: "config",
       status: "error",
@@ -45136,11 +45692,24 @@ async function checkOpenAI() {
     };
   }
 }
+var SCHEMA_VERSION_RE = /^--\s*@version:\s*(\S+)/m;
+function readBundledSchemaVersion() {
+  try {
+    const assets = resolveServerAssets();
+    if (!existsSync8(assets.schemaFile))
+      return null;
+    const m = readFileSync6(assets.schemaFile, "utf8").match(SCHEMA_VERSION_RE);
+    return m ? m[1] : null;
+  } catch {
+    return null;
+  }
+}
+var SCHEMA_CHECK_NAME = "schema + RPCs";
 async function checkSchemaVersion() {
   const settings = loadSettings();
   if (!settings.supabaseUrl || !settings.supabaseKey) {
     return {
-      name: "schema",
+      name: SCHEMA_CHECK_NAME,
       status: "skipped",
       detail: "Supabase config missing; skipped."
     };
@@ -45158,31 +45727,50 @@ async function checkSchemaVersion() {
     });
     if (!resp.ok) {
       return {
-        name: "schema",
+        name: SCHEMA_CHECK_NAME,
         status: "error",
-        detail: `cerefox_schema_version returned ${resp.status}`,
-        hint: "Deploy the schema: `uv run python scripts/db_deploy.py`"
+        detail: `cerefox_schema_version returned ${resp.status} — schema not deployed.`,
+        hint: "Deploy the schema + RPCs (see remediation below)."
       };
     }
     const deployed = await resp.json();
-    return {
-      name: "schema",
-      status: "ok",
-      detail: `cerefox_schema_version() → "${deployed}"`
-    };
+    const bundled = readBundledSchemaVersion();
+    const level = classifyCompat(deployed, COMPATIBILITY.minSchema, bundled);
+    switch (level) {
+      case "below-min":
+        return {
+          name: SCHEMA_CHECK_NAME,
+          status: "error",
+          detail: `Deployed schema v${deployed} is below the required minimum v${COMPATIBILITY.minSchema}.`,
+          hint: "Update the schema + RPCs (see remediation below)."
+        };
+      case "above-min-but-old":
+        return {
+          name: SCHEMA_CHECK_NAME,
+          status: "warn",
+          detail: `Deployed schema v${deployed} works but is older than this client's bundled v${bundled}.`,
+          hint: "Update the schema + RPCs (see remediation below)."
+        };
+      default:
+        return {
+          name: SCHEMA_CHECK_NAME,
+          status: "ok",
+          detail: `cerefox_schema_version() → "${deployed}"${bundled ? ` (bundled v${bundled})` : ""}`
+        };
+    }
   } catch (err) {
     return {
-      name: "schema",
+      name: SCHEMA_CHECK_NAME,
       status: "error",
       detail: `Schema version probe failed: ${err instanceof Error ? err.message : String(err)}`
     };
   }
 }
 function hasCerefoxInJsonFile(path) {
-  if (!existsSync5(path))
+  if (!existsSync8(path))
     return false;
   try {
-    const parsed = JSON.parse(readFileSync5(path, "utf8"));
+    const parsed = JSON.parse(readFileSync6(path, "utf8"));
     const mcpServers = parsed.mcpServers;
     return Boolean(mcpServers && typeof mcpServers === "object" && "cerefox" in mcpServers);
   } catch {
@@ -45191,9 +45779,9 @@ function hasCerefoxInJsonFile(path) {
 }
 function checkMcpConfigs() {
   const home = homedir4();
-  const claudeCodeUser = join5(home, ".claude.json");
-  const claudeCodeProj = join5(process.cwd(), ".mcp.json");
-  const claudeDesktop = process.platform === "darwin" ? join5(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : process.platform === "win32" ? join5(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json") : join5(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeCodeUser = join7(home, ".claude.json");
+  const claudeCodeProj = join7(process.cwd(), ".mcp.json");
+  const claudeDesktop = process.platform === "darwin" ? join7(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : process.platform === "win32" ? join7(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json") : join7(home, ".config", "Claude", "claude_desktop_config.json");
   const found = [];
   if (hasCerefoxInJsonFile(claudeCodeUser))
     found.push("Claude Code (user)");
@@ -45217,9 +45805,9 @@ function checkMcpConfigs() {
 }
 function checkLegacyShadowEnv() {
   const home = homedir4();
-  const homeEnv = join5(home, USER_STATE_DIR_NAME, ".env");
-  const cwdEnv = join5(process.cwd(), ".env");
-  if (!existsSync5(homeEnv) || !existsSync5(cwdEnv))
+  const homeEnv = join7(home, USER_STATE_DIR_NAME, ".env");
+  const cwdEnv = join7(process.cwd(), ".env");
+  if (!existsSync8(homeEnv) || !existsSync8(cwdEnv))
     return null;
   try {
     if (realpathSync(homeEnv) === realpathSync(cwdEnv))
@@ -45278,6 +45866,68 @@ async function checkPostgres() {
     await sql.end({ timeout: 1 }).catch(() => {});
   }
 }
+async function checkEdgeFunctionsCompat() {
+  const settings = loadSettings();
+  if (!settings.supabaseUrl) {
+    return {
+      name: "edge functions",
+      status: "skipped",
+      detail: "Supabase URL not set; EF version check skipped."
+    };
+  }
+  if (!settings.supabaseAnonKey) {
+    return {
+      name: "edge functions",
+      status: "skipped",
+      detail: "No CEREFOX_SUPABASE_ANON_KEY set; EF version check skipped.",
+      hint: "Set the legacy anon JWT (eyJ…) to enable client↔server version checks."
+    };
+  }
+  let compat;
+  try {
+    compat = await checkServerCompatibility({
+      aggregatorUrl: aggregatorUrlFor(settings.supabaseUrl),
+      bearer: settings.supabaseAnonKey,
+      bundledEf: PKG_VERSION
+    });
+  } catch (err) {
+    return {
+      name: "edge functions",
+      status: "skipped",
+      detail: `Version probe failed: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (compat.efProbeSkipped) {
+    return {
+      name: "edge functions",
+      status: "skipped",
+      detail: compat.efSkipReason ?? "EF version check skipped."
+    };
+  }
+  const deployed = compat.edgeFunctions.deployed ?? "unknown";
+  switch (compat.edgeFunctions.level) {
+    case "below-min":
+      return {
+        name: "edge functions",
+        status: "error",
+        detail: `Deployed EF v${deployed} is below the required minimum v${compat.edgeFunctions.min}.`,
+        hint: "Update the Edge Functions (see remediation below)."
+      };
+    case "above-min-but-old":
+      return {
+        name: "edge functions",
+        status: "warn",
+        detail: `Deployed EF v${deployed} works but is older than this client (v${PKG_VERSION}).`,
+        hint: "Update the Edge Functions (see remediation below)."
+      };
+    default:
+      return {
+        name: "edge functions",
+        status: "ok",
+        detail: `Deployed EF v${deployed} (≥ required v${compat.edgeFunctions.min}).`
+      };
+  }
+}
 async function runSteps(steps, opts) {
   const results = [];
   for (let i = 0;i < steps.length; i++) {
@@ -45303,7 +45953,8 @@ async function runAllChecks(opts = {}) {
     { name: "legacy env", phase: "Checking legacy env shadowing", run: () => checkLegacyShadowEnv() },
     { name: "supabase", phase: "Probing Supabase Data API", run: () => checkSupabase() },
     { name: "openai", phase: "Probing OpenAI embeddings", run: () => checkOpenAI() },
-    { name: "schema", phase: "Reading schema version", run: () => checkSchemaVersion() },
+    { name: "schema + RPCs", phase: "Reading schema + RPC version", run: () => checkSchemaVersion() },
+    { name: "edge functions", phase: "Probing Edge Function versions", run: () => checkEdgeFunctionsCompat() },
     { name: "postgres", phase: "Probing Postgres DDL endpoint", run: () => checkPostgres() },
     { name: "mcp clients", phase: "Scanning MCP client configs", run: () => checkMcpConfigs() }
   ];
@@ -45331,7 +45982,7 @@ function symbol(status) {
       return cErr.dim("ℹ");
   }
 }
-async function action8(options) {
+async function action10(options) {
   const useSpinner = !options.json && process.stderr.isTTY;
   const spinner = useSpinner ? ora({ text: "Starting checks…", spinner: "dots", stream: process.stderr }).start() : null;
   const results = await runAllChecks({
@@ -45355,6 +46006,26 @@ async function action8(options) {
     }
     println("");
   }
+  if (!options.json) {
+    const stale = (name) => {
+      const r = results.find((x) => x.name === name);
+      return r != null && (r.status === "error" || r.status === "warn");
+    };
+    const needsSchema = stale("schema + RPCs");
+    const needsEf = stale("edge functions");
+    let remediation = null;
+    if (needsSchema && needsEf) {
+      remediation = "Update the server (schema + RPCs + Edge Functions): cerefox deploy-server";
+    } else if (needsSchema) {
+      remediation = "Update the schema + RPCs: cerefox deploy-server --schema-only";
+    } else if (needsEf) {
+      remediation = "Update the Edge Functions: cerefox deploy-server --functions-only";
+    }
+    if (remediation) {
+      println(cErr.yellow("→ " + remediation));
+      println("");
+    }
+  }
   const errCount = results.filter((r) => r.status === "error").length;
   const warnCount = results.filter((r) => r.status === "warn").length;
   if (errCount > 0) {
@@ -45368,13 +46039,13 @@ async function action8(options) {
   }
 }
 function registerDoctor(program2) {
-  program2.command("doctor").description("Run diagnostic checks against the installed Cerefox.").option("--json", "Emit machine-readable JSON (no colours, structured output).").action(action8);
+  program2.command("doctor").description("Run diagnostic checks against the installed Cerefox.").option("--json", "Emit machine-readable JSON (no colours, structured output).").action(action10);
 }
 
 // src/cli/commands/get-audit-log.ts
 init_cli_core();
 init_client();
-async function action9(options) {
+async function action11(options) {
   const limit = parsePositiveInt(options.limit, "--limit", 50);
   const client = getClient();
   const data = await client.rpc("cerefox_list_audit_entries", {
@@ -45412,14 +46083,14 @@ async function action9(options) {
   })));
 }
 function registerGetAuditLog(program2) {
-  program2.command("get-audit-log").description("Query the audit log with optional filters.").option("-d, --document-id <uuid>", "Filter by document.").option("-a, --author <name>", "Filter by author.").option("-o, --operation <type>", "Filter by operation: create, update-content, update-metadata, delete, restore.").option("--since <iso>", "Lower-bound ISO timestamp.").option("--until <iso>", "Upper-bound ISO timestamp.").option("-l, --limit <n>", "Maximum entries (max 200).", "50").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action9);
+  program2.command("get-audit-log").description("Query the audit log with optional filters.").option("-d, --document-id <uuid>", "Filter by document.").option("-a, --author <name>", "Filter by author.").option("-o, --operation <type>", "Filter by operation: create, update-content, update-metadata, delete, restore.").option("--since <iso>", "Lower-bound ISO timestamp.").option("--until <iso>", "Upper-bound ISO timestamp.").option("-l, --limit <n>", "Maximum entries (max 200).", "50").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action11);
 }
 
 // src/cli/commands/get-doc.ts
 init_cli_core();
 init_cli_core();
 init_client();
-async function action10(documentId, options) {
+async function action12(documentId, options) {
   const client = getClient();
   const rows = await client.rpc("cerefox_get_document", {
     p_document_id: documentId,
@@ -45449,18 +46120,18 @@ async function action10(documentId, options) {
   println(doc.full_content);
 }
 function registerGetDoc(program2) {
-  program2.command("get-doc").description("Retrieve the full content of a document by ID.").argument("<document-id>", "UUID of the document.").option("--version-id <uuid>", "Specific archived version (default: current).").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action10);
+  program2.command("get-doc").description("Retrieve the full content of a document by ID.").argument("<document-id>", "UUID of the document.").option("--version-id <uuid>", "Specific archived version (default: current).").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action12);
 }
 
 // src/cli/commands/ingest.ts
 init_dist4();
 init_cli_core();
 init_config();
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 import { basename as basename2, extname as extname2 } from "node:path";
 
 // src/ingestion/pipeline.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import { basename, extname, resolve as resolve3 } from "node:path";
 
 // ../../_shared/ingest/chunker.ts
@@ -46144,7 +46815,7 @@ ${c2.content}`);
     };
   }
   async ingestFile(path, opts = {}) {
-    const text = readFileSync6(path, "utf8");
+    const text = readFileSync7(path, "utf8");
     const absPath = resolve3(path);
     const stem = basename(absPath, extname(absPath));
     return this.ingestText({
@@ -46178,7 +46849,7 @@ async function readContent(path, paste) {
   }
   let content;
   try {
-    content = readFileSync7(path, "utf8");
+    content = readFileSync8(path, "utf8");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     throw userError(`Cannot read ${path}: ${msg}`);
@@ -46186,7 +46857,7 @@ async function readContent(path, paste) {
   const titleFromPath = basename2(path, extname2(path));
   return { content, titleFromPath };
 }
-async function action11(path, options) {
+async function action13(path, options) {
   const { content, titleFromPath } = await readContent(path, Boolean(options.paste));
   const title = options.title ?? titleFromPath;
   if (!title || title.trim() === "") {
@@ -46258,7 +46929,7 @@ async function action11(path, options) {
   }
 }
 function registerIngest(program2) {
-  program2.command("ingest").description("Ingest a file (or stdin paste) into the knowledge base.").argument("[path]", "Path to the file to ingest. Omit when using --paste.").option("--paste", "Read content from stdin instead of a file.").option("-t, --title <title>", "Document title (required with --paste; defaults to filename without extension).").option("-p, --project-name <name>", "Single project membership (non-destructive on update).").option("-P, --project-names <names>", "Comma-separated full project membership set (destructive replace on update).").option("-m, --metadata <json>", "JSON metadata object.").option("--source <label>", "Origin label (default: cli).", "cli").option("-u, --update-if-exists", "Update an existing doc with the same title.").option("-i, --document-id <uuid>", "Update a specific document by UUID (overrides --update-if-exists).").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").action(action11);
+  program2.command("ingest").description("Ingest a file (or stdin paste) into the knowledge base.").argument("[path]", "Path to the file to ingest. Omit when using --paste.").option("--paste", "Read content from stdin instead of a file.").option("-t, --title <title>", "Document title (required with --paste; defaults to filename without extension).").option("-p, --project-name <name>", "Single project membership (non-destructive on update).").option("-P, --project-names <names>", "Comma-separated full project membership set (destructive replace on update).").option("-m, --metadata <json>", "JSON metadata object.").option("--source <label>", "Origin label (default: cli).", "cli").option("-u, --update-if-exists", "Update an existing doc with the same title.").option("-i, --document-id <uuid>", "Update a specific document by UUID (overrides --update-if-exists).").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").action(action13);
 }
 
 // src/cli/commands/ingest-dir.ts
@@ -46266,18 +46937,18 @@ init_dist4();
 init_cli_core();
 init_config();
 var import_cli_progress = __toESM(require_cli_progress(), 1);
-import { readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
-import { basename as basename3, extname as extname3, join as join6 } from "node:path";
+import { readdirSync as readdirSync4, statSync as statSync3 } from "node:fs";
+import { basename as basename3, extname as extname3, join as join8 } from "node:path";
 function walk(dir, extensions) {
   let entries;
   try {
-    entries = readdirSync2(dir);
+    entries = readdirSync4(dir);
   } catch (err) {
     throw userError(`Cannot read directory ${dir}: ${err instanceof Error ? err.message : String(err)}`);
   }
   const files = [];
   for (const name of entries) {
-    const full = join6(dir, name);
+    const full = join8(dir, name);
     let stat;
     try {
       stat = statSync3(full);
@@ -46294,7 +46965,7 @@ function walk(dir, extensions) {
   }
   return files;
 }
-async function action12(dir, options) {
+async function action14(dir, options) {
   const extensions = new Set((options.extensions ?? ".md,.txt").split(",").map((e) => e.trim().toLowerCase()).map((e) => e.startsWith(".") ? e : "." + e).filter((e) => e.length > 0));
   const files = walk(dir, extensions);
   if (files.length === 0) {
@@ -46367,29 +47038,30 @@ async function action12(dir, options) {
   }
 }
 function registerIngestDir(program2) {
-  program2.command("ingest-dir").description("Recursively ingest a directory of markdown / text files.").argument("<dir>", "Root directory to walk.").option("-p, --project-name <name>", "Project membership for all ingested docs.").option("-m, --metadata <json>", "JSON metadata applied to every doc.").option("--source <label>", "Origin label (default: cli).", "cli").option("-u, --update-if-exists", "Update an existing doc with the same title.").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").option("-e, --extensions <list>", "Comma-separated file extensions to ingest.", ".md,.txt").action(action12);
+  program2.command("ingest-dir").description("Recursively ingest a directory of markdown / text files.").argument("<dir>", "Root directory to walk.").option("-p, --project-name <name>", "Project membership for all ingested docs.").option("-m, --metadata <json>", "JSON metadata applied to every doc.").option("--source <label>", "Origin label (default: cli).", "cli").option("-u, --update-if-exists", "Update an existing doc with the same title.").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").option("-e, --extensions <list>", "Comma-separated file extensions to ingest.", ".md,.txt").action(action14);
 }
 
 // src/cli/commands/init.ts
 init_cli_core();
 init_config();
+import { spawnSync as spawnSync4 } from "node:child_process";
 import {
   chmodSync,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync6,
+  existsSync as existsSync9,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { dirname as dirname4, join as join9 } from "node:path";
 async function readConfigFile(path) {
-  if (!existsSync6(path)) {
+  if (!existsSync9(path)) {
     throw userError(`--config file not found: ${path}`);
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync9(path, "utf8"));
+    parsed = JSON.parse(readFileSync10(path, "utf8"));
   } catch (err) {
     throw userError(`--config: invalid JSON in ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -46431,7 +47103,7 @@ function parseDotEnvFile(content) {
   return map;
 }
 function answersFromEnvFile(path) {
-  const parsed = parseDotEnvFile(readFileSync9(path, "utf8"));
+  const parsed = parseDotEnvFile(readFileSync10(path, "utf8"));
   const required = ["CEREFOX_SUPABASE_URL", "CEREFOX_SUPABASE_KEY", "OPENAI_API_KEY"];
   for (const key of required) {
     if (!parsed[key] || parsed[key].trim() === "") {
@@ -46592,14 +47264,60 @@ async function promptMigrationChoice() {
   const ch = choice.trim().toLowerCase() || "c";
   return ch;
 }
-async function postWriteLifecycle(envPath, options) {
-  if (!options.skipSchema) {
+async function probeSchemaVersion(url, key) {
+  try {
+    const resp = await fetch(`${url.replace(/\/$/, "")}/rest/v1/rpc/cerefox_schema_version`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", apikey: key, Authorization: `Bearer ${key}` },
+      body: "{}"
+    });
+    if (!resp.ok)
+      return null;
+    const data = await resp.json();
+    return typeof data === "string" ? data : null;
+  } catch {
+    return null;
+  }
+}
+function launchDeployServer(extraArgs = []) {
+  const r = spawnSync4(process.execPath, [process.argv[1], "deploy-server", ...extraArgs], {
+    stdio: "inherit"
+  });
+  return r.status ?? 1;
+}
+async function maybeOfferServerDeploy() {
+  const settings = loadSettings();
+  if (!settings.supabaseUrl || !settings.supabaseKey)
+    return;
+  const deployed = await probeSchemaVersion(settings.supabaseUrl, settings.supabaseKey);
+  if (deployed === null) {
+    println(c.bold("Schema deploy"));
+    println(c.dim("  No Cerefox schema detected on this Supabase project."));
+    const yes = await confirm("  Deploy the server now (schema + RPCs + Edge Functions)?", false);
+    if (yes)
+      launchDeployServer();
+    else
+      println(c.dim("  Skipped. Run `cerefox deploy-server` later (or `cerefox doctor` to recheck)."));
+    println("");
+    return;
+  }
+  if (compareSemver(deployed, COMPATIBILITY.minSchema) < 0) {
     println(c.bold("Schema deploy"));
-    println(c.dim(`  v0.5 doesn't yet bundle the schema-deploy path (it needs the direct
-` + "  Postgres connection ported, scheduled for v0.6). For now:"));
-    println(c.cyan("    uv run python scripts/db_deploy.py"));
-    println(c.dim("  Skip this if your Supabase already has the schema."));
+    println(c.yellow(`  Deployed schema v${deployed} is below the required v${COMPATIBILITY.minSchema}.`));
+    const yes = await confirm("  Update the server now (applies pending migrations, refreshes RPCs + EFs)?", true);
+    if (yes)
+      launchDeployServer();
+    else
+      println(c.dim("  Skipped. Run `cerefox deploy-server` when ready."));
     println("");
+    return;
+  }
+  println(c.dim(`Schema v${deployed} already deployed (≥ required v${COMPATIBILITY.minSchema}).`));
+  println("");
+}
+async function postWriteLifecycle(envPath, options) {
+  if (!options.skipSchema) {
+    await maybeOfferServerDeploy();
   }
   if (!options.skipSelfDocs) {
     println(c.bold("Self-doc ingest"));
@@ -46640,7 +47358,7 @@ async function postWriteLifecycle(envPath, options) {
   println(c.dim(`  Config in effect: ${envPath}`));
 }
 function writeAnswersTo(target, answers) {
-  mkdirSync3(dirname3(target), { recursive: true });
+  mkdirSync3(dirname4(target), { recursive: true });
   writeFileSync3(target, buildEnvFile(answers), "utf8");
   if (process.platform !== "win32") {
     try {
@@ -46650,13 +47368,13 @@ function writeAnswersTo(target, answers) {
     }
   }
 }
-async function action14(options) {
-  const homeEnv = join7(homedir5(), USER_STATE_DIR_NAME, ".env");
-  const cwdEnv = join7(process.cwd(), ".env");
+async function action16(options) {
+  const homeEnv = join9(homedir5(), USER_STATE_DIR_NAME, ".env");
+  const cwdEnv = join9(process.cwd(), ".env");
   const explicitDir = (process.env.CEREFOX_CONFIG_DIR ?? "").trim();
   if (explicitDir) {
     const target2 = resolveEnvFile();
-    if (existsSync6(target2) && !options.force) {
+    if (existsSync9(target2) && !options.force) {
       println(c.yellow(`⚠ Config already exists at ${target2}.`));
       const ok2 = await confirm("Overwrite?", true);
       if (!ok2) {
@@ -46678,7 +47396,7 @@ async function action14(options) {
     await postWriteLifecycle(target2, options);
     return;
   }
-  if (existsSync6(homeEnv) && !options.force) {
+  if (existsSync9(homeEnv) && !options.force) {
     println(c.yellow(`⚠ Config already exists at ${homeEnv}.`));
     const ok2 = await confirm("Overwrite?", true);
     if (!ok2) {
@@ -46699,12 +47417,12 @@ async function action14(options) {
     await postWriteLifecycle(homeEnv, options);
     return;
   }
-  if (existsSync6(cwdEnv) && !options.force && !options.config) {
+  if (existsSync9(cwdEnv) && !options.force && !options.config) {
     printMigrationMenu(cwdEnv, homeEnv);
     const ch = await promptMigrationChoice();
     println("");
     if (ch === "c") {
-      mkdirSync3(dirname3(homeEnv), { recursive: true });
+      mkdirSync3(dirname4(homeEnv), { recursive: true });
       copyFileSync2(cwdEnv, homeEnv);
       if (process.platform !== "win32") {
         try {
@@ -46759,13 +47477,13 @@ async function action14(options) {
   await postWriteLifecycle(target, options);
 }
 function registerInit(program2) {
-  program2.command("init").description("Interactive first-run setup (config, schema deploy stub, optional MCP wiring).").option("-c, --config <file>", "Non-interactive mode: read answers from a JSON file.").option("--force", "Overwrite existing configuration without prompting.").option("--skip-schema", "Skip the schema deploy step.").option("--skip-self-docs", "Skip the bundled self-doc ingest.").option("--skip-agent-config", "Skip the optional MCP agent wiring.").action(action14);
+  program2.command("init").description("Interactive first-run setup (config, schema deploy stub, optional MCP wiring).").option("-c, --config <file>", "Non-interactive mode: read answers from a JSON file.").option("--force", "Overwrite existing configuration without prompting.").option("--skip-schema", "Skip the schema deploy step.").option("--skip-self-docs", "Skip the bundled self-doc ingest.").option("--skip-agent-config", "Skip the optional MCP agent wiring.").action(action16);
 }
 
 // src/cli/commands/list-docs.ts
 init_cli_core();
 init_client();
-async function action15(options) {
+async function action17(options) {
   const limit = parsePositiveInt(options.limit, "--limit", 100);
   const client = getClient();
   let projectId;
@@ -46820,13 +47538,13 @@ async function action15(options) {
   })));
 }
 function registerListDocs(program2) {
-  program2.command("list-docs").description("List documents in the knowledge base.").option("-p, --project <name>", "Filter to a specific project.").option("-l, --limit <n>", "Maximum docs to return.", "100").option("--json", "Emit machine-readable JSON.").action(action15);
+  program2.command("list-docs").description("List documents in the knowledge base.").option("-p, --project <name>", "Filter to a specific project.").option("-l, --limit <n>", "Maximum docs to return.", "100").option("--json", "Emit machine-readable JSON.").action(action17);
 }
 
 // src/cli/commands/list-metadata-keys.ts
 init_cli_core();
 init_client();
-async function action16(options) {
+async function action18(options) {
   const client = getClient();
   const data = await client.rpc("cerefox_list_metadata_keys");
   if (data === null) {
@@ -46854,13 +47572,13 @@ async function action16(options) {
   })));
 }
 function registerListMetadataKeys(program2) {
-  program2.command("list-metadata-keys").description("List all metadata keys with document counts and example values.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action16);
+  program2.command("list-metadata-keys").description("List all metadata keys with document counts and example values.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action18);
 }
 
 // src/cli/commands/list-projects.ts
 init_cli_core();
 init_client();
-async function action17(options) {
+async function action19(options) {
   const client = getClient();
   const { data, error: error2 } = await client.raw.from("cerefox_projects").select("id, name, description, created_at").order("name", { ascending: true });
   if (error2) {
@@ -46889,13 +47607,13 @@ async function action17(options) {
   })), "(no projects)");
 }
 function registerListProjects(program2) {
-  program2.command("list-projects").description("List all projects in the knowledge base.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action17);
+  program2.command("list-projects").description("List all projects in the knowledge base.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action19);
 }
 
 // src/cli/commands/list-versions.ts
 init_cli_core();
 init_client();
-async function action18(documentId, options) {
+async function action20(documentId, options) {
   const client = getClient();
   const data = await client.rpc("cerefox_list_document_versions", {
     p_document_id: documentId
@@ -46936,7 +47654,7 @@ async function action18(documentId, options) {
   })));
 }
 function registerListVersions(program2) {
-  program2.command("list-versions").description("List archived versions of a document.").argument("<document-id>", "UUID of the document.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action18);
+  program2.command("list-versions").description("List archived versions of a document.").argument("<document-id>", "UUID of the document.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action20);
 }
 
 // src/cli/commands/mcp.ts
@@ -46951,7 +47669,7 @@ function registerMcp(program2) {
 // src/cli/commands/metadata-search.ts
 init_cli_core();
 init_client();
-async function action19(options) {
+async function action21(options) {
   const metadataFilter = parseJsonObjectArg(options.metadataFilter, "--metadata-filter");
   if (!metadataFilter || Object.keys(metadataFilter).length === 0) {
     throw userError("--metadata-filter is required and must be a non-empty JSON object.", `Example: --metadata-filter '{"type":"decision-log"}'.`);
@@ -47014,7 +47732,7 @@ async function action19(options) {
   }
 }
 function registerMetadataSearch(program2) {
-  program2.command("metadata-search").description("Find documents by metadata criteria (no text query).").requiredOption("-f, --metadata-filter <json>", "JSON object; only docs whose metadata contains ALL pairs are returned.").option("-p, --project-name <name>", "Filter to a specific project.").option("--updated-since <iso>", "Only docs updated on/after this ISO timestamp.").option("--created-since <iso>", "Only docs created on/after this ISO timestamp.").option("--include-content", "Include full document text in results.").option("-l, --limit <n>", "Maximum docs to return.", "10").option("--max-bytes <n>", "Response size budget in bytes (with --include-content).", "200000").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action19);
+  program2.command("metadata-search").description("Find documents by metadata criteria (no text query).").requiredOption("-f, --metadata-filter <json>", "JSON object; only docs whose metadata contains ALL pairs are returned.").option("-p, --project-name <name>", "Filter to a specific project.").option("--updated-since <iso>", "Only docs updated on/after this ISO timestamp.").option("--created-since <iso>", "Only docs created on/after this ISO timestamp.").option("--include-content", "Include full document text in results.").option("-l, --limit <n>", "Maximum docs to return.", "10").option("--max-bytes <n>", "Response size budget in bytes (with --include-content).", "200000").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action21);
 }
 
 // src/cli/commands/reindex.ts
@@ -47022,7 +47740,7 @@ init_dist4();
 init_cli_core();
 init_config();
 var DEFAULT_MODEL = "text-embedding-3-small";
-async function action20(options) {
+async function action22(options) {
   const settings = loadSettings();
   if (!settings.supabaseUrl || !settings.supabaseKey) {
     throw userError("Supabase credentials not configured — run `cerefox init` first.");
@@ -47101,41 +47819,41 @@ ${c2.content}`;
   }
 }
 function registerReindex(program2) {
-  program2.command("reindex").description("Re-embed existing document chunks (v0.7+).").option("--all", "Reindex every chunk regardless of embedder.").option("--batch <n>", "Chunks per OpenAI batch call. Capped at 96 internally.", "32").option("--dry-run", "Show counts without re-embedding.").option("-i, --document-id <uuid>", "Limit reindex to a single document.").action(action20);
+  program2.command("reindex").description("Re-embed existing document chunks (v0.7+).").option("--all", "Reindex every chunk regardless of embedder.").option("--batch <n>", "Chunks per OpenAI batch call. Capped at 96 internally.", "32").option("--dry-run", "Show counts without re-embedding.").option("-i, --document-id <uuid>", "Limit reindex to a single document.").action(action22);
 }
 
 // src/cli/commands/restore.ts
 init_cli_core();
 init_client();
-import { existsSync as existsSync7, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join8, resolve as resolve4 } from "node:path";
+import { join as join10, resolve as resolve4 } from "node:path";
 function expandHome2(path) {
   if (path === "~")
     return homedir6();
   if (path.startsWith("~/"))
-    return join8(homedir6(), path.slice(2));
+    return join10(homedir6(), path.slice(2));
   return path;
 }
 function resolveBackupFile(target) {
   const path = resolve4(expandHome2(target));
-  if (!existsSync7(path)) {
+  if (!existsSync10(path)) {
     throw userError(`Backup path not found: ${target}`);
   }
   const stat = statSync4(path);
   if (stat.isFile())
     return path;
-  const candidates = readdirSync3(path).filter((n) => n.endsWith(".json") && n.startsWith("cerefox-")).map((n) => ({ name: n, mtime: statSync4(join8(path, n)).mtimeMs })).sort((a, b2) => b2.mtime - a.mtime);
+  const candidates = readdirSync5(path).filter((n) => n.endsWith(".json") && n.startsWith("cerefox-")).map((n) => ({ name: n, mtime: statSync4(join10(path, n)).mtimeMs })).sort((a, b2) => b2.mtime - a.mtime);
   if (candidates.length === 0) {
     throw userError(`No cerefox-*.json files in ${path}`);
   }
-  return join8(path, candidates[0].name);
+  return join10(path, candidates[0].name);
 }
-async function action21(target, options) {
+async function action23(target, options) {
   const file = resolveBackupFile(target);
   let payload;
   try {
-    payload = JSON.parse(readFileSync10(file, "utf8"));
+    payload = JSON.parse(readFileSync11(file, "utf8"));
   } catch (err) {
     throw userError(`Could not parse backup file ${file}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -47187,7 +47905,7 @@ async function action21(target, options) {
   }
 }
 function registerRestore(program2) {
-  program2.command("restore").description("Restore a JSON-snapshot backup into the knowledge base.").argument("<snapshot>", "Backup file (or directory; most recent is picked) produced by `cerefox backup`.").option("--dry-run", "Print what would be restored without writing.").option("-p, --project-name <name>", "Reserved for future use; currently ignored (project memberships ride along with each doc's metadata).").action(action21);
+  program2.command("restore").description("Restore a JSON-snapshot backup into the knowledge base.").argument("<snapshot>", "Backup file (or directory; most recent is picked) produced by `cerefox backup`.").option("--dry-run", "Print what would be restored without writing.").option("-p, --project-name <name>", "Reserved for future use; currently ignored (project memberships ride along with each doc's metadata).").action(action23);
 }
 
 // src/cli/commands/search.ts
@@ -47212,7 +47930,7 @@ async function embedQuery(query) {
 }
 
 // src/cli/commands/search.ts
-async function action22(query, options) {
+async function action24(query, options) {
   if (!query || query.trim() === "") {
     throw userError("Empty query.");
   }
@@ -47346,13 +48064,13 @@ async function action22(query, options) {
   }
 }
 function registerSearch(program2) {
-  program2.command("search").description("Search the knowledge base (hybrid FTS + semantic).").argument("<query>", "Natural-language search query.").option("-c, --match-count <n>", "Maximum number of documents to return.", "5").option("-p, --project-name <name>", "Filter results to a specific project.").option("-f, --metadata-filter <json>", "JSON containment filter; only docs whose metadata contains ALL pairs are returned.").option("--mode <mode>", "Search mode: docs (default), hybrid, fts.", "docs").option("--alpha <float>", "Semantic weight 0..1 (default: 0.7).", "0.7").option("--min-score <float>", "Minimum cosine similarity threshold.", "0.5").option("--max-bytes <n>", "Response size budget in bytes.", "200000").option("-r, --requestor <name>", "Agent / user name (recorded in usage log).").option("--json", "Emit machine-readable JSON instead of the default text.").action(action22);
+  program2.command("search").description("Search the knowledge base (hybrid FTS + semantic).").argument("<query>", "Natural-language search query.").option("-c, --match-count <n>", "Maximum number of documents to return.", "5").option("-p, --project-name <name>", "Filter results to a specific project.").option("-f, --metadata-filter <json>", "JSON containment filter; only docs whose metadata contains ALL pairs are returned.").option("--mode <mode>", "Search mode: docs (default), hybrid, fts.", "docs").option("--alpha <float>", "Semantic weight 0..1 (default: 0.7).", "0.7").option("--min-score <float>", "Minimum cosine similarity threshold.", "0.5").option("--max-bytes <n>", "Response size budget in bytes.", "200000").option("-r, --requestor <name>", "Agent / user name (recorded in usage log).").option("--json", "Emit machine-readable JSON instead of the default text.").action(action24);
 }
 
 // src/cli/commands/self-update.ts
 init_cli_core();
 init_meta();
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 function detectRuntime() {
   const bin = (process.argv[1] ?? "").toLowerCase();
   if (bin.includes(".bun") || bin.includes("/bun/")) {
@@ -47393,7 +48111,7 @@ async function fetchLatestVersion() {
   }
   return body.version;
 }
-async function action23(options) {
+async function action25(options) {
   let target;
   try {
     target = options.version ?? await fetchLatestVersion();
@@ -47425,7 +48143,7 @@ async function action23(options) {
       return;
     }
   }
-  const result = spawnSync3(runtime.command, runtime.args(target), {
+  const result = spawnSync5(runtime.command, runtime.args(target), {
     stdio: "inherit"
   });
   if (result.status !== 0) {
@@ -47445,7 +48163,7 @@ async function action23(options) {
 }
 function registerSelfUpdate(program2) {
   const desc = "Upgrade Cerefox in place. Alias: `cerefox upgrade`.";
-  const declaration = (cmd) => cmd.description(desc).option("--check", "Print current vs latest; do nothing.").option("--yes", "Non-interactive (skip confirmation).").option("--version <version>", "Pin a specific version (e.g. 0.5.1 or 0.6.0-rc.1).").action(action23);
+  const declaration = (cmd) => cmd.description(desc).option("--check", "Print current vs latest; do nothing.").option("--yes", "Non-interactive (skip confirmation).").option("--version <version>", "Pin a specific version (e.g. 0.5.1 or 0.6.0-rc.1).").action(action25);
   declaration(program2.command("self-update"));
   declaration(program2.command("upgrade"));
 }
@@ -47464,7 +48182,7 @@ function symbol2(status) {
       return cErr.dim("ℹ");
   }
 }
-async function action24(options) {
+async function action26(options) {
   const useSpinner = !options.json && process.stderr.isTTY;
   const spinner = useSpinner ? ora({ text: "Starting checks…", spinner: "dots", stream: process.stderr }).start() : null;
   const results = await runFastChecks({
@@ -47485,7 +48203,7 @@ async function action24(options) {
   }
 }
 function registerStatus(program2) {
-  program2.command("status").description("Quick sanity check (fast subset of `cerefox doctor`).").option("--json", "Emit machine-readable JSON.").action(action24);
+  program2.command("status").description("Quick sanity check (fast subset of `cerefox doctor`).").option("--json", "Emit machine-readable JSON.").action(action26);
 }
 
 // src/cli/commands/sync-docs.ts
@@ -47494,19 +48212,19 @@ init_mcp_tools();
 init_config();
 init_client();
 import {
-  existsSync as existsSync8,
-  readFileSync as readFileSync11,
-  readdirSync as readdirSync4,
+  existsSync as existsSync11,
+  readFileSync as readFileSync12,
+  readdirSync as readdirSync6,
   statSync as statSync5
 } from "node:fs";
-import { basename as basename5, extname as extname5, join as join9, relative } from "node:path";
+import { basename as basename5, extname as extname5, join as join11, relative } from "node:path";
 var ROOT_LEVEL_DOCS = ["README.md", "AGENT_GUIDE.md", "AGENT_QUICK_REFERENCE.md"];
 function walkMarkdown(dir) {
   const out = [];
-  if (!existsSync8(dir))
+  if (!existsSync11(dir))
     return out;
-  for (const name of readdirSync4(dir)) {
-    const full = join9(dir, name);
+  for (const name of readdirSync6(dir)) {
+    const full = join11(dir, name);
     let stat;
     try {
       stat = statSync5(full);
@@ -47521,16 +48239,16 @@ function walkMarkdown(dir) {
   }
   return out;
 }
-async function action25(options) {
+async function action27(options) {
   const cwd = process.cwd();
   const project = options.project ?? "cerefox";
   const targets = [];
   for (const rel of ROOT_LEVEL_DOCS) {
-    const abs = join9(cwd, rel);
-    if (existsSync8(abs))
+    const abs = join11(cwd, rel);
+    if (existsSync11(abs))
       targets.push({ abs, rel });
   }
-  for (const abs of walkMarkdown(join9(cwd, "docs"))) {
+  for (const abs of walkMarkdown(join11(cwd, "docs"))) {
     targets.push({ abs, rel: relative(cwd, abs) });
   }
   if (targets.length === 0) {
@@ -47554,7 +48272,7 @@ async function action25(options) {
   const authorType = resolveAuthorType("agent");
   const outcomes = [];
   for (const t of targets) {
-    const content = readFileSync11(t.abs, "utf8");
+    const content = readFileSync12(t.abs, "utf8");
     const title = basename5(t.abs, extname5(t.abs));
     try {
       const message = await ingestTool.handler(client.raw, {
@@ -47583,7 +48301,7 @@ async function action25(options) {
   }
 }
 function registerSyncDocs(program2) {
-  program2.command("sync-docs").description("Sync repo docs (README, AGENT_*, docs/) into a Cerefox project.").option("--dry-run", "Print what would be synced without writing.").option("-p, --project <name>", "Target project for the sync.", "cerefox").action(action25);
+  program2.command("sync-docs").description("Sync repo docs (README, AGENT_*, docs/) into a Cerefox project.").option("--dry-run", "Print what would be synced without writing.").option("-p, --project <name>", "Target project for the sync.", "cerefox").action(action27);
 }
 
 // src/cli/program.ts
@@ -48918,8 +49636,8 @@ var _baseMimes = {
 var baseMimes = _baseMimes;
 
 // ../../node_modules/.bun/@hono+node-server@2.0.4+1bbe96acb4c5ebf1/node_modules/@hono/node-server/dist/serve-static.mjs
-import { createReadStream, existsSync as existsSync9, statSync as statSync6 } from "node:fs";
-import { join as join10 } from "node:path";
+import { createReadStream, existsSync as existsSync12, statSync as statSync6 } from "node:fs";
+import { join as join12 } from "node:path";
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 var ENCODINGS = {
   br: ".br",
@@ -48951,7 +49669,7 @@ var tryDecodeURI = (str) => tryDecode(str, decodeURI);
 var serveStatic = (options = { root: "" }) => {
   const root = options.root || "";
   const optionPath = options.path;
-  if (root !== "" && !existsSync9(root))
+  if (root !== "" && !existsSync12(root))
     console.error(`serveStatic: root path '${root}' is not found, are you sure it's correct?`);
   return async (c2, next) => {
     if (c2.finalized)
@@ -48968,11 +49686,11 @@ var serveStatic = (options = { root: "" }) => {
         await options.onNotFound?.(c2.req.path, c2);
         return next();
       }
-    let path = join10(root, !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c2) : filename);
+    let path = join12(root, !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c2) : filename);
     let stats = getStats(path);
     if (stats && stats.isDirectory()) {
       const indexFile = options.index ?? "index.html";
-      path = join10(path, indexFile);
+      path = join12(path, indexFile);
       stats = getStats(path);
     }
     if (!stats) {
@@ -49029,9 +49747,9 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // src/web/server.ts
-import { existsSync as existsSync12 } from "node:fs";
-import { readFileSync as readFileSync13 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
+import { join as join15 } from "node:path";
 
 // ../../node_modules/.bun/hono@4.12.23/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
@@ -50838,7 +51556,7 @@ function registerConfigRoutes(app, ctx) {
 }
 
 // src/web/routes/discovery.ts
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DOC_COLS = "id, title, source, source_path, content_hash, metadata, chunk_count, total_chars, review_status, created_at, updated_at, deleted_at";
 function jsonByteLength(value) {
   return Buffer.byteLength(JSON.stringify(value), "utf8");
@@ -51284,7 +52002,7 @@ function registerDiscoveryRoutes(app, ctx) {
     if (!path) {
       return c2.json({ tried_path: "", anchor, matches: [] });
     }
-    if (UUID_RE.test(path)) {
+    if (UUID_RE2.test(path)) {
       if (path === fromDocId) {
         return c2.json({ tried_path: path, anchor, matches: [] });
       }
@@ -51880,13 +52598,13 @@ import { execFileSync } from "node:child_process";
 
 // src/web/docs.ts
 import {
-  existsSync as existsSync10,
-  readFileSync as readFileSync12,
-  readdirSync as readdirSync5,
+  existsSync as existsSync13,
+  readFileSync as readFileSync13,
+  readdirSync as readdirSync7,
   statSync as statSync7
 } from "node:fs";
-import { basename as basename6, dirname as dirname4, join as join11, resolve as resolve5 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { basename as basename6, dirname as dirname5, join as join13, resolve as resolve5 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 var TOP_LEVEL_DOCS = [
   { filename: "README.md", path: "README.md", category: "readme" },
   {
@@ -51900,38 +52618,38 @@ var TOP_LEVEL_DOCS = [
     category: "agent-guide"
   }
 ];
-function moduleDir() {
-  return dirname4(fileURLToPath2(import.meta.url));
+function moduleDir2() {
+  return dirname5(fileURLToPath3(import.meta.url));
 }
 function resolveDocsRoots() {
-  const here = moduleDir();
+  const here = moduleDir2();
   const pkgRootCandidates = [
-    join11(here, "..", ".."),
-    join11(here, "..", "..", "..", "..")
+    join13(here, "..", ".."),
+    join13(here, "..", "..", "..", "..")
   ];
   let pkgGuides = null;
   let pkgTopLevel = null;
   for (const pkg of pkgRootCandidates) {
-    const guides = join11(pkg, "docs", "guides");
-    if (existsSync10(guides) && statSync7(guides).isDirectory()) {
+    const guides = join13(pkg, "docs", "guides");
+    if (existsSync13(guides) && statSync7(guides).isDirectory()) {
       pkgGuides = guides;
       pkgTopLevel = pkg;
       break;
     }
   }
-  const repoCandidate = join11(here, "..", "..", "..", "..");
-  const repoGuides = join11(repoCandidate, "docs", "guides");
+  const repoCandidate = join13(here, "..", "..", "..", "..");
+  const repoGuides = join13(repoCandidate, "docs", "guides");
   const repoTopLevel = repoCandidate;
   return {
     pkgGuides,
     pkgTopLevel,
-    repoGuides: existsSync10(repoGuides) ? repoGuides : null,
-    repoTopLevel: existsSync10(join11(repoTopLevel, "README.md")) ? repoTopLevel : null
+    repoGuides: existsSync13(repoGuides) ? repoGuides : null,
+    repoTopLevel: existsSync13(join13(repoTopLevel, "README.md")) ? repoTopLevel : null
   };
 }
 function readH1(filePath) {
   try {
-    const content = readFileSync12(filePath, "utf8");
+    const content = readFileSync13(filePath, "utf8");
     const match2 = content.match(/^#\s+(.+?)\s*$/m);
     return match2 ? match2[1] : null;
   } catch {
@@ -51951,17 +52669,17 @@ function listBundledDocs2() {
   const topRoot = pkgTopLevel ?? repoTopLevel;
   if (topRoot) {
     for (const t of TOP_LEVEL_DOCS) {
-      const abs = join11(topRoot, t.filename);
-      if (existsSync10(abs)) {
+      const abs = join13(topRoot, t.filename);
+      if (existsSync13(abs)) {
         entries.push(entryForFile(abs, t.path, t.category));
       }
     }
   }
   const guidesRoot = pkgGuides ?? repoGuides;
   if (guidesRoot) {
-    const names = readdirSync5(guidesRoot).filter((n) => n.endsWith(".md")).sort();
+    const names = readdirSync7(guidesRoot).filter((n) => n.endsWith(".md")).sort();
     for (const name of names) {
-      const abs = join11(guidesRoot, name);
+      const abs = join13(guidesRoot, name);
       entries.push(entryForFile(abs, `guides/${name}`, "guide"));
     }
   }
@@ -51975,9 +52693,9 @@ function readDoc(docPath) {
     if (!candidate.startsWith(resolve5(root) + "/") && candidate !== resolve5(root)) {
       continue;
     }
-    if (existsSync10(candidate) && statSync7(candidate).isFile()) {
+    if (existsSync13(candidate) && statSync7(candidate).isFile()) {
       try {
-        return readFileSync12(candidate, "utf8");
+        return readFileSync13(candidate, "utf8");
       } catch {
         return null;
       }
@@ -52006,7 +52724,7 @@ var VERSION_INFO = {
   git_commit_short: resolveGitCommitShort(),
   build_date: process.env.CEREFOX_BUILD_DATE ?? null
 };
-var SCHEMA_VERSION_RE = /^--\s*@version:\s*(\S+)/m;
+var SCHEMA_VERSION_RE2 = /^--\s*@version:\s*(\S+)/m;
 function registerMetaRoutes(app, ctx) {
   app.get("/api/v1/version", (c2) => c2.json(VERSION_INFO));
   app.get("/api/v1/docs", (c2) => c2.json(listBundledDocs2()));
@@ -52023,18 +52741,18 @@ function registerMetaRoutes(app, ctx) {
   app.get("/api/v1/schema-version", async (c2) => {
     let bundled = null;
     try {
-      const { readFileSync: readFileSync13, existsSync: existsSync11 } = await import("node:fs");
-      const { fileURLToPath: fileURLToPath3 } = await import("node:url");
-      const { dirname: dirname5, join: join12 } = await import("node:path");
-      const here = dirname5(fileURLToPath3(import.meta.url));
+      const { readFileSync: readFileSync14, existsSync: existsSync14 } = await import("node:fs");
+      const { fileURLToPath: fileURLToPath4 } = await import("node:url");
+      const { dirname: dirname6, join: join14 } = await import("node:path");
+      const here = dirname6(fileURLToPath4(import.meta.url));
       const candidates = [
-        join12(here, "..", "..", "..", "db", "schema.sql"),
-        join12(here, "..", "..", "..", "..", "..", "src", "cerefox", "db", "schema.sql")
+        join14(here, "..", "..", "..", "db", "schema.sql"),
+        join14(here, "..", "..", "..", "..", "..", "src", "cerefox", "db", "schema.sql")
       ];
       for (const path of candidates) {
-        if (existsSync11(path)) {
-          const sql = readFileSync13(path, "utf8");
-          const match2 = sql.match(SCHEMA_VERSION_RE);
+        if (existsSync14(path)) {
+          const sql = readFileSync14(path, "utf8");
+          const match2 = sql.match(SCHEMA_VERSION_RE2);
           bundled = match2 ? match2[1] : null;
           break;
         }
@@ -52071,7 +52789,14 @@ function registerMetaRoutes(app, ctx) {
       } catch {}
     }
     const mismatch = Boolean(bundled && deployed && bundled !== deployed);
-    return c2.json({ bundled, deployed, mismatch });
+    const level = classifyCompat(deployed, COMPATIBILITY.minSchema, bundled);
+    return c2.json({
+      bundled,
+      deployed,
+      mismatch,
+      level,
+      min: COMPATIBILITY.minSchema
+    });
   });
 }
 
@@ -52136,21 +52861,21 @@ function registerProjectsRoutes(app, ctx) {
 }
 
 // src/web/static.ts
-import { existsSync as existsSync11, statSync as statSync8 } from "node:fs";
-import { dirname as dirname5, join as join12 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
-function moduleDir2() {
-  return dirname5(fileURLToPath3(import.meta.url));
+import { existsSync as existsSync14, statSync as statSync8 } from "node:fs";
+import { dirname as dirname6, join as join14 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+function moduleDir3() {
+  return dirname6(fileURLToPath4(import.meta.url));
 }
 function isUsableSpaDir(dir) {
-  return existsSync11(dir) && statSync8(dir).isDirectory() && existsSync11(join12(dir, "index.html"));
+  return existsSync14(dir) && statSync8(dir).isDirectory() && existsSync14(join14(dir, "index.html"));
 }
 function resolveSpaDist() {
-  const here = moduleDir2();
+  const here = moduleDir3();
   const candidates = [
-    join12(here, "..", "frontend"),
-    join12(here, "..", "..", "dist", "frontend"),
-    join12(here, "..", "..", "..", "..", "frontend", "dist")
+    join14(here, "..", "frontend"),
+    join14(here, "..", "..", "..", "..", "frontend", "dist"),
+    join14(here, "..", "..", "dist", "frontend")
   ];
   for (const c2 of candidates) {
     if (isUsableSpaDir(c2))
@@ -52159,13 +52884,13 @@ function resolveSpaDist() {
   return null;
 }
 function resolveStaticDir() {
-  const here = moduleDir2();
+  const here = moduleDir3();
   const candidates = [
-    join12(here, "..", "static"),
-    join12(here, "..", "..", "..", "..", "web", "static")
+    join14(here, "..", "static"),
+    join14(here, "..", "..", "..", "..", "web", "static")
   ];
   for (const c2 of candidates) {
-    if (existsSync11(c2) && statSync8(c2).isDirectory())
+    if (existsSync14(c2) && statSync8(c2).isDirectory())
       return c2;
   }
   return null;
@@ -52207,10 +52932,13 @@ var ROOT_REDIRECT_HTML = `<!DOCTYPE html>
 </html>`;
 
 // src/web/server.ts
+init_meta();
+init_cli_core();
+init_config();
 function buildApp(ctx = buildWebContext()) {
   const app = new Hono2;
   if (true) {
-    app.use(logger());
+    app.use(logger((message, ...rest) => console.log(`${localTimestamp()}  ${message}`, ...rest)));
   }
   registerMetaRoutes(app, ctx);
   if (ctx) {
@@ -52246,18 +52974,52 @@ function buildApp(ctx = buildWebContext()) {
       root: spaDist,
       rewriteRequestPath: (path) => path.replace(/^\/app/, "") || "/"
     }));
-    const indexPath = join13(spaDist, "index.html");
-    if (existsSync12(indexPath)) {
-      const indexHtml = readFileSync13(indexPath, "utf8");
+    const indexPath = join15(spaDist, "index.html");
+    if (existsSync15(indexPath)) {
+      const indexHtml = readFileSync14(indexPath, "utf8");
       app.get("/app/*", (c2) => c2.html(indexHtml));
     }
   }
   app.get("/", (c2) => c2.html(ROOT_REDIRECT_HTML));
   return app;
 }
+
+class CompatibilityError extends Error {
+}
+async function assertServerCompatible() {
+  const settings = loadSettings();
+  if (!settings.supabaseUrl || !settings.supabaseAnonKey)
+    return;
+  let compat2;
+  try {
+    compat2 = await checkServerCompatibility({
+      aggregatorUrl: aggregatorUrlFor(settings.supabaseUrl),
+      bearer: settings.supabaseAnonKey,
+      bundledEf: PKG_VERSION
+    });
+  } catch {
+    return;
+  }
+  if (!compat2.blocking)
+    return;
+  const parts = [];
+  if (compat2.schema.level === "below-min") {
+    parts.push(`  • schema v${compat2.schema.deployed} is below the required v${compat2.schema.min}`);
+  }
+  if (compat2.edgeFunctions.level === "below-min") {
+    parts.push(`  • Edge Functions v${compat2.edgeFunctions.deployed} are below the required v${compat2.edgeFunctions.min}`);
+  }
+  throw new CompatibilityError(`Refusing to start: the deployed Cerefox server is incompatible with this client (v${PKG_VERSION}).
+` + parts.join(`
+`) + `
+
+Redeploy your server:  cerefox deploy-server
+` + `(or downgrade the client to match the deployed server).`);
+}
 async function buildWebServer(options = {}) {
   const host = options.host ?? "127.0.0.1";
   const port = options.port ?? 8000;
+  await assertServerCompatible();
   const app = buildApp();
   const server = serve({ fetch: app.fetch, hostname: host, port });
   return {
@@ -52269,31 +53031,263 @@ async function buildWebServer(options = {}) {
   };
 }
 
+// src/web/daemon.ts
+import { spawn } from "node:child_process";
+import {
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync4,
+  openSync,
+  readFileSync as readFileSync15,
+  rmSync,
+  writeFileSync as writeFileSync4
+} from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join16 } from "node:path";
+var STATE_DIR = join16(homedir7(), ".cerefox");
+var PID_FILE = join16(STATE_DIR, "web.pid");
+var LOG_FILE = join16(STATE_DIR, "web.log");
+var daemonPaths = { stateDir: STATE_DIR, pidFile: PID_FILE, logFile: LOG_FILE };
+function ensureStateDir() {
+  if (!existsSync16(STATE_DIR))
+    mkdirSync4(STATE_DIR, { recursive: true });
+}
+function readPidFile() {
+  if (!existsSync16(PID_FILE))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync15(PID_FILE, "utf8"));
+    if (typeof parsed.pid !== "number")
+      return null;
+    return {
+      pid: parsed.pid,
+      port: typeof parsed.port === "number" ? parsed.port : 8000,
+      host: typeof parsed.host === "string" ? parsed.host : "127.0.0.1",
+      startedAt: typeof parsed.startedAt === "string" ? parsed.startedAt : "unknown"
+    };
+  } catch {
+    return null;
+  }
+}
+function writePidFile(info3) {
+  ensureStateDir();
+  writeFileSync4(PID_FILE, JSON.stringify(info3, null, 2) + `
+`, "utf8");
+}
+function removePidFile() {
+  rmSync(PID_FILE, { force: true });
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+async function isResponding(host, port, timeoutMs = 1500) {
+  const probeHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+  try {
+    const ctrl = new AbortController;
+    const timer2 = setTimeout(() => ctrl.abort(), timeoutMs);
+    try {
+      const resp = await fetch(`http://${probeHost}:${port}/api/v1/version`, {
+        signal: ctrl.signal
+      });
+      return resp.ok;
+    } finally {
+      clearTimeout(timer2);
+    }
+  } catch {
+    return false;
+  }
+}
+var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+function assertUnix() {
+  if (process.platform === "win32") {
+    throw new Error("Daemon mode (`cerefox web start/stop/status`) is not supported on Windows yet. " + "Run `cerefox web` in the foreground, or set up a Windows service manually.");
+  }
+}
+async function startDaemon(opts) {
+  assertUnix();
+  ensureStateDir();
+  const existing = readPidFile();
+  if (existing && isProcessAlive(existing.pid)) {
+    return existing.port === opts.port ? { kind: "already-running", info: existing } : { kind: "port-conflict", info: existing };
+  }
+  if (existing)
+    removePidFile();
+  const logFd = openSync(LOG_FILE, "a");
+  const child = spawn(opts.runtime, [opts.scriptPath, "web", "--host", opts.host, "--port", String(opts.port)], { detached: true, stdio: ["ignore", logFd, logFd] });
+  child.unref();
+  if (typeof child.pid !== "number") {
+    throw new Error("Failed to spawn the web server process (no pid).");
+  }
+  writePidFile({
+    pid: child.pid,
+    port: opts.port,
+    host: opts.host,
+    startedAt: new Date().toISOString()
+  });
+  let responding = false;
+  for (let i = 0;i < 20; i++) {
+    if (!isProcessAlive(child.pid))
+      break;
+    if (await isResponding(opts.host, opts.port)) {
+      responding = true;
+      break;
+    }
+    await sleep2(250);
+  }
+  return { kind: "started", pid: child.pid, responding };
+}
+async function stopDaemon() {
+  assertUnix();
+  const info3 = readPidFile();
+  if (!info3 || !isProcessAlive(info3.pid)) {
+    removePidFile();
+    return { kind: "not-running" };
+  }
+  try {
+    process.kill(info3.pid, "SIGTERM");
+  } catch {}
+  let forced = false;
+  let alive = true;
+  for (let i = 0;i < 12; i++) {
+    await sleep2(250);
+    if (!isProcessAlive(info3.pid)) {
+      alive = false;
+      break;
+    }
+  }
+  if (alive) {
+    try {
+      process.kill(info3.pid, "SIGKILL");
+      forced = true;
+    } catch {}
+  }
+  removePidFile();
+  return { kind: "stopped", pid: info3.pid, forced };
+}
+async function statusDaemon() {
+  const info3 = readPidFile();
+  if (!info3)
+    return { kind: "stopped" };
+  if (!isProcessAlive(info3.pid))
+    return { kind: "stale", info: info3 };
+  const responding = await isResponding(info3.host, info3.port);
+  return { kind: "running", info: info3, responding };
+}
+
 // src/cli/commands/web.ts
+function parsePort(raw2) {
+  const port = Number.parseInt(raw2, 10);
+  if (!Number.isFinite(port) || port < 1 || port > 65535) {
+    eprintln(`Invalid --port: ${raw2}`);
+    process.exit(2);
+  }
+  return port;
+}
+async function runForeground(host, port, watch) {
+  if (watch) {
+    info("--watch is reserved; not yet implemented.");
+  }
+  try {
+    const handle = await buildWebServer({ host, port });
+    println(`${localTimestamp()}  Cerefox web listening on http://${handle.host}:${handle.port}/`);
+    println(`  Web UI:  http://${handle.host}:${handle.port}/app/`);
+    println(`  API:     http://${handle.host}:${handle.port}/api/v1/`);
+    const shutdown = async (signal) => {
+      println(`${localTimestamp()}  Received ${signal}; shutting down.`);
+      await handle.close().catch(() => {});
+      process.exit(0);
+    };
+    process.on("SIGINT", () => void shutdown("SIGINT"));
+    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+  } catch (err) {
+    if (err instanceof CompatibilityError) {
+      eprintln(err.message);
+    } else {
+      eprintln(`Failed to start web server: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    process.exit(1);
+  }
+}
 function registerWeb(program2) {
-  program2.command("web").description("Start the local web UI / API server.").option("--host <host>", "Bind host.", "127.0.0.1").option("--port <port>", "Bind port.", "8000").option("--watch", "Enable hot-reload (dev mode; reserved for v0.6.x).").action(async (rawOpts) => {
-    const port = Number.parseInt(rawOpts.port, 10);
-    if (!Number.isFinite(port) || port < 1 || port > 65535) {
-      eprintln(`Invalid --port: ${rawOpts.port}`);
-      process.exit(2);
+  const web = program2.command("web").description("Start the local web UI / API server (foreground; see `web start` for daemon).").option("--host <host>", "Bind host.", "127.0.0.1").option("--port <port>", "Bind port.", "8000").option("--watch", "Enable hot-reload (dev mode; reserved).").action(async (rawOpts) => {
+    await runForeground(rawOpts.host, parsePort(rawOpts.port), rawOpts.watch);
+  });
+  web.command("start").description("Start the web server in the background (detached daemon).").option("--host <host>", "Bind host.", "127.0.0.1").option("--port <port>", "Bind port.", "8000").action(async (rawOpts) => {
+    const port = parsePort(rawOpts.port);
+    try {
+      const outcome = await startDaemon({
+        host: rawOpts.host,
+        port,
+        scriptPath: process.argv[1],
+        runtime: process.execPath
+      });
+      switch (outcome.kind) {
+        case "already-running":
+          info(`Cerefox web is already running on :${outcome.info.port} (pid ${outcome.info.pid}).`);
+          process.exit(0);
+          break;
+        case "port-conflict":
+          eprintln(`A Cerefox web daemon is already running on :${outcome.info.port} (pid ${outcome.info.pid}).
+` + `Stop it first (\`cerefox web stop\`) or start on its port.`);
+          process.exit(1);
+          break;
+        case "started":
+          if (outcome.responding) {
+            info(`Cerefox web started (pid ${outcome.pid}) on http://${rawOpts.host}:${port}/`);
+            println(`  Web UI:  http://${rawOpts.host}:${port}/app/`);
+            println(c.dim(`  Logs:    ${daemonPaths.logFile}`));
+            println(c.dim(`  Stop:    cerefox web stop`));
+          } else {
+            eprintln(`Started (pid ${outcome.pid}) but it is not responding on :${port} yet.
+` + `Check the log for errors: ${daemonPaths.logFile}`);
+            process.exit(1);
+          }
+          break;
+      }
+    } catch (err) {
+      eprintln(err instanceof Error ? err.message : String(err));
+      process.exit(1);
     }
-    if (rawOpts.watch) {
-      info("--watch is reserved; not yet implemented in Part 24A.");
+  });
+  web.command("stop").description("Stop the background web server daemon.").action(async () => {
+    try {
+      const outcome = await stopDaemon();
+      if (outcome.kind === "not-running") {
+        info("No Cerefox web daemon is running.");
+      } else {
+        info(`Stopped Cerefox web (pid ${outcome.pid})${outcome.forced ? " — forced (SIGKILL)" : ""}.`);
+      }
+    } catch (err) {
+      eprintln(err instanceof Error ? err.message : String(err));
+      process.exit(1);
     }
+  });
+  web.command("status").description("Show the background web server daemon status.").action(async () => {
     try {
-      const handle = await buildWebServer({ host: rawOpts.host, port });
-      info(`Cerefox web listening on http://${handle.host}:${handle.port}/`);
-      println(`  Web UI:  http://${handle.host}:${handle.port}/app/`);
-      println(`  API:     http://${handle.host}:${handle.port}/api/v1/`);
-      const shutdown = async (signal) => {
-        info(`Received ${signal}; shutting down.`);
-        await handle.close().catch(() => {});
-        process.exit(0);
-      };
-      process.on("SIGINT", () => void shutdown("SIGINT"));
-      process.on("SIGTERM", () => void shutdown("SIGTERM"));
+      const status = await statusDaemon();
+      switch (status.kind) {
+        case "stopped":
+          println("Cerefox web: stopped (no daemon running).");
+          break;
+        case "stale":
+          println(c.yellow(`Cerefox web: stale pidfile — process ${status.info.pid} is not running.`));
+          println(c.dim(`  Clean up: cerefox web stop  (removes ${daemonPaths.pidFile})`));
+          break;
+        case "running":
+          if (status.responding) {
+            println(c.green(`Cerefox web: running on :${status.info.port} (pid ${status.info.pid}, since ${status.info.startedAt}).`));
+          } else {
+            println(c.yellow(`Cerefox web: process ${status.info.pid} alive but not responding on :${status.info.port}.`));
+            println(c.dim(`  Check the log: ${daemonPaths.logFile}`));
+          }
+          break;
+      }
     } catch (err) {
-      eprintln(`Failed to start web server: ${err instanceof Error ? err.message : String(err)}`);
+      eprintln(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
@@ -52305,9 +53299,9 @@ function buildProgram() {
 Command groups (each row in the list above falls into one):
 ` + `  READS      search · get-doc · list-docs · list-versions · list-projects
 ` + `             · list-metadata-keys · metadata-search · get-audit-log
-` + `  WRITES     ingest · ingest-dir · delete-doc
+` + `  WRITES     ingest · ingest-dir · delete-doc · delete-project
 ` + `  SERVERS    mcp · web
-` + `  LIFECYCLE  init · doctor · status · configure-agent · self-update · upgrade · sync-self-docs
+` + `  LIFECYCLE  init · doctor · status · configure-agent · self-update · upgrade · sync-self-docs · deploy-server
 ` + `  OPS        backup · restore · sync-docs · docs · reindex · config-get · config-set · completion
 ` + `
 Exit codes:
@@ -52330,6 +53324,7 @@ Learn more:
   registerIngest(program2);
   registerIngestDir(program2);
   registerDeleteDoc(program2);
+  registerDeleteProject(program2);
   registerMcp(program2);
   registerWeb(program2);
   registerInit(program2);
@@ -52338,6 +53333,7 @@ Learn more:
   registerConfigureAgent(program2);
   registerSelfUpdate(program2);
   registerSyncSelfDocs(program2);
+  registerDeployServer(program2);
   registerBackup(program2);
   registerRestore(program2);
   registerSyncDocs(program2);
@@ -52351,7 +53347,7 @@ Learn more:
 
 // src/bin/cerefox.ts
 async function bareEntryPoint() {
-  const { existsSync: existsSync13 } = await import("node:fs");
+  const { existsSync: existsSync17 } = await import("node:fs");
   const { resolveEnvFile: resolveEnvFile2 } = await Promise.resolve().then(() => (init_config(), exports_config));
   const { c: c2, println: println2 } = await Promise.resolve().then(() => (init_cli_core(), exports_cli_core));
   const { PKG_VERSION: PKG_VERSION2 } = await Promise.resolve().then(() => (init_meta(), exports_meta));
@@ -52360,7 +53356,7 @@ async function bareEntryPoint() {
   println2("");
   let configExists = false;
   try {
-    configExists = existsSync13(resolveEnvFile2());
+    configExists = existsSync17(resolveEnvFile2());
   } catch {}
   if (!configExists) {
     println2(c2.yellow("⚠ No config detected."));