@cerefox/memory 0.8.0 → 0.8.2

package/dist/bin/cerefox.js

@@ -182,6 +182,10 @@ function printTable(rows, emptyMessage = "(no rows)") {
     println(line(headers.map((h) => String(row[h] ?? ""))));
   }
 }
+function localTimestamp(d = new Date) {
+  const p = (n, w = 2) => String(n).padStart(w, "0");
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ` + `${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}.${p(d.getMilliseconds(), 3)}`;
+}
 function eprintln(line = "") {
   process.stderr.write(line + `
 `);
@@ -5315,6 +5319,7 @@ __export(exports_cli_core, {
   parseFloat01: () => parseFloat01,
   ok: () => ok,
   notFound: () => notFound,
+  localTimestamp: () => localTimestamp,
   info: () => info,
   errorln: () => errorln,
   eprintln: () => eprintln,
@@ -7179,7 +7184,7 @@ var exports_meta = {};
 __export(exports_meta, {
   PKG_VERSION: () => PKG_VERSION
 });
-var PKG_VERSION = "0.8.0";
+var PKG_VERSION = "0.8.2";
 var init_meta = () => {};
 
 // ../../node_modules/.bun/tslib@2.8.1/node_modules/tslib/tslib.js
@@ -24624,12 +24629,12 @@ var init_src = __esm(() => {
 
 // src/cli/util/bundled-docs.ts
 import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync5, statSync } from "node:fs";
-import { dirname as dirname3, join as join5, resolve as resolve2 } from "node:path";
+import { dirname as dirname3, join as join6, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function findPackageRoot() {
   let dir = dirname3(fileURLToPath2(import.meta.url));
   for (let i = 0;i < 10; i++) {
-    const pkgJson = join5(dir, "package.json");
+    const pkgJson = join6(dir, "package.json");
     if (existsSync7(pkgJson)) {
       try {
         const parsed = JSON.parse(readFileSync5(pkgJson, "utf8"));
@@ -24645,14 +24650,14 @@ function findPackageRoot() {
   return resolve2(dirname3(fileURLToPath2(import.meta.url)), "..", "..", "..");
 }
 function bundledDocsDir() {
-  const inPackage = join5(PACKAGE_ROOT, "docs");
+  const inPackage = join6(PACKAGE_ROOT, "docs");
   if (existsSync7(inPackage))
     return inPackage;
   return resolve2(PACKAGE_ROOT, "..", "..", "docs");
 }
 function agentGuidePath() {
   const candidates = [
-    join5(PACKAGE_ROOT, "AGENT_GUIDE.md"),
+    join6(PACKAGE_ROOT, "AGENT_GUIDE.md"),
     resolve2(PACKAGE_ROOT, "..", "..", "AGENT_GUIDE.md")
   ];
   for (const c2 of candidates)
@@ -24662,7 +24667,7 @@ function agentGuidePath() {
 }
 function agentQuickReferencePath() {
   const candidates = [
-    join5(PACKAGE_ROOT, "AGENT_QUICK_REFERENCE.md"),
+    join6(PACKAGE_ROOT, "AGENT_QUICK_REFERENCE.md"),
     resolve2(PACKAGE_ROOT, "..", "..", "AGENT_QUICK_REFERENCE.md")
   ];
   for (const c2 of candidates)
@@ -24673,12 +24678,12 @@ function agentQuickReferencePath() {
 function listBundledDocs() {
   const entries = [];
   const docsDir = bundledDocsDir();
-  const guidesDir = join5(docsDir, "guides");
+  const guidesDir = join6(docsDir, "guides");
   if (existsSync7(guidesDir) && statSync(guidesDir).isDirectory()) {
     for (const name of readdirSync3(guidesDir)) {
       if (!name.endsWith(".md"))
         continue;
-      const full = join5(guidesDir, name);
+      const full = join6(guidesDir, name);
       entries.push({
         topic: name.replace(/\.md$/, ""),
         path: full,
@@ -26814,11 +26819,11 @@ async function runSyncSelfDocs(options = {}) {
     printTable(outcomes.filter((o) => o.status === "error").map((o) => ({ topic: o.topic, error: o.detail.slice(0, 100) })));
   }
 }
-async function action14(options) {
+async function action15(options) {
   await runSyncSelfDocs(options);
 }
 function registerSyncSelfDocs(program2) {
-  program2.command("sync-self-docs").description("Ingest bundled Cerefox docs under the _cerefox-self-docs project.").option("--dry-run", "List what would be ingested without writing.").option("--project <name>", "Override the target project name.", "_cerefox-self-docs").action(action14);
+  program2.command("sync-self-docs").description("Ingest bundled Cerefox docs under the _cerefox-self-docs project.").option("--dry-run", "List what would be ingested without writing.").option("--project <name>", "Override the target project name.", "_cerefox-self-docs").action(action15);
 }
 var init_sync_self_docs = __esm(() => {
   init_cli_core();
@@ -41528,6 +41533,49 @@ function registerDeleteDoc(program2) {
   program2.command("delete-doc").description("Soft-delete a document (recoverable via the web UI trash).").argument("<document-id>", "UUID of the document to delete.").option("--reason <text>", "Optional reason recorded in the audit log.").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").option("--yes", "Skip the confirmation prompt.").action(action6);
 }
 
+// src/cli/commands/delete-project.ts
+init_cli_core();
+init_client();
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function action7(target, options) {
+  const client = getClient();
+  const isUuid = UUID_RE.test(target);
+  const lookup = isUuid ? client.raw.from("cerefox_projects").select("id, name, description").eq("id", target).maybeSingle() : client.raw.from("cerefox_projects").select("id, name, description").eq("name", target).maybeSingle();
+  const { data: project, error } = await lookup;
+  if (error) {
+    throw systemError(`Project lookup failed: ${error.message}`);
+  }
+  if (!project) {
+    throw notFound(`Project "${target}" not found.`);
+  }
+  const { count, error: countErr } = await client.raw.from("cerefox_document_projects").select("*", { count: "exact", head: true }).eq("project_id", project.id);
+  if (countErr) {
+    throw systemError(`Could not count documents in project: ${countErr.message}`);
+  }
+  const docCount = count ?? 0;
+  if (docCount > 0 && !options.force) {
+    throw userError(`Project "${project.name}" still has ${docCount} document link(s).`, "Pass --force to delete the project anyway (documents remain; only the project row is removed).");
+  }
+  println(c.yellow("About to delete project:"));
+  println(`  ${project.name}`);
+  println(c.dim(`  ${project.id} · ${docCount} doc link(s)`));
+  if (!options.yes) {
+    const ok2 = await confirm("Continue?", true);
+    if (!ok2) {
+      println(c.dim("Aborted."));
+      return;
+    }
+  }
+  const { error: delErr } = await client.raw.from("cerefox_projects").delete().eq("id", project.id);
+  if (delErr) {
+    throw systemError(`Delete failed: ${delErr.message}`);
+  }
+  println(c.green(`✓ Deleted project "${project.name}" (id: ${project.id}).`));
+}
+function registerDeleteProject(program2) {
+  program2.command("delete-project").description("Delete an empty project (use --force to remove a non-empty one).").argument("<name-or-id>", "Project name (exact match) or UUID.").option("--yes", "Skip the confirmation prompt.").option("--force", "Allow deletion when documents are still linked to the project.").action(action7);
+}
+
 // src/cli/commands/deploy-server.ts
 init_cli_core();
 init_config();
@@ -41584,8 +41632,9 @@ function resolveServerAssets(opts = {}) {
 }
 
 // ../../_shared/db-deploy/index.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4, readdirSync } from "node:fs";
 init_src();
+import { existsSync as existsSync5, readFileSync as readFileSync4, readdirSync } from "node:fs";
+import { join as join5 } from "node:path";
 var RESET_SQL = `
 DROP TABLE IF EXISTS cerefox_chunks      CASCADE;
 DROP TABLE IF EXISTS cerefox_documents   CASCADE;
@@ -41651,6 +41700,95 @@ async function runDbDeploy(opts) {
     await sql.end({ timeout: 5 }).catch(() => {});
   }
 }
+var BOOTSTRAP_MIGRATIONS_SQL = `
+CREATE TABLE IF NOT EXISTS cerefox_migrations (
+    id         SERIAL      PRIMARY KEY,
+    filename   TEXT        NOT NULL UNIQUE,
+    applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+`;
+async function detectExistingSchema(dbUrl) {
+  const sql = src_default(dbUrl, { prepare: false, onnotice: () => {} });
+  try {
+    const rows = await sql`SELECT to_regclass('public.cerefox_documents') AS t`;
+    return rows[0]?.t != null;
+  } finally {
+    await sql.end({ timeout: 5 }).catch(() => {});
+  }
+}
+async function migrationStatus(opts) {
+  const sql = src_default(opts.dbUrl, { prepare: false, onnotice: () => {} });
+  try {
+    await sql.unsafe(BOOTSTRAP_MIGRATIONS_SQL);
+    const all = listMigrationFiles(opts.assets.migrationsDir);
+    const appliedRows = await sql`SELECT filename FROM cerefox_migrations ORDER BY filename`;
+    const appliedSet = new Set(appliedRows.map((r) => r.filename));
+    return {
+      all,
+      applied: all.filter((f) => appliedSet.has(f)),
+      pending: all.filter((f) => !appliedSet.has(f))
+    };
+  } finally {
+    await sql.end({ timeout: 5 }).catch(() => {});
+  }
+}
+async function runDbMigrate(opts) {
+  const log = opts.log ?? (() => {});
+  const sql = src_default(opts.dbUrl, { prepare: false, onnotice: () => {} });
+  try {
+    await sql.unsafe(BOOTSTRAP_MIGRATIONS_SQL);
+    const allFiles = listMigrationFiles(opts.assets.migrationsDir);
+    const appliedRows = await sql`SELECT filename FROM cerefox_migrations ORDER BY filename`;
+    const appliedSet = new Set(appliedRows.map((r) => r.filename));
+    const pending = allFiles.filter((f) => !appliedSet.has(f));
+    if (pending.length === 0)
+      return { ok: true, applied: [], pending: [] };
+    if (opts.dryRun) {
+      for (const f of pending)
+        log(`Would apply ${f}`);
+      return { ok: true, applied: [], pending };
+    }
+    const applied = [];
+    for (const f of pending) {
+      const body = readFileSync4(join5(opts.assets.migrationsDir, f), "utf8");
+      log(`Applying ${f}…`);
+      try {
+        await sql.begin(async (tx) => {
+          await tx.unsafe(body);
+          await tx`INSERT INTO cerefox_migrations (filename) VALUES (${f}) ON CONFLICT DO NOTHING`;
+        });
+        applied.push(f);
+      } catch (err) {
+        return {
+          ok: false,
+          applied,
+          pending,
+          failedFile: f,
+          error: err instanceof Error ? err.message : String(err)
+        };
+      }
+    }
+    return { ok: true, applied, pending };
+  } finally {
+    await sql.end({ timeout: 5 }).catch(() => {});
+  }
+}
+async function applyRpcs(opts) {
+  const log = opts.log ?? (() => {});
+  log("Refresh RPCs (rpcs.sql)…");
+  if (opts.dryRun)
+    return { ok: true };
+  const rpcsSql = readFileSync4(opts.assets.rpcsFile, "utf8");
+  const sql = src_default(opts.dbUrl, { prepare: false, onnotice: () => {} });
+  try {
+    await sql.unsafe(rpcsSql);
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    await sql.end({ timeout: 5 }).catch(() => {});
+  }
+}
 
 // src/cli/commands/deploy-server.ts
 function commandSucceeds(cmd, args) {
@@ -41661,16 +41799,28 @@ function commandSucceeds(cmd, args) {
     return false;
   }
 }
+function parseProjectRef(supabaseUrl) {
+  if (!supabaseUrl)
+    return null;
+  try {
+    const host = new URL(supabaseUrl).hostname;
+    const label = host.split(".")[0];
+    return /^[a-z0-9]{20}$/.test(label) ? label : null;
+  } catch {
+    return null;
+  }
+}
 function listEdgeFunctions(functionsDir) {
   if (!existsSync6(functionsDir))
     return [];
   return readdirSync2(functionsDir, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("cerefox-")).map((e) => e.name).sort();
 }
-async function action7(options) {
+async function action8(options) {
   const settings = loadSettings();
   const assets = resolveServerAssets();
   const doSchema = !options.functionsOnly;
   const doFunctions = !options.schemaOnly;
+  const projectRef = options.projectRef ?? parseProjectRef(settings.supabaseUrl);
   const checks = [];
   if (doSchema) {
     checks.push({
@@ -41698,12 +41848,11 @@ async function action7(options) {
       remediation: "Install Node 20+ (npx ships with it) from nodejs.org, then re-run. " + "`cerefox deploy-server` shells out to the Supabase CLI via npx."
     });
     checks.push({
-      label: "Supabase project linked (`npx supabase link`)",
-      ok: existsSync6("supabase/config.toml") || existsSync6(".supabase/config.toml"),
-      remediation: `Authenticate + link your project (one-time, from any working dir):
-` + `      npx supabase login
-` + `      npx supabase link --project-ref <your-project-ref>
-` + "    Your project ref is in the dashboard URL: " + "https://supabase.com/dashboard/project/<project-ref>"
+      label: "Supabase project ref resolved (from CEREFOX_SUPABASE_URL)",
+      ok: Boolean(projectRef),
+      remediation: `Could not derive the project ref from CEREFOX_SUPABASE_URL.
+` + "    Set CEREFOX_SUPABASE_URL to your project URL " + `(https://<project-ref>.supabase.co), or pass --project-ref <ref>.
+` + "    Also make sure you're logged in once: npx supabase login"
     });
   }
   const failed = checks.filter((ch) => !ch.ok);
@@ -41724,12 +41873,38 @@ async function action7(options) {
   }
   println(c.green(`
 ✓ All prerequisites satisfied.`));
+  let schemaMode = "unknown";
+  let pending = [];
+  if (doSchema) {
+    try {
+      const exists = await detectExistingSchema(settings.databaseUrl);
+      schemaMode = exists ? "existing" : "fresh";
+      if (exists) {
+        pending = (await migrationStatus({ dbUrl: settings.databaseUrl, assets })).pending;
+      }
+    } catch (err) {
+      if (!options.dryRun) {
+        eprintln(c.red(`
+✗ Could not connect to the database: ${err instanceof Error ? err.message : String(err)}`));
+        eprintln(c.dim("   Verify CEREFOX_DATABASE_URL (Session Pooler, port 5432)."));
+        process.exit(1);
+      }
+    }
+  }
   const planLines = [];
   if (doSchema) {
-    planLines.push(`  • ${options.reset ? "RESET + redeploy" : "Deploy"} schema + RPCs to ${settings.supabaseUrl || "your Supabase database"}`);
+    if (schemaMode === "fresh") {
+      planLines.push(`  • Deploy fresh schema + RPCs to ${settings.supabaseUrl || "your Supabase database"}`);
+    } else if (schemaMode === "existing") {
+      planLines.push(`  • Update existing schema: apply ${pending.length} pending migration(s) + refresh RPCs`);
+      for (const f of pending)
+        planLines.push(c.dim(`      – ${f}`));
+    } else {
+      planLines.push(`  • Schema + RPCs (fresh or update — couldn't probe the DB)`);
+    }
   }
   if (doFunctions) {
-    planLines.push(`  • Deploy ${efNames.length} Edge Function(s): ${efNames.join(", ")}`);
+    planLines.push(`  • Deploy ${efNames.length} Edge Function(s) to project ${projectRef}: ${efNames.join(", ")}`);
   }
   println(c.bold(`
 Plan:`));
@@ -41741,26 +41916,52 @@ Plan:`));
     process.exit(0);
   }
   const proceed = await confirm(`
-Proceed with deployment to Supabase${options.reset ? " (--reset DROPS existing data!)" : ""}?`, true);
+Proceed with deployment to Supabase?`, true);
   if (!proceed) {
     println(c.dim("Aborted."));
     process.exit(0);
   }
   if (doSchema) {
-    println(c.bold(`
-▶  Deploying schema + RPCs…`));
-    const result = await runDbDeploy({
-      dbUrl: settings.databaseUrl,
-      assets,
-      reset: options.reset,
-      log: (line) => println(c.dim(`   ${line}`))
-    });
-    if (!result.ok) {
-      eprintln(c.red(`
+    if (schemaMode === "fresh") {
+      println(c.bold(`
+▶  Deploying fresh schema + RPCs…`));
+      const result = await runDbDeploy({
+        dbUrl: settings.databaseUrl,
+        assets,
+        log: (line) => println(c.dim(`   ${line}`))
+      });
+      if (!result.ok) {
+        eprintln(c.red(`
 ✗ Schema deploy failed at "${result.failedStep}": ${result.error}`));
-      process.exit(1);
+        process.exit(1);
+      }
+      println(c.green(`   ✓ Fresh schema deployed (${result.stepsRun} steps).`));
+    } else {
+      println(c.bold(`
+▶  Updating existing schema (migrations + RPC refresh)…`));
+      const mig = await runDbMigrate({
+        dbUrl: settings.databaseUrl,
+        assets,
+        log: (line) => println(c.dim(`   ${line}`))
+      });
+      if (!mig.ok) {
+        eprintln(c.red(`
+✗ Migration "${mig.failedFile}" failed: ${mig.error}`));
+        eprintln(c.dim("   Earlier migrations in this run were committed. Fix + re-run."));
+        process.exit(1);
+      }
+      const rpcs = await applyRpcs({
+        dbUrl: settings.databaseUrl,
+        assets,
+        log: (line) => println(c.dim(`   ${line}`))
+      });
+      if (!rpcs.ok) {
+        eprintln(c.red(`
+✗ RPC refresh failed: ${rpcs.error}`));
+        process.exit(1);
+      }
+      println(c.green(`   ✓ Applied ${mig.applied.length} migration(s); RPCs refreshed.`));
     }
-    println(c.green(`   ✓ Schema deployed (${result.stepsRun} steps).`));
   }
   if (doFunctions) {
     println(c.bold(`
@@ -41770,7 +41971,10 @@ Proceed with deployment to Supabase${options.reset ? " (--reset DROPS existing d
     for (const ef of efNames) {
       info(`   deploying ${ef}…`);
       const workdir = assets.functionsDir.replace(/\/functions$/, "").replace(/\/supabase$/, "");
-      const r = spawnSync2("npx", ["--yes", "supabase", "functions", "deploy", ef], {
+      const args = ["--yes", "supabase", "functions", "deploy", ef];
+      if (projectRef)
+        args.push("--project-ref", projectRef);
+      const r = spawnSync2("npx", args, {
         encoding: "utf8",
         stdio: "inherit",
         cwd: workdir,
@@ -41794,7 +41998,7 @@ Proceed with deployment to Supabase${options.reset ? " (--reset DROPS existing d
   println(c.dim("Verify with: cerefox doctor"));
 }
 function registerDeployServer(program2) {
-  program2.command("deploy-server").description("Deploy the Cerefox server side (schema + RPCs + Edge Functions) to Supabase.").option("--dry-run", "Print the plan + pre-flight without deploying.").option("--reset", "DROP existing Cerefox tables before redeploying the schema (DESTRUCTIVE).").option("--schema-only", "Deploy only the schema + RPCs (skip Edge Functions).").option("--functions-only", "Deploy only the Edge Functions (skip the schema).").action(action7);
+  program2.command("deploy-server").description("Deploy/update the Cerefox server side (schema + RPCs + Edge Functions) on Supabase.").option("--dry-run", "Print the plan + pre-flight without deploying.").option("--schema-only", "Deploy/update only the schema + RPCs (skip Edge Functions).").option("--functions-only", "Deploy only the Edge Functions (skip the schema/RPCs).").option("--project-ref <ref>", "Supabase project ref for Edge Function deploys (default: derived from CEREFOX_SUPABASE_URL).").action(action8);
 }
 
 // src/cli/commands/docs.ts
@@ -41808,7 +42012,7 @@ function openInBrowser(path) {
     println(c.dim(`(could not auto-open; the file is at: ${path})`));
   }
 }
-function action8(topic, options) {
+function action9(topic, options) {
   const docs = listBundledDocs();
   if (options.list || !topic && !options.print) {
     if (docs.length === 0) {
@@ -41837,7 +42041,7 @@ function action8(topic, options) {
   openInBrowser(doc.path);
 }
 function registerDocs(program2) {
-  program2.command("docs").description("Open bundled Cerefox docs in your browser (or print to stdout).").argument("[topic]", "Doc topic (e.g. quickstart, connect-agents). Omit for the index.").option("--print", "Print to stdout instead of opening a browser.").option("--list", "List available topics.").action(action8);
+  program2.command("docs").description("Open bundled Cerefox docs in your browser (or print to stdout).").argument("[topic]", "Doc topic (e.g. quickstart, connect-agents). Omit for the index.").option("--print", "Print to stdout instead of opening a browser.").option("--list", "List available topics.").action(action9);
 }
 
 // ../../node_modules/.bun/ora@9.4.0/node_modules/ora/index.js
@@ -45227,11 +45431,16 @@ init_cli_core();
 
 // src/cli/util/checks.ts
 init_meta();
-init_config();
-init_config();
 import { existsSync as existsSync8, readFileSync as readFileSync6, realpathSync, statSync as statSync2 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
+
+// ../../_shared/ef-meta/index.ts
+var EF_VERSION = "0.8.0";
+
+// src/cli/util/checks.ts
+init_config();
+init_config();
 
 // ../../_shared/compatibility/index.ts
 var COMPATIBILITY = {
@@ -45502,11 +45711,24 @@ async function checkOpenAI() {
     };
   }
 }
+var SCHEMA_VERSION_RE = /^--\s*@version:\s*(\S+)/m;
+function readBundledSchemaVersion() {
+  try {
+    const assets = resolveServerAssets();
+    if (!existsSync8(assets.schemaFile))
+      return null;
+    const m = readFileSync6(assets.schemaFile, "utf8").match(SCHEMA_VERSION_RE);
+    return m ? m[1] : null;
+  } catch {
+    return null;
+  }
+}
+var SCHEMA_CHECK_NAME = "schema + RPCs";
 async function checkSchemaVersion() {
   const settings = loadSettings();
   if (!settings.supabaseUrl || !settings.supabaseKey) {
     return {
-      name: "schema",
+      name: SCHEMA_CHECK_NAME,
       status: "skipped",
       detail: "Supabase config missing; skipped."
     };
@@ -45524,21 +45746,40 @@ async function checkSchemaVersion() {
     });
     if (!resp.ok) {
       return {
-        name: "schema",
+        name: SCHEMA_CHECK_NAME,
         status: "error",
-        detail: `cerefox_schema_version returned ${resp.status}`,
-        hint: "Deploy the schema: `uv run python scripts/db_deploy.py`"
+        detail: `cerefox_schema_version returned ${resp.status} — schema not deployed.`,
+        hint: "Deploy the schema + RPCs (see remediation below)."
       };
     }
     const deployed = await resp.json();
-    return {
-      name: "schema",
-      status: "ok",
-      detail: `cerefox_schema_version() → "${deployed}"`
-    };
+    const bundled = readBundledSchemaVersion();
+    const level = classifyCompat(deployed, COMPATIBILITY.minSchema, bundled);
+    switch (level) {
+      case "below-min":
+        return {
+          name: SCHEMA_CHECK_NAME,
+          status: "error",
+          detail: `Deployed schema v${deployed} is below the required minimum v${COMPATIBILITY.minSchema}.`,
+          hint: "Update the schema + RPCs (see remediation below)."
+        };
+      case "above-min-but-old":
+        return {
+          name: SCHEMA_CHECK_NAME,
+          status: "warn",
+          detail: `Deployed schema v${deployed} works but is older than this client's bundled v${bundled}.`,
+          hint: "Update the schema + RPCs (see remediation below)."
+        };
+      default:
+        return {
+          name: SCHEMA_CHECK_NAME,
+          status: "ok",
+          detail: `cerefox_schema_version() → "${deployed}"${bundled ? ` (bundled v${bundled})` : ""}`
+        };
+    }
   } catch (err) {
     return {
-      name: "schema",
+      name: SCHEMA_CHECK_NAME,
       status: "error",
       detail: `Schema version probe failed: ${err instanceof Error ? err.message : String(err)}`
     };
@@ -45557,9 +45798,9 @@ function hasCerefoxInJsonFile(path) {
 }
 function checkMcpConfigs() {
   const home = homedir4();
-  const claudeCodeUser = join6(home, ".claude.json");
-  const claudeCodeProj = join6(process.cwd(), ".mcp.json");
-  const claudeDesktop = process.platform === "darwin" ? join6(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : process.platform === "win32" ? join6(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json") : join6(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeCodeUser = join7(home, ".claude.json");
+  const claudeCodeProj = join7(process.cwd(), ".mcp.json");
+  const claudeDesktop = process.platform === "darwin" ? join7(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : process.platform === "win32" ? join7(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json") : join7(home, ".config", "Claude", "claude_desktop_config.json");
   const found = [];
   if (hasCerefoxInJsonFile(claudeCodeUser))
     found.push("Claude Code (user)");
@@ -45583,8 +45824,8 @@ function checkMcpConfigs() {
 }
 function checkLegacyShadowEnv() {
   const home = homedir4();
-  const homeEnv = join6(home, USER_STATE_DIR_NAME, ".env");
-  const cwdEnv = join6(process.cwd(), ".env");
+  const homeEnv = join7(home, USER_STATE_DIR_NAME, ".env");
+  const cwdEnv = join7(process.cwd(), ".env");
   if (!existsSync8(homeEnv) || !existsSync8(cwdEnv))
     return null;
   try {
@@ -45666,7 +45907,7 @@ async function checkEdgeFunctionsCompat() {
     compat = await checkServerCompatibility({
       aggregatorUrl: aggregatorUrlFor(settings.supabaseUrl),
       bearer: settings.supabaseAnonKey,
-      bundledEf: PKG_VERSION
+      bundledEf: EF_VERSION
     });
   } catch (err) {
     return {
@@ -45689,14 +45930,14 @@ async function checkEdgeFunctionsCompat() {
         name: "edge functions",
         status: "error",
         detail: `Deployed EF v${deployed} is below the required minimum v${compat.edgeFunctions.min}.`,
-        hint: "Redeploy the Edge Functions: `cerefox deploy-server --functions-only`."
+        hint: "Update the Edge Functions (see remediation below)."
       };
     case "above-min-but-old":
       return {
         name: "edge functions",
         status: "warn",
-        detail: `Deployed EF v${deployed} works but is older than this client (v${PKG_VERSION}).`,
-        hint: "Consider redeploying: `cerefox deploy-server --functions-only`."
+        detail: `Deployed EF v${deployed} works but is older than the bundled Edge Functions (v${EF_VERSION}).`,
+        hint: "Update the Edge Functions (see remediation below)."
       };
     default:
       return {
@@ -45731,7 +45972,7 @@ async function runAllChecks(opts = {}) {
     { name: "legacy env", phase: "Checking legacy env shadowing", run: () => checkLegacyShadowEnv() },
     { name: "supabase", phase: "Probing Supabase Data API", run: () => checkSupabase() },
     { name: "openai", phase: "Probing OpenAI embeddings", run: () => checkOpenAI() },
-    { name: "schema", phase: "Reading schema version", run: () => checkSchemaVersion() },
+    { name: "schema + RPCs", phase: "Reading schema + RPC version", run: () => checkSchemaVersion() },
     { name: "edge functions", phase: "Probing Edge Function versions", run: () => checkEdgeFunctionsCompat() },
     { name: "postgres", phase: "Probing Postgres DDL endpoint", run: () => checkPostgres() },
     { name: "mcp clients", phase: "Scanning MCP client configs", run: () => checkMcpConfigs() }
@@ -45760,7 +46001,7 @@ function symbol(status) {
       return cErr.dim("ℹ");
   }
 }
-async function action9(options) {
+async function action10(options) {
   const useSpinner = !options.json && process.stderr.isTTY;
   const spinner = useSpinner ? ora({ text: "Starting checks…", spinner: "dots", stream: process.stderr }).start() : null;
   const results = await runAllChecks({
@@ -45784,6 +46025,26 @@ async function action9(options) {
     }
     println("");
   }
+  if (!options.json) {
+    const stale = (name) => {
+      const r = results.find((x) => x.name === name);
+      return r != null && (r.status === "error" || r.status === "warn");
+    };
+    const needsSchema = stale("schema + RPCs");
+    const needsEf = stale("edge functions");
+    let remediation = null;
+    if (needsSchema && needsEf) {
+      remediation = "Update the server (schema + RPCs + Edge Functions): cerefox deploy-server";
+    } else if (needsSchema) {
+      remediation = "Update the schema + RPCs: cerefox deploy-server --schema-only";
+    } else if (needsEf) {
+      remediation = "Update the Edge Functions: cerefox deploy-server --functions-only";
+    }
+    if (remediation) {
+      println(cErr.yellow("→ " + remediation));
+      println("");
+    }
+  }
   const errCount = results.filter((r) => r.status === "error").length;
   const warnCount = results.filter((r) => r.status === "warn").length;
   if (errCount > 0) {
@@ -45797,13 +46058,13 @@ async function action9(options) {
   }
 }
 function registerDoctor(program2) {
-  program2.command("doctor").description("Run diagnostic checks against the installed Cerefox.").option("--json", "Emit machine-readable JSON (no colours, structured output).").action(action9);
+  program2.command("doctor").description("Run diagnostic checks against the installed Cerefox.").option("--json", "Emit machine-readable JSON (no colours, structured output).").action(action10);
 }
 
 // src/cli/commands/get-audit-log.ts
 init_cli_core();
 init_client();
-async function action10(options) {
+async function action11(options) {
   const limit = parsePositiveInt(options.limit, "--limit", 50);
   const client = getClient();
   const data = await client.rpc("cerefox_list_audit_entries", {
@@ -45841,14 +46102,14 @@ async function action10(options) {
   })));
 }
 function registerGetAuditLog(program2) {
-  program2.command("get-audit-log").description("Query the audit log with optional filters.").option("-d, --document-id <uuid>", "Filter by document.").option("-a, --author <name>", "Filter by author.").option("-o, --operation <type>", "Filter by operation: create, update-content, update-metadata, delete, restore.").option("--since <iso>", "Lower-bound ISO timestamp.").option("--until <iso>", "Upper-bound ISO timestamp.").option("-l, --limit <n>", "Maximum entries (max 200).", "50").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action10);
+  program2.command("get-audit-log").description("Query the audit log with optional filters.").option("-d, --document-id <uuid>", "Filter by document.").option("-a, --author <name>", "Filter by author.").option("-o, --operation <type>", "Filter by operation: create, update-content, update-metadata, delete, restore.").option("--since <iso>", "Lower-bound ISO timestamp.").option("--until <iso>", "Upper-bound ISO timestamp.").option("-l, --limit <n>", "Maximum entries (max 200).", "50").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action11);
 }
 
 // src/cli/commands/get-doc.ts
 init_cli_core();
 init_cli_core();
 init_client();
-async function action11(documentId, options) {
+async function action12(documentId, options) {
   const client = getClient();
   const rows = await client.rpc("cerefox_get_document", {
     p_document_id: documentId,
@@ -45878,7 +46139,7 @@ async function action11(documentId, options) {
   println(doc.full_content);
 }
 function registerGetDoc(program2) {
-  program2.command("get-doc").description("Retrieve the full content of a document by ID.").argument("<document-id>", "UUID of the document.").option("--version-id <uuid>", "Specific archived version (default: current).").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action11);
+  program2.command("get-doc").description("Retrieve the full content of a document by ID.").argument("<document-id>", "UUID of the document.").option("--version-id <uuid>", "Specific archived version (default: current).").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action12);
 }
 
 // src/cli/commands/ingest.ts
@@ -46615,7 +46876,7 @@ async function readContent(path, paste) {
   const titleFromPath = basename2(path, extname2(path));
   return { content, titleFromPath };
 }
-async function action12(path, options) {
+async function action13(path, options) {
   const { content, titleFromPath } = await readContent(path, Boolean(options.paste));
   const title = options.title ?? titleFromPath;
   if (!title || title.trim() === "") {
@@ -46687,7 +46948,7 @@ async function action12(path, options) {
   }
 }
 function registerIngest(program2) {
-  program2.command("ingest").description("Ingest a file (or stdin paste) into the knowledge base.").argument("[path]", "Path to the file to ingest. Omit when using --paste.").option("--paste", "Read content from stdin instead of a file.").option("-t, --title <title>", "Document title (required with --paste; defaults to filename without extension).").option("-p, --project-name <name>", "Single project membership (non-destructive on update).").option("-P, --project-names <names>", "Comma-separated full project membership set (destructive replace on update).").option("-m, --metadata <json>", "JSON metadata object.").option("--source <label>", "Origin label (default: cli).", "cli").option("-u, --update-if-exists", "Update an existing doc with the same title.").option("-i, --document-id <uuid>", "Update a specific document by UUID (overrides --update-if-exists).").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").action(action12);
+  program2.command("ingest").description("Ingest a file (or stdin paste) into the knowledge base.").argument("[path]", "Path to the file to ingest. Omit when using --paste.").option("--paste", "Read content from stdin instead of a file.").option("-t, --title <title>", "Document title (required with --paste; defaults to filename without extension).").option("-p, --project-name <name>", "Single project membership (non-destructive on update).").option("-P, --project-names <names>", "Comma-separated full project membership set (destructive replace on update).").option("-m, --metadata <json>", "JSON metadata object.").option("--source <label>", "Origin label (default: cli).", "cli").option("-u, --update-if-exists", "Update an existing doc with the same title.").option("-i, --document-id <uuid>", "Update a specific document by UUID (overrides --update-if-exists).").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").action(action13);
 }
 
 // src/cli/commands/ingest-dir.ts
@@ -46696,7 +46957,7 @@ init_cli_core();
 init_config();
 var import_cli_progress = __toESM(require_cli_progress(), 1);
 import { readdirSync as readdirSync4, statSync as statSync3 } from "node:fs";
-import { basename as basename3, extname as extname3, join as join7 } from "node:path";
+import { basename as basename3, extname as extname3, join as join8 } from "node:path";
 function walk(dir, extensions) {
   let entries;
   try {
@@ -46706,7 +46967,7 @@ function walk(dir, extensions) {
   }
   const files = [];
   for (const name of entries) {
-    const full = join7(dir, name);
+    const full = join8(dir, name);
     let stat;
     try {
       stat = statSync3(full);
@@ -46723,7 +46984,7 @@ function walk(dir, extensions) {
   }
   return files;
 }
-async function action13(dir, options) {
+async function action14(dir, options) {
   const extensions = new Set((options.extensions ?? ".md,.txt").split(",").map((e) => e.trim().toLowerCase()).map((e) => e.startsWith(".") ? e : "." + e).filter((e) => e.length > 0));
   const files = walk(dir, extensions);
   if (files.length === 0) {
@@ -46796,7 +47057,7 @@ async function action13(dir, options) {
   }
 }
 function registerIngestDir(program2) {
-  program2.command("ingest-dir").description("Recursively ingest a directory of markdown / text files.").argument("<dir>", "Root directory to walk.").option("-p, --project-name <name>", "Project membership for all ingested docs.").option("-m, --metadata <json>", "JSON metadata applied to every doc.").option("--source <label>", "Origin label (default: cli).", "cli").option("-u, --update-if-exists", "Update an existing doc with the same title.").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").option("-e, --extensions <list>", "Comma-separated file extensions to ingest.", ".md,.txt").action(action13);
+  program2.command("ingest-dir").description("Recursively ingest a directory of markdown / text files.").argument("<dir>", "Root directory to walk.").option("-p, --project-name <name>", "Project membership for all ingested docs.").option("-m, --metadata <json>", "JSON metadata applied to every doc.").option("--source <label>", "Origin label (default: cli).", "cli").option("-u, --update-if-exists", "Update an existing doc with the same title.").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").option("-e, --extensions <list>", "Comma-separated file extensions to ingest.", ".md,.txt").action(action14);
 }
 
 // src/cli/commands/init.ts
@@ -46812,7 +47073,7 @@ import {
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname4, join as join8 } from "node:path";
+import { dirname as dirname4, join as join9 } from "node:path";
 async function readConfigFile(path) {
   if (!existsSync9(path)) {
     throw userError(`--config file not found: ${path}`);
@@ -47062,11 +47323,11 @@ async function maybeOfferServerDeploy() {
   if (compareSemver(deployed, COMPATIBILITY.minSchema) < 0) {
     println(c.bold("Schema deploy"));
     println(c.yellow(`  Deployed schema v${deployed} is below the required v${COMPATIBILITY.minSchema}.`));
-    const yes = await confirm("  Redeploy the server now (--reset DROPS existing data)?", true);
+    const yes = await confirm("  Update the server now (applies pending migrations, refreshes RPCs + EFs)?", true);
     if (yes)
-      launchDeployServer(["--reset"]);
+      launchDeployServer();
     else
-      println(c.dim("  Skipped. Run `cerefox deploy-server --reset` when ready."));
+      println(c.dim("  Skipped. Run `cerefox deploy-server` when ready."));
     println("");
     return;
   }
@@ -47126,9 +47387,9 @@ function writeAnswersTo(target, answers) {
     }
   }
 }
-async function action15(options) {
-  const homeEnv = join8(homedir5(), USER_STATE_DIR_NAME, ".env");
-  const cwdEnv = join8(process.cwd(), ".env");
+async function action16(options) {
+  const homeEnv = join9(homedir5(), USER_STATE_DIR_NAME, ".env");
+  const cwdEnv = join9(process.cwd(), ".env");
   const explicitDir = (process.env.CEREFOX_CONFIG_DIR ?? "").trim();
   if (explicitDir) {
     const target2 = resolveEnvFile();
@@ -47235,13 +47496,13 @@ async function action15(options) {
   await postWriteLifecycle(target, options);
 }
 function registerInit(program2) {
-  program2.command("init").description("Interactive first-run setup (config, schema deploy stub, optional MCP wiring).").option("-c, --config <file>", "Non-interactive mode: read answers from a JSON file.").option("--force", "Overwrite existing configuration without prompting.").option("--skip-schema", "Skip the schema deploy step.").option("--skip-self-docs", "Skip the bundled self-doc ingest.").option("--skip-agent-config", "Skip the optional MCP agent wiring.").action(action15);
+  program2.command("init").description("Interactive first-run setup (config, schema deploy stub, optional MCP wiring).").option("-c, --config <file>", "Non-interactive mode: read answers from a JSON file.").option("--force", "Overwrite existing configuration without prompting.").option("--skip-schema", "Skip the schema deploy step.").option("--skip-self-docs", "Skip the bundled self-doc ingest.").option("--skip-agent-config", "Skip the optional MCP agent wiring.").action(action16);
 }
 
 // src/cli/commands/list-docs.ts
 init_cli_core();
 init_client();
-async function action16(options) {
+async function action17(options) {
   const limit = parsePositiveInt(options.limit, "--limit", 100);
   const client = getClient();
   let projectId;
@@ -47296,13 +47557,13 @@ async function action16(options) {
   })));
 }
 function registerListDocs(program2) {
-  program2.command("list-docs").description("List documents in the knowledge base.").option("-p, --project <name>", "Filter to a specific project.").option("-l, --limit <n>", "Maximum docs to return.", "100").option("--json", "Emit machine-readable JSON.").action(action16);
+  program2.command("list-docs").description("List documents in the knowledge base.").option("-p, --project <name>", "Filter to a specific project.").option("-l, --limit <n>", "Maximum docs to return.", "100").option("--json", "Emit machine-readable JSON.").action(action17);
 }
 
 // src/cli/commands/list-metadata-keys.ts
 init_cli_core();
 init_client();
-async function action17(options) {
+async function action18(options) {
   const client = getClient();
   const data = await client.rpc("cerefox_list_metadata_keys");
   if (data === null) {
@@ -47330,13 +47591,13 @@ async function action17(options) {
   })));
 }
 function registerListMetadataKeys(program2) {
-  program2.command("list-metadata-keys").description("List all metadata keys with document counts and example values.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action17);
+  program2.command("list-metadata-keys").description("List all metadata keys with document counts and example values.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action18);
 }
 
 // src/cli/commands/list-projects.ts
 init_cli_core();
 init_client();
-async function action18(options) {
+async function action19(options) {
   const client = getClient();
   const { data, error: error2 } = await client.raw.from("cerefox_projects").select("id, name, description, created_at").order("name", { ascending: true });
   if (error2) {
@@ -47365,13 +47626,13 @@ async function action18(options) {
   })), "(no projects)");
 }
 function registerListProjects(program2) {
-  program2.command("list-projects").description("List all projects in the knowledge base.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action18);
+  program2.command("list-projects").description("List all projects in the knowledge base.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action19);
 }
 
 // src/cli/commands/list-versions.ts
 init_cli_core();
 init_client();
-async function action19(documentId, options) {
+async function action20(documentId, options) {
   const client = getClient();
   const data = await client.rpc("cerefox_list_document_versions", {
     p_document_id: documentId
@@ -47412,7 +47673,7 @@ async function action19(documentId, options) {
   })));
 }
 function registerListVersions(program2) {
-  program2.command("list-versions").description("List archived versions of a document.").argument("<document-id>", "UUID of the document.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action19);
+  program2.command("list-versions").description("List archived versions of a document.").argument("<document-id>", "UUID of the document.").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action20);
 }
 
 // src/cli/commands/mcp.ts
@@ -47427,7 +47688,7 @@ function registerMcp(program2) {
 // src/cli/commands/metadata-search.ts
 init_cli_core();
 init_client();
-async function action20(options) {
+async function action21(options) {
   const metadataFilter = parseJsonObjectArg(options.metadataFilter, "--metadata-filter");
   if (!metadataFilter || Object.keys(metadataFilter).length === 0) {
     throw userError("--metadata-filter is required and must be a non-empty JSON object.", `Example: --metadata-filter '{"type":"decision-log"}'.`);
@@ -47490,7 +47751,7 @@ async function action20(options) {
   }
 }
 function registerMetadataSearch(program2) {
-  program2.command("metadata-search").description("Find documents by metadata criteria (no text query).").requiredOption("-f, --metadata-filter <json>", "JSON object; only docs whose metadata contains ALL pairs are returned.").option("-p, --project-name <name>", "Filter to a specific project.").option("--updated-since <iso>", "Only docs updated on/after this ISO timestamp.").option("--created-since <iso>", "Only docs created on/after this ISO timestamp.").option("--include-content", "Include full document text in results.").option("-l, --limit <n>", "Maximum docs to return.", "10").option("--max-bytes <n>", "Response size budget in bytes (with --include-content).", "200000").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action20);
+  program2.command("metadata-search").description("Find documents by metadata criteria (no text query).").requiredOption("-f, --metadata-filter <json>", "JSON object; only docs whose metadata contains ALL pairs are returned.").option("-p, --project-name <name>", "Filter to a specific project.").option("--updated-since <iso>", "Only docs updated on/after this ISO timestamp.").option("--created-since <iso>", "Only docs created on/after this ISO timestamp.").option("--include-content", "Include full document text in results.").option("-l, --limit <n>", "Maximum docs to return.", "10").option("--max-bytes <n>", "Response size budget in bytes (with --include-content).", "200000").option("-r, --requestor <name>", "Agent / user name (usage log).").option("--json", "Emit machine-readable JSON.").action(action21);
 }
 
 // src/cli/commands/reindex.ts
@@ -47498,7 +47759,7 @@ init_dist4();
 init_cli_core();
 init_config();
 var DEFAULT_MODEL = "text-embedding-3-small";
-async function action21(options) {
+async function action22(options) {
   const settings = loadSettings();
   if (!settings.supabaseUrl || !settings.supabaseKey) {
     throw userError("Supabase credentials not configured — run `cerefox init` first.");
@@ -47577,7 +47838,7 @@ ${c2.content}`;
   }
 }
 function registerReindex(program2) {
-  program2.command("reindex").description("Re-embed existing document chunks (v0.7+).").option("--all", "Reindex every chunk regardless of embedder.").option("--batch <n>", "Chunks per OpenAI batch call. Capped at 96 internally.", "32").option("--dry-run", "Show counts without re-embedding.").option("-i, --document-id <uuid>", "Limit reindex to a single document.").action(action21);
+  program2.command("reindex").description("Re-embed existing document chunks (v0.7+).").option("--all", "Reindex every chunk regardless of embedder.").option("--batch <n>", "Chunks per OpenAI batch call. Capped at 96 internally.", "32").option("--dry-run", "Show counts without re-embedding.").option("-i, --document-id <uuid>", "Limit reindex to a single document.").action(action22);
 }
 
 // src/cli/commands/restore.ts
@@ -47585,12 +47846,12 @@ init_cli_core();
 init_client();
 import { existsSync as existsSync10, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join9, resolve as resolve4 } from "node:path";
+import { join as join10, resolve as resolve4 } from "node:path";
 function expandHome2(path) {
   if (path === "~")
     return homedir6();
   if (path.startsWith("~/"))
-    return join9(homedir6(), path.slice(2));
+    return join10(homedir6(), path.slice(2));
   return path;
 }
 function resolveBackupFile(target) {
@@ -47601,13 +47862,13 @@ function resolveBackupFile(target) {
   const stat = statSync4(path);
   if (stat.isFile())
     return path;
-  const candidates = readdirSync5(path).filter((n) => n.endsWith(".json") && n.startsWith("cerefox-")).map((n) => ({ name: n, mtime: statSync4(join9(path, n)).mtimeMs })).sort((a, b2) => b2.mtime - a.mtime);
+  const candidates = readdirSync5(path).filter((n) => n.endsWith(".json") && n.startsWith("cerefox-")).map((n) => ({ name: n, mtime: statSync4(join10(path, n)).mtimeMs })).sort((a, b2) => b2.mtime - a.mtime);
   if (candidates.length === 0) {
     throw userError(`No cerefox-*.json files in ${path}`);
   }
-  return join9(path, candidates[0].name);
+  return join10(path, candidates[0].name);
 }
-async function action22(target, options) {
+async function action23(target, options) {
   const file = resolveBackupFile(target);
   let payload;
   try {
@@ -47663,7 +47924,7 @@ async function action22(target, options) {
   }
 }
 function registerRestore(program2) {
-  program2.command("restore").description("Restore a JSON-snapshot backup into the knowledge base.").argument("<snapshot>", "Backup file (or directory; most recent is picked) produced by `cerefox backup`.").option("--dry-run", "Print what would be restored without writing.").option("-p, --project-name <name>", "Reserved for future use; currently ignored (project memberships ride along with each doc's metadata).").action(action22);
+  program2.command("restore").description("Restore a JSON-snapshot backup into the knowledge base.").argument("<snapshot>", "Backup file (or directory; most recent is picked) produced by `cerefox backup`.").option("--dry-run", "Print what would be restored without writing.").option("-p, --project-name <name>", "Reserved for future use; currently ignored (project memberships ride along with each doc's metadata).").action(action23);
 }
 
 // src/cli/commands/search.ts
@@ -47688,7 +47949,7 @@ async function embedQuery(query) {
 }
 
 // src/cli/commands/search.ts
-async function action23(query, options) {
+async function action24(query, options) {
   if (!query || query.trim() === "") {
     throw userError("Empty query.");
   }
@@ -47822,7 +48083,7 @@ async function action23(query, options) {
   }
 }
 function registerSearch(program2) {
-  program2.command("search").description("Search the knowledge base (hybrid FTS + semantic).").argument("<query>", "Natural-language search query.").option("-c, --match-count <n>", "Maximum number of documents to return.", "5").option("-p, --project-name <name>", "Filter results to a specific project.").option("-f, --metadata-filter <json>", "JSON containment filter; only docs whose metadata contains ALL pairs are returned.").option("--mode <mode>", "Search mode: docs (default), hybrid, fts.", "docs").option("--alpha <float>", "Semantic weight 0..1 (default: 0.7).", "0.7").option("--min-score <float>", "Minimum cosine similarity threshold.", "0.5").option("--max-bytes <n>", "Response size budget in bytes.", "200000").option("-r, --requestor <name>", "Agent / user name (recorded in usage log).").option("--json", "Emit machine-readable JSON instead of the default text.").action(action23);
+  program2.command("search").description("Search the knowledge base (hybrid FTS + semantic).").argument("<query>", "Natural-language search query.").option("-c, --match-count <n>", "Maximum number of documents to return.", "5").option("-p, --project-name <name>", "Filter results to a specific project.").option("-f, --metadata-filter <json>", "JSON containment filter; only docs whose metadata contains ALL pairs are returned.").option("--mode <mode>", "Search mode: docs (default), hybrid, fts.", "docs").option("--alpha <float>", "Semantic weight 0..1 (default: 0.7).", "0.7").option("--min-score <float>", "Minimum cosine similarity threshold.", "0.5").option("--max-bytes <n>", "Response size budget in bytes.", "200000").option("-r, --requestor <name>", "Agent / user name (recorded in usage log).").option("--json", "Emit machine-readable JSON instead of the default text.").action(action24);
 }
 
 // src/cli/commands/self-update.ts
@@ -47869,7 +48130,7 @@ async function fetchLatestVersion() {
   }
   return body.version;
 }
-async function action24(options) {
+async function action25(options) {
   let target;
   try {
     target = options.version ?? await fetchLatestVersion();
@@ -47921,7 +48182,7 @@ async function action24(options) {
 }
 function registerSelfUpdate(program2) {
   const desc = "Upgrade Cerefox in place. Alias: `cerefox upgrade`.";
-  const declaration = (cmd) => cmd.description(desc).option("--check", "Print current vs latest; do nothing.").option("--yes", "Non-interactive (skip confirmation).").option("--version <version>", "Pin a specific version (e.g. 0.5.1 or 0.6.0-rc.1).").action(action24);
+  const declaration = (cmd) => cmd.description(desc).option("--check", "Print current vs latest; do nothing.").option("--yes", "Non-interactive (skip confirmation).").option("--version <version>", "Pin a specific version (e.g. 0.5.1 or 0.6.0-rc.1).").action(action25);
   declaration(program2.command("self-update"));
   declaration(program2.command("upgrade"));
 }
@@ -47940,7 +48201,7 @@ function symbol2(status) {
       return cErr.dim("ℹ");
   }
 }
-async function action25(options) {
+async function action26(options) {
   const useSpinner = !options.json && process.stderr.isTTY;
   const spinner = useSpinner ? ora({ text: "Starting checks…", spinner: "dots", stream: process.stderr }).start() : null;
   const results = await runFastChecks({
@@ -47961,7 +48222,7 @@ async function action25(options) {
   }
 }
 function registerStatus(program2) {
-  program2.command("status").description("Quick sanity check (fast subset of `cerefox doctor`).").option("--json", "Emit machine-readable JSON.").action(action25);
+  program2.command("status").description("Quick sanity check (fast subset of `cerefox doctor`).").option("--json", "Emit machine-readable JSON.").action(action26);
 }
 
 // src/cli/commands/sync-docs.ts
@@ -47975,14 +48236,14 @@ import {
   readdirSync as readdirSync6,
   statSync as statSync5
 } from "node:fs";
-import { basename as basename5, extname as extname5, join as join10, relative } from "node:path";
+import { basename as basename5, extname as extname5, join as join11, relative } from "node:path";
 var ROOT_LEVEL_DOCS = ["README.md", "AGENT_GUIDE.md", "AGENT_QUICK_REFERENCE.md"];
 function walkMarkdown(dir) {
   const out = [];
   if (!existsSync11(dir))
     return out;
   for (const name of readdirSync6(dir)) {
-    const full = join10(dir, name);
+    const full = join11(dir, name);
     let stat;
     try {
       stat = statSync5(full);
@@ -47997,16 +48258,16 @@ function walkMarkdown(dir) {
   }
   return out;
 }
-async function action26(options) {
+async function action27(options) {
   const cwd = process.cwd();
   const project = options.project ?? "cerefox";
   const targets = [];
   for (const rel of ROOT_LEVEL_DOCS) {
-    const abs = join10(cwd, rel);
+    const abs = join11(cwd, rel);
     if (existsSync11(abs))
       targets.push({ abs, rel });
   }
-  for (const abs of walkMarkdown(join10(cwd, "docs"))) {
+  for (const abs of walkMarkdown(join11(cwd, "docs"))) {
     targets.push({ abs, rel: relative(cwd, abs) });
   }
   if (targets.length === 0) {
@@ -48059,7 +48320,7 @@ async function action26(options) {
   }
 }
 function registerSyncDocs(program2) {
-  program2.command("sync-docs").description("Sync repo docs (README, AGENT_*, docs/) into a Cerefox project.").option("--dry-run", "Print what would be synced without writing.").option("-p, --project <name>", "Target project for the sync.", "cerefox").action(action26);
+  program2.command("sync-docs").description("Sync repo docs (README, AGENT_*, docs/) into a Cerefox project.").option("--dry-run", "Print what would be synced without writing.").option("-p, --project <name>", "Target project for the sync.", "cerefox").action(action27);
 }
 
 // src/cli/program.ts
@@ -49395,7 +49656,7 @@ var baseMimes = _baseMimes;
 
 // ../../node_modules/.bun/@hono+node-server@2.0.4+1bbe96acb4c5ebf1/node_modules/@hono/node-server/dist/serve-static.mjs
 import { createReadStream, existsSync as existsSync12, statSync as statSync6 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 var ENCODINGS = {
   br: ".br",
@@ -49444,11 +49705,11 @@ var serveStatic = (options = { root: "" }) => {
         await options.onNotFound?.(c2.req.path, c2);
         return next();
       }
-    let path = join11(root, !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c2) : filename);
+    let path = join12(root, !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c2) : filename);
     let stats = getStats(path);
     if (stats && stats.isDirectory()) {
       const indexFile = options.index ?? "index.html";
-      path = join11(path, indexFile);
+      path = join12(path, indexFile);
       stats = getStats(path);
     }
     if (!stats) {
@@ -49507,7 +49768,7 @@ var serveStatic = (options = { root: "" }) => {
 // src/web/server.ts
 import { existsSync as existsSync15 } from "node:fs";
 import { readFileSync as readFileSync14 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 
 // ../../node_modules/.bun/hono@4.12.23/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
@@ -51314,7 +51575,7 @@ function registerConfigRoutes(app, ctx) {
 }
 
 // src/web/routes/discovery.ts
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DOC_COLS = "id, title, source, source_path, content_hash, metadata, chunk_count, total_chars, review_status, created_at, updated_at, deleted_at";
 function jsonByteLength(value) {
   return Buffer.byteLength(JSON.stringify(value), "utf8");
@@ -51760,7 +52021,7 @@ function registerDiscoveryRoutes(app, ctx) {
     if (!path) {
       return c2.json({ tried_path: "", anchor, matches: [] });
     }
-    if (UUID_RE.test(path)) {
+    if (UUID_RE2.test(path)) {
       if (path === fromDocId) {
         return c2.json({ tried_path: path, anchor, matches: [] });
       }
@@ -52361,7 +52622,7 @@ import {
   readdirSync as readdirSync7,
   statSync as statSync7
 } from "node:fs";
-import { basename as basename6, dirname as dirname5, join as join12, resolve as resolve5 } from "node:path";
+import { basename as basename6, dirname as dirname5, join as join13, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var TOP_LEVEL_DOCS = [
   { filename: "README.md", path: "README.md", category: "readme" },
@@ -52382,27 +52643,27 @@ function moduleDir2() {
 function resolveDocsRoots() {
   const here = moduleDir2();
   const pkgRootCandidates = [
-    join12(here, "..", ".."),
-    join12(here, "..", "..", "..", "..")
+    join13(here, "..", ".."),
+    join13(here, "..", "..", "..", "..")
   ];
   let pkgGuides = null;
   let pkgTopLevel = null;
   for (const pkg of pkgRootCandidates) {
-    const guides = join12(pkg, "docs", "guides");
+    const guides = join13(pkg, "docs", "guides");
     if (existsSync13(guides) && statSync7(guides).isDirectory()) {
       pkgGuides = guides;
       pkgTopLevel = pkg;
       break;
     }
   }
-  const repoCandidate = join12(here, "..", "..", "..", "..");
-  const repoGuides = join12(repoCandidate, "docs", "guides");
+  const repoCandidate = join13(here, "..", "..", "..", "..");
+  const repoGuides = join13(repoCandidate, "docs", "guides");
   const repoTopLevel = repoCandidate;
   return {
     pkgGuides,
     pkgTopLevel,
     repoGuides: existsSync13(repoGuides) ? repoGuides : null,
-    repoTopLevel: existsSync13(join12(repoTopLevel, "README.md")) ? repoTopLevel : null
+    repoTopLevel: existsSync13(join13(repoTopLevel, "README.md")) ? repoTopLevel : null
   };
 }
 function readH1(filePath) {
@@ -52427,7 +52688,7 @@ function listBundledDocs2() {
   const topRoot = pkgTopLevel ?? repoTopLevel;
   if (topRoot) {
     for (const t of TOP_LEVEL_DOCS) {
-      const abs = join12(topRoot, t.filename);
+      const abs = join13(topRoot, t.filename);
       if (existsSync13(abs)) {
         entries.push(entryForFile(abs, t.path, t.category));
       }
@@ -52437,7 +52698,7 @@ function listBundledDocs2() {
   if (guidesRoot) {
     const names = readdirSync7(guidesRoot).filter((n) => n.endsWith(".md")).sort();
     for (const name of names) {
-      const abs = join12(guidesRoot, name);
+      const abs = join13(guidesRoot, name);
       entries.push(entryForFile(abs, `guides/${name}`, "guide"));
     }
   }
@@ -52482,7 +52743,7 @@ var VERSION_INFO = {
   git_commit_short: resolveGitCommitShort(),
   build_date: process.env.CEREFOX_BUILD_DATE ?? null
 };
-var SCHEMA_VERSION_RE = /^--\s*@version:\s*(\S+)/m;
+var SCHEMA_VERSION_RE2 = /^--\s*@version:\s*(\S+)/m;
 function registerMetaRoutes(app, ctx) {
   app.get("/api/v1/version", (c2) => c2.json(VERSION_INFO));
   app.get("/api/v1/docs", (c2) => c2.json(listBundledDocs2()));
@@ -52501,16 +52762,16 @@ function registerMetaRoutes(app, ctx) {
     try {
       const { readFileSync: readFileSync14, existsSync: existsSync14 } = await import("node:fs");
       const { fileURLToPath: fileURLToPath4 } = await import("node:url");
-      const { dirname: dirname6, join: join13 } = await import("node:path");
+      const { dirname: dirname6, join: join14 } = await import("node:path");
       const here = dirname6(fileURLToPath4(import.meta.url));
       const candidates = [
-        join13(here, "..", "..", "..", "db", "schema.sql"),
-        join13(here, "..", "..", "..", "..", "..", "src", "cerefox", "db", "schema.sql")
+        join14(here, "..", "..", "..", "db", "schema.sql"),
+        join14(here, "..", "..", "..", "..", "..", "src", "cerefox", "db", "schema.sql")
       ];
       for (const path of candidates) {
         if (existsSync14(path)) {
           const sql = readFileSync14(path, "utf8");
-          const match2 = sql.match(SCHEMA_VERSION_RE);
+          const match2 = sql.match(SCHEMA_VERSION_RE2);
           bundled = match2 ? match2[1] : null;
           break;
         }
@@ -52620,20 +52881,20 @@ function registerProjectsRoutes(app, ctx) {
 
 // src/web/static.ts
 import { existsSync as existsSync14, statSync as statSync8 } from "node:fs";
-import { dirname as dirname6, join as join13 } from "node:path";
+import { dirname as dirname6, join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function moduleDir3() {
   return dirname6(fileURLToPath4(import.meta.url));
 }
 function isUsableSpaDir(dir) {
-  return existsSync14(dir) && statSync8(dir).isDirectory() && existsSync14(join13(dir, "index.html"));
+  return existsSync14(dir) && statSync8(dir).isDirectory() && existsSync14(join14(dir, "index.html"));
 }
 function resolveSpaDist() {
   const here = moduleDir3();
   const candidates = [
-    join13(here, "..", "frontend"),
-    join13(here, "..", "..", "..", "..", "frontend", "dist"),
-    join13(here, "..", "..", "dist", "frontend")
+    join14(here, "..", "frontend"),
+    join14(here, "..", "..", "..", "..", "frontend", "dist"),
+    join14(here, "..", "..", "dist", "frontend")
   ];
   for (const c2 of candidates) {
     if (isUsableSpaDir(c2))
@@ -52644,8 +52905,8 @@ function resolveSpaDist() {
 function resolveStaticDir() {
   const here = moduleDir3();
   const candidates = [
-    join13(here, "..", "static"),
-    join13(here, "..", "..", "..", "..", "web", "static")
+    join14(here, "..", "static"),
+    join14(here, "..", "..", "..", "..", "web", "static")
   ];
   for (const c2 of candidates) {
     if (existsSync14(c2) && statSync8(c2).isDirectory())
@@ -52691,11 +52952,12 @@ var ROOT_REDIRECT_HTML = `<!DOCTYPE html>
 
 // src/web/server.ts
 init_meta();
+init_cli_core();
 init_config();
 function buildApp(ctx = buildWebContext()) {
   const app = new Hono2;
   if (true) {
-    app.use(logger());
+    app.use(logger((message, ...rest) => console.log(`${localTimestamp()}  ${message}`, ...rest)));
   }
   registerMetaRoutes(app, ctx);
   if (ctx) {
@@ -52731,7 +52993,7 @@ function buildApp(ctx = buildWebContext()) {
       root: spaDist,
       rewriteRequestPath: (path) => path.replace(/^\/app/, "") || "/"
     }));
-    const indexPath = join14(spaDist, "index.html");
+    const indexPath = join15(spaDist, "index.html");
     if (existsSync15(indexPath)) {
       const indexHtml = readFileSync14(indexPath, "utf8");
       app.get("/app/*", (c2) => c2.html(indexHtml));
@@ -52752,7 +53014,7 @@ async function assertServerCompatible() {
     compat2 = await checkServerCompatibility({
       aggregatorUrl: aggregatorUrlFor(settings.supabaseUrl),
       bearer: settings.supabaseAnonKey,
-      bundledEf: PKG_VERSION
+      bundledEf: EF_VERSION
     });
   } catch {
     return;
@@ -52799,10 +53061,10 @@ import {
   writeFileSync as writeFileSync4
 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join15 } from "node:path";
-var STATE_DIR = join15(homedir7(), ".cerefox");
-var PID_FILE = join15(STATE_DIR, "web.pid");
-var LOG_FILE = join15(STATE_DIR, "web.log");
+import { join as join16 } from "node:path";
+var STATE_DIR = join16(homedir7(), ".cerefox");
+var PID_FILE = join16(STATE_DIR, "web.pid");
+var LOG_FILE = join16(STATE_DIR, "web.log");
 var daemonPaths = { stateDir: STATE_DIR, pidFile: PID_FILE, logFile: LOG_FILE };
 function ensureStateDir() {
   if (!existsSync16(STATE_DIR))
@@ -52950,11 +53212,11 @@ async function runForeground(host, port, watch) {
   }
   try {
     const handle = await buildWebServer({ host, port });
-    info(`Cerefox web listening on http://${handle.host}:${handle.port}/`);
+    println(`${localTimestamp()}  Cerefox web listening on http://${handle.host}:${handle.port}/`);
     println(`  Web UI:  http://${handle.host}:${handle.port}/app/`);
     println(`  API:     http://${handle.host}:${handle.port}/api/v1/`);
     const shutdown = async (signal) => {
-      info(`Received ${signal}; shutting down.`);
+      println(`${localTimestamp()}  Received ${signal}; shutting down.`);
       await handle.close().catch(() => {});
       process.exit(0);
     };
@@ -53056,7 +53318,7 @@ function buildProgram() {
 Command groups (each row in the list above falls into one):
 ` + `  READS      search · get-doc · list-docs · list-versions · list-projects
 ` + `             · list-metadata-keys · metadata-search · get-audit-log
-` + `  WRITES     ingest · ingest-dir · delete-doc
+` + `  WRITES     ingest · ingest-dir · delete-doc · delete-project
 ` + `  SERVERS    mcp · web
 ` + `  LIFECYCLE  init · doctor · status · configure-agent · self-update · upgrade · sync-self-docs · deploy-server
 ` + `  OPS        backup · restore · sync-docs · docs · reindex · config-get · config-set · completion
@@ -53081,6 +53343,7 @@ Learn more:
   registerIngest(program2);
   registerIngestDir(program2);
   registerDeleteDoc(program2);
+  registerDeleteProject(program2);
   registerMcp(program2);
   registerWeb(program2);
   registerInit(program2);