@cerefox/memory 1.15.2 → 1.16.0

package/dist/bin/cerefox.js

@@ -5318,7 +5318,7 @@ var init_cli_core = __esm(() => {
 });
 
 // src/meta.ts
-var PKG_VERSION = "1.15.2";
+var PKG_VERSION = "1.16.0";
 var init_meta = () => {};
 
 // ../../_shared/config/paths.ts
@@ -23799,7 +23799,7 @@ var init__utils = __esm(() => {
 });
 
 // ../../_shared/server-assets/index.ts
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
 import { dirname as dirname2, join as join5 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { cwd as processCwd2 } from "node:process";
@@ -23845,7 +23845,20 @@ function resolveServerAssets(opts = {}) {
   }
   return sourceServerAssets(join5(here, "..", ".."));
 }
-var init_server_assets = () => {};
+function bundledSchemaVersion(opts = {}) {
+  try {
+    const assets = resolveServerAssets(opts);
+    if (!existsSync5(assets.schemaFile))
+      return null;
+    return readFileSync5(assets.schemaFile, "utf8").match(SCHEMA_VERSION_RE)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+var SCHEMA_VERSION_RE;
+var init_server_assets = __esm(() => {
+  SCHEMA_VERSION_RE = /^--\s*@version:\s*(\S+)/m;
+});
 
 // ../../node_modules/.bun/postgres@3.4.9/node_modules/postgres/src/query.js
 function cachedError(xs) {
@@ -26142,7 +26155,7 @@ var init__projects = __esm(() => {
 });
 
 // src/cli/util/bundled-docs.ts
-import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync } from "node:fs";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync7, statSync } from "node:fs";
 import { dirname as dirname3, join as join7, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function findPackageRoot() {
@@ -26151,7 +26164,7 @@ function findPackageRoot() {
     const pkgJson = join7(dir, "package.json");
     if (existsSync8(pkgJson)) {
       try {
-        const parsed = JSON.parse(readFileSync6(pkgJson, "utf8"));
+        const parsed = JSON.parse(readFileSync7(pkgJson, "utf8"));
         if (parsed.name === "@cerefox/memory")
           return dir;
       } catch {}
@@ -26226,7 +26239,7 @@ function readBundledDoc(topic) {
   return {
     topic: entry.topic,
     path: entry.path,
-    content: readFileSync6(entry.path, "utf8")
+    content: readFileSync7(entry.path, "utf8")
   };
 }
 var PACKAGE_ROOT;
@@ -26235,7 +26248,7 @@ var init_bundled_docs = __esm(() => {
 });
 
 // ../../_shared/ef-meta/index.ts
-var EF_VERSION = "1.15.2", CEREFOX_VERSION = "1.15.2", EF_LAST_CHANGED = "1.15.2";
+var EF_VERSION = "1.16.0", CEREFOX_VERSION = "1.16.0", EF_LAST_CHANGED = "1.16.0";
 var init_ef_meta = () => {};
 
 // ../../_shared/compatibility/index.ts
@@ -26380,6 +26393,7 @@ __export(exports_onnx_embedder, {
   ONNX_MODEL_ID: () => ONNX_MODEL_ID,
   ONNX_MODEL_NAME: () => ONNX_MODEL_NAME,
   buildPrefixedInputs: () => buildPrefixedInputs,
+  isModelCached: () => isModelCached,
   nomicPrefix: () => nomicPrefix,
   onnxEmbed: () => onnxEmbed,
   warmup: () => warmup
@@ -26394,6 +26408,9 @@ function buildPrefixedInputs(texts, role) {
   const p = nomicPrefix(role);
   return texts.map((t) => p + t);
 }
+function isModelCached(dir = getCacheDir()) {
+  return MODEL_FILES.every((f) => existsSync10(join9(dir, f)));
+}
 function getCacheDir() {
   const env = globalThis.process?.env ?? {};
   if (env.CEREFOX_MODELS_DIR)
@@ -26436,6 +26453,12 @@ async function ensurePipeline() {
     return pipelinePromise;
   pipelinePromise = (async () => {
     const transformers = await loadTransformers();
+    if (isModelCached()) {
+      const pipe = await transformers.pipeline("feature-extraction", ONNX_MODEL_ID, {
+        dtype: ONNX_MODEL_DTYPE
+      });
+      return pipe;
+    }
     const mb = ONNX_MODEL_APPROX_MB;
     const fmt = (s) => s < 60 ? `${s}s` : `${Math.round(s / 60)}m`;
     process.stderr.write(`[cerefox-embed] loading "${ONNX_MODEL_NAME}" from HuggingFace (~${mb} MB; est. ${fmt(Math.round(mb * 8 / 50))}-${fmt(Math.round(mb * 8 / 10))} at 50-10 Mbps; first-run only)…
@@ -26559,8 +26582,15 @@ async function onnxEmbed(texts, role) {
   }
   return vectors;
 }
-var ONNX_MODEL_ID = "nomic-ai/nomic-embed-text-v1.5", ONNX_MODEL_NAME = "nomic-embed-text-v1.5", ONNX_MODEL_DTYPE = "q8", ONNX_MODEL_DIM = 768, ONNX_MODEL_APPROX_MB = 130, transformersModule = null, pipelinePromise = null, DEFAULT_ONNX_BATCH = 4;
-var init_onnx_embedder = () => {};
+var ONNX_MODEL_ID = "nomic-ai/nomic-embed-text-v1.5", ONNX_MODEL_NAME = "nomic-embed-text-v1.5", ONNX_MODEL_DTYPE = "q8", ONNX_MODEL_DIM = 768, ONNX_MODEL_APPROX_MB = 130, MODEL_FILES, transformersModule = null, pipelinePromise = null, DEFAULT_ONNX_BATCH = 4;
+var init_onnx_embedder = __esm(() => {
+  MODEL_FILES = [
+    "config.json",
+    "tokenizer.json",
+    "tokenizer_config.json",
+    `onnx/model_quantized.onnx`
+  ].map((f) => join9(ONNX_MODEL_ID, f));
+});
 
 // ../../_shared/embeddings/index.ts
 function openaiEmbeddingConfig() {
@@ -50568,8 +50598,9 @@ async function handler2(supabase, args, ctx) {
     result_count: 1
   });
   return `Soft-deleted "${row.title ?? "untitled"}" (id: ${document_id}, ` + `${row.total_chars ?? "?"} chars) at ${row.deleted_at}.
-` + `The document is excluded from search but fully recoverable: it sits in the ` + `trash until restored or purged. cerefox_restore_document undoes this if it ` + `was a mistake; permanent purge is human-only (web UI).
-` + `Tell your user what you deleted and why, so they can review it.`;
+` + `The document is excluded from search but fully recoverable: it sits in the ` + `trash until restored or purged. cerefox_restore_document undoes this if it ` + `was a mistake; permanent purge is human-only (web UI), or automatic after the ` + `trash retention period if the operator has turned trash auto-purge on.
+` + (row.auto_purged ? `Trash auto-purge (an operator setting): this delete also permanently purged ` + `${row.auto_purged} document(s) that had been in the trash longer than the ` + `retention period.
+` : "") + `Tell your user what you deleted and why, so they can review it.`;
 }
 var deleteDocumentTool;
 var init_delete_document = __esm(() => {
@@ -50578,7 +50609,7 @@ var init_delete_document = __esm(() => {
   init_identity();
   deleteDocumentTool = {
     name: "cerefox_delete_document",
-    description: "SOFT-delete a document: it leaves search results and lands in the trash, recoverable until a human purges it. Requires expected_content_hash — the content_hash of the document AS YOU READ IT — so a delete always follows a read; if the document changed in between, the call fails with a conflict and you should re-read before deciding again. A mistaken delete can be undone with cerefox_restore_document; permanent purge is human-only (web UI). ALWAYS tell your user what you deleted and why. Pass a short reason — it is recorded in the audit log for the human reviewing the trash. Prefer this over ingesting empty/placeholder content when a document should go away.",
+    description: "SOFT-delete a document: it leaves search results and lands in the trash, recoverable until a human purges it (or, if the operator has turned on trash auto-purge, until it has been in the trash longer than the retention period; a delete reports any such purges it triggered). Requires expected_content_hash — the content_hash of the document AS YOU READ IT — so a delete always follows a read; if the document changed in between, the call fails with a conflict and you should re-read before deciding again. A mistaken delete can be undone with cerefox_restore_document; permanent purge is human-only (web UI). ALWAYS tell your user what you deleted and why. Pass a short reason — it is recorded in the audit log for the human reviewing the trash. Prefer this over ingesting empty/placeholder content when a document should go away.",
     annotations: {
       title: "Delete document (soft, recoverable)",
       readOnlyHint: false,
@@ -51405,12 +51436,12 @@ var init_partial_edits2 = __esm(() => {
 });
 
 // ../../_shared/mcp-tools/get-help-content.ts
-var HELP_FULL = '# Cerefox Knowledge Base -- Agent Quick Reference\n\nCerefox is a persistent, shared knowledge base. You have **15 core MCP tools** (14 with CLI equivalents — `cerefox_get_help` is MCP-only), plus 4 dormant relation tools that appear only when `relations_enabled` is on. For the full guide, search Cerefox for "How AI Agents Use Cerefox" or call `cerefox_get_help` to retrieve this content over MCP.\n\n## Tools\n\n| Tool | Purpose | Key params |\n|------|---------|------------|\n| `cerefox_search` | Find documents (hybrid FTS + semantic) | `query` (required), `project_name`, `metadata_filter`, `author` |\n| `cerefox_ingest` | Save or update a document | `title`, `content` (required), `document_id` (update by ID), `expected_content_hash` (**required on content updates** — see rule 10), `last_write_wins`, `update_if_exists`, `project_name` (single, non-destructive add on update), `project_names` (list, destructive replace on update), `metadata` (omit on update to keep existing tags; `{}` clears), `author` |\n| `cerefox_insert` | **Add** to a document without resending it. Cannot destroy content. | `document_id`, `text`, `position` (`end_of_document`/`end_of_section`/`after_heading`/`before_heading`), `expected_content_hash` (required), `anchor_heading` (unless `end_of_document`), `section_part`, `author` |\n| `cerefox_edit` | **Change** parts of a document: 1..n operations applied atomically | `document_id`, `operations` (`insert`/`replace_section`/`delete_section`/`rename_section`), `expected_content_hash` (required), `author` |\n| `cerefox_delete_document` | **Soft**-delete a document (to trash; excluded from search; permanent purge is human-only) | `document_id`, `expected_content_hash` (**required** — a delete must follow a read), `reason` (recorded in the audit log — give one), `author` |\n| `cerefox_restore_document` | Restore a soft-deleted document from the trash (audited inverse of delete; no-op if not deleted) | `document_id` (required), `reason` (recorded in the audit log), `author` |\n| `cerefox_get_document` | Get full document by ID (header includes `content_hash` — the update token), or with `outline: true` just its heading paths, sizes and hash, or with `section: "## Heading"` one section\'s text | `document_id` (required), `outline`, `section`, `section_part`, `author` |\n| `cerefox_list_versions` | Version history of a document | `document_id` (required), `author` |\n| `cerefox_set_relation` ⚑ | Link two documents (`source --rel_type--> target`) | `source_id`, `target_id`, `rel_type` (required), `metadata`, `author` |\n| `cerefox_delete_relation` ⚑ | Remove a relation | `source_id`, `target_id`, `rel_type`, `author` |\n| `cerefox_get_relations` ⚑ | All relations touching a document, both directions | `document_id` |\n| `cerefox_get_neighbors` ⚑ | Walk the graph along ONE relation type | `document_id`, `rel_type` (required), `depth`, `from_time`, `to_time`, `limit` |\n| `cerefox_metadata_search` | Find or list docs by metadata, project, or time (no text query) | `metadata_filter`, `project_name` (list a project\'s docs), `updated_since`, `include_content` — **at least one** of metadata_filter/project_name/updated_since/created_since |\n| `cerefox_list_metadata_keys` | Discover available metadata keys | (none required) |\n| `cerefox_list_projects` | List all projects | (none required) |\n| `cerefox_set_document_metadata` | Change tags WITHOUT resending content. **Merges** by default; a `null` value removes a key | `document_id`, `metadata` (required), `replace` (rare: set exactly this object), `author` |\n| `cerefox_set_document_projects` | Set doc\'s project memberships to exactly the given list (destructive replace; metadata-only, no content change) | `document_id`, `project_names` (required), `author` |\n| `cerefox_get_audit_log` | Query write operation history | `document_id`, `by_author` (filter), `operation`, `since`, `author` |\n| `cerefox_get_help` | Retrieve Cerefox conventions (this reference) over MCP. **Call this whenever uncertain.** | `topic` (optional, case-insensitive H2 substring match) |\n\n⚑ **Opt-in — usually absent.** The four relation tools are hidden unless the\noperator enables them (`relations_enabled`). **Trust your own tool list**: if\nthey are not in it, the feature is switched off for this deployment. That is\nnormal, not an error, and not something to work around.\n\n## Editing part of a document (prefer this over re-sending)\n\n**Re-sending a whole document to change part of it is the main way agents lose\ndata.** You have to reproduce the untouched remainder verbatim, and any drift\nsilently rewrites content nobody asked you to touch — which the caller cannot\ndiff. Use the partial-edit tools instead:\n\n1. **Learn the anchors** — `cerefox_get_document(document_id, outline: true)`.\n   Returns heading paths, per-section sizes and the `content_hash`, without the\n   body. The paths it returns are exactly what `anchor_heading` accepts.\n2. **Add** → `cerefox_insert`. `end_of_document` is a plain append;\n   `end_of_section` adds inside a named section. It is structurally incapable of\n   removing anything, so "I meant to append" cannot become "I replaced the file".\n3. **Look before you overwrite** — `cerefox_get_document(document_id,\n   section: "## Heading")` returns exactly the text a `replace_section` on that\n   anchor would destroy. The outline gives you a section\'s *size*, never its\n   *text*, so on a document you did not write yourself this is the difference\n   between a replace and a blind overwrite.\n4. **Change or remove** → `cerefox_edit`. Put changes that belong together in\n   ONE call: they apply atomically, so a table row and the total it feeds cannot\n   end up disagreeing. To change a single line, `replace_section` on its\n   smallest enclosing heading — that is the intended granularity, not a\n   workaround. To fix a stale heading (`## OPEN TODOs (as of ...)`), use\n   `rename_section`: it changes the heading text and leaves the body and\n   position alone.\n5. All of them require `expected_content_hash` and **have no last-write-wins**. A\n   conflict means someone else changed the document; re-read and decide, do not\n   force it.\n\n**A section runs to the next same-or-higher heading, or to the end of the\ndocument.** So `end_of_document` inserts land inside the *last* section, and\nreplacing or deleting that section removes them too. A large shrink in the\nresponse is your warning; `cerefox_list_versions` has the previous content.\n\n**When an anchor is ambiguous the tool refuses and hands you the options** — a\nrepeated heading returns the qualifying paths, and a section with both its own\ncontent and sub-sections returns both `section_part` choices. That is a\nrecoverable answer, not a failure: retry with what it gave you.\n\n## Essential Rules\n\n1. **Search before ingesting** -- check if the document exists first.\n2. **Prefer ID-based updates** -- pass `document_id` from search results for deterministic updates. Falls back to title-matching with `update_if_exists: true`.\n3. **Set `author`** to your name on every call, reads and writes alike (e.g., "Claude Code", "archiver"). Same parameter on every tool. (`requestor` is still accepted everywhere as the pre-1.13.1 alias.) On the CLI it is `--author` on every command too (plus `--author-type` on writes); or rely on `CEREFOX_AUTHOR_NAME`/`CEREFOX_AUTHOR_TYPE` env vars set in the user\'s `.env`.\n4. **Use `document_id` from search results** `[id: uuid]` for get_document and list_versions.\n5. **`max_bytes` has to fit a whole document.** Search returns COMPLETE documents, so a budget smaller than the top hit fits nothing. You get a header-only list saying so (never "No results found." — that means the store really has nothing). Raise `max_bytes`, or read one document with `cerefox_get_document` using `outline: true` or `section`.\n6. **Add metadata** -- at minimum `type` ("decision-log", "research", "design-doc") and `status` ("active", "draft").\n7. **Write for retrieval: the title does real work.** The document title is indexed at the **highest weight** *and* prepended to every chunk before it is embedded, so it steers both halves of hybrid search (keyword and semantic) for every chunk in the document. Name the document with the distinctive terms someone would actually search for -- "Cerefox Response Size Limits", not "Notes" or "Update 3". Renaming re-indexes and re-embeds, so correcting a vague title is cheap and takes effect immediately. Inside the content, write structured Markdown with H1/H2/H3 headings: the chunker follows them, and a chunk\'s own heading carries the same weight as the title.\n8. **Deletes are soft (recoverable); permanent purge is web-UI-only.** `cerefox_delete_document` requires the document\'s `content_hash` as you read it (read before you delete) and takes a `reason` — give one; it is what the human reviewing the trash sees. `cerefox_restore_document` undoes a mistaken delete (also audited, also takes a `reason`). Always surface deletes AND restores to the user. Once a human purges from the web UI, the document is gone for good.\n9. **Cross-doc links inside content**: **always use `[Text](document-uuid)`.** UUIDs are the only fully reliable link form — stable across title changes, never ambiguous, no encoding gotchas. Every `cerefox_search` result shows `[id: <uuid>]` after the title; grab it and use it. Title-based linking (`[Text](<Title With Spaces>)`) is fragile (breaks on colons, parens, ampersands, brackets — silently navigates to wrong page) — **don\'t write title-based links**; do an extra search to get the UUID instead. Repo-path forms (`[Text](docs/path.md)`) exist for repo-ingested files; don\'t construct manually. **The server validates `](uuid)` links on every write** (v1.7.0): a link to a nonexistent id rejects the write, naming the offender — that means you mangled the UUID; re-read the source and correct it, do not retry unchanged. Example ids go in backticks (code is not validated). `[[Wikilinks]]` may dangle. See `AGENT_GUIDE.md → Writing linkable content` for the full rule.\n10. **Concurrency: content updates require `expected_content_hash`.** Pass the `content_hash` you last saw — every read shows one (`cerefox_get_document` incl. outline mode, `cerefox_search`, `cerefox_metadata_search`) and **every write returns the new one, including create** (v1.3.0, #189), so after writing you already hold the token for your next edit; no re-read needed. If it\'s stale you get a **conflict** — re-read the document, merge your changes into the latest content, retry with the new hash. **Never resolve a conflict by overwriting blindly** — the current content includes another writer\'s work. `last_write_wins: true` skips the check; use it ONLY when an external source of truth makes conflicts meaningless (file re-sync), never to silence a conflict.\n11. **Search: prefer a few distinctive terms; heed `below confidence`.** When nothing clears the relevance threshold, `cerefox_search` returns the closest candidates prefixed with a `below confidence` warning instead of an empty set — that flag means **weak signal, not absent knowledge**: check the candidates\' scores and titles before concluding the KB lacks the content. A truly empty response means nothing even weakly related exists.\n12. **Relations express how documents relate; lifecycle tells you if knowledge is still good.** Use `cerefox_set_relation` when one document supersedes, contradicts, references, or continues another. `supersedes` marks the target **superseded**; `contradicts` marks **both** stale; `related_to`/`duplicates`/`contradicts` are symmetric (both directions written). Any other type string is accepted without special behaviour. When a search result or `cerefox_get_relations` shows a neighbour marked `[superseded]` or `[stale]`, say so rather than presenting it as current.\n13. **Project memberships — non-destructive by default**: on `cerefox_ingest` updates, **`project_name` (singular) is a non-destructive add** (ensures membership, preserves others). Use **`project_names` (list)** when you want to set the doc\'s full project set in one call (destructive replace). For metadata-only project changes without writing content, use **`cerefox_set_document_projects(document_id, project_names)`** — that tool is the destructive-replace contract made explicit. Never call `cerefox_set_document_projects` with a single name when you mean "add" — that would REMOVE the doc from all other projects. When in doubt, use `cerefox_ingest` with singular `project_name`.\n\n## Update Workflow (ID-based -- preferred)\n\n```\nsearch("topic") -> find doc [id: abc123] -> get_document(abc123) -> note its content_hash -> modify ->\ningest(title="Same Title", content="...", document_id="abc123",\n       expected_content_hash="<the hash you read>", author="my-agent")\n```\n\nOn a **conflict** error: get_document again (fresh content + fresh hash) -> merge your changes -> retry with the new hash.\n\n## Update Workflow (title-based -- fallback)\n\n```\nsearch("topic") -> find doc (note its hash) -> modify ->\ningest(title="Same Title", content="...", update_if_exists=true,\n       expected_content_hash="<the hash you read>", author="my-agent")\n```\n\n## Catch-Up Workflow\n\n```\nmetadata_search(metadata_filter={"type": "decision-log"}, updated_since="2026-03-28T00:00:00Z")\n```\n\n## CLI fallback (when MCP is unavailable)\n\nIf `cerefox_search` is not in your tool list, your user has likely installed the Cerefox CLI. The canonical invocation is plain **`cerefox <subcommand>`** (the TypeScript CLI, installed via `npm install -g @cerefox/memory`). It uses a resource-verb shape (`cerefox document get`, `cerefox project list`, …).\n\nSame operations, same conventions. Full reference: [`docs/guides/cli.md`](docs/guides/cli.md). CLI flag names match MCP parameter names exactly (e.g. `metadata_filter` ↔ `--metadata-filter`); common flags also have single-letter short forms (`-f`, `-p`, `-c`, `-m`, `-u`, `-a`). Use the canonical long name (what `--help` shows) or its short form — there are no long-form aliases like `--filter` or `--count`.\n\n| MCP tool | CLI |\n|---|---|\n| `cerefox_search` | `cerefox search "<q>" --author "<your-name>"` |\n| `cerefox_ingest` (paste) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --author "<your-name>" --author-type agent` |\n| `cerefox_ingest` (update by ID) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --document-id "<uuid>" --expected-content-hash "<hash>" --author "<your-name>" --author-type agent` |\n| `cerefox_get_document` | `cerefox document get <id> --version-id <vid> --author "<your-name>"` |\n| `cerefox_list_versions` | `cerefox document version list <id> --author "<your-name>"` |\n| `cerefox_list_projects` | `cerefox project list --author "<your-name>"` |\n| `cerefox_list_metadata_keys` | `cerefox metadata keys` |\n| `cerefox_insert` | `cerefox document insert <id> -t "<text>" -p <position> -a "<anchor-heading>" -e "<hash>" --author "<your-name>" --author-type agent` |\n| `cerefox_edit` | `cerefox document edit-parts <id> --operations \'<json>\' -e "<hash>" --author "<your-name>" --author-type agent` |\n| `cerefox_delete_document` | `cerefox document delete <id> --reason "<why>" --author "<your-name>" --author-type agent --yes` (confirms interactively instead of requiring the hash) |\n| `cerefox_restore_document` | `cerefox document restore <id> --reason "<why>" --author "<your-name>" --author-type agent` |\n| `cerefox_metadata_search` | `cerefox metadata search --metadata-filter \'<json>\' --author "<your-name>"` (list a project: `cerefox document list --project <name>`) |\n| `cerefox_set_document_metadata` | `cerefox document set-metadata <id> --set key=value` (also `--remove key`, `--json \'{...}\'`, `--replace`) |\n| `cerefox_set_document_projects` | `cerefox document set-projects <id> <name...> --author "<your-name>" --author-type agent` (or `--clear` to remove all) |\n| `cerefox_get_audit_log` | `cerefox audit list --author "<your-name>"` (add `--json` for scripted access) |\n| `cerefox_get_help` | `cerefox guides show agent-quick-reference` (or `cerefox guides list` for the full bundled-docs index) |\n\n**Set identity on every call**, exactly as you would on MCP:\n- Writes (`document ingest`, `document ingest-dir`): `--author "<your-name>" --author-type agent`\n- Reads: `--author "<your-name>"` (the same flag; `--requestor` still works as a hidden alias)\n\nOr have your user set `CEREFOX_AUTHOR_NAME` / `CEREFOX_AUTHOR_TYPE` / `CEREFOX_REQUESTOR_NAME` in their `.env` to apply defaults once.\n\n## Timestamps are UTC\n\nEvery timestamp Cerefox returns — `created_at` on audit entries, version\nhistory, document metadata — is **UTC**, and now carries its `Z` marker so it\ncannot be mistaken for local time.\n\n**When you write a date into a document\'s CONTENT, use your own clock, not a\nCerefox timestamp.** These are different things: a timestamp records when the\nserver stored something; a date in a log entry or a heading is authored content\nand belongs to your timezone. An agent working a Pacific afternoon read\n`2026-08-11` from version history, wrote "8/11" into its entries, and put a\nday\'s work in the future — the timestamp was correct, and copying it into\ncontent was not.\n\nCerefox deliberately does not convert to local time on the API or MCP paths.\n"Local" has no server-side meaning: the remote MCP server runs in a cloud\nfunction whose local time *is* UTC, while a local MCP server runs in yours, so\nthe same document would report two different times depending on transport. The\nweb UI converts because a browser knows the viewer\'s timezone; nothing\nserver-side does.\n\n## Mistakes that have actually happened\n\nEach of these comes from a real agent session, and each is easy to make.\n\n- **`cerefox_ingest` always replaces the ENTIRE document.** Never a section.\n  Before sending, check that the tool name matches the intent: if the intent is\n  "change one section", the call is `cerefox_edit` with `replace_section`. A\n  section-sized edit sent as a full ingest truncated a 13,000-character index to\n  a single word. It was recovered from version history within the minute, but\n  only because it was noticed immediately.\n\n- **Do not include the anchor\'s own heading in your text.** `replace_section`\n  keeps the heading and `insert` places your text inside the section, so\n  including it produces two. This is now refused rather than silently applied,\n  but the shape is worth knowing: it happened twice in one session, the second\n  time while trying to repair the first. A *deeper* sub-heading inside your text\n  is fine.\n\n- **Content between sections belongs to the section ABOVE it.** A section runs\n  to the next heading of the same or higher level, so a `---` rule, a note, or\n  any trailing text sitting just above the next heading is part of the section\n  before it — even when it visually reads as belonging below. Replacing that\n  section takes it too. An agent hit exactly this: a `---` that separated two\n  major sections disappeared when the section above it was replaced. The write\n  was correct by the addressing rules; the surprise is that "the end of this\n  section" is further down the page than it looks. Note the loss warning will\n  not catch it if your replacement text is longer than what it replaced, since\n  there is then no net loss to report.\n\n- **To change only tags, use `cerefox_set_document_metadata`, never `cerefox_ingest`.**\n  Ingest replaces the whole document, so re-sending it to set one tag carries the\n  full transcription risk for no reason. The metadata tool merges: the keys you\n  pass are set, everything else is left alone, so you do not need to read the\n  document first and cannot drop a tag another agent set. Pass `null` as a value\n  to remove a key.\n\n- **Never partial-edit to fix a partial edit.** If a write leaves unexpected\n  structure, stop. Use `cerefox_list_versions`, retrieve the last good version,\n  and re-ingest cleanly. Repairing edits with more edits compounds the damage.\n\n- **A rejected batch is safe.** Operations in one `cerefox_edit` are\n  all-or-nothing: if any is invalid, nothing is written. A refusal costs you a\n  retry, not data — so prefer one call for changes that belong together, and do\n  not split a batch to "make it more likely to succeed".\n\n- **Read before replacing.** `cerefox_get_document(section: "## Heading")`\n  returns exactly what a `replace_section` on that anchor would overwrite. Use it\n  for any section you did not write in this session. The outline gives a\n  section\'s *size*, never its *text*.\n\n- **Verify after writing** — read the result back before reporting success, and\n  report what the read actually shows.\n\n- **Partial edits cannot change a document\'s stored TITLE.** `rename_section`\n  changes a heading inside the content; the title is a separate field and still\n  needs `cerefox_ingest`.\n\n- **If a capability seems missing from one server, suspect your client first.**\n  Local and remote run the same code. **Every `cerefox_get_help()` response\n  begins with the server\'s version and the operations it registers** — you do\n  not need a special topic, and the *absence* of that block is itself an answer:\n  a server that does not print it predates v1.5.0. If that\n  disagrees with your tool list, the client is holding a list it fetched before\n  an upgrade — clients cache it at connect time. Ask the user to restart the\n  client. Do not record a capability difference between servers as a fact; every\n  such report so far has been a stale client.\n- Long inline bodies can arrive with literal `\\n`/`\\"` (the author over-escaped; Cerefox stores bytes faithfully). For long or quote-dense content, ingest from a file or build incrementally with `cerefox_insert`; read back multi-line writes.\n', HELP_SECTIONS, HELP_SECTION_HEADINGS;
+var HELP_FULL = '# Cerefox Knowledge Base -- Agent Quick Reference\n\nCerefox is a persistent, shared knowledge base. You have **15 core MCP tools** (14 with CLI equivalents — `cerefox_get_help` is MCP-only), plus 4 dormant relation tools that appear only when `relations_enabled` is on. For the full guide, search Cerefox for "How AI Agents Use Cerefox" or call `cerefox_get_help` to retrieve this content over MCP.\n\n## Tools\n\n| Tool | Purpose | Key params |\n|------|---------|------------|\n| `cerefox_search` | Find documents (hybrid FTS + semantic) | `query` (required), `project_name`, `metadata_filter`, `author` |\n| `cerefox_ingest` | Save or update a document | `title`, `content` (required), `document_id` (update by ID), `expected_content_hash` (**required on content updates** — see rule 10), `last_write_wins`, `update_if_exists`, `project_name` (single, non-destructive add on update), `project_names` (list, destructive replace on update), `metadata` (omit on update to keep existing tags; `{}` clears), `author` |\n| `cerefox_insert` | **Add** to a document without resending it. Cannot destroy content. | `document_id`, `text`, `position` (`end_of_document`/`end_of_section`/`after_heading`/`before_heading`), `expected_content_hash` (required), `anchor_heading` (unless `end_of_document`), `section_part`, `author` |\n| `cerefox_edit` | **Change** parts of a document: 1..n operations applied atomically | `document_id`, `operations` (`insert`/`replace_section`/`delete_section`/`rename_section`), `expected_content_hash` (required), `author` |\n| `cerefox_delete_document` | **Soft**-delete a document (to trash; excluded from search; permanent purge is human-only) | `document_id`, `expected_content_hash` (**required** — a delete must follow a read), `reason` (recorded in the audit log — give one), `author` |\n| `cerefox_restore_document` | Restore a soft-deleted document from the trash (audited inverse of delete; no-op if not deleted) | `document_id` (required), `reason` (recorded in the audit log), `author` |\n| `cerefox_get_document` | Get full document by ID (header includes `content_hash` — the update token), or with `outline: true` just its heading paths, sizes and hash, or with `section: "## Heading"` one section\'s text | `document_id` (required), `outline`, `section`, `section_part`, `author` |\n| `cerefox_list_versions` | Version history of a document | `document_id` (required), `author` |\n| `cerefox_set_relation` ⚑ | Link two documents (`source --rel_type--> target`) | `source_id`, `target_id`, `rel_type` (required), `metadata`, `author` |\n| `cerefox_delete_relation` ⚑ | Remove a relation | `source_id`, `target_id`, `rel_type`, `author` |\n| `cerefox_get_relations` ⚑ | All relations touching a document, both directions | `document_id` |\n| `cerefox_get_neighbors` ⚑ | Walk the graph along ONE relation type | `document_id`, `rel_type` (required), `depth`, `from_time`, `to_time`, `limit` |\n| `cerefox_metadata_search` | Find or list docs by metadata, project, or time (no text query) | `metadata_filter`, `project_name` (list a project\'s docs), `updated_since`, `include_content` — **at least one** of metadata_filter/project_name/updated_since/created_since |\n| `cerefox_list_metadata_keys` | Discover available metadata keys | (none required) |\n| `cerefox_list_projects` | List all projects | (none required) |\n| `cerefox_set_document_metadata` | Change tags WITHOUT resending content. **Merges** by default; a `null` value removes a key | `document_id`, `metadata` (required), `replace` (rare: set exactly this object), `author` |\n| `cerefox_set_document_projects` | Set doc\'s project memberships to exactly the given list (destructive replace; metadata-only, no content change) | `document_id`, `project_names` (required), `author` |\n| `cerefox_get_audit_log` | Query write operation history | `document_id`, `by_author` (filter), `operation`, `since`, `author` |\n| `cerefox_get_help` | Retrieve Cerefox conventions (this reference) over MCP. **Call this whenever uncertain.** | `topic` (optional, case-insensitive H2 substring match) |\n\n⚑ **Opt-in — usually absent.** The four relation tools are hidden unless the\noperator enables them (`relations_enabled`). **Trust your own tool list**: if\nthey are not in it, the feature is switched off for this deployment. That is\nnormal, not an error, and not something to work around.\n\n## Editing part of a document (prefer this over re-sending)\n\n**Re-sending a whole document to change part of it is the main way agents lose\ndata.** You have to reproduce the untouched remainder verbatim, and any drift\nsilently rewrites content nobody asked you to touch — which the caller cannot\ndiff. Use the partial-edit tools instead:\n\n1. **Learn the anchors** — `cerefox_get_document(document_id, outline: true)`.\n   Returns heading paths, per-section sizes and the `content_hash`, without the\n   body. The paths it returns are exactly what `anchor_heading` accepts.\n2. **Add** → `cerefox_insert`. `end_of_document` is a plain append;\n   `end_of_section` adds inside a named section. It is structurally incapable of\n   removing anything, so "I meant to append" cannot become "I replaced the file".\n3. **Look before you overwrite** — `cerefox_get_document(document_id,\n   section: "## Heading")` returns exactly the text a `replace_section` on that\n   anchor would destroy. The outline gives you a section\'s *size*, never its\n   *text*, so on a document you did not write yourself this is the difference\n   between a replace and a blind overwrite.\n4. **Change or remove** → `cerefox_edit`. Put changes that belong together in\n   ONE call: they apply atomically, so a table row and the total it feeds cannot\n   end up disagreeing. To change a single line, `replace_section` on its\n   smallest enclosing heading — that is the intended granularity, not a\n   workaround. To fix a stale heading (`## OPEN TODOs (as of ...)`), use\n   `rename_section`: it changes the heading text and leaves the body and\n   position alone.\n5. All of them require `expected_content_hash` and **have no last-write-wins**. A\n   conflict means someone else changed the document; re-read and decide, do not\n   force it.\n\n**A section runs to the next same-or-higher heading, or to the end of the\ndocument.** So `end_of_document` inserts land inside the *last* section, and\nreplacing or deleting that section removes them too. A large shrink in the\nresponse is your warning; `cerefox_list_versions` has the previous content.\n\n**When an anchor is ambiguous the tool refuses and hands you the options** — a\nrepeated heading returns the qualifying paths, and a section with both its own\ncontent and sub-sections returns both `section_part` choices. That is a\nrecoverable answer, not a failure: retry with what it gave you.\n\n## Essential Rules\n\n1. **Search before ingesting** -- check if the document exists first.\n2. **Prefer ID-based updates** -- pass `document_id` from search results for deterministic updates. Falls back to title-matching with `update_if_exists: true`.\n3. **Set `author`** to your name on every call, reads and writes alike (e.g., "Claude Code", "archiver"). Same parameter on every tool. (`requestor` is still accepted everywhere as the pre-1.13.1 alias.) On the CLI it is `--author` on every command too (plus `--author-type` on writes); or rely on `CEREFOX_AUTHOR_NAME`/`CEREFOX_AUTHOR_TYPE` env vars set in the user\'s `.env`.\n4. **Use `document_id` from search results** `[id: uuid]` for get_document and list_versions.\n5. **`max_bytes` has to fit a whole document.** Search returns COMPLETE documents, so a budget smaller than the top hit fits nothing. You get a header-only list saying so (never "No results found." — that means the store really has nothing). Raise `max_bytes`, or read one document with `cerefox_get_document` using `outline: true` or `section`.\n6. **Add metadata** -- at minimum `type` ("decision-log", "research", "design-doc") and `status` ("active", "draft").\n7. **Write for retrieval: the title does real work.** The document title is indexed at the **highest weight** *and* prepended to every chunk before it is embedded, so it steers both halves of hybrid search (keyword and semantic) for every chunk in the document. Name the document with the distinctive terms someone would actually search for -- "Cerefox Response Size Limits", not "Notes" or "Update 3". Renaming re-indexes and re-embeds, so correcting a vague title is cheap and takes effect immediately. Inside the content, write structured Markdown with H1/H2/H3 headings: the chunker follows them, and a chunk\'s own heading carries the same weight as the title.\n8. **Deletes are soft (recoverable); permanent purge is web-UI-only.** `cerefox_delete_document` requires the document\'s `content_hash` as you read it (read before you delete) and takes a `reason` — give one; it is what the human reviewing the trash sees. `cerefox_restore_document` undoes a mistaken delete (also audited, also takes a `reason`). Always surface deletes AND restores to the user. Once a human purges from the web UI, the document is gone for good; so is one auto-purged after `trash_retention_days`, if the operator has turned trash auto-purge on.\n9. **Cross-doc links inside content**: **always use `[Text](document-uuid)`.** UUIDs are the only fully reliable link form — stable across title changes, never ambiguous, no encoding gotchas. Every `cerefox_search` result shows `[id: <uuid>]` after the title; grab it and use it. Title-based linking (`[Text](<Title With Spaces>)`) is fragile (breaks on colons, parens, ampersands, brackets — silently navigates to wrong page) — **don\'t write title-based links**; do an extra search to get the UUID instead. Repo-path forms (`[Text](docs/path.md)`) exist for repo-ingested files; don\'t construct manually. **The server validates `](uuid)` links on every write** (v1.7.0): a link to a nonexistent id rejects the write, naming the offender — that means you mangled the UUID; re-read the source and correct it, do not retry unchanged. Example ids go in backticks (code is not validated). `[[Wikilinks]]` may dangle. See `AGENT_GUIDE.md → Writing linkable content` for the full rule.\n10. **Concurrency: content updates require `expected_content_hash`.** Pass the `content_hash` you last saw — every read shows one (`cerefox_get_document` incl. outline mode, `cerefox_search`, `cerefox_metadata_search`) and **every write returns the new one, including create** (v1.3.0, #189), so after writing you already hold the token for your next edit; no re-read needed. If it\'s stale you get a **conflict** — re-read the document, merge your changes into the latest content, retry with the new hash. **Never resolve a conflict by overwriting blindly** — the current content includes another writer\'s work. `last_write_wins: true` skips the check; use it ONLY when an external source of truth makes conflicts meaningless (file re-sync), never to silence a conflict.\n11. **Search: prefer a few distinctive terms; heed `below confidence`.** When nothing clears the relevance threshold, `cerefox_search` returns the closest candidates prefixed with a `below confidence` warning instead of an empty set — that flag means **weak signal, not absent knowledge**: check the candidates\' scores and titles before concluding the KB lacks the content. A truly empty response means nothing even weakly related exists.\n12. **Relations express how documents relate; lifecycle tells you if knowledge is still good.** Use `cerefox_set_relation` when one document supersedes, contradicts, references, or continues another. `supersedes` marks the target **superseded**; `contradicts` marks **both** stale; `related_to`/`duplicates`/`contradicts` are symmetric (both directions written). Any other type string is accepted without special behaviour. When a search result or `cerefox_get_relations` shows a neighbour marked `[superseded]` or `[stale]`, say so rather than presenting it as current.\n13. **Project memberships — non-destructive by default**: on `cerefox_ingest` updates, **`project_name` (singular) is a non-destructive add** (ensures membership, preserves others). Use **`project_names` (list)** when you want to set the doc\'s full project set in one call (destructive replace). For metadata-only project changes without writing content, use **`cerefox_set_document_projects(document_id, project_names)`** — that tool is the destructive-replace contract made explicit. Never call `cerefox_set_document_projects` with a single name when you mean "add" — that would REMOVE the doc from all other projects. When in doubt, use `cerefox_ingest` with singular `project_name`.\n\n## Update Workflow (ID-based -- preferred)\n\n```\nsearch("topic") -> find doc [id: abc123] -> get_document(abc123) -> note its content_hash -> modify ->\ningest(title="Same Title", content="...", document_id="abc123",\n       expected_content_hash="<the hash you read>", author="my-agent")\n```\n\nOn a **conflict** error: get_document again (fresh content + fresh hash) -> merge your changes -> retry with the new hash.\n\n## Update Workflow (title-based -- fallback)\n\n```\nsearch("topic") -> find doc (note its hash) -> modify ->\ningest(title="Same Title", content="...", update_if_exists=true,\n       expected_content_hash="<the hash you read>", author="my-agent")\n```\n\n## Catch-Up Workflow\n\n```\nmetadata_search(metadata_filter={"type": "decision-log"}, updated_since="2026-03-28T00:00:00Z")\n```\n\n## CLI fallback (when MCP is unavailable)\n\nIf `cerefox_search` is not in your tool list, your user has likely installed the Cerefox CLI. The canonical invocation is plain **`cerefox <subcommand>`** (the TypeScript CLI, installed via `npm install -g @cerefox/memory`). It uses a resource-verb shape (`cerefox document get`, `cerefox project list`, …).\n\nSame operations, same conventions. Full reference: [`docs/guides/cli.md`](docs/guides/cli.md). CLI flag names match MCP parameter names exactly (e.g. `metadata_filter` ↔ `--metadata-filter`); common flags also have single-letter short forms (`-f`, `-p`, `-c`, `-m`, `-u`, `-a`). Use the canonical long name (what `--help` shows) or its short form — there are no long-form aliases like `--filter` or `--count`.\n\n| MCP tool | CLI |\n|---|---|\n| `cerefox_search` | `cerefox search "<q>" --author "<your-name>"` |\n| `cerefox_ingest` (paste) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --author "<your-name>" --author-type agent` |\n| `cerefox_ingest` (update by ID) | `printf \'...\' \\| cerefox document ingest --paste --title "<t>" --document-id "<uuid>" --expected-content-hash "<hash>" --author "<your-name>" --author-type agent` |\n| `cerefox_get_document` | `cerefox document get <id> --version-id <vid> --author "<your-name>"` |\n| `cerefox_list_versions` | `cerefox document version list <id> --author "<your-name>"` |\n| `cerefox_list_projects` | `cerefox project list --author "<your-name>"` |\n| `cerefox_list_metadata_keys` | `cerefox metadata keys` |\n| `cerefox_insert` | `cerefox document insert <id> -t "<text>" -p <position> -a "<anchor-heading>" -e "<hash>" --author "<your-name>" --author-type agent` |\n| `cerefox_edit` | `cerefox document edit-parts <id> --operations \'<json>\' -e "<hash>" --author "<your-name>" --author-type agent` |\n| `cerefox_delete_document` | `cerefox document delete <id> --reason "<why>" --author "<your-name>" --author-type agent --yes` (confirms interactively instead of requiring the hash) |\n| `cerefox_restore_document` | `cerefox document restore <id> --reason "<why>" --author "<your-name>" --author-type agent` |\n| `cerefox_metadata_search` | `cerefox metadata search --metadata-filter \'<json>\' --author "<your-name>"` (list a project: `cerefox document list --project <name>`) |\n| `cerefox_set_document_metadata` | `cerefox document set-metadata <id> --set key=value` (also `--remove key`, `--json \'{...}\'`, `--replace`) |\n| `cerefox_set_document_projects` | `cerefox document set-projects <id> <name...> --author "<your-name>" --author-type agent` (or `--clear` to remove all) |\n| `cerefox_get_audit_log` | `cerefox audit list --author "<your-name>"` (add `--json` for scripted access) |\n| `cerefox_get_help` | `cerefox guides show agent-quick-reference` (or `cerefox guides list` for the full bundled-docs index) |\n\n**Set identity on every call**, exactly as you would on MCP:\n- Writes (`document ingest`, `document ingest-dir`): `--author "<your-name>" --author-type agent`\n- Reads: `--author "<your-name>"` (the same flag; `--requestor` still works as a hidden alias)\n\nOr have your user set `CEREFOX_AUTHOR_NAME` / `CEREFOX_AUTHOR_TYPE` / `CEREFOX_REQUESTOR_NAME` in their `.env` to apply defaults once.\n\n## Timestamps are UTC\n\nEvery timestamp Cerefox returns — `created_at` on audit entries, version\nhistory, document metadata — is **UTC**, and now carries its `Z` marker so it\ncannot be mistaken for local time.\n\n**When you write a date into a document\'s CONTENT, use your own clock, not a\nCerefox timestamp.** These are different things: a timestamp records when the\nserver stored something; a date in a log entry or a heading is authored content\nand belongs to your timezone. An agent working a Pacific afternoon read\n`2026-08-11` from version history, wrote "8/11" into its entries, and put a\nday\'s work in the future — the timestamp was correct, and copying it into\ncontent was not.\n\nCerefox deliberately does not convert to local time on the API or MCP paths.\n"Local" has no server-side meaning: the remote MCP server runs in a cloud\nfunction whose local time *is* UTC, while a local MCP server runs in yours, so\nthe same document would report two different times depending on transport. The\nweb UI converts because a browser knows the viewer\'s timezone; nothing\nserver-side does.\n\n## Mistakes that have actually happened\n\nEach of these comes from a real agent session, and each is easy to make.\n\n- **`cerefox_ingest` always replaces the ENTIRE document.** Never a section.\n  Before sending, check that the tool name matches the intent: if the intent is\n  "change one section", the call is `cerefox_edit` with `replace_section`. A\n  section-sized edit sent as a full ingest truncated a 13,000-character index to\n  a single word. It was recovered from version history within the minute, but\n  only because it was noticed immediately.\n\n- **Do not include the anchor\'s own heading in your text.** `replace_section`\n  keeps the heading and `insert` places your text inside the section, so\n  including it produces two. This is now refused rather than silently applied,\n  but the shape is worth knowing: it happened twice in one session, the second\n  time while trying to repair the first. A *deeper* sub-heading inside your text\n  is fine.\n\n- **Content between sections belongs to the section ABOVE it.** A section runs\n  to the next heading of the same or higher level, so a `---` rule, a note, or\n  any trailing text sitting just above the next heading is part of the section\n  before it — even when it visually reads as belonging below. Replacing that\n  section takes it too. An agent hit exactly this: a `---` that separated two\n  major sections disappeared when the section above it was replaced. The write\n  was correct by the addressing rules; the surprise is that "the end of this\n  section" is further down the page than it looks. Note the loss warning will\n  not catch it if your replacement text is longer than what it replaced, since\n  there is then no net loss to report.\n\n- **To change only tags, use `cerefox_set_document_metadata`, never `cerefox_ingest`.**\n  Ingest replaces the whole document, so re-sending it to set one tag carries the\n  full transcription risk for no reason. The metadata tool merges: the keys you\n  pass are set, everything else is left alone, so you do not need to read the\n  document first and cannot drop a tag another agent set. Pass `null` as a value\n  to remove a key.\n\n- **Never partial-edit to fix a partial edit.** If a write leaves unexpected\n  structure, stop. Use `cerefox_list_versions`, retrieve the last good version,\n  and re-ingest cleanly. Repairing edits with more edits compounds the damage.\n\n- **A rejected batch is safe.** Operations in one `cerefox_edit` are\n  all-or-nothing: if any is invalid, nothing is written. A refusal costs you a\n  retry, not data — so prefer one call for changes that belong together, and do\n  not split a batch to "make it more likely to succeed".\n\n- **Read before replacing.** `cerefox_get_document(section: "## Heading")`\n  returns exactly what a `replace_section` on that anchor would overwrite. Use it\n  for any section you did not write in this session. The outline gives a\n  section\'s *size*, never its *text*.\n\n- **Verify after writing** — read the result back before reporting success, and\n  report what the read actually shows.\n\n- **Partial edits cannot change a document\'s stored TITLE.** `rename_section`\n  changes a heading inside the content; the title is a separate field and still\n  needs `cerefox_ingest`.\n\n- **If a capability seems missing from one server, suspect your client first.**\n  Local and remote run the same code. **Every `cerefox_get_help()` response\n  begins with the server\'s version and the operations it registers** — you do\n  not need a special topic, and the *absence* of that block is itself an answer:\n  a server that does not print it predates v1.5.0. If that\n  disagrees with your tool list, the client is holding a list it fetched before\n  an upgrade — clients cache it at connect time. Ask the user to restart the\n  client. Do not record a capability difference between servers as a fact; every\n  such report so far has been a stale client.\n- Long inline bodies can arrive with literal `\\n`/`\\"` (the author over-escaped; Cerefox stores bytes faithfully). For long or quote-dense content, ingest from a file or build incrementally with `cerefox_insert`; read back multi-line writes.\n', HELP_SECTIONS, HELP_SECTION_HEADINGS;
 var init_get_help_content = __esm(() => {
   HELP_SECTIONS = {
     Tools: "## Tools\n\n| Tool | Purpose | Key params |\n|------|---------|------------|\n| `cerefox_search` | Find documents (hybrid FTS + semantic) | `query` (required), `project_name`, `metadata_filter`, `author` |\n| `cerefox_ingest` | Save or update a document | `title`, `content` (required), `document_id` (update by ID), `expected_content_hash` (**required on content updates** — see rule 10), `last_write_wins`, `update_if_exists`, `project_name` (single, non-destructive add on update), `project_names` (list, destructive replace on update), `metadata` (omit on update to keep existing tags; `{}` clears), `author` |\n| `cerefox_insert` | **Add** to a document without resending it. Cannot destroy content. | `document_id`, `text`, `position` (`end_of_document`/`end_of_section`/`after_heading`/`before_heading`), `expected_content_hash` (required), `anchor_heading` (unless `end_of_document`), `section_part`, `author` |\n| `cerefox_edit` | **Change** parts of a document: 1..n operations applied atomically | `document_id`, `operations` (`insert`/`replace_section`/`delete_section`/`rename_section`), `expected_content_hash` (required), `author` |\n| `cerefox_delete_document` | **Soft**-delete a document (to trash; excluded from search; permanent purge is human-only) | `document_id`, `expected_content_hash` (**required** — a delete must follow a read), `reason` (recorded in the audit log — give one), `author` |\n| `cerefox_restore_document` | Restore a soft-deleted document from the trash (audited inverse of delete; no-op if not deleted) | `document_id` (required), `reason` (recorded in the audit log), `author` |\n| `cerefox_get_document` | Get full document by ID (header includes `content_hash` — the update token), or with `outline: true` just its heading paths, sizes and hash, or with `section: \"## Heading\"` one section's text | `document_id` (required), `outline`, `section`, `section_part`, `author` |\n| `cerefox_list_versions` | Version history of a document | `document_id` (required), `author` |\n| `cerefox_set_relation` ⚑ | Link two documents (`source --rel_type--> target`) | `source_id`, `target_id`, `rel_type` (required), `metadata`, `author` |\n| `cerefox_delete_relation` ⚑ | Remove a relation | `source_id`, `target_id`, `rel_type`, `author` |\n| `cerefox_get_relations` ⚑ | All relations touching a document, both directions | `document_id` |\n| `cerefox_get_neighbors` ⚑ | Walk the graph along ONE relation type | `document_id`, `rel_type` (required), `depth`, `from_time`, `to_time`, `limit` |\n| `cerefox_metadata_search` | Find or list docs by metadata, project, or time (no text query) | `metadata_filter`, `project_name` (list a project's docs), `updated_since`, `include_content` — **at least one** of metadata_filter/project_name/updated_since/created_since |\n| `cerefox_list_metadata_keys` | Discover available metadata keys | (none required) |\n| `cerefox_list_projects` | List all projects | (none required) |\n| `cerefox_set_document_metadata` | Change tags WITHOUT resending content. **Merges** by default; a `null` value removes a key | `document_id`, `metadata` (required), `replace` (rare: set exactly this object), `author` |\n| `cerefox_set_document_projects` | Set doc's project memberships to exactly the given list (destructive replace; metadata-only, no content change) | `document_id`, `project_names` (required), `author` |\n| `cerefox_get_audit_log` | Query write operation history | `document_id`, `by_author` (filter), `operation`, `since`, `author` |\n| `cerefox_get_help` | Retrieve Cerefox conventions (this reference) over MCP. **Call this whenever uncertain.** | `topic` (optional, case-insensitive H2 substring match) |\n\n⚑ **Opt-in — usually absent.** The four relation tools are hidden unless the\noperator enables them (`relations_enabled`). **Trust your own tool list**: if\nthey are not in it, the feature is switched off for this deployment. That is\nnormal, not an error, and not something to work around.",
     "Editing part of a document (prefer this over re-sending)": '## Editing part of a document (prefer this over re-sending)\n\n**Re-sending a whole document to change part of it is the main way agents lose\ndata.** You have to reproduce the untouched remainder verbatim, and any drift\nsilently rewrites content nobody asked you to touch — which the caller cannot\ndiff. Use the partial-edit tools instead:\n\n1. **Learn the anchors** — `cerefox_get_document(document_id, outline: true)`.\n   Returns heading paths, per-section sizes and the `content_hash`, without the\n   body. The paths it returns are exactly what `anchor_heading` accepts.\n2. **Add** → `cerefox_insert`. `end_of_document` is a plain append;\n   `end_of_section` adds inside a named section. It is structurally incapable of\n   removing anything, so "I meant to append" cannot become "I replaced the file".\n3. **Look before you overwrite** — `cerefox_get_document(document_id,\n   section: "## Heading")` returns exactly the text a `replace_section` on that\n   anchor would destroy. The outline gives you a section\'s *size*, never its\n   *text*, so on a document you did not write yourself this is the difference\n   between a replace and a blind overwrite.\n4. **Change or remove** → `cerefox_edit`. Put changes that belong together in\n   ONE call: they apply atomically, so a table row and the total it feeds cannot\n   end up disagreeing. To change a single line, `replace_section` on its\n   smallest enclosing heading — that is the intended granularity, not a\n   workaround. To fix a stale heading (`## OPEN TODOs (as of ...)`), use\n   `rename_section`: it changes the heading text and leaves the body and\n   position alone.\n5. All of them require `expected_content_hash` and **have no last-write-wins**. A\n   conflict means someone else changed the document; re-read and decide, do not\n   force it.\n\n**A section runs to the next same-or-higher heading, or to the end of the\ndocument.** So `end_of_document` inserts land inside the *last* section, and\nreplacing or deleting that section removes them too. A large shrink in the\nresponse is your warning; `cerefox_list_versions` has the previous content.\n\n**When an anchor is ambiguous the tool refuses and hands you the options** — a\nrepeated heading returns the qualifying paths, and a section with both its own\ncontent and sub-sections returns both `section_part` choices. That is a\nrecoverable answer, not a failure: retry with what it gave you.',
-    "Essential Rules": '## Essential Rules\n\n1. **Search before ingesting** -- check if the document exists first.\n2. **Prefer ID-based updates** -- pass `document_id` from search results for deterministic updates. Falls back to title-matching with `update_if_exists: true`.\n3. **Set `author`** to your name on every call, reads and writes alike (e.g., "Claude Code", "archiver"). Same parameter on every tool. (`requestor` is still accepted everywhere as the pre-1.13.1 alias.) On the CLI it is `--author` on every command too (plus `--author-type` on writes); or rely on `CEREFOX_AUTHOR_NAME`/`CEREFOX_AUTHOR_TYPE` env vars set in the user\'s `.env`.\n4. **Use `document_id` from search results** `[id: uuid]` for get_document and list_versions.\n5. **`max_bytes` has to fit a whole document.** Search returns COMPLETE documents, so a budget smaller than the top hit fits nothing. You get a header-only list saying so (never "No results found." — that means the store really has nothing). Raise `max_bytes`, or read one document with `cerefox_get_document` using `outline: true` or `section`.\n6. **Add metadata** -- at minimum `type` ("decision-log", "research", "design-doc") and `status` ("active", "draft").\n7. **Write for retrieval: the title does real work.** The document title is indexed at the **highest weight** *and* prepended to every chunk before it is embedded, so it steers both halves of hybrid search (keyword and semantic) for every chunk in the document. Name the document with the distinctive terms someone would actually search for -- "Cerefox Response Size Limits", not "Notes" or "Update 3". Renaming re-indexes and re-embeds, so correcting a vague title is cheap and takes effect immediately. Inside the content, write structured Markdown with H1/H2/H3 headings: the chunker follows them, and a chunk\'s own heading carries the same weight as the title.\n8. **Deletes are soft (recoverable); permanent purge is web-UI-only.** `cerefox_delete_document` requires the document\'s `content_hash` as you read it (read before you delete) and takes a `reason` — give one; it is what the human reviewing the trash sees. `cerefox_restore_document` undoes a mistaken delete (also audited, also takes a `reason`). Always surface deletes AND restores to the user. Once a human purges from the web UI, the document is gone for good.\n9. **Cross-doc links inside content**: **always use `[Text](document-uuid)`.** UUIDs are the only fully reliable link form — stable across title changes, never ambiguous, no encoding gotchas. Every `cerefox_search` result shows `[id: <uuid>]` after the title; grab it and use it. Title-based linking (`[Text](<Title With Spaces>)`) is fragile (breaks on colons, parens, ampersands, brackets — silently navigates to wrong page) — **don\'t write title-based links**; do an extra search to get the UUID instead. Repo-path forms (`[Text](docs/path.md)`) exist for repo-ingested files; don\'t construct manually. **The server validates `](uuid)` links on every write** (v1.7.0): a link to a nonexistent id rejects the write, naming the offender — that means you mangled the UUID; re-read the source and correct it, do not retry unchanged. Example ids go in backticks (code is not validated). `[[Wikilinks]]` may dangle. See `AGENT_GUIDE.md → Writing linkable content` for the full rule.\n10. **Concurrency: content updates require `expected_content_hash`.** Pass the `content_hash` you last saw — every read shows one (`cerefox_get_document` incl. outline mode, `cerefox_search`, `cerefox_metadata_search`) and **every write returns the new one, including create** (v1.3.0, #189), so after writing you already hold the token for your next edit; no re-read needed. If it\'s stale you get a **conflict** — re-read the document, merge your changes into the latest content, retry with the new hash. **Never resolve a conflict by overwriting blindly** — the current content includes another writer\'s work. `last_write_wins: true` skips the check; use it ONLY when an external source of truth makes conflicts meaningless (file re-sync), never to silence a conflict.\n11. **Search: prefer a few distinctive terms; heed `below confidence`.** When nothing clears the relevance threshold, `cerefox_search` returns the closest candidates prefixed with a `below confidence` warning instead of an empty set — that flag means **weak signal, not absent knowledge**: check the candidates\' scores and titles before concluding the KB lacks the content. A truly empty response means nothing even weakly related exists.\n12. **Relations express how documents relate; lifecycle tells you if knowledge is still good.** Use `cerefox_set_relation` when one document supersedes, contradicts, references, or continues another. `supersedes` marks the target **superseded**; `contradicts` marks **both** stale; `related_to`/`duplicates`/`contradicts` are symmetric (both directions written). Any other type string is accepted without special behaviour. When a search result or `cerefox_get_relations` shows a neighbour marked `[superseded]` or `[stale]`, say so rather than presenting it as current.\n13. **Project memberships — non-destructive by default**: on `cerefox_ingest` updates, **`project_name` (singular) is a non-destructive add** (ensures membership, preserves others). Use **`project_names` (list)** when you want to set the doc\'s full project set in one call (destructive replace). For metadata-only project changes without writing content, use **`cerefox_set_document_projects(document_id, project_names)`** — that tool is the destructive-replace contract made explicit. Never call `cerefox_set_document_projects` with a single name when you mean "add" — that would REMOVE the doc from all other projects. When in doubt, use `cerefox_ingest` with singular `project_name`.',
+    "Essential Rules": '## Essential Rules\n\n1. **Search before ingesting** -- check if the document exists first.\n2. **Prefer ID-based updates** -- pass `document_id` from search results for deterministic updates. Falls back to title-matching with `update_if_exists: true`.\n3. **Set `author`** to your name on every call, reads and writes alike (e.g., "Claude Code", "archiver"). Same parameter on every tool. (`requestor` is still accepted everywhere as the pre-1.13.1 alias.) On the CLI it is `--author` on every command too (plus `--author-type` on writes); or rely on `CEREFOX_AUTHOR_NAME`/`CEREFOX_AUTHOR_TYPE` env vars set in the user\'s `.env`.\n4. **Use `document_id` from search results** `[id: uuid]` for get_document and list_versions.\n5. **`max_bytes` has to fit a whole document.** Search returns COMPLETE documents, so a budget smaller than the top hit fits nothing. You get a header-only list saying so (never "No results found." — that means the store really has nothing). Raise `max_bytes`, or read one document with `cerefox_get_document` using `outline: true` or `section`.\n6. **Add metadata** -- at minimum `type` ("decision-log", "research", "design-doc") and `status` ("active", "draft").\n7. **Write for retrieval: the title does real work.** The document title is indexed at the **highest weight** *and* prepended to every chunk before it is embedded, so it steers both halves of hybrid search (keyword and semantic) for every chunk in the document. Name the document with the distinctive terms someone would actually search for -- "Cerefox Response Size Limits", not "Notes" or "Update 3". Renaming re-indexes and re-embeds, so correcting a vague title is cheap and takes effect immediately. Inside the content, write structured Markdown with H1/H2/H3 headings: the chunker follows them, and a chunk\'s own heading carries the same weight as the title.\n8. **Deletes are soft (recoverable); permanent purge is web-UI-only.** `cerefox_delete_document` requires the document\'s `content_hash` as you read it (read before you delete) and takes a `reason` — give one; it is what the human reviewing the trash sees. `cerefox_restore_document` undoes a mistaken delete (also audited, also takes a `reason`). Always surface deletes AND restores to the user. Once a human purges from the web UI, the document is gone for good; so is one auto-purged after `trash_retention_days`, if the operator has turned trash auto-purge on.\n9. **Cross-doc links inside content**: **always use `[Text](document-uuid)`.** UUIDs are the only fully reliable link form — stable across title changes, never ambiguous, no encoding gotchas. Every `cerefox_search` result shows `[id: <uuid>]` after the title; grab it and use it. Title-based linking (`[Text](<Title With Spaces>)`) is fragile (breaks on colons, parens, ampersands, brackets — silently navigates to wrong page) — **don\'t write title-based links**; do an extra search to get the UUID instead. Repo-path forms (`[Text](docs/path.md)`) exist for repo-ingested files; don\'t construct manually. **The server validates `](uuid)` links on every write** (v1.7.0): a link to a nonexistent id rejects the write, naming the offender — that means you mangled the UUID; re-read the source and correct it, do not retry unchanged. Example ids go in backticks (code is not validated). `[[Wikilinks]]` may dangle. See `AGENT_GUIDE.md → Writing linkable content` for the full rule.\n10. **Concurrency: content updates require `expected_content_hash`.** Pass the `content_hash` you last saw — every read shows one (`cerefox_get_document` incl. outline mode, `cerefox_search`, `cerefox_metadata_search`) and **every write returns the new one, including create** (v1.3.0, #189), so after writing you already hold the token for your next edit; no re-read needed. If it\'s stale you get a **conflict** — re-read the document, merge your changes into the latest content, retry with the new hash. **Never resolve a conflict by overwriting blindly** — the current content includes another writer\'s work. `last_write_wins: true` skips the check; use it ONLY when an external source of truth makes conflicts meaningless (file re-sync), never to silence a conflict.\n11. **Search: prefer a few distinctive terms; heed `below confidence`.** When nothing clears the relevance threshold, `cerefox_search` returns the closest candidates prefixed with a `below confidence` warning instead of an empty set — that flag means **weak signal, not absent knowledge**: check the candidates\' scores and titles before concluding the KB lacks the content. A truly empty response means nothing even weakly related exists.\n12. **Relations express how documents relate; lifecycle tells you if knowledge is still good.** Use `cerefox_set_relation` when one document supersedes, contradicts, references, or continues another. `supersedes` marks the target **superseded**; `contradicts` marks **both** stale; `related_to`/`duplicates`/`contradicts` are symmetric (both directions written). Any other type string is accepted without special behaviour. When a search result or `cerefox_get_relations` shows a neighbour marked `[superseded]` or `[stale]`, say so rather than presenting it as current.\n13. **Project memberships — non-destructive by default**: on `cerefox_ingest` updates, **`project_name` (singular) is a non-destructive add** (ensures membership, preserves others). Use **`project_names` (list)** when you want to set the doc\'s full project set in one call (destructive replace). For metadata-only project changes without writing content, use **`cerefox_set_document_projects(document_id, project_names)`** — that tool is the destructive-replace contract made explicit. Never call `cerefox_set_document_projects` with a single name when you mean "add" — that would REMOVE the doc from all other projects. When in doubt, use `cerefox_ingest` with singular `project_name`.',
     "Update Workflow (ID-based -- preferred)": `## Update Workflow (ID-based -- preferred)
 
 \`\`\`
@@ -51652,6 +51683,7 @@ async function handler6(supabase, args, ctx) {
     throw new McpInvalidParams('metadata must be a JSON object of key/value pairs, e.g. {"type":"note"} — not a string, number, or array');
   }
   const update_if_exists = args.update_if_exists ?? false;
+  const overrideNote = args.update_if_exists === false ? " Note: update_if_exists flag was overridden by document_id." : "";
   const author = callerIdentity(args) ?? DEFAULT_IDENTITY;
   const author_type = "agent";
   const expected_content_hash = args.expected_content_hash?.trim() || null;
@@ -51677,7 +51709,7 @@ async function handler6(supabase, args, ctx) {
       throw new McpInvalidParams(`Document ${document_id} ("${existingDoc.title}") is soft-deleted (in the trash). ` + `A trashed document cannot be updated — restore it first with ` + `cerefox_restore_document, then retry, or create a new document instead.`);
     }
     if (existingDoc.content_hash === contentHash) {
-      const note = update_if_exists ? "" : " Note: update_if_exists flag was overridden by document_id.";
+      const note = overrideNote;
       return `Document already up-to-date: "${existingDoc.title}" (id: ${existingDoc.id}). Content hash unchanged (${contentHash}).${note}`;
     }
     if (!last_write_wins && expected_content_hash && expected_content_hash !== existingDoc.content_hash) {
@@ -51727,7 +51759,7 @@ async function handler6(supabase, args, ctx) {
     } else if (project_name) {
       await ensureDocumentInProject(supabase, existingDoc.id, project_name, { author, authorType: author_type });
     }
-    const note = update_if_exists ? "" : " Note: update_if_exists flag was overridden by document_id.";
+    const note = overrideNote;
     return `Document updated: "${title}" (id: ${existingDoc.id}), ${chunks.length} chunk(s), ${totalChars} chars. New content_hash: ${contentHash}.${note}${escapedContentNote(content)}`;
   }
   if (update_if_exists) {
@@ -53467,7 +53499,7 @@ var require_cli_progress = __commonJS(function(exports, module) {
 });
 
 // src/cli/commands/sync-self-docs.ts
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 import { basename as basename4, extname as extname5 } from "node:path";
 async function runSyncSelfDocs(options = {}) {
   const project = options.project ?? "_cerefox-self-docs";
@@ -53494,7 +53526,7 @@ async function runSyncSelfDocs(options = {}) {
   const authorType = resolveAuthorType("agent");
   const outcomes = [];
   for (const doc of docs) {
-    const content = readFileSync12(doc.path, "utf8");
+    const content = readFileSync13(doc.path, "utf8");
     const m = content.match(/^#\s+(.+)$/m);
     const title = m ? m[1].trim() : basename4(doc.path, extname5(doc.path));
     try {
@@ -58571,7 +58603,7 @@ var require_data = __commonJS(function(exports, module) {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.bun/fast-uri@3.1.8/node_modules/fast-uri/lib/utils.js
 var require_utils2 = __commonJS(function(exports, module) {
   var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
   var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
@@ -59088,7 +59120,7 @@ var require_utils2 = __commonJS(function(exports, module) {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.bun/fast-uri@3.1.8/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS(function(exports, module) {
   var { isUUID } = require_utils2();
   var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
@@ -59263,7 +59295,7 @@ var require_schemes = __commonJS(function(exports, module) {
   };
 });
 
-// ../../node_modules/.bun/fast-uri@3.1.7/node_modules/fast-uri/index.js
+// ../../node_modules/.bun/fast-uri@3.1.8/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS(function(exports, module) {
   var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils2();
   var { SCHEMES, getSchemeHandler } = require_schemes();
@@ -59593,13 +59625,14 @@ var require_fast_uri = __commonJS(function(exports, module) {
       if (!malformedIPLiteral) {
         malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
       }
-      if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
-        if (uri.indexOf("%") !== -1) {
-          if (parsed.host !== undefined && !malformedIPLiteral) {
-            const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-            parsed.host = reescapeHostDelimiters(host, isIP);
-          }
+      if (uri.indexOf("%") !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
+        let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+        if (!isIP) {
+          host = normalizePercentEncoding(host.toLowerCase());
         }
+        parsed.host = reescapeHostDelimiters(host, isIP);
+      }
+      if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
         if (parsed.path) {
           parsed.path = normalizePathEncoding(parsed.path);
         }
@@ -63058,7 +63091,6 @@ var init_stdio2 = __esm(() => {
 });
 
 // src/server.ts
-import { existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
 function buildServer() {
   const settings = loadSettings();
   if (!settings.supabaseUrl || !settings.supabaseKey) {
@@ -63109,14 +63141,7 @@ async function warnIfSchemaVersionMismatch(supabase) {
     const deployed = typeof data === "string" ? data : null;
     if (!deployed)
       return;
-    let bundled = null;
-    try {
-      const assets = resolveServerAssets();
-      if (existsSync13(assets.schemaFile)) {
-        const m = readFileSync14(assets.schemaFile, "utf8").match(SCHEMA_VERSION_RE2);
-        bundled = m ? m[1] : null;
-      }
-    } catch {}
+    const bundled = bundledSchemaVersion();
     if (!bundled)
       return;
     if (compareSemver(deployed, bundled) < 0) {
@@ -63125,7 +63150,7 @@ async function warnIfSchemaVersionMismatch(supabase) {
     }
   } catch {}
 }
-var SERVER_NAME = "cerefox", SCHEMA_VERSION_RE2;
+var SERVER_NAME = "cerefox";
 var init_server3 = __esm(() => {
   init_server2();
   init_stdio2();
@@ -63136,7 +63161,6 @@ var init_server3 = __esm(() => {
   init_server_assets();
   init_mcp_tools();
   init_meta();
-  SCHEMA_VERSION_RE2 = /^--\s*@version:\s*(\S+)/m;
 });
 
 // src/bin/cerefox.ts
@@ -65723,6 +65747,27 @@ var CONFIG_CATALOG = [
     highImpact: true,
     impactNote: "Turning this OFF keeps every version of every document forever. Versions carry embeddings, so storage grows without bound — on a busy store that is the largest table. Turning it back ON prunes on the next save, which permanently deletes versions outside the window (the newest and any archived ones survive)."
   },
+  {
+    key: "trash_auto_purge_enabled",
+    description: "Permanently purge documents that have been in the trash longer than the trash retention period. Swept by the next document delete (there is no scheduler): a document becomes eligible after the period and is removed by the next delete after that.",
+    kind: "boolean",
+    defaultValue: "false",
+    group: "Retention",
+    highImpact: true,
+    impactNote: "Turning this ON makes every document delete also purge, permanently, the documents that have been in the trash longer than the retention period, up to 100 per delete, including ones already in the trash today. Purged documents cannot be restored. Each purge is recorded in the audit log as 'trash-retention'."
+  },
+  {
+    key: "trash_retention_days",
+    description: "Days a document stays in the trash before auto-purge may remove it (only while trash auto-purge is on). This is the window in which a trashed document can still be restored.",
+    kind: "number",
+    defaultValue: "60",
+    min: 1,
+    max: 3650,
+    integer: true,
+    group: "Retention",
+    highImpact: true,
+    impactNote: "Shortening this while auto-purge is on makes more of the current trash eligible: the next delete purges documents older than the new period, permanently."
+  },
   {
     key: "document_size_warning_chars",
     description: "Flag writes that push a document past this many characters (0 = off). Partial edits make writes cheap, so an agent that only ever inserts never assembles the document and never sees it grow; this puts the fact in the write's response. A signal only — writes are never blocked.",
@@ -65766,6 +65811,9 @@ function validateConfigValue(key, value) {
     if (!Number.isFinite(n)) {
       return `${key} must be a number (got ${JSON.stringify(value)}).`;
     }
+    if (spec.integer && !Number.isInteger(n)) {
+      return `${key} must be a whole number (got ${n}).`;
+    }
     if (spec.min !== undefined && n < spec.min) {
       return `${key} must be ≥ ${spec.min} (got ${n}).`;
     }
@@ -67333,6 +67381,9 @@ async function action7(documentId, options) {
   if (options.reason) {
     println(c.dim(`  Reason (recorded in the audit log): ${options.reason}`));
   }
+  if (result?.auto_purged) {
+    println(c.yellow(`  Trash auto-purge: this delete also permanently purged ${result.auto_purged} document(s) ` + `that had been in the trash longer than trash_retention_days.`));
+  }
 }
 function registerDeleteDoc(program) {
   program.command("delete-doc").description("Soft-delete a document (recoverable via the web UI trash).").argument("<document-id>", "UUID of the document to delete.").option("--reason <text>", "Optional reason recorded in the audit log.").option("-a, --author <name>", "Caller identity (audit log).").option("--author-type <type>", "'user' or 'agent' (default: user).", "user").option("--yes", "Skip the confirmation prompt.").action(action7);
@@ -67439,7 +67490,7 @@ import { readdirSync as readdirSync2 } from "node:fs";
 
 // ../../_shared/db-deploy/index.ts
 init_src();
-import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync } from "node:fs";
 import { join as join6 } from "node:path";
 var RESET_SQL = `
 DROP TABLE IF EXISTS cerefox_chunks      CASCADE;
@@ -67462,8 +67513,8 @@ function listMigrationFiles(migrationsDir) {
   return readdirSync(migrationsDir).filter((n) => n.endsWith(".sql")).sort();
 }
 function buildDeploySteps(assets, opts = {}) {
-  const schemaSql = readFileSync5(assets.schemaFile, "utf8");
-  const rpcsSql = readFileSync5(assets.rpcsFile, "utf8");
+  const schemaSql = readFileSync6(assets.schemaFile, "utf8");
+  const rpcsSql = readFileSync6(assets.rpcsFile, "utf8");
   const steps = [];
   if (opts.reset) {
     steps.push({ label: "Reset: drop existing Cerefox objects", sql: RESET_SQL });
@@ -67575,7 +67626,7 @@ async function runDbMigrate(opts) {
     }
     const applied = [];
     for (const f of pending) {
-      const body = readFileSync5(join6(opts.assets.migrationsDir, f), "utf8");
+      const body = readFileSync6(join6(opts.assets.migrationsDir, f), "utf8");
       log(`Applying ${f}…`);
       try {
         await sql.begin(async (tx) => {
@@ -67605,7 +67656,7 @@ async function applyRpcs(opts) {
   log("Refresh RPCs (rpcs.sql)…");
   if (opts.dryRun)
     return { ok: true };
-  const rpcsSql = readFileSync5(opts.assets.rpcsFile, "utf8");
+  const rpcsSql = readFileSync6(opts.assets.rpcsFile, "utf8");
   const sql = src_default(opts.dbUrl, { prepare: false, onnotice: () => {} });
   try {
     await sql.unsafe(rpcsSql);
@@ -71723,7 +71774,7 @@ init_config();
 init_config();
 init_compatibility();
 init_server_assets();
-import { existsSync as existsSync11, readFileSync as readFileSync8, realpathSync, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9, realpathSync, statSync as statSync2 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { join as join10 } from "node:path";
 
@@ -71733,7 +71784,7 @@ import {
   existsSync as existsSync9,
   mkdirSync as mkdirSync3,
   openSync,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   rmSync,
   writeFileSync as writeFileSync4
 } from "node:fs";
@@ -71757,7 +71808,7 @@ function readPidFile() {
   if (!existsSync9(PID_FILE))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync7(PID_FILE, "utf8"));
+    const parsed = JSON.parse(readFileSync8(PID_FILE, "utf8"));
     if (typeof parsed.pid !== "number")
       return null;
     return {
@@ -72153,18 +72204,6 @@ async function checkOpenAI() {
     };
   }
 }
-var SCHEMA_VERSION_RE = /^--\s*@version:\s*(\S+)/m;
-function readBundledSchemaVersion() {
-  try {
-    const assets = resolveServerAssets();
-    if (!existsSync11(assets.schemaFile))
-      return null;
-    const m = readFileSync8(assets.schemaFile, "utf8").match(SCHEMA_VERSION_RE);
-    return m ? m[1] : null;
-  } catch {
-    return null;
-  }
-}
 var SCHEMA_CHECK_NAME = "schema + RPCs";
 async function checkSchemaVersion() {
   const settings = loadSettings();
@@ -72195,7 +72234,7 @@ async function checkSchemaVersion() {
       };
     }
     const deployed = await resp.json();
-    const bundled = readBundledSchemaVersion();
+    const bundled = bundledSchemaVersion();
     const level = classifyCompat(deployed, COMPATIBILITY.minSchema, bundled);
     switch (level) {
       case "below-min":
@@ -72269,6 +72308,51 @@ async function checkReviewWorkflow() {
     hint: on ? undefined : "Turn it on with `cerefox config set review_workflow_enabled true`."
   };
 }
+async function checkTrashAutoPurge() {
+  const name = "trash auto-purge";
+  const settings = loadSettings();
+  if (!settings.supabaseUrl || !settings.supabaseKey) {
+    return { name, status: "skipped", detail: "no Supabase credentials" };
+  }
+  const read = async (key) => {
+    const resp = await fetch(`${settings.supabaseUrl.replace(/\/$/, "")}/rest/v1/rpc/cerefox_get_config`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        apikey: settings.supabaseKey,
+        Authorization: `Bearer ${settings.supabaseKey}`
+      },
+      body: JSON.stringify({ p_key: key })
+    });
+    if (!resp.ok)
+      throw new Error(`HTTP ${resp.status}`);
+    const body = await resp.json();
+    return typeof body === "string" ? body : null;
+  };
+  let enabled;
+  let days;
+  try {
+    [enabled, days] = await Promise.all([read("trash_auto_purge_enabled"), read("trash_retention_days")]);
+  } catch (err) {
+    return { name, status: "skipped", detail: `could not read config: ${err.message}` };
+  }
+  if (enabled == null) {
+    return { name, status: "ok", detail: "not available on this schema (needs 0.17.0; the trash is never auto-purged)" };
+  }
+  if (enabled.trim() !== "true") {
+    return {
+      name,
+      status: "ok",
+      detail: "off — the trash is only emptied by hand",
+      hint: "Opt in with `cerefox config set trash_auto_purge_enabled true` (period: trash_retention_days)."
+    };
+  }
+  return {
+    name,
+    status: "ok",
+    detail: `ON — each delete also purges documents trashed more than ${days ?? "?"} day(s) ago (up to 100 per delete)`
+  };
+}
 async function checkEmbedderMismatch() {
   const settings = loadSettings();
   if (!settings.supabaseUrl || !settings.supabaseKey) {
@@ -72405,7 +72489,7 @@ function hasCerefoxInJsonFile(path) {
   if (!existsSync11(path))
     return false;
   try {
-    const parsed = JSON.parse(readFileSync8(path, "utf8"));
+    const parsed = JSON.parse(readFileSync9(path, "utf8"));
     const mcpServers = parsed.mcpServers;
     return Boolean(mcpServers && typeof mcpServers === "object" && "cerefox" in mcpServers);
   } catch {
@@ -72658,6 +72742,7 @@ async function runAllChecks(opts = {}) {
     { name: "openai", phase: "Probing OpenAI embeddings", run: () => checkOpenAI() },
     { name: "schema + RPCs", phase: "Reading schema + RPC version", run: () => checkSchemaVersion() },
     { name: "review workflow", phase: "Reading review workflow flag", run: () => checkReviewWorkflow() },
+    { name: "trash auto-purge", phase: "Reading trash auto-purge settings", run: () => checkTrashAutoPurge() },
     { name: "embedder", phase: "Checking embedder consistency", run: () => checkEmbedderMismatch() },
     { name: "content format", phase: "Checking chunk reconstruction format", run: () => checkContentFormat() },
     { name: "metadata health", phase: "Checking metadata well-formedness", run: () => checkMetadataHealth() },
@@ -73059,11 +73144,11 @@ function registerGetDoc(program) {
 init_dist4();
 init_cli_core();
 init_config();
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import { basename as basename2, extname as extname3 } from "node:path";
 
 // src/ingestion/pipeline.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import { basename, extname as extname2, resolve as resolve3 } from "node:path";
 // ../../_shared/ingest/pipeline-helpers.ts
 import { createHash } from "node:crypto";
@@ -73389,6 +73474,10 @@ async function fileToMarkdown(filename, data) {
 }
 
 // src/ingestion/pipeline.ts
+function updateByIdNote(updateExisting) {
+  return updateExisting === false ? "document_id provided; update_if_exists flag was overridden" : undefined;
+}
+
 class IngestionPipeline {
   db;
   apiKey;
@@ -73453,9 +73542,9 @@ class IngestionPipeline {
           result.projectIds = await this.db.getDocumentProjectIds(documentId);
         }
       }
-      if (!updateExisting) {
-        result.note = "document_id provided; update_if_exists flag was overridden";
-      }
+      const note = updateByIdNote(opts.updateExisting);
+      if (note)
+        result.note = note;
       return result;
     }
     if (updateExisting) {
@@ -73729,7 +73818,7 @@ class IngestionPipeline {
     };
   }
   async ingestFile(path, opts = {}) {
-    const text = await fileToMarkdown(path, readFileSync9(path));
+    const text = await fileToMarkdown(path, readFileSync10(path));
     const absPath = resolve3(path);
     const stem = basename(absPath, extname2(absPath));
     return this.ingestText({
@@ -73764,7 +73853,7 @@ async function readContent(path, paste) {
   }
   let content;
   try {
-    content = readFileSync10(path, "utf8");
+    content = readFileSync11(path, "utf8");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     throw userError(`Cannot read ${path}: ${msg}`);
@@ -73822,7 +73911,7 @@ async function action20(path, options) {
       projectName: options.projectName ?? null,
       projectNames: projectNames ?? null,
       metadata: metadata ?? null,
-      updateExisting: Boolean(options.updateIfExists),
+      updateExisting: options.updateIfExists ? true : undefined,
       documentId: options.documentId ?? null,
       author,
       authorType,
@@ -73836,7 +73925,7 @@ async function action20(path, options) {
       projectName: options.projectName ?? null,
       projectNames: projectNames ?? null,
       metadata: metadata ?? null,
-      updateExisting: Boolean(options.updateIfExists),
+      updateExisting: options.updateIfExists ? true : undefined,
       documentId: options.documentId ?? null,
       author,
       authorType,
@@ -73874,14 +73963,14 @@ init_cli_core();
 init_mcp_tools();
 init_config();
 init_client();
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 function resolveText(value, what) {
   if (value === undefined)
     throw userError(`${what} is required.`);
   if (value === "-")
-    return readFileSync11(0, "utf8");
+    return readFileSync12(0, "utf8");
   if (value.startsWith("@"))
-    return readFileSync11(value.slice(1), "utf8");
+    return readFileSync12(value.slice(1), "utf8");
   return value;
 }
 function context() {
@@ -74014,7 +74103,7 @@ async function action21(dir, options) {
         sourceOnCreate: "cli",
         projectName: options.projectName ?? null,
         metadata: metadata ?? null,
-        updateExisting: Boolean(options.updateIfExists),
+        updateExisting: options.updateIfExists ? true : undefined,
         author,
         authorType,
         lastWriteWins: true
@@ -74057,7 +74146,7 @@ import {
   copyFileSync as copyFileSync2,
   existsSync as existsSync12,
   mkdirSync as mkdirSync5,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync14,
   writeFileSync as writeFileSync5
 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
@@ -74068,7 +74157,7 @@ async function readConfigFile(path) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync13(path, "utf8"));
+    parsed = JSON.parse(readFileSync14(path, "utf8"));
   } catch (err) {
     throw userError(`--config: invalid JSON in ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -74110,7 +74199,7 @@ function parseDotEnvFile(content) {
   return map;
 }
 function answersFromEnvFile(path) {
-  const parsed = parseDotEnvFile(readFileSync13(path, "utf8"));
+  const parsed = parseDotEnvFile(readFileSync14(path, "utf8"));
   const required = ["CEREFOX_SUPABASE_URL", "CEREFOX_SUPABASE_KEY", "OPENAI_API_KEY"];
   for (const key of required) {
     if (!parsed[key] || parsed[key].trim() === "") {
@@ -75046,7 +75135,7 @@ function registerMigrateFormat(program) {
 // src/cli/commands/restore.ts
 init_cli_core();
 init_client();
-import { existsSync as existsSync14, readFileSync as readFileSync15, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync15, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 import { join as join13, resolve as resolve4 } from "node:path";
 function expandHome2(path) {
@@ -75058,7 +75147,7 @@ function expandHome2(path) {
 }
 function resolveBackupFile(target) {
   const path = resolve4(expandHome2(target));
-  if (!existsSync14(path)) {
+  if (!existsSync13(path)) {
     throw userError(`Backup path not found: ${target}`);
   }
   const stat = statSync4(path);
@@ -75549,7 +75638,7 @@ init_config();
 import { randomBytes } from "node:crypto";
 
 // src/cli/util/env-file.ts
-import { copyFileSync as copyFileSync3, existsSync as existsSync15, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "node:fs";
+import { copyFileSync as copyFileSync3, existsSync as existsSync14, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "node:fs";
 import { dirname as dirname5 } from "node:path";
 import { spawnSync as spawnSync6 } from "node:child_process";
 function escapeRegExp(s) {
@@ -75559,7 +75648,7 @@ function upsertEnvVar(path, key, value, opts = {}) {
   const line = `${key}=${value}`;
   const header = opts.comment ? `# ${opts.comment}
 ` : "";
-  if (!existsSync15(path)) {
+  if (!existsSync14(path)) {
     writeFileSync6(path, `${header}${line}
 `, { mode: 384 });
     return { path, action: "created" };
@@ -75589,7 +75678,7 @@ ${header}${line}
   return { path, action, backupPath };
 }
 function readEnvVar(path, key) {
-  if (!existsSync15(path))
+  if (!existsSync14(path))
     return null;
   const m = readFileSync16(path, "utf8").match(new RegExp(`^\\s*${escapeRegExp(key)}=(.*)$`, "m"));
   return m ? m[1].trim() : null;
@@ -75612,7 +75701,7 @@ function envGitignoreWarning(path) {
 }
 
 // src/web/auth.ts
-import { existsSync as existsSync16 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 
 // ../../node_modules/.bun/@hono+node-server@2.1.1+2ac783cc5e75a70c/node_modules/@hono/node-server/dist/conninfo.mjs
 var getConnInfo = (c) => {
@@ -75677,7 +75766,7 @@ var LOOPBACK_ADDRESSES = new Set([
 ]);
 function isContainerised() {
   try {
-    return existsSync16("/.dockerenv");
+    return existsSync15("/.dockerenv");
   } catch {
     return false;
   }
@@ -77556,7 +77645,7 @@ var _baseMimes = {
 var baseMimes = _baseMimes;
 
 // ../../node_modules/.bun/@hono+node-server@2.1.1+2ac783cc5e75a70c/node_modules/@hono/node-server/dist/serve-static.mjs
-import { createReadStream, existsSync as existsSync17, statSync as statSync5 } from "node:fs";
+import { createReadStream, existsSync as existsSync16, statSync as statSync5 } from "node:fs";
 import { join as join14 } from "node:path";
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 var ENCODINGS = {
@@ -77630,7 +77719,7 @@ var tryDecodeURI = (str) => tryDecode(str, decodeURI);
 var serveStatic = (options = { root: "" }) => {
   const root = options.root || "";
   const optionPath = options.path;
-  if (root !== "" && !existsSync17(root))
+  if (root !== "" && !existsSync16(root))
     console.error(`serveStatic: root path '${root}' is not found, are you sure it's correct?`);
   return async (c, next) => {
     if (c.finalized)
@@ -77713,7 +77802,7 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // src/web/server.ts
-import { existsSync as existsSync21 } from "node:fs";
+import { existsSync as existsSync20 } from "node:fs";
 import { readFileSync as readFileSync19, statSync as statSync8 } from "node:fs";
 import { join as join18 } from "node:path";
 
@@ -80066,9 +80155,14 @@ function registerDiscoveryRoutes(app, ctx) {
   });
   app.get("/api/v1/documents/trash", async (c) => {
     const limit = Math.min(Math.max(Number.parseInt(c.req.query("limit") ?? "50", 10) || 50, 1), 500);
+    const deletedBefore = c.req.query("deleted_before");
+    if (deletedBefore !== undefined && Number.isNaN(Date.parse(deletedBefore))) {
+      return c.json({ detail: "deleted_before must be an ISO-8601 timestamp" }, 400);
+    }
+    const cutoff = deletedBefore !== undefined ? new Date(deletedBefore).toISOString() : "infinity";
     const [listed, counted] = await Promise.all([
-      ctx.supabase.from("cerefox_documents").select("id, title, source, chunk_count, total_chars, review_status, deleted_at, updated_at").not("deleted_at", "is", null).order("deleted_at", { ascending: false }).limit(limit),
-      ctx.supabase.from("cerefox_documents").select("id", { count: "exact", head: true }).not("deleted_at", "is", null)
+      ctx.supabase.from("cerefox_documents").select("id, title, source, chunk_count, total_chars, review_status, deleted_at, updated_at").not("deleted_at", "is", null).lt("deleted_at", cutoff).order("deleted_at", { ascending: false }).limit(limit),
+      ctx.supabase.from("cerefox_documents").select("id", { count: "exact", head: true }).not("deleted_at", "is", null).lt("deleted_at", cutoff)
     ]);
     const { data, error } = listed;
     if (error)
@@ -80574,7 +80668,11 @@ function registerDocumentWriteRoutes(app, ctx) {
       return c.json({ detail: error.message }, 500);
     }
     const row = data;
-    return c.json({ success: true, ...row ? { already_deleted: row.already_deleted ?? false } : {} });
+    return c.json({
+      success: true,
+      ...row ? { already_deleted: row.already_deleted ?? false } : {},
+      ...typeof row?.auto_purged === "number" ? { auto_purged: row.auto_purged } : {}
+    });
   });
   app.post("/api/v1/documents/:document_id/restore", async (c) => {
     const documentId = c.req.param("document_id");
@@ -80790,7 +80888,7 @@ function registerIngestRoutes(app, ctx) {
         projectNames: Array.isArray(body.project_names) ? body.project_names : null,
         projectName: typeof body.project_name === "string" ? body.project_name : null,
         metadata: body.metadata ?? null,
-        updateExisting: body.update_existing === true || body.update_if_exists === true,
+        updateExisting: body.update_existing == null && body.update_if_exists == null ? undefined : body.update_existing === true || body.update_if_exists === true,
         documentId: body.document_id ?? null,
         author: who.identity.author,
         authorType: who.identity.authorType,
@@ -80955,12 +81053,15 @@ function registerIngestRoutes(app, ctx) {
 }
 
 // src/web/routes/meta.ts
+init_server_assets();
 init_meta();
 import { execFileSync } from "node:child_process";
+import { dirname as dirname7 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/web/docs.ts
 import {
-  existsSync as existsSync18,
+  existsSync as existsSync17,
   readFileSync as readFileSync17,
   readdirSync as readdirSync6,
   statSync as statSync6
@@ -80993,7 +81094,7 @@ function resolveDocsRoots() {
   let pkgTopLevel = null;
   for (const pkg of pkgRootCandidates) {
     const guides = join15(pkg, "docs", "guides");
-    if (existsSync18(guides) && statSync6(guides).isDirectory()) {
+    if (existsSync17(guides) && statSync6(guides).isDirectory()) {
       pkgGuides = guides;
       pkgTopLevel = pkg;
       break;
@@ -81005,8 +81106,8 @@ function resolveDocsRoots() {
   return {
     pkgGuides,
     pkgTopLevel,
-    repoGuides: existsSync18(repoGuides) ? repoGuides : null,
-    repoTopLevel: existsSync18(join15(repoTopLevel, "README.md")) ? repoTopLevel : null
+    repoGuides: existsSync17(repoGuides) ? repoGuides : null,
+    repoTopLevel: existsSync17(join15(repoTopLevel, "README.md")) ? repoTopLevel : null
   };
 }
 function readH1(filePath) {
@@ -81032,7 +81133,7 @@ function listBundledDocs2() {
   if (topRoot) {
     for (const t of TOP_LEVEL_DOCS) {
       const abs = join15(topRoot, t.filename);
-      if (existsSync18(abs)) {
+      if (existsSync17(abs)) {
         entries.push(entryForFile(abs, t.path, t.category));
       }
     }
@@ -81059,7 +81160,7 @@ function readDoc(docPath) {
   if (!candidate.startsWith(rootResolved + "/") && candidate !== rootResolved) {
     return null;
   }
-  if (existsSync18(candidate) && statSync6(candidate).isFile()) {
+  if (existsSync17(candidate) && statSync6(candidate).isFile()) {
     try {
       return readFileSync17(candidate, "utf8");
     } catch {
@@ -81068,15 +81169,30 @@ function readDoc(docPath) {
   }
   return null;
 }
+function readOpenApiDocument() {
+  const here = moduleDir2();
+  const fromSource = here.endsWith(join15("src", "web"));
+  const repoCopy = join15(here, "..", "..", "..", "..", "docs", "api", "openapi.json");
+  const candidates = fromSource ? [repoCopy] : [
+    join15(here, "..", "..", "docs", "api", "openapi.json"),
+    repoCopy
+  ];
+  for (const p of candidates) {
+    if (existsSync17(p))
+      return readFileSync17(p, "utf8");
+  }
+  return null;
+}
 
 // src/web/routes/meta.ts
 init_compatibility();
-function resolveGitCommitShort() {
+function resolveGitCommitShort(dir = dirname7(fileURLToPath4(import.meta.url))) {
   const env = process.env.CEREFOX_GIT_COMMIT;
   if (env)
     return env.slice(0, 7);
   try {
     const out = execFileSync("git", ["rev-parse", "--short", "HEAD"], {
+      cwd: dir,
       timeout: 2000,
       stdio: ["ignore", "pipe", "ignore"]
     }).toString().trim();
@@ -81090,7 +81206,6 @@ var VERSION_INFO = {
   git_commit_short: resolveGitCommitShort(),
   build_date: process.env.CEREFOX_BUILD_DATE ?? null
 };
-var SCHEMA_VERSION_RE3 = /^--\s*@version:\s*(\S+)/m;
 function registerMetaRoutes(app, ctx) {
   app.get("/api/v1/version", (c) => {
     const label = (process.env.CEREFOX_ENV_LABEL ?? "").trim();
@@ -81107,28 +81222,15 @@ function registerMetaRoutes(app, ctx) {
       "Content-Type": "text/markdown; charset=utf-8"
     });
   });
-  app.get("/api/v1/schema-version", async (c) => {
-    let bundled = null;
-    try {
-      const { readFileSync, existsSync } = await import("node:fs");
-      const { fileURLToPath } = await import("node:url");
-      const { dirname, join } = await import("node:path");
-      const here = dirname(fileURLToPath(import.meta.url));
-      const candidates = [
-        join(here, "..", "..", "..", "db", "schema.sql"),
-        join(here, "..", "..", "..", "..", "..", "src", "cerefox", "db", "schema.sql")
-      ];
-      for (const path of candidates) {
-        if (existsSync(path)) {
-          const sql = readFileSync(path, "utf8");
-          const match = sql.match(SCHEMA_VERSION_RE3);
-          bundled = match ? match[1] : null;
-          break;
-        }
-      }
-    } catch {
-      bundled = null;
+  app.get("/api/v1/openapi.json", (c) => {
+    const doc = readOpenApiDocument();
+    if (doc === null) {
+      return c.json({ detail: "The OpenAPI document is not bundled with this build." }, 404);
     }
+    return c.body(doc, 200, { "Content-Type": "application/json; charset=utf-8" });
+  });
+  app.get("/api/v1/schema-version", async (c) => {
+    const bundled = bundledSchemaVersion();
     let deployed = null;
     if (ctx) {
       try {
@@ -81157,8 +81259,8 @@ function registerMetaRoutes(app, ctx) {
         }
       } catch {}
     }
-    const mismatch = Boolean(bundled && deployed && bundled !== deployed);
     const level = classifyCompat(deployed, COMPATIBILITY.minSchema, bundled);
+    const mismatch = level === "above-min-but-old";
     return c.json({
       bundled,
       deployed,
@@ -81216,7 +81318,7 @@ function registerPostgrestProxy(app) {
 
 // src/web/routes/preferences.ts
 init_config();
-import { existsSync as existsSync19, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join16 } from "node:path";
 function isTheme(v) {
   return v === "auto" || v === "light" || v === "dark";
@@ -81242,7 +81344,7 @@ function registerPreferencesRoutes(app) {
     const next = { ...readPrefs(), theme: body.theme };
     try {
       const dir = userStateDir();
-      if (!existsSync19(dir))
+      if (!existsSync18(dir))
         mkdirSync6(dir, { recursive: true });
       writeFileSync7(prefsFile(), `${JSON.stringify(next, null, 2)}
 `);
@@ -81379,14 +81481,14 @@ function registerProjectsRoutes(app, ctx) {
 }
 
 // src/web/static.ts
-import { existsSync as existsSync20, statSync as statSync7 } from "node:fs";
-import { dirname as dirname7, join as join17 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { existsSync as existsSync19, statSync as statSync7 } from "node:fs";
+import { dirname as dirname8, join as join17 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 function moduleDir3() {
-  return dirname7(fileURLToPath4(import.meta.url));
+  return dirname8(fileURLToPath5(import.meta.url));
 }
 function isUsableSpaDir(dir) {
-  return existsSync20(dir) && statSync7(dir).isDirectory() && existsSync20(join17(dir, "index.html"));
+  return existsSync19(dir) && statSync7(dir).isDirectory() && existsSync19(join17(dir, "index.html"));
 }
 function resolveSpaDist() {
   const here = moduleDir3();
@@ -81408,7 +81510,7 @@ function resolveStaticDir() {
     join17(here, "..", "..", "..", "..", "web", "static")
   ];
   for (const c of candidates) {
-    if (existsSync20(c) && statSync7(c).isDirectory())
+    if (existsSync19(c) && statSync7(c).isDirectory())
       return c;
   }
   return null;
@@ -81455,11 +81557,16 @@ init_ef_meta();
 init_cli_core();
 init_config();
 init_compatibility();
+var OPENAPI_PATH = "/api/v1/openapi.json";
 function buildApp(ctx = buildWebContext()) {
   const app = new Hono2;
   if (true) {
     app.use(logger((message, ...rest) => console.log(`${localTimestamp()}  ${message}`, ...rest)));
   }
+  app.use("/api/v1/*", async (c, next) => {
+    await next();
+    c.res.headers.set("Link", `<${OPENAPI_PATH}>; rel="service-desc"`);
+  });
   app.use("/api/v1/*", apiAuth());
   app.use("/rest/v1/*", apiAuth());
   registerMetaRoutes(app, ctx);
@@ -81500,7 +81607,7 @@ function buildApp(ctx = buildWebContext()) {
     }));
     app.get("/app/assets/*", (c) => c.text("Not found", 404));
     const indexPath = join18(spaDist, "index.html");
-    if (existsSync21(indexPath)) {
+    if (existsSync20(indexPath)) {
       let cached = null;
       const readIndex = () => {
         try {