@gmickel/gno 1.27.1 → 1.29.0

package/src/cli/commands/embed.ts

@@ -492,6 +492,7 @@ export async function embed(options: EmbedOptions = {}): Promise<EmbedResult> {
       }
       await llm.getManager().dispose(modelUri);
       const recreated = await llm.createEmbeddingPort(modelUri, {
+        egressCollections: options.collection ? [options.collection] : "all",
         policy,
         onProgress: downloadProgress
           ? (progress) => downloadProgress("embed", progress)
@@ -508,6 +509,7 @@ export async function embed(options: EmbedOptions = {}): Promise<EmbedResult> {
       return { ok: true as const, value: recreated.value };
     };
     const embedResult = await llm.createEmbeddingPort(modelUri, {
+      egressCollections: options.collection ? [options.collection] : "all",
       policy,
       onProgress: downloadProgress
         ? (progress) => downloadProgress("embed", progress)

package/src/cli/commands/get.ts

@@ -21,6 +21,10 @@ import {
   getDocumentCapabilities,
   type DocumentCapabilities,
 } from "../../core/document-capabilities";
+import {
+  projectRecordEvidenceMetadata,
+  type RecordEvidenceMetadata,
+} from "../../core/record-metadata";
 import {
   evidenceFromExactDocument,
   RetrievalTraceSession as TraceSession,
@@ -85,6 +89,7 @@ export interface GetResponse {
     converterVersion?: string;
     mirrorHash?: string;
   };
+  record?: RecordEvidenceMetadata;
   capabilities: DocumentCapabilities;
 }
 
@@ -332,6 +337,7 @@ function buildResponse(ctx: BuildResponseContext): GetResult {
       language: doc.languageHint ?? undefined,
       source: buildSourceMeta(doc, config),
       conversion: buildConversionMeta(doc),
+      record: projectRecordEvidenceMetadata(doc),
       capabilities: buildCapabilities(doc),
     },
   };
@@ -349,6 +355,7 @@ interface DocRow {
   sourceSize: number;
   sourceMtime?: string;
   sourceHash: string;
+  recordSourcePath?: string | null;
 }
 
 function buildSourceMeta(
@@ -356,11 +363,12 @@ function buildSourceMeta(
   config: ConfigLike
 ): GetResponse["source"] {
   const coll = config.collections.find((c) => c.name === doc.collection);
-  const absPath = coll ? `${coll.path}/${doc.relPath}` : undefined;
+  const relPath = doc.recordSourcePath ?? doc.relPath;
+  const absPath = coll ? `${coll.path}/${relPath}` : undefined;
 
   return {
     absPath,
-    relPath: doc.relPath,
+    relPath,
     mime: doc.sourceMime,
     ext: doc.sourceExt,
     modifiedAt: doc.sourceMtime ?? undefined,
@@ -373,11 +381,13 @@ function buildCapabilities(doc: {
   sourceExt: string;
   sourceMime: string;
   mirrorHash?: string | null;
+  recordKey?: string | null;
 }): DocumentCapabilities {
   return getDocumentCapabilities({
     sourceExt: doc.sourceExt,
     sourceMime: doc.sourceMime,
     contentAvailable: doc.mirrorHash !== null,
+    recordKey: doc.recordKey,
   });
 }
 

package/src/cli/commands/index-cmd.ts

@@ -32,6 +32,8 @@ export interface IndexOptions {
   yes?: boolean;
   /** Verbose output */
   verbose?: boolean;
+  /** Emit the complete structured index receipt. */
+  json?: boolean;
 }
 
 /**
@@ -124,6 +126,17 @@ export function formatIndex(
     return `Error: ${result.error}`;
   }
 
+  if (options.json) {
+    return JSON.stringify(
+      {
+        syncResult: result.syncResult,
+        embedSkipped: result.embedSkipped,
+        ...(result.embedResult ? { embedResult: result.embedResult } : {}),
+      },
+      null,
+      2
+    );
+  }
   const { syncResult, embedSkipped } = result;
   const lines: string[] = ["Indexing complete.", ""];
 

package/src/cli/commands/multi-get.ts

@@ -17,6 +17,10 @@ import {
   indexNamesMatch,
   isValidIndexName,
 } from "../../app/index-name";
+import {
+  projectRecordEvidenceMetadata,
+  type RecordEvidenceMetadata,
+} from "../../core/record-metadata";
 import { isGlobPattern, parseRef, splitRefs } from "./ref-parser";
 import { initStore } from "./shared";
 
@@ -53,6 +57,7 @@ export interface MultiGetDocument {
   truncated?: boolean;
   totalLines?: number;
   source: { absPath?: string; relPath: string; mime: string; ext: string };
+  record?: RecordEvidenceMetadata;
 }
 
 export interface SkippedDoc {
@@ -230,6 +235,7 @@ async function fetchSingleDocument(
   );
   const coll = ctx.config.collections.find((c) => c.name === doc.collection);
 
+  const sourceRelPath = doc.recordSourcePath ?? doc.relPath;
   ctx.documents.push({
     docid: doc.docid,
     uri: decorateUriForIndex(doc.uri, ctx.indexName),
@@ -238,11 +244,12 @@ async function fetchSingleDocument(
     truncated: truncated || undefined,
     totalLines: content.split("\n").length,
     source: {
-      absPath: coll ? `${coll.path}/${doc.relPath}` : undefined,
-      relPath: doc.relPath,
+      absPath: coll ? `${coll.path}/${sourceRelPath}` : undefined,
+      relPath: sourceRelPath,
       mime: doc.sourceMime,
       ext: doc.sourceExt,
     },
+    record: projectRecordEvidenceMetadata(doc),
   });
 }
 

package/src/cli/commands/query.ts

@@ -195,6 +195,9 @@ export async function query(
     }
     traceSession = traceStart.value ?? undefined;
     const llm = new LlmAdapter(config);
+    const egressCollections = options.collection
+      ? [options.collection]
+      : ("all" as const);
 
     // Resolve download policy from env/flags
     const globals = getGlobals();
@@ -210,6 +213,7 @@ export async function query(
 
     // Create embedding port (for vector search)
     const embedResult = await llm.createEmbeddingPort(embedUri, {
+      egressCollections,
       policy,
       onProgress: downloadProgress
         ? (progress) => downloadProgress("embed", progress)
@@ -223,6 +227,7 @@ export async function query(
     // Skip when structured query modes are provided.
     if (expandUri) {
       const genResult = await llm.createExpansionPort(expandUri, {
+        egressCollections,
         policy,
         onProgress: downloadProgress
           ? (progress) => downloadProgress("expand", progress)
@@ -236,6 +241,7 @@ export async function query(
     // Create rerank port - optional
     if (rerankUri) {
       const rerankResult = await llm.createRerankPort(rerankUri, {
+        egressCollections,
         policy,
         onProgress: downloadProgress
           ? (progress) => downloadProgress("rerank", progress)
@@ -354,12 +360,16 @@ export async function queryDiagnose(
     const shouldCreateAnyModel =
       shouldCreateEmbeddingPort || !options.noExpand || !options.noRerank;
     const llm = shouldCreateAnyModel ? new LlmAdapter(config) : null;
+    const egressCollections = options.collection
+      ? [options.collection]
+      : ("all" as const);
 
     const embedUri = shouldCreateEmbeddingPort
       ? resolveModelUri(config, "embed", options.embedModel, options.collection)
       : null;
     if (embedUri && llm) {
       const embedResult = await llm.createEmbeddingPort(embedUri, {
+        egressCollections,
         policy,
         onProgress: downloadProgress
           ? (progress) => downloadProgress("embed", progress)
@@ -378,6 +388,7 @@ export async function queryDiagnose(
         options.collection
       );
       const genResult = await llm.createExpansionPort(expandUri, {
+        egressCollections,
         policy,
         onProgress: downloadProgress
           ? (progress) => downloadProgress("expand", progress)
@@ -396,6 +407,7 @@ export async function queryDiagnose(
         options.collection
       );
       const rerankResult = await llm.createRerankPort(rerankUri, {
+        egressCollections,
         policy,
         onProgress: downloadProgress
           ? (progress) => downloadProgress("rerank", progress)

package/src/cli/commands/replay.ts

@@ -91,16 +91,26 @@ export const traceReplay = async (
     const policy = resolveDownloadPolicy(process.env, {
       offline: options.offline,
     });
+    const egressCollections = "all" as const;
     if (embedUri) {
-      const created = await llm.createEmbeddingPort(embedUri, { policy });
+      const created = await llm.createEmbeddingPort(embedUri, {
+        egressCollections,
+        policy,
+      });
       if (created.ok) embedPort = created.value;
     }
     if (expandUri) {
-      const created = await llm.createExpansionPort(expandUri, { policy });
+      const created = await llm.createExpansionPort(expandUri, {
+        egressCollections,
+        policy,
+      });
       if (created.ok) expandPort = created.value;
     }
     if (rerankUri) {
-      const created = await llm.createRerankPort(rerankUri, { policy });
+      const created = await llm.createRerankPort(rerankUri, {
+        egressCollections,
+        policy,
+      });
       if (created.ok) rerankPort = created.value;
     }
     if (embedPort && embedUri) {

package/src/cli/commands/shared.ts

@@ -168,6 +168,34 @@ export function formatSyncResultLines(
       lines.push(`  ${c.filesMarkedInactive} marked inactive`);
     }
 
+    for (const file of c.files ?? []) {
+      const receipt = file.recordImport;
+      if (
+        !receipt ||
+        (receipt.failures.length === 0 && receipt.warnings.length === 0)
+      )
+        continue;
+      const warningCount = receipt.failures.length + receipt.warnings.length;
+      lines.push(
+        `  ${file.relPath}: ${warningCount} record warning${warningCount === 1 ? "" : "s"} (${receipt.snapshotState} snapshot)`
+      );
+      if (options.verbose) {
+        for (const warning of receipt.warnings) {
+          lines.push(
+            `    [${warning.code}]: ${warning.message} (retryable=${warning.retryable ? "yes" : "no"})`
+          );
+        }
+        for (const failure of receipt.failures) {
+          const locator = failure.sourceLocator
+            ? ` at ${failure.sourceLocator}`
+            : "";
+          lines.push(
+            `    [${failure.code}]${locator}: ${failure.message} (retryable=${failure.retryable ? "yes" : "no"})`
+          );
+        }
+      }
+    }
+
     if (options.verbose && c.errors.length > 0) {
       for (const err of c.errors) {
         lines.push(`    [${err.code}] ${err.relPath}: ${err.message}`);

package/src/cli/commands/update.ts

@@ -24,6 +24,8 @@ export interface UpdateOptions {
   gitPull?: boolean;
   /** Verbose output */
   verbose?: boolean;
+  /** Emit the complete structured sync receipt. */
+  json?: boolean;
 }
 
 /**
@@ -80,5 +82,8 @@ export function formatUpdate(
     return `Error: ${result.error}`;
   }
 
+  if (options.json) {
+    return JSON.stringify(result.result, null, 2);
+  }
   return formatSyncResultLines(result.result, options).join("\n");
 }

package/src/cli/commands/vsearch.ts

@@ -128,7 +128,9 @@ export async function vsearch(
 
     // Create LLM adapter for embeddings
     const llm = new LlmAdapter(config);
-    const embedResult = await llm.createEmbeddingPort(modelUri);
+    const embedResult = await llm.createEmbeddingPort(modelUri, {
+      egressCollections: options.collection ? [options.collection] : "all",
+    });
     if (!embedResult.ok) {
       await traceSession?.finish("failed");
       return { success: false, error: embedResult.error.message };

package/src/cli/program.ts

@@ -1509,6 +1509,7 @@ function wireOnboardingCommands(program: Command): void {
     .option("--no-embed", "skip embedding after sync")
     .option("--git-pull", "run git pull in git repositories")
     .option("--models-pull", "download models if missing")
+    .option("--json", "JSON output")
     .action(
       async (
         collection: string | undefined,
@@ -1525,6 +1526,7 @@ function wireOnboardingCommands(program: Command): void {
           modelsPull: Boolean(cmdOpts.modelsPull),
           yes: globals.yes,
           verbose: globals.verbose,
+          json: getFormat(cmdOpts) === "json",
         };
         const result = await index(opts);
 
@@ -2103,6 +2105,129 @@ function wireManagementCommands(program: Command): void {
       });
     });
 
+  const collectionPolicyCmd = collectionCmd
+    .command("policy")
+    .description("Inspect and change collection egress policy");
+
+  collectionPolicyCmd
+    .command("get <name>")
+    .description("Show effective policy, source, and confirmation revision")
+    .action(async (name: string) => {
+      const { collectionPolicyGet } = await import("./commands/collection");
+      await collectionPolicyGet(name, { configPath: getGlobals().config });
+    });
+
+  collectionPolicyCmd
+    .command("set <name> <policy>")
+    .description("Set local_only, lan, or remote policy")
+    .option(
+      "--confirm-relaxation <current-revision>",
+      "confirm relaxation against the current policy revision"
+    )
+    .action(
+      async (
+        name: string,
+        policy: string,
+        cmdOpts: Record<string, unknown>
+      ) => {
+        if (!["local_only", "lan", "remote"].includes(policy)) {
+          throw new CliError(
+            "VALIDATION",
+            "Policy must be local_only, lan, or remote"
+          );
+        }
+        const { collectionPolicySet } = await import("./commands/collection");
+        await collectionPolicySet(
+          name,
+          policy as "local_only" | "lan" | "remote",
+          {
+            configPath: getGlobals().config,
+            confirmRelaxation: cmdOpts.confirmRelaxation as string | undefined,
+          }
+        );
+      }
+    );
+
+  collectionPolicyCmd
+    .command("check")
+    .description("Check or explain an exact egress decision without acting")
+    .requiredOption("--action <action>", "egress action")
+    .requiredOption(
+      "--destination <zone>",
+      "local_process, loopback, lan, remote"
+    )
+    .requiredOption("--content-class <class>", "content class")
+    .option(
+      "-c, --collection <name>",
+      "collection scope (repeatable)",
+      collectRepeatableValue,
+      []
+    )
+    .option("--authenticated", "caller authentication succeeded")
+    .option("--authorized", "operation authorization succeeded")
+    .option("--partial", "explicitly permit partial collection results")
+    .option(
+      "--explain-egress",
+      "return the same decision contract without performing an action"
+    )
+    .action(async (cmdOpts: Record<string, unknown>) => {
+      const { collectionPolicyCheck } = await import("./commands/collection");
+      await collectionPolicyCheck(
+        {
+          collections: cmdOpts.collection as string[],
+          action: cmdOpts.action as Parameters<
+            typeof collectionPolicyCheck
+          >[0]["action"],
+          destinationZone: cmdOpts.destination as Parameters<
+            typeof collectionPolicyCheck
+          >[0]["destinationZone"],
+          contentClass: cmdOpts.contentClass as Parameters<
+            typeof collectionPolicyCheck
+          >[0]["contentClass"],
+          authenticated: Boolean(cmdOpts.authenticated),
+          authorized: Boolean(cmdOpts.authorized),
+          partial: Boolean(cmdOpts.partial),
+        },
+        { configPath: getGlobals().config }
+      );
+    });
+
+  const egressAuditCmd = program
+    .command("egress-audit")
+    .description("Manage local content-free egress audit receipts");
+  egressAuditCmd
+    .command("list")
+    .option("--limit <count>", "page size", Number)
+    .option("--cursor <cursor>", "opaque next-page cursor")
+    .action(async (cmdOpts: Record<string, unknown>) => {
+      const { egressAuditList } = await import("./commands/egress-audit");
+      await egressAuditList(
+        {
+          limit: cmdOpts.limit as number | undefined,
+          cursor: cmdOpts.cursor as string | undefined,
+        },
+        { configPath: getGlobals().config }
+      );
+    });
+  egressAuditCmd.command("show <audit-id>").action(async (auditId: string) => {
+    const { egressAuditShow } = await import("./commands/egress-audit");
+    await egressAuditShow(auditId, { configPath: getGlobals().config });
+  });
+  egressAuditCmd.command("status").action(async () => {
+    const { egressAuditStatus } = await import("./commands/egress-audit");
+    await egressAuditStatus({ configPath: getGlobals().config });
+  });
+  egressAuditCmd
+    .command("delete <audit-id>")
+    .action(async (auditId: string) => {
+      const { egressAuditDelete } = await import("./commands/egress-audit");
+      await egressAuditDelete(auditId, { configPath: getGlobals().config });
+    });
+  egressAuditCmd.command("purge").action(async () => {
+    const { egressAuditPurge } = await import("./commands/egress-audit");
+    await egressAuditPurge({ configPath: getGlobals().config });
+  });
+
   // context subcommands
   const contextCmd = program
     .command("context")
@@ -2515,6 +2640,7 @@ function wireManagementCommands(program: Command): void {
     .command("update")
     .description("Sync files from disk into the index")
     .option("--git-pull", "run git pull in git repositories")
+    .option("--json", "JSON output")
     .action(async (cmdOpts: Record<string, unknown>) => {
       const globals = getGlobals();
       const { update, formatUpdate } = await import("./commands/update");
@@ -2523,6 +2649,7 @@ function wireManagementCommands(program: Command): void {
         indexName: globals.index,
         gitPull: Boolean(cmdOpts.gitPull),
         verbose: globals.verbose,
+        json: getFormat(cmdOpts) === "json",
       };
       const result = await update(opts);
 

package/src/config/index.ts

@@ -59,6 +59,7 @@ export {
   CollectionSchema,
   type Config,
   ConfigSchema,
+  DEFAULT_EGRESS_POLICY,
   HttpGatewayConfigSchema,
   HttpGatewayLimitsSchema,
   CONTENT_TYPE_GRAPH_HINTS,
@@ -70,11 +71,19 @@ export {
   DEFAULT_EXCLUDES,
   DEFAULT_FTS_TOKENIZER,
   DEFAULT_PATTERN,
+  type EffectiveConfiguredEgressPolicy,
+  EGRESS_POLICIES,
+  EGRESS_POLICY_SOURCES,
+  type EgressPolicy,
+  EgressPolicySchema,
+  type EgressPolicySource,
+  EgressPolicySourceSchema,
   FTS_TOKENIZERS,
   type FtsTokenizer,
   getCollectionFromScope,
   isValidLanguageHint,
   parseScope,
+  resolveConfiguredEgressPolicy,
   type ProjectProfileBinding,
   ProjectProfileBindingSchema,
   type ScopeType,

package/src/config/project-profile.ts

@@ -5,6 +5,7 @@ import { hasLikelySecretPath } from "../core/path-rules";
 import {
   CONTENT_TYPE_SEARCH_BOOST_MAX,
   CONTENT_TYPE_SEARCH_BOOST_MIN,
+  CollectionSchema,
   isValidLanguageHint,
   PROJECT_AFFINITY_MAX_CONTRIBUTION,
 } from "./types";
@@ -218,6 +219,7 @@ export const ProjectProfileCollectionSchema = z
       .refine(isValidLanguageHint, "Invalid BCP-47 language hint")
       .optional(),
     modelPreset: z.string().regex(REFERENCE_PATTERN).optional(),
+    recordAdapters: CollectionSchema.shape.recordAdapters,
   })
   .strict();
 

package/src/config/types.ts

@@ -10,6 +10,7 @@ import { isAbsolute } from "node:path";
 import { z } from "zod";
 
 import { URI_PREFIX } from "../app/constants";
+import { JsonlFieldMappingSchema } from "../converters/adapters/jsonl/config";
 import { RetrievalTraceConfigSchema } from "./retrieval-traces";
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -47,6 +48,28 @@ export type FtsTokenizer = (typeof FTS_TOKENIZERS)[number];
 /** Default FTS tokenizer - snowball english for multilingual stemming */
 export const DEFAULT_FTS_TOKENIZER: FtsTokenizer = "snowball english";
 
+/** Collection-owned boundary for where indexed content may travel. */
+export const EGRESS_POLICIES = ["local_only", "lan", "remote"] as const;
+export const EgressPolicySchema = z.enum(EGRESS_POLICIES);
+export type EgressPolicy = z.infer<typeof EgressPolicySchema>;
+
+/** Missing policy is always interpreted as the fail-closed local-only default. */
+export const DEFAULT_EGRESS_POLICY: EgressPolicy = "local_only";
+
+/** Provenance for an effective collection egress policy. */
+export const EGRESS_POLICY_SOURCES = [
+  "explicit",
+  "config_default",
+  "legacy_default",
+] as const;
+export const EgressPolicySourceSchema = z.enum(EGRESS_POLICY_SOURCES);
+export type EgressPolicySource = z.infer<typeof EgressPolicySourceSchema>;
+
+export interface EffectiveConfiguredEgressPolicy {
+  policy: EgressPolicy;
+  source: Extract<EgressPolicySource, "explicit" | "config_default">;
+}
+
 /**
  * BCP-47 language tag pattern (simplified, case-insensitive).
  * Matches: en, de, fr, zh-CN, zh-Hans, und, en-US, etc.
@@ -103,6 +126,18 @@ export const CollectionSchema = z.object({
     })
     .optional(),
 
+  /**
+   * Explicit collection egress boundary. Absence remains valid for legacy
+   * configs and resolves to local_only rather than relaxing access.
+   */
+  egressPolicy: EgressPolicySchema.optional(),
+
+  /**
+   * Durable monotonic token for egress policy/source changes. Legacy configs
+   * start at zero; guarded mutations advance it under the config write lock.
+   */
+  egressPolicyRevision: z.number().int().nonnegative().optional(),
+
   /** Optional per-collection model overrides */
   models: z
     .object({
@@ -112,11 +147,42 @@ export const CollectionSchema = z.object({
       gen: z.string().min(1).optional(),
     })
     .optional(),
+
+  /** Optional declarative overrides for ambiguous export formats. */
+  recordAdapters: z
+    .object({
+      jsonl: z
+        .object({ fieldMapping: JsonlFieldMappingSchema.optional() })
+        .strict()
+        .optional(),
+      transcript: z
+        .object({ format: z.enum(["json", "srt", "text", "vtt"]) })
+        .strict()
+        .optional(),
+    })
+    .strict()
+    .optional(),
 });
 
 export type Collection = z.infer<typeof CollectionSchema>;
 export type CollectionModelOverrides = NonNullable<Collection["models"]>;
 
+/** Resolve config input without erasing whether the user made an explicit choice. */
+export function resolveConfiguredEgressPolicy(
+  collection: Pick<Collection, "egressPolicy">
+): EffectiveConfiguredEgressPolicy {
+  if (collection.egressPolicy === undefined) {
+    return {
+      policy: DEFAULT_EGRESS_POLICY,
+      source: "config_default",
+    };
+  }
+  return {
+    policy: collection.egressPolicy,
+    source: "explicit",
+  };
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Project Affinity Input
 // ─────────────────────────────────────────────────────────────────────────────