@the-40-thieves/obsidian-tc-shared 1.31.7 → 1.32.0

package/dist/config/observability.schema.js

@@ -11,10 +11,11 @@
 // (cfg.transports.http + cfg.auth), so it stays in config.schema.ts.
 import { z } from "zod";
 import { classifyJudgeBaseUrl, isDisallowedLiteralHost, isLoopbackHost } from "../net-host";
+import { configPathGlob } from "./path-glob";
 export const ObservabilityConfigSchema = z.object({
-    // traceDetail / tracesSampleRate were declared here and read by NOTHING: no sampling was ever applied
-    // and no detail switch existed. Removed rather than left as a lie in a schema operators trust. Re-add
-    // them together with the code that honors them.
+    // The top-level traceDetail / tracesSampleRate were declared here and read by NOTHING: no sampling
+    // was ever applied. Removed rather than left as a lie in a schema operators trust. The detail switch
+    // is back as otel.detail, together with the code that honors it (otel/dispatch-spans.ts).
     otel: z
         .object({
         endpoint: z
@@ -26,6 +27,10 @@ export const ObservabilityConfigSchema = z.object({
             .record(z.string(), z.string())
             .prefault({})
             .describe("Extra headers sent with OTLP exports, e.g. an auth token. Values may be secret."),
+        detail: z
+            .enum(["root", "children", "verbose"])
+            .default("root")
+            .describe('Span detail per tool call. "root": one span per request (default, no extra cost). "children": adds a span per pipeline stage (input_parse, auth_check, policy_eval, idempotency, rate_limit, hitl_check, acl_eval, tool_impl, output_serialize). "verbose": also one span per batch item and per SQLite transaction, capped at 64 child spans per request. Spans carry structured error codes only, never note content, paths or secrets.'),
     })
         .prefault({})
         .describe("OpenTelemetry trace export."),
@@ -42,7 +47,7 @@ export const ObservabilityConfigSchema = z.object({
         bind: z
             .string()
             .default("127.0.0.1")
-            .describe("Bind address for the scrape endpoint. Loopback by default — /metrics is unauthenticated."),
+            .describe("Bind address for the scrape endpoint. Loopback by default. /metrics is open only under auth.mode none on a loopback bind; under jwt or oidc it needs an admin:metrics bearer on every bind."),
     })
         .prefault({})
         .describe("Prometheus metrics endpoint."),
@@ -63,21 +68,34 @@ export const ObservabilityConfigSchema = z.object({
         .describe("CloudEvents export stream."),
     retention: z
         .object({
-        // morgianaEventsDays was declared and read by nothing and stays removed — the morgiana spool
-        // still has no retention. tracesDays was removed for the same reason and is RE-ADDED here by
-        // THE-610, which implemented the filesystem arm the original key was missing.
+        // morgianaEventsDays was declared and read by nothing and was removed; the spool's retention is
+        // spoolRetentionDays / spoolMaxBytes below, read by morgiana/spool-sweep.ts. tracesDays was
+        // removed for the same reason and is RE-ADDED here by THE-610, which implemented the
+        // filesystem arm the original key was missing.
         eventLogDays: z
             .number()
             .int()
             .positive()
             .default(30)
-            .describe("Days of event_log rows kept by the maintenance sweep. The morgiana event spool is still not pruned and grows without bound."),
+            .describe("Days of event_log rows kept by the maintenance sweep. The morgiana event spool has its own bounds, spoolRetentionDays and spoolMaxBytes."),
         tracesDays: z
             .number()
             .int()
             .positive()
             .default(30)
             .describe("Days of workspace session trace files (<vault>/<traceFolder>/*.jsonl) kept by the maintenance sweep. Traces are per-vault and live INSIDE the vault, so they are also picked up by whatever syncs or backs it up. Orphans from a failed start_session are pruned by the same age rule (the trace is written before the session row, so a failed attempt leaves a file with no row referencing it)."),
+        spoolRetentionDays: z
+            .number()
+            .int()
+            .nonnegative()
+            .default(30)
+            .describe("Days of morgiana CloudEvents spool files (<cacheDir>/<vault>/morgiana-events-<YYYY-MM-DD>.jsonl) kept by the maintenance sweep. Whole day files older than this are deleted; the file for the current UTC day, and any file modified in the last hour, is never touched. 0 keeps the spool forever (no age bound). Make sure MORGIANA has consumed a file before its day leaves this window."),
+        spoolMaxBytes: z
+            .number()
+            .int()
+            .positive()
+            .optional()
+            .describe("Optional size bound on the morgiana spool, in bytes, applied per vault directory: when a vault's spool files total more than this, the oldest day files are deleted until it fits. The current day's file is never deleted, so a single day larger than the bound is kept. Absent means no size bound."),
     })
         .prefault({})
         .describe("Retention policy for locally stored observability data."),
@@ -99,6 +117,102 @@ export const SnapshotsConfigSchema = z
         .describe("Maximum snapshot versions kept per note. Older versions are pruned."),
 })
     .prefault({});
+// Orphan sweep for the memory graph (memory_entities / memory_relations /
+// memory_observation_intervals). Memory rows are user data, so only the dangling-row class is on
+// by default; the two age-gated classes are off until their retention window is set. See
+// db/memory-orphans.ts for the exact definition of each class.
+export const MemoryOrphansConfigSchema = z
+    .object({
+    enabled: z
+        .boolean()
+        .default(true)
+        .describe("Run the memory orphan sweep. With only this on, it removes DANGLING rows: a memory_relations row whose source or target entity no longer exists, and a memory_observation_intervals row whose entity no longer exists. Both are unreachable by every reader. It never deletes an entity that merely has no relations. Set false to turn the whole sweep off, including the opt-in classes below. Also requires maintenance.enabled."),
+    intervalMs: z
+        .number()
+        .int()
+        .min(60_000)
+        .default(86_400_000)
+        .describe("Milliseconds between memory orphan sweeps (default: daily)."),
+    batchSize: z
+        .number()
+        .int()
+        .positive()
+        .max(5000)
+        .default(500)
+        .describe("Maximum rows deleted per write transaction, so a large backlog is drained in short lock holds rather than one long one. A class stops after 100 batches per run and resumes on the next run."),
+    retiredRetentionDays: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("OPT-IN, off when absent. Days after retirement (measured from updated_at) before a status=retired entity is deleted, and only when it is empty: blank observations, no interval rows, no relation in either direction, and no materialized note (vault_path unset). A retired entity that still holds any fact, edge or note is never deleted."),
+    removedVaultRetentionDays: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("OPT-IN, off when absent. Days since an entity was last updated before it is deleted, together with its relations and intervals, when its vault_id is not in the live vault registry (the configured vaults plus any added with add_vault). Off by default because a vault missing from the registry can also be a config typo or an unmounted drive; never runs when the registry is empty. Keep it long."),
+    dryRun: z
+        .boolean()
+        .default(false)
+        .describe("Count what each class WOULD delete, log it, and delete nothing. The metric counter is not incremented for a dry run."),
+})
+    .prefault({});
+// Scheduled wiki lint: the lint_wiki checks on a timer. Read-only and OFF by default: a pass walks
+// every note and compares note vectors pairwise, which no deployment should pay without asking.
+const WikiLintConfigSchema = z
+    .object({
+    enabled: z
+        .boolean()
+        .default(false)
+        .describe("Run the lint_wiki checks on a schedule and log a one-line summary per vault (proposal counts by kind). Read-only: it never edits a note and never blocks a write; call lint_wiki for the proposals themselves. Off by default. Also requires maintenance.enabled."),
+    intervalHours: z
+        .number()
+        .positive()
+        .max(8760)
+        .default(24)
+        .describe("Hours between scheduled lint passes."),
+    folder: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("Lint only this vault-relative folder (applied to every vault). Absent lints the whole vault."),
+    maxNotes: z
+        .number()
+        .int()
+        .positive()
+        .max(5000)
+        .default(1500)
+        .describe("Cap on notes compared pairwise by the near-duplicate check; its cost grows with the square of this."),
+    judge: z
+        .boolean()
+        .default(true)
+        .describe("Have the scheduled pass ask the wikiJudge LLM about each near-duplicate pair and log the verdict counts. On by default, but it only runs when a judge is configured (a gateway, or wikiJudge.provider typesafe) and wikiJudge.maxCallsPerDay is above 0; it spends judge calls, bounded by judgeMaxCalls and that daily cap. Set false to turn it off."),
+    judgeMaxCalls: z
+        .number()
+        .int()
+        .positive()
+        .max(500)
+        .default(20)
+        .describe("Per-run cap on judge calls made by the scheduled pass (cached verdicts are free and do not count). Pairs beyond it stay unjudged until a later run."),
+})
+    .prefault({});
+// Scheduled regeneration of each wiki folder's generated index.md and log.md. OFF by default: it
+// writes into the vault without a request, so it is something to switch on.
+const WikiPagesConfigSchema = z
+    .object({
+    enabled: z
+        .boolean()
+        .default(false)
+        .describe("Regenerate every wiki folder's generated index.md (the pages grouped by their SCHEMA.md type) and log.md (an append-only projection of the write provenance chain) on a schedule, as commit_wiki_page does after each write. Writes inside vaults[].wiki.folder only, never over a hand-edited or foreign index.md/log.md (lint_wiki reports those), never in a read-only vault, and lists only paths readable without any rule-scope. Off by default. Also requires maintenance.enabled."),
+    intervalHours: z
+        .number()
+        .positive()
+        .max(8760)
+        .default(6)
+        .describe("Hours between scheduled regeneration passes."),
+})
+    .prefault({});
 // THE-292 — periodic cache.db maintenance sweep (expired idempotency/elicit rows + event_log
 // retention + PRAGMA optimize). Fully defaulted: a config predating it validates unchanged.
 export const MaintenanceConfigSchema = z
@@ -156,6 +270,23 @@ export const MaintenanceConfigSchema = z
         .positive()
         .default(30)
         .describe("Days a FAILED (dead-lettered) job row is retained. Longer than the complete-row window because these exist to be read; bounded by age, so a burst of failures inside the window is still unbounded in count."),
+    // docs/G2.3-storage.md ("Not auto-swept"): capture_queue was committed_at soft-delete only,
+    // with purging deferred to "a future tool" — it never shipped, so a long-running server's
+    // capture_queue grew unbounded even after every row was reviewed and committed. Mirrors the
+    // jobs sweep's terminal-only discipline: only COMMITTED rows (committed_at IS NOT NULL) age
+    // out, by committed_at, never captured_at — a row awaiting review (committed_at IS NULL) is
+    // live work (commit_capture is the only thing that ever transitions it) and is never touched
+    // by this sweep at any age, matching a `queued`/`running` job row above. See
+    // db/maintenance.ts's sweepCaptureQueue for the WHERE clause this governs.
+    captureQueueRetentionDays: z
+        .number()
+        .int()
+        .positive()
+        .default(30)
+        .describe("Days a COMMITTED capture_queue row (committed_at IS NOT NULL) is retained before the maintenance sweep prunes it, measured from committed_at. A row still awaiting review (committed_at IS NULL) is never pruned by this sweep, at any age. An operator can also purge every committed row for one vault immediately (independent of age, matching that tool's other include flags) via reset_vault_cache's include.capture_committed. commit_capture's default (delete_from_queue: true) removes the row at commit time, before this window is ever reached; a caller that opts to KEEP a committed row (delete_from_queue: false) — the only shape this sweep can still find and prune — should keep this value above the longest highlight-import/ambient-import re-sync window (listCaptureTags reads a committed row's import-dedupe:/ambient-dedupe: tag as its dedup identity), or a purged row can be re-imported as a duplicate (see the highlight-import/ambient-import dedup tags noted on commit_capture)."),
+    memoryOrphans: MemoryOrphansConfigSchema,
+    wikiLint: WikiLintConfigSchema,
+    wikiPages: WikiPagesConfigSchema,
 })
     .prefault({});
 // THE-649 — filesystem watch over each vault root. Fully defaulted, and defaulted ON: docs/SYNC.md
@@ -289,11 +420,11 @@ export function isUnusableEgressExcludePattern(pattern) {
 export const EgressConfigSchema = z
     .object({
     excludePaths: z
-        .array(z.string().refine((p) => !isUnusableEgressExcludePattern(p), {
+        .array(configPathGlob().refine((p) => !isUnusableEgressExcludePattern(p), {
         message: 'egress.excludePaths: pattern normalises to nothing ("", "/", "./", or whitespace only), so it would exclude nothing at all. Name a real folder or glob ("Private", "Private/**"), or "**" to withhold the whole vault.',
     }))
         .default([])
-        .describe('Gitignore-style glob patterns (vault-relative), compiled with the same glob engine as auth.acl.readPaths, plus a NORMALISATION and a WIDENING that auth.acl.readPaths does not get, because a pattern here that matches nothing protects nothing and says so nowhere. Normalisation: a leading "/" or "./" is stripped and repeated separators collapse, so "/Private", "./Private", "Private" and "Private//" are one and the same root-anchored pattern. Widening: EVERY pattern also matches everything beneath it, so "Private", "Private/", "Private*/" and "Private/*" each withhold that folder\'s whole subtree, not just its direct children; "**/Private" matches a Private folder at ANY depth (root included) and its subtree. Consequences worth stating, both in the safe direction (this is a security control, so an ambiguous pattern excludes too much, never too little): a folder-shaped pattern also matches a FILE of that exact name, so "Private/" or "Private*/" additionally excludes a root note named "Private.md"; a literal pattern naming a specific file ("Private/a.md") still matches only that exact file, never a sibling like "Private/a.md.bak"; and matching stays case- and unicode-sensitive exactly as auth.acl.readPaths is. "**" is the EXCLUDE-ALL form: it withholds every note from every hosted provider, which is a supported fully-local deployment (the plane still runs; nothing vault-derived leaves the machine through it). One spelling is REFUSED at config load rather than compiled: a pattern that normalises to nothing ("", "/", "./", or whitespace only), which would sit in the config looking like a configured exclusion while protecting nothing. Enforced at the PORT, not merely by each caller: every GatewayClient this server constructs (gateway/client.ts\'s createGatewayClient) and every EmbeddingProvider it constructs (embeddings/index.ts\'s createEmbeddingProvider(Async)) refuses a request that does not declare which vault paths its text came from, or that names an excluded one — so a call site that forgets to filter fails loudly instead of leaking, not only the ones that remember to check first. Covers every content-bearing egress leg in the tree: contradiction judging, synthesis, citation inference (both the scheduled job and the citation-infer CLI), index-time embedding (the batched reconcile AND the single-note write path — write_note/append_note/patch_note and the filesystem watcher), reflect and knowledge_challenge\'s gateway calls, the note- and cluster-level summarizers (the `obsidian-tc index`/`cluster` CLI passes), densify-llm\'s semantic-edge extraction, the hosted /rerank passthrough, and the scheduled proactive-advisory sweep\'s candidate embedding. An excluded chunk is still chunked, stored, and text/regex-searchable, but gets no vector, so semantic_search will not surface it. This is the documented COST of exclusion: embeddings are themselves egress (a hosted embedding provider can, in principle, receive text it never sees in plaintext form), so an excluded folder is withheld from embedding too, not only from generative jobs. Best-effort, like every comparable exclusion file in this ecosystem (.gitignore, .cursorignore, .aiignore): a caller with direct filesystem or MCP-tool read access to the vault is unaffected — this is an EGRESS control, not a read-visibility control (see auth.acl.readPaths for that). NOT covered: lexical/regex search over an excluded chunk stays local and searchable by design (the point is withholding it from a model, not hiding it from the vault owner). Paths are re-evaluated on every pass, not baked in once: renaming a folder into or out of the exclusion re-includes or re-excludes it on the very next consolidation pass, reconcile, or write, never retroactively.'),
+        .describe('Gitignore-style glob patterns (vault-relative), compiled with the same glob engine as auth.acl.readPaths, plus a NORMALISATION and a WIDENING that auth.acl.readPaths does not get, because a pattern here that matches nothing protects nothing and says so nowhere. Normalisation: a backslash is read as a separator (a vault path can never contain one, so `Private\\**` is `Private/**` rather than a pattern that silently matches nothing), a leading "/" or "./" is stripped and repeated separators collapse, so "/Private", "./Private", "Private" and "Private//" are one and the same root-anchored pattern. Widening: EVERY pattern also matches everything beneath it, so "Private", "Private/", "Private*/" and "Private/*" each withhold that folder\'s whole subtree, not just its direct children; "**/Private" matches a Private folder at ANY depth (root included) and its subtree. Consequences worth stating, both in the safe direction (this is a security control, so an ambiguous pattern excludes too much, never too little): a folder-shaped pattern also matches a FILE of that exact name, so "Private/" or "Private*/" additionally excludes a root note named "Private.md"; a literal pattern naming a specific file ("Private/a.md") still matches only that exact file, never a sibling like "Private/a.md.bak"; and matching stays case- and unicode-sensitive exactly as auth.acl.readPaths is. "**" is the EXCLUDE-ALL form: it withholds every note from every hosted provider, which is a supported fully-local deployment (the plane still runs; nothing vault-derived leaves the machine through it). One spelling is REFUSED at config load rather than compiled: a pattern that normalises to nothing ("", "/", "./", or whitespace only), which would sit in the config looking like a configured exclusion while protecting nothing. Enforced at the PORT, not merely by each caller: every GatewayClient this server constructs (gateway/client.ts\'s createGatewayClient) and every EmbeddingProvider it constructs (embeddings/index.ts\'s createEmbeddingProvider(Async)) refuses a request that does not declare which vault paths its text came from, or that names an excluded one — so a call site that forgets to filter fails loudly instead of leaking, not only the ones that remember to check first. Covers every content-bearing egress leg in the tree: contradiction judging, synthesis, citation inference (both the scheduled job and the citation-infer CLI), index-time embedding (the batched reconcile AND the single-note write path — write_note/append_note/patch_note and the filesystem watcher), reflect and knowledge_challenge\'s gateway calls, the note- and cluster-level summarizers (the `obsidian-tc index`/`cluster` CLI passes), densify-llm\'s semantic-edge extraction, the hosted /rerank passthrough, and the scheduled proactive-advisory sweep\'s candidate embedding. An excluded chunk is still chunked, stored, and text/regex-searchable, but gets no vector, so semantic_search will not surface it. This is the documented COST of exclusion: embeddings are themselves egress (a hosted embedding provider can, in principle, receive text it never sees in plaintext form), so an excluded folder is withheld from embedding too, not only from generative jobs. Best-effort, like every comparable exclusion file in this ecosystem (.gitignore, .cursorignore, .aiignore): a caller with direct filesystem or MCP-tool read access to the vault is unaffected — this is an EGRESS control, not a read-visibility control (see auth.acl.readPaths for that). NOT covered: lexical/regex search over an excluded chunk stays local and searchable by design (the point is withholding it from a model, not hiding it from the vault owner). Paths are re-evaluated on every pass, not baked in once: renaming a folder into or out of the exclusion re-includes or re-excludes it on the very next consolidation pass, reconcile, or write, never retroactively.'),
 })
     .prefault({});
 // plur read-API proxy config (M5 / THE-181, G2.1 Domain 24). GLOBAL, not per-vault:

package/dist/config/observability.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"observability.schema.js","sourceRoot":"","sources":["../../src/config/observability.schema.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,gGAAgG;AAChG,iFAAiF;AACjF,EAAE;AACF,oFAAoF;AACpF,+FAA+F;AAC/F,iGAAiG;AACjG,0GAA0G;AAC1G,EAAE;AACF,sFAAsF;AACtF,qEAAqE;AACrE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,sGAAsG;IACtG,sGAAsG;IACtG,gDAAgD;IAChD,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CAAC,6EAA6E,CAAC;QAC1F,OAAO,EAAE,CAAC;aACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aAC9B,QAAQ,CAAC,EAAE,CAAC;aACZ,QAAQ,CACP,iFAAiF,CAClF;KACJ,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,6BAA6B,CAAC;IAC1C,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,yCAAyC,CAAC;QACvF,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,KAAK,CAAC;aACV,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CAAC,0CAA0C,CAAC;QACvD,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,OAAO,CAAC,WAAW,CAAC;aACpB,QAAQ,CACP,0FAA0F,CAC3F;KACJ,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,8BAA8B,CAAC;IAC3C,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QAC3F,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CAAC,+EAA+E,CAAC;QAC5F,WAAW,EAAE,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aAC9B,QAAQ,CAAC,EAAE,CAAC;aACZ,QAAQ,CAAC,6DAA6D,CAAC;KAC3E,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,4BAA4B,CAAC;IACzC,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,6FAA6F;QAC7F,6FAA6F;QAC7F,8EAA8E;QAC9E,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CACP,6HAA6H,CAC9H;QACH,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CACP,oYAAoY,CACrY;KACJ,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,yDAAyD,CAAC;CACvE,CAAC,CAAC;AACH,8FAA8F;AAC9F,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,4MAA4M,CAC7M;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,IAAI,CAAC;SACT,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAChB,6FAA6F;AAC7F,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,+HAA+H,CAChI;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,qCAAqC,CAAC;IAClD,4FAA4F;IAC5F,sFAAsF;IACtF,yBAAyB,EAAE,CAAC;SACzB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,CAAC;SACV,QAAQ,CACP,oUAAoU,CACrU;IACH,wFAAwF;IACxF,6FAA6F;IAC7F,0DAA0D;IAC1D,6FAA6F;IAC7F,8FAA8F;IAC9F,8FAA8F;IAC9F,6FAA6F;IAC7F,2FAA2F;IAC3F,4FAA4F;IAC5F,0FAA0F;IAC1F,4FAA4F;IAC5F,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,2fAA2f,CAC5f;IACH,qBAAqB,EAAE,CAAC;SACrB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,qQAAqQ,CACtQ;IACH,uBAAuB,EAAE,CAAC;SACvB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,GAAG,CAAC;SACZ,QAAQ,CACP,0bAA0b,CAC3b;IACH,uBAAuB,EAAE,CAAC;SACvB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,8MAA8M,CAC/M;CACJ,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,mGAAmG;AACnG,kGAAkG;AAClG,kGAAkG;AAClG,oGAAoG;AACpG,4CAA4C;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,4jBAA4jB,CAC7jB;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,GAAG,CAAC;SACZ,QAAQ,CACP,qRAAqR,CACtR;CACJ,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,6FAA6F;AAC7F,4FAA4F;AAC5F,+FAA+F;AAC/F,iGAAiG;AACjG,gGAAgG;AAChG,iEAAiE;AACjE,EAAE;AACF,kGAAkG;AAClG,+DAA+D;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,oeAAoe,CACre;CACJ,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,6FAA6F;AAC7F,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,2FAA2F;AAC3F,EAAE;AACF,6FAA6F;AAC7F,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,iGAAiG;AACjG,gGAAgG;AAChG,6FAA6F;AAC7F,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CACP,2PAA2P,CAC5P;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,GAAG,CAAC;SACZ,QAAQ,CAAC,uCAAuC,CAAC;IACpD,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,CAAC;SACV,QAAQ,CACP,6vBAA6vB,CAC9vB;IACH,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,OAAO,CAAC;SAChB,QAAQ,CACP,6jCAA6jC,CAC9jC;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CACP,mhCAAmhC,CACphC;CACJ,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,8FAA8F;AAC9F,mGAAmG;AACnG,0FAA0F;AAC1F,iGAAiG;AACjG,uEAAuE;AACvE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAe;IAC5D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,8FAA8F;IAC9F,mFAAmF;IACnF,IAAI,CAAC,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE;QAC3D,OAAO,EACL,wNAAwN;KAC3N,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,wqHAAwqH,CACzqH;CACJ,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,oFAAoF;AACpF,kFAAkF;AAClF,yEAAyE;AACzE,2EAA2E;AAC3E,kFAAkF;AAClF,kFAAkF;AAClF,qFAAqF;AACrF,wBAAwB;AACxB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,qIAAqI,CACtI;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,8IAA8I,CAC/I;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACvF,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,qCAAqC,CAAC;IAClD,0FAA0F;IAC1F,4FAA4F;IAC5F,wEAAwE;IACxE,iFAAiF;IACjF,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,iIAAiI,CAClI;CACJ,CAAC,CAAC;AAEH,gGAAgG;AAChG,6FAA6F;AAC7F,gGAAgG;AAChG,+FAA+F;AAC/F,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,sPAAsP,CACvP;CACJ,CAAC,CAAC;AAEH,6FAA6F;AAC7F,0FAA0F;AAC1F,mGAAmG;AACnG,gGAAgG;AAChG,6FAA6F;AAC7F,gGAAgG;AAChG,kGAAkG;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,gQAAgQ,CACjQ;CACJ,CAAC,CAAC;AAEH,kGAAkG;AAClG,oGAAoG;AACpG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CACP,2fAA2f,CAC5f;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,ytBAAytB,CAC1tB;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,sNAAsN,CACvN;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,0SAA0S,CAC3S;CACJ,CAAC;KACD,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EACL,gSAAgS;SACnS,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,OAAO,EACL,4KAA4K;aAC/K,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,OAAO,EACL,yPAAyP;aAC5P,CAAC,CAAC;QACL,CAAC;QACD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,OAAO,EACL,gZAAgZ;aACnZ,CAAC,CAAC;QACL,CAAC;QACD,4FAA4F;QAC5F,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,OAAO,EACL,wZAAwZ;aAC3Z,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC"}
+{"version":3,"file":"observability.schema.js","sourceRoot":"","sources":["../../src/config/observability.schema.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,gGAAgG;AAChG,iFAAiF;AACjF,EAAE;AACF,oFAAoF;AACpF,+FAA+F;AAC/F,iGAAiG;AACjG,0GAA0G;AAC1G,EAAE;AACF,sFAAsF;AACtF,qEAAqE;AACrE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,mGAAmG;IACnG,qGAAqG;IACrG,0FAA0F;IAC1F,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CAAC,6EAA6E,CAAC;QAC1F,OAAO,EAAE,CAAC;aACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aAC9B,QAAQ,CAAC,EAAE,CAAC;aACZ,QAAQ,CACP,iFAAiF,CAClF;QACH,MAAM,EAAE,CAAC;aACN,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;aACrC,OAAO,CAAC,MAAM,CAAC;aACf,QAAQ,CACP,2aAA2a,CAC5a;KACJ,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,6BAA6B,CAAC;IAC1C,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,yCAAyC,CAAC;QACvF,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,KAAK,CAAC;aACV,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CAAC,0CAA0C,CAAC;QACvD,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,OAAO,CAAC,WAAW,CAAC;aACpB,QAAQ,CACP,6LAA6L,CAC9L;KACJ,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,8BAA8B,CAAC;IAC3C,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QAC3F,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CAAC,+EAA+E,CAAC;QAC5F,WAAW,EAAE,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aAC9B,QAAQ,CAAC,EAAE,CAAC;aACZ,QAAQ,CAAC,6DAA6D,CAAC;KAC3E,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,4BAA4B,CAAC;IACzC,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,gGAAgG;QAChG,4FAA4F;QAC5F,qFAAqF;QACrF,+CAA+C;QAC/C,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CACP,0IAA0I,CAC3I;QACH,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CACP,oYAAoY,CACrY;QACH,kBAAkB,EAAE,CAAC;aAClB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,WAAW,EAAE;aACb,OAAO,CAAC,EAAE,CAAC;aACX,QAAQ,CACP,8XAA8X,CAC/X;QACH,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,wSAAwS,CACzS;KACJ,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,yDAAyD,CAAC;CACvE,CAAC,CAAC;AACH,8FAA8F;AAC9F,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,4MAA4M,CAC7M;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,IAAI,CAAC;SACT,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAChB,0EAA0E;AAC1E,iGAAiG;AACjG,yFAAyF;AACzF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,qaAAqa,CACta;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,MAAM,CAAC;SACX,OAAO,CAAC,UAAU,CAAC;SACnB,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,IAAI,CAAC;SACT,OAAO,CAAC,GAAG,CAAC;SACZ,QAAQ,CACP,8LAA8L,CAC/L;IACH,oBAAoB,EAAE,CAAC;SACpB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,gVAAgV,CACjV;IACH,yBAAyB,EAAE,CAAC;SACzB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,2YAA2Y,CAC5Y;IACH,MAAM,EAAE,CAAC;SACN,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CACP,sHAAsH,CACvH;CACJ,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,mGAAmG;AACnG,gGAAgG;AAChG,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CACP,mQAAmQ,CACpQ;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,GAAG,CAAC,IAAI,CAAC;SACT,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,sCAAsC,CAAC;IACnD,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,8FAA8F,CAC/F;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,IAAI,CAAC;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,qGAAqG,CACtG;IACH,KAAK,EAAE,CAAC;SACL,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,wVAAwV,CACzV;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,GAAG,CAAC;SACR,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,qJAAqJ,CACtJ;CACJ,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,iGAAiG;AACjG,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CACP,2dAA2d,CAC5d;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,GAAG,CAAC,IAAI,CAAC;SACT,OAAO,CAAC,CAAC,CAAC;SACV,QAAQ,CAAC,8CAA8C,CAAC;CAC5D,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,6FAA6F;AAC7F,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,+HAA+H,CAChI;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,qCAAqC,CAAC;IAClD,4FAA4F;IAC5F,sFAAsF;IACtF,yBAAyB,EAAE,CAAC;SACzB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,CAAC;SACV,QAAQ,CACP,oUAAoU,CACrU;IACH,wFAAwF;IACxF,6FAA6F;IAC7F,0DAA0D;IAC1D,6FAA6F;IAC7F,8FAA8F;IAC9F,8FAA8F;IAC9F,6FAA6F;IAC7F,2FAA2F;IAC3F,4FAA4F;IAC5F,0FAA0F;IAC1F,4FAA4F;IAC5F,wBAAwB,EAAE,CAAC;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,2fAA2f,CAC5f;IACH,qBAAqB,EAAE,CAAC;SACrB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,qQAAqQ,CACtQ;IACH,uBAAuB,EAAE,CAAC;SACvB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,GAAG,CAAC;SACZ,QAAQ,CACP,0bAA0b,CAC3b;IACH,uBAAuB,EAAE,CAAC;SACvB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,8MAA8M,CAC/M;IACH,4FAA4F;IAC5F,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,4FAA4F;IAC5F,6FAA6F;IAC7F,6EAA6E;IAC7E,2EAA2E;IAC3E,yBAAyB,EAAE,CAAC;SACzB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,w9BAAw9B,CACz9B;IACH,aAAa,EAAE,yBAAyB;IACxC,QAAQ,EAAE,oBAAoB;IAC9B,SAAS,EAAE,qBAAqB;CACjC,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,mGAAmG;AACnG,kGAAkG;AAClG,kGAAkG;AAClG,oGAAoG;AACpG,4CAA4C;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,4jBAA4jB,CAC7jB;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,GAAG,CAAC;SACZ,QAAQ,CACP,qRAAqR,CACtR;CACJ,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,6FAA6F;AAC7F,4FAA4F;AAC5F,+FAA+F;AAC/F,iGAAiG;AACjG,gGAAgG;AAChG,iEAAiE;AACjE,EAAE;AACF,kGAAkG;AAClG,+DAA+D;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,oeAAoe,CACre;CACJ,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,6FAA6F;AAC7F,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,2FAA2F;AAC3F,EAAE;AACF,6FAA6F;AAC7F,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,iGAAiG;AACjG,gGAAgG;AAChG,6FAA6F;AAC7F,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CACP,2PAA2P,CAC5P;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,GAAG,CAAC;SACZ,QAAQ,CAAC,uCAAuC,CAAC;IACpD,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,CAAC,CAAC;SACV,QAAQ,CACP,6vBAA6vB,CAC9vB;IACH,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,OAAO,CAAC;SAChB,QAAQ,CACP,6jCAA6jC,CAC9jC;IACH,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CACP,mhCAAmhC,CACphC;CACJ,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,mGAAmG;AACnG,kGAAkG;AAClG,mGAAmG;AACnG,8FAA8F;AAC9F,mGAAmG;AACnG,0FAA0F;AAC1F,iGAAiG;AACjG,uEAAuE;AACvE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAe;IAC5D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,8FAA8F;IAC9F,mFAAmF;IACnF,IAAI,CAAC,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE;QACjE,OAAO,EACL,wNAAwN;KAC3N,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,u0HAAu0H,CACx0H;CACJ,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhB,oFAAoF;AACpF,kFAAkF;AAClF,yEAAyE;AACzE,2EAA2E;AAC3E,kFAAkF;AAClF,kFAAkF;AAClF,qFAAqF;AACrF,wBAAwB;AACxB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,qIAAqI,CACtI;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,8IAA8I,CAC/I;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACvF,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,qCAAqC,CAAC;IAClD,0FAA0F;IAC1F,4FAA4F;IAC5F,wEAAwE;IACxE,iFAAiF;IACjF,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,iIAAiI,CAClI;CACJ,CAAC,CAAC;AAEH,gGAAgG;AAChG,6FAA6F;AAC7F,gGAAgG;AAChG,+FAA+F;AAC/F,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,sPAAsP,CACvP;CACJ,CAAC,CAAC;AAEH,6FAA6F;AAC7F,0FAA0F;AAC1F,mGAAmG;AACnG,gGAAgG;AAChG,6FAA6F;AAC7F,gGAAgG;AAChG,kGAAkG;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,gQAAgQ,CACjQ;CACJ,CAAC,CAAC;AAEH,kGAAkG;AAClG,oGAAoG;AACpG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CACP,2fAA2f,CAC5f;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,ytBAAytB,CAC1tB;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,sNAAsN,CACvN;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,0SAA0S,CAC3S;CACJ,CAAC;KACD,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EACL,gSAAgS;SACnS,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,OAAO,EACL,4KAA4K;aAC/K,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,OAAO,EACL,yPAAyP;aAC5P,CAAC,CAAC;QACL,CAAC;QACD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,OAAO,EACL,gZAAgZ;aACnZ,CAAC,CAAC;QACL,CAAC;QACD,4FAA4F;QAC5F,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,OAAO,EACL,wZAAwZ;aAC3Z,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC"}

package/dist/config/path-glob.d.ts

@@ -0,0 +1,17 @@
+import { z } from "zod";
+/** An operator path glob: a string normalised by `normalizeConfigPathGlob` at parse time.
+ *  `.overwrite` (not `.transform`) so the schema stays a plain ZodString: the generated JSON schema
+ *  and the docgen walker both still see `string`, and further `.min`/`.refine` checks chain on. */
+export declare const configPathGlob: () => z.ZodString;
+/** An ACL path glob (`acl.rules[].glob`, `acl.readPaths` / `writePaths` / `deletePaths`, root and
+ *  per vault): `configPathGlob`'s normalisation, plus REFUSAL of a root-marked or
+ *  trailing-separator pattern (see above). The check sees the raw value so the message can quote it,
+ *  and normalises it the same way first. */
+export declare const aclPathGlob: () => z.ZodString;
+/** Obsidian's Excluded-files dialect (vaults[].index.excludePaths): `/regex/` is a regular
+ *  expression, anything else a case-insensitive path prefix. The shape test is shared with the
+ *  matcher (server's search/index-exclusion.ts) so the two cannot disagree on which entries are
+ *  regexes. */
+export declare function isRegexExclusionEntry(entry: string): boolean;
+export declare const indexExclusionEntry: () => z.ZodString;
+//# sourceMappingURL=path-glob.d.ts.map

package/dist/config/path-glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-glob.d.ts","sourceRoot":"","sources":["../../src/config/path-glob.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB;;mGAEmG;AACnG,eAAO,MAAM,cAAc,mBAAsD,CAAC;AAsElF;;;4CAG4C;AAC5C,eAAO,MAAM,WAAW,mBAOe,CAAC;AAExC;;;eAGe;AACf,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AAWD,eAAO,MAAM,mBAAmB,mBAA2D,CAAC"}

package/dist/config/path-glob.js

@@ -0,0 +1,118 @@
+// The ONE parse point for an operator-written vault-path glob in the config file. Leaf module:
+// imports Zod only, so every schema that holds such a field can use it (same import rule as the
+// other config/*.schema.ts leaves).
+//
+// WHY: a checked vault path is always forward-slash (normalizeVaultPath splits on [\\/]+), but a
+// glob was only NFC-normalised before compiling. `Private\**` — the natural spelling on Windows —
+// therefore compiled to a regex that no vault path can match. For a whitelist
+// (acl.readPaths/writePaths/deletePaths) that fails closed, which is safe; for a RESTRICTION
+// (egress.excludePaths, acl.rules, vaults[].index.excludePaths) it fails OPEN and says so nowhere.
+// Normalising here, once, at config load means the compilers downstream (acl.ts's globToRegExp, the
+// egress filter, the index-exclusion matcher) only ever see forward-slash input.
+//
+// A vault path can never contain a backslash (normalizeVaultPath treats it as a separator), so
+// there is no escaping use case to preserve in OPERATOR input: `\` is always a separator here. This
+// is unrelated to the escaping the server applies to globs it BUILDS itself (acl.ts escapeGlob),
+// which never passes through config parsing.
+import { z } from "zod";
+/** Backslash -> slash, then repeated separators collapse. Nothing else: no trimming (a folder may
+ *  legitimately carry surrounding whitespace), no case folding, no leading `./` or `/` handling
+ *  (egress.excludePaths does its own, in normalizeEgressExcludePattern). */
+function normalizeConfigPathGlob(glob) {
+    return glob.replace(/[\\/]+/g, "/");
+}
+/** An operator path glob: a string normalised by `normalizeConfigPathGlob` at parse time.
+ *  `.overwrite` (not `.transform`) so the schema stays a plain ZodString: the generated JSON schema
+ *  and the docgen walker both still see `string`, and further `.min`/`.refine` checks chain on. */
+export const configPathGlob = () => z.string().overwrite(normalizeConfigPathGlob);
+// ACL variant. An ACL glob is matched against a ROOTLESS vault-relative path (`Private/x.md`), so a
+// pattern that is still root-marked after normalisation never matches anything: `\Private\**`
+// -> `/Private/**`, `C:\notes\**`, a UNC `\\server\share`, or `./Private/**`. For `acl.rules` that
+// fails OPEN (the rule's extra scopes are bypassed, and nothing says so). It is REFUSED rather than
+// stripped: stripping an inert whitelist entry would turn it into a grant the operator never saw
+// take effect. A TRAILING separator is refused for the same reason: `notes/private/` is the exact
+// path `notes/private/` (a note path never ends in `/`), not the folder, and matches nothing.
+// Egress and index fields do not use this variant: a leading `/` there is stripped and a folder
+// widened (normalizeEgressExcludePattern, normalizeIndexExclusionEntry), so they cannot fail open
+// this way.
+//
+// Also refused, for the same fail-open reason, and never normalised away:
+//  - a `.` or `..` path SEGMENT anywhere (`../Private/**`, `Private/./**`, `Private/../**`). The
+//    server's runtime path normaliser (vault/paths.ts) rejects `..` and drops `.`, so a checked
+//    path never carries one and a rule spelled with one never matches the folder it names.
+//    Collapsing `Private/./**` to `Private/**` for the operator is possible but `Private/../**`
+//    has no honest rewrite, and a silent rewrite of a security pattern hides what was written.
+//  - a control character (`\p{Cc}`: NUL, tab, newline, DEL, C1). NUL cannot appear in a vault path at
+//    all, it is the matcher's own internal `**` sentinel (acl.ts), so a pattern carrying it
+//    compiles to something that over-matches.
+const ROOT_MARKER = /^(?:[A-Za-z]:\/|\/|\.\/)+/;
+const CONTROL_CHAR = /\p{Cc}/u;
+/** The reason an already-normalised ACL glob can never match a vault-relative path, with the
+ *  spelling that would; `undefined` when the pattern is fine. */
+function aclGlobProblem(normalized) {
+    const rooted = ROOT_MARKER.test(normalized);
+    const trailing = normalized.endsWith("/");
+    const bare = normalized.replace(ROOT_MARKER, "");
+    // Segments of what is left after the root marker, so a leading `./` is reported once, as the root
+    // marker it is, not again as a `.` segment.
+    const segments = bare.split("/");
+    const dot = segments.includes(".");
+    const dotDot = segments.includes("..");
+    const control = CONTROL_CHAR.test(normalized);
+    if (!rooted && !trailing && !dot && !dotDot && !control)
+        return undefined;
+    const suggestion = trailing ? `${bare}**` : bare;
+    const why = [];
+    const fix = [];
+    if (rooted) {
+        why.push('it starts with a root marker (a leading "/" or "\\", a drive letter such as "C:", a UNC "\\\\" prefix, or "./")');
+    }
+    if (trailing) {
+        why.push('it ends with a separator, so it is the exact path "…/" rather than the folder');
+    }
+    if (rooted || trailing) {
+        fix.push(`ACL patterns are vault-relative paths with no leading separator; write "${suggestion === "" ? "**" : suggestion}" instead`);
+    }
+    if (dot)
+        why.push('it has a "." path segment, which a vault path never carries');
+    if (dotDot)
+        why.push('it has a ".." path segment, which a vault path never carries');
+    if (dot || dotDot) {
+        fix.push('spell the folder itself, with no "." or ".." segment (for example "Private/**" rather than "../Private/**")');
+    }
+    if (control) {
+        why.push("it has a control character (NUL, tab, newline, DEL, ...), which an ACL pattern may not contain");
+        fix.push("remove the control character");
+    }
+    return `ACL pattern can never match a note: ${why.join(" and ")}. ${fix.join("; ")}.`;
+}
+/** An ACL path glob (`acl.rules[].glob`, `acl.readPaths` / `writePaths` / `deletePaths`, root and
+ *  per vault): `configPathGlob`'s normalisation, plus REFUSAL of a root-marked or
+ *  trailing-separator pattern (see above). The check sees the raw value so the message can quote it,
+ *  and normalises it the same way first. */
+export const aclPathGlob = () => z
+    .string()
+    .superRefine((raw, ctx) => {
+    const problem = aclGlobProblem(normalizeConfigPathGlob(raw));
+    if (problem !== undefined)
+        ctx.addIssue({ code: "custom", message: `"${raw}": ${problem}` });
+})
+    .overwrite(normalizeConfigPathGlob);
+/** Obsidian's Excluded-files dialect (vaults[].index.excludePaths): `/regex/` is a regular
+ *  expression, anything else a case-insensitive path prefix. The shape test is shared with the
+ *  matcher (server's search/index-exclusion.ts) so the two cannot disagree on which entries are
+ *  regexes. */
+export function isRegexExclusionEntry(entry) {
+    return entry.length > 2 && entry.startsWith("/") && entry.endsWith("/");
+}
+/** One Obsidian-dialect exclusion entry. A `/regex/` entry is left exactly as written (a backslash
+ *  there is a regex escape). A prefix entry is normalised like any path glob, and a leading
+ *  separator is dropped: prefixes are matched against vault-relative paths, and a leading `/` that
+ *  came from `\Old\` must not turn the entry into a regex-shaped `/Old/`. */
+function normalizeIndexExclusionEntry(entry) {
+    if (isRegexExclusionEntry(entry.trim()))
+        return entry;
+    return normalizeConfigPathGlob(entry).replace(/^\/+/, "");
+}
+export const indexExclusionEntry = () => z.string().overwrite(normalizeIndexExclusionEntry);
+//# sourceMappingURL=path-glob.js.map

package/dist/config/path-glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-glob.js","sourceRoot":"","sources":["../../src/config/path-glob.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,gGAAgG;AAChG,oCAAoC;AACpC,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,8EAA8E;AAC9E,6FAA6F;AAC7F,mGAAmG;AACnG,oGAAoG;AACpG,iFAAiF;AACjF,EAAE;AACF,+FAA+F;AAC/F,oGAAoG;AACpG,iGAAiG;AACjG,6CAA6C;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;4EAE4E;AAC5E,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;mGAEmG;AACnG,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;AAElF,oGAAoG;AACpG,8FAA8F;AAC9F,mGAAmG;AACnG,oGAAoG;AACpG,iGAAiG;AACjG,kGAAkG;AAClG,8FAA8F;AAC9F,gGAAgG;AAChG,kGAAkG;AAClG,YAAY;AACZ,EAAE;AACF,0EAA0E;AAC1E,iGAAiG;AACjG,gGAAgG;AAChG,2FAA2F;AAC3F,gGAAgG;AAChG,+FAA+F;AAC/F,sGAAsG;AACtG,4FAA4F;AAC5F,8CAA8C;AAC9C,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAChD,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B;iEACiE;AACjE,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACjD,kGAAkG;IAClG,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC1E,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CACN,iHAAiH,CAClH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CACN,2EAA2E,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,WAAW,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IACjF,IAAI,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IACrF,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,IAAI,CACN,6GAA6G,CAC9G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CACN,gGAAgG,CACjG,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,uCAAuC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACxF,CAAC;AAED;;;4CAG4C;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,EAAE,CAC9B,CAAC;KACE,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,OAAO,GAAG,cAAc,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,SAAS;QAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;AAC/F,CAAC,CAAC;KACD,SAAS,CAAC,uBAAuB,CAAC,CAAC;AAExC;;;eAGe;AACf,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;6EAG6E;AAC7E,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC"}

package/dist/config/provenance.schema.d.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+export declare const ProvenanceConfigSchema: z.ZodPrefault<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    host: z.ZodPrefault<z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<{
+            hashed: "hashed";
+            label: "label";
+        }>>;
+        label: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    retentionDays: z.ZodOptional<z.ZodNumber>;
+    query: z.ZodPrefault<z.ZodObject<{
+        maxScanRows: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    stamp: z.ZodPrefault<z.ZodObject<{
+        gitTrailers: z.ZodDefault<z.ZodBoolean>;
+        frontmatter: z.ZodDefault<z.ZodBoolean>;
+        frontmatterKey: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>>;
+//# sourceMappingURL=provenance.schema.d.ts.map

package/dist/config/provenance.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.schema.d.ts","sourceRoot":"","sources":["../../src/config/provenance.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;kBAkFpB,CAAC"}

package/dist/config/provenance.schema.js

@@ -0,0 +1,72 @@
+import { z } from "zod";
+// Signed write provenance: one hash-chained, signed record per committed mutating tool call.
+// Fully defaulted and defaulted ON: the record holds hashes and attribution only (never note
+// content or prompts), and a server that records nothing cannot answer "who changed this".
+export const ProvenanceConfigSchema = z
+    .object({
+    enabled: z
+        .boolean()
+        .default(true)
+        .describe("Record one provenance row per committed mutating tool call: tool, vault, the paths it named with sha256 digests before and after (never content), timestamp, principal, session, client and claimed model/project/agent/machine, each field tagged verified or self_reported. Rows are hash-chained per vault and signed with the auth registry's EdDSA key when one is active. Verify with `obsidian-tc provenance verify`."),
+    host: z
+        .object({
+        mode: z
+            .enum(["hashed", "label"])
+            .default("hashed")
+            .describe('"hashed" (default) records a stable digest of this machine\'s hostname, so rows correlate without naming the host. "label" records `label` verbatim.'),
+        label: z
+            .string()
+            .min(1)
+            .max(128)
+            .optional()
+            .describe('The host id recorded when mode is "label". Required in that mode.'),
+    })
+        .refine((h) => h.mode !== "label" || h.label !== undefined, {
+        message: 'provenance.host.label is required when provenance.host.mode is "label"',
+        path: ["label"],
+    })
+        .prefault({})
+        .describe("How this server identifies itself on every provenance row."),
+    retentionDays: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("Days a provenance row is kept before the maintenance sweep prunes it. ABSENT (the default) keeps rows forever: this is an audit trail, and pruning it is an explicit decision. Pruning removes a contiguous prefix and moves a signed anchor up to the last row dropped, so the remaining chain still verifies."),
+    query: z
+        .object({
+        maxScanRows: z
+            .number()
+            .int()
+            .min(1000)
+            .max(10_000_000)
+            .default(100_000)
+            .describe("Most provenance rows one get_provenance call examines. A query is one newest-first pass over the vault's chain (the signed body is the only record of a path, so there is no index to seek by); each row examined costs one substring test over its ~0.5 KB body, so the default 100000 is a few hundred milliseconds at worst. A chain longer than this is read newest-first and the answer carries scan_truncated: older history was not examined. Raise it for a long-retention vault; `obsidian-tc provenance verify` is not bounded by it."),
+    })
+        .prefault({})
+        .describe("Limits on the get_provenance query."),
+    stamp: z
+        .object({
+        gitTrailers: z
+            .boolean()
+            .default(false)
+            .describe("Append `Obsidian-TC-*` trailers to a commit made through the git_commit tool, summarising the recorded writes whose current bytes are in that commit: session, principal (the verified principal, else `unverified`), model (always tagged `(self-reported)`) and the provenance seq range. A commit that includes no recorded write gets none. Any `Obsidian-TC-*` trailer the caller wrote itself is removed first, so a trailer in the log is always the server's. Needs `provenance.enabled`."),
+        frontmatter: z
+            .boolean()
+            .default(false)
+            .describe("Write a compact provenance object under `frontmatterKey` into notes an agent CREATES (write_note creating, commit_capture, execute_template). Never touches an existing note, and never any other frontmatter key. The object holds session, principal (verified, else `unverified`), model_self_reported and seq; never the host id. Needs `provenance.enabled`."),
+        frontmatterKey: z
+            .string()
+            .regex(/^[A-Za-z_][A-Za-z0-9_-]{0,63}$/)
+            .default("obsidian_tc_provenance")
+            .describe("The frontmatter key the stamp is written under when `frontmatter` is on. A caller-supplied value under this key in a note being created is replaced by the real stamp."),
+    })
+        .prefault({})
+        .describe("Optional, OFF by default: stamp provenance into commit trailers and newly created notes. The signed record in cache.db stays the source of truth; a stamp is a convenience copy."),
+})
+    .refine((p) => p.enabled || !(p.stamp.gitTrailers || p.stamp.frontmatter), {
+    message: "provenance.stamp needs provenance.enabled",
+    path: ["stamp"],
+})
+    .prefault({});
+//# sourceMappingURL=provenance.schema.js.map

package/dist/config/provenance.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.schema.js","sourceRoot":"","sources":["../../src/config/provenance.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,6FAA6F;AAC7F,6FAA6F;AAC7F,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,8ZAA8Z,CAC/Z;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,IAAI,EAAE,CAAC;aACJ,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;aACzB,OAAO,CAAC,QAAQ,CAAC;aACjB,QAAQ,CACP,sJAAsJ,CACvJ;QACH,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,mEAAmE,CAAC;KACjF,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE;QAC1D,OAAO,EAAE,wEAAwE;QACjF,IAAI,EAAE,CAAC,OAAO,CAAC;KAChB,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,4DAA4D,CAAC;IACzE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,iTAAiT,CAClT;IACH,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,IAAI,CAAC;aACT,GAAG,CAAC,UAAU,CAAC;aACf,OAAO,CAAC,OAAO,CAAC;aAChB,QAAQ,CACP,ihBAAihB,CAClhB;KACJ,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,qCAAqC,CAAC;IAClD,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,WAAW,EAAE,CAAC;aACX,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,meAAme,CACpe;QACH,WAAW,EAAE,CAAC;aACX,OAAO,EAAE;aACT,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,mWAAmW,CACpW;QACH,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,KAAK,CAAC,gCAAgC,CAAC;aACvC,OAAO,CAAC,wBAAwB,CAAC;aACjC,QAAQ,CACP,wKAAwK,CACzK;KACJ,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CACP,kLAAkL,CACnL;CACJ,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;IACzE,OAAO,EAAE,2CAA2C;IACpD,IAAI,EAAE,CAAC,OAAO,CAAC;CAChB,CAAC;KACD,QAAQ,CAAC,EAAE,CAAC,CAAC"}

package/dist/config/reranker.schema.d.ts

@@ -9,6 +9,10 @@ export declare const RerankerConfigSchema: z.ZodObject<{
     modulePath: z.ZodOptional<z.ZodString>;
     localModelPath: z.ZodOptional<z.ZodString>;
     localModulePath: z.ZodOptional<z.ZodString>;
+    passageFormat: z.ZodOptional<z.ZodEnum<{
+        chunk: "chunk";
+        "title+chunk": "title+chunk";
+    }>>;
 }, z.core.$strip>;
 export type RerankerConfig = z.infer<typeof RerankerConfigSchema>;
 //# sourceMappingURL=reranker.schema.d.ts.map

package/dist/config/reranker.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reranker.schema.d.ts","sourceRoot":"","sources":["../../src/config/reranker.schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,oBAAoB;;;;;;;;;;iBA2E/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"reranker.schema.d.ts","sourceRoot":"","sources":["../../src/config/reranker.schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAoF/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/config/reranker.schema.js

@@ -59,5 +59,12 @@ export const RerankerConfigSchema = z.object({
         .min(1)
         .optional()
         .describe("Explicit path to @the-40-thieves/obsidian-tc-reranker-local's BUILT module entry (its dist/index.js), for provider 'local'. Absolute, or resolved against the config file's directory (same convention as modulePath). Tried FIRST, before the bare package specifier and the source-checkout default — see that package's README for when you need this. Ignored by every other provider."),
+    // Read by the retrieval pipeline's rerank stage, not by a provider: it changes the TEXT every
+    // reranker backend is handed, so it applies to all of them (including the auto-selected local one
+    // when no block is set, which then keeps the default).
+    passageFormat: z
+        .enum(["chunk", "title+chunk"])
+        .optional()
+        .describe('What text each candidate is sent to the reranker as. "chunk" (the default when unset): the raw chunk text. "title+chunk": the note title (its file name without the .md extension), a blank line, then the chunk text, so a title-identified note is rankable on its title. Applies to every reranker backend, to gated rerank and to the rrf_rerank / score_merge fusion modes; a cluster-summary candidate is always sent as-is. Experimental: on the repository\'s two English corpora a reranker fed raw chunks lost on every shape while title+chunk won or tied for most rerankers, but two shapes are too few for a default (ADR 0007), so the default stays "chunk".'),
 });
 //# sourceMappingURL=reranker.schema.js.map

package/dist/config/reranker.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"reranker.schema.js","sourceRoot":"","sources":["../../src/config/reranker.schema.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,mGAAmG;AACnG,uEAAuE;AACvE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,qoBAAqoB,CACtoB;IACH,mGAAmG;IACnG,6FAA6F;IAC7F,gGAAgG;IAChG,iGAAiG;IACjG,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,iTAAiT,CAClT;IACH,qEAAqE;IACrE,OAAO,EAAE,CAAC;SACP,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,kTAAkT,CACnT;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,6JAA6J,CAC9J;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,kIAAkI,CACnI;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,2IAA2I,CAC5I;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,2UAA2U,CAC5U;IACH,+FAA+F;IAC/F,8FAA8F;IAC9F,+BAA+B;IAC/B,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,0gBAA0gB,CAC3gB;IACH,oFAAoF;IACpF,6FAA6F;IAC7F,8FAA8F;IAC9F,8FAA8F;IAC9F,6CAA6C;IAC7C,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,4XAA4X,CAC7X;CACJ,CAAC,CAAC"}
+{"version":3,"file":"reranker.schema.js","sourceRoot":"","sources":["../../src/config/reranker.schema.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,mGAAmG;AACnG,uEAAuE;AACvE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,qoBAAqoB,CACtoB;IACH,mGAAmG;IACnG,6FAA6F;IAC7F,gGAAgG;IAChG,iGAAiG;IACjG,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,iTAAiT,CAClT;IACH,qEAAqE;IACrE,OAAO,EAAE,CAAC;SACP,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CACP,kTAAkT,CACnT;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,6JAA6J,CAC9J;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,kIAAkI,CACnI;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,2IAA2I,CAC5I;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,2UAA2U,CAC5U;IACH,+FAA+F;IAC/F,8FAA8F;IAC9F,+BAA+B;IAC/B,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,0gBAA0gB,CAC3gB;IACH,oFAAoF;IACpF,6FAA6F;IAC7F,8FAA8F;IAC9F,8FAA8F;IAC9F,6CAA6C;IAC7C,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,4XAA4X,CAC7X;IACH,8FAA8F;IAC9F,kGAAkG;IAClG,uDAAuD;IACvD,aAAa,EAAE,CAAC;SACb,IAAI,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CACP,8oBAA8oB,CAC/oB;CACJ,CAAC,CAAC"}

package/dist/config/retrieval.schema.d.ts

@@ -1,7 +1,14 @@
 import { z } from "zod";
 /** THE-397: retrieval-fusion knobs (the first config-exposed retrieval section). */
 export declare const RetrievalConfigSchema: z.ZodObject<{
-    rrfK: z.ZodDefault<z.ZodNumber>;
+    rrfK: z.ZodOptional<z.ZodNumber>;
+    derivedDefaults: z.ZodDefault<z.ZodBoolean>;
+    useSearchModePreference: z.ZodDefault<z.ZodBoolean>;
+    searchAutoRoute: z.ZodDefault<z.ZodEnum<{
+        hybrid: "hybrid";
+        "text-first": "text-first";
+        "weak-text": "weak-text";
+    }>>;
     classRouter: z.ZodDefault<z.ZodBoolean>;
     sparse: z.ZodDefault<z.ZodBoolean>;
     colbert: z.ZodDefault<z.ZodBoolean>;
@@ -26,7 +33,7 @@ export declare const RetrievalConfigSchema: z.ZodObject<{
         maxTagFanout: z.ZodDefault<z.ZodNumber>;
         knnEdges: z.ZodDefault<z.ZodBoolean>;
         knnK: z.ZodDefault<z.ZodNumber>;
-        knnMinSim: z.ZodDefault<z.ZodNumber>;
+        knnMinSim: z.ZodOptional<z.ZodNumber>;
         includeInWalk: z.ZodDefault<z.ZodBoolean>;
         derivedWeight: z.ZodDefault<z.ZodNumber>;
         llmEdges: z.ZodDefault<z.ZodBoolean>;
@@ -99,6 +106,7 @@ export declare const ExperientialConfigSchema: z.ZodObject<{
             apiKey: z.ZodOptional<z.ZodString>;
             apiKeyEnv: z.ZodDefault<z.ZodString>;
             baseUrl: z.ZodDefault<z.ZodString>;
+            plainHttpHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
             allowPlainHttp: z.ZodDefault<z.ZodBoolean>;
             timeoutMs: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>>;