neotoma 0.22.0 → 0.22.2

package/dist/config.d.ts

@@ -24,6 +24,19 @@ export declare const config: {
     /** When true, MCP clients receive the compact instruction block (same body as runtime fallback) instead of the full fenced block from docs — for dual-host setups that already load workspace Neotoma rules. */
     mcpCompactInstructions: boolean;
     oauthClientId: string;
+    /**
+     * Additional exact callback URLs an operator trusts to receive an authorization
+     * code when the authorize request arrives via a tunnel (non-local Host).
+     *
+     * Comma-separated list of FULL callback URLs, not origins — `https://app.example.com/auth/callback`
+     * authorises that path and nothing else on that host. Entries must be https: unless
+     * they point at a loopback host. Empty by default: an operator who sets nothing keeps
+     * exactly the behaviour they had before this existed.
+     *
+     * Validated at load, fail-closed on the WHOLE list: one malformed entry rejects
+     * every entry and fails startup. See parseTrustedCallbackUrls above for why.
+     */
+    oauthTrustedCallbackUrls: string[];
     requireKeyForOauth: boolean;
     encryption: {
         enabled: boolean;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAgLA,eAAO,MAAM,MAAM;;;;eAIO,QAAQ,GAAG,QAAQ;IAC3C,0FAA0F;;IAE1F,6DAA6D;;;;;;;;;;;;;;;;IA4B7D,gNAAgN;;;;;;;;;;;;;;;;;CAiCjN,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAsBpC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAqQA,eAAO,MAAM,MAAM;;;;eAIO,QAAQ,GAAG,QAAQ;IAC3C,0FAA0F;;IAE1F,6DAA6D;;;;;;;;;;;;;;;;IA4B7D,gNAAgN;;;IAKhN;;;;;;;;;;;OAWG;;;;;;;;;;;;;;;;CAgCJ,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAsBpC"}

package/dist/config.js

@@ -164,6 +164,83 @@ const dbBackend = (process.env.NEOTOMA_DB_BACKEND || "sqlite").toLowerCase();
 if (dbBackend !== "sqlite" && dbBackend !== "libsql") {
     throw new Error(`Invalid NEOTOMA_DB_BACKEND "${process.env.NEOTOMA_DB_BACKEND}": expected "sqlite" or "libsql"`);
 }
+const OAUTH_CALLBACK_LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+/**
+ * Why an entry is refused, phrased for an operator reading a startup failure.
+ * Returns null when the entry is acceptable.
+ */
+function describeTrustedCallbackDefect(entry) {
+    let url;
+    try {
+        url = new URL(entry);
+    }
+    catch {
+        return "not a parseable absolute URL (a full URL with a scheme is required, e.g. https://app.example.com/auth/callback)";
+    }
+    const protocol = url.protocol.toLowerCase();
+    if (protocol !== "https:" && protocol !== "http:") {
+        return `scheme "${protocol}" is not supported here (use https:, or http: only for a loopback host)`;
+    }
+    if (url.username || url.password) {
+        return "carries userinfo (user:password@host), which is a URL-spoofing vector and is never load-bearing in a callback";
+    }
+    const host = url.hostname.toLowerCase();
+    if (!host) {
+        return "has no host";
+    }
+    if (protocol === "http:" && !OAUTH_CALLBACK_LOOPBACK_HOSTS.has(host)) {
+        return "is plaintext http: to a non-loopback host, which would ship authorization codes in cleartext (use https:)";
+    }
+    return null;
+}
+/**
+ * Parse NEOTOMA_OAUTH_TRUSTED_CALLBACK_URLS, FAILING CLOSED on the whole list.
+ *
+ * If any entry is malformed, the entire list is rejected and startup fails —
+ * entries 1 and 3 do not survive a bad entry 2. This is deliberate and is the
+ * condition pre-registered on #2384 before implementation.
+ *
+ * The rejected alternative was skipping a bad entry and honouring the rest. That
+ * is friendlier on a typo, but it makes an allowlist enforce something other than
+ * what the operator wrote, with no signal that it did: the refusal a bad entry
+ * produces is indistinguishable from an exact-match miss. An allowlist is a
+ * security control, and a control that silently binds less than its configuration
+ * says is the failure mode in docs/foundation/principles.md#1. Refusing to start
+ * is loud, immediate, and happens before any authorization request is served,
+ * rather than surfacing as an unexplained sign-in failure weeks later.
+ *
+ * The blast radius of the strict reading is bounded: this throws only when the
+ * operator has actually set the variable. Leaving it unset is the default and is
+ * unaffected.
+ */
+function parseTrustedCallbackUrls(raw) {
+    const entries = (raw || "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    const defects = entries
+        .map((entry, index) => {
+        const defect = describeTrustedCallbackDefect(entry);
+        // The entry is operator-authored config, not user input, and is already
+        // echoed in startup logs; but userinfo is the one part that could carry a
+        // credential, so redact it rather than printing it back.
+        return defect ? `  entry ${index + 1} ("${redactUrlUserinfo(entry)}"): ${defect}` : null;
+    })
+        .filter((defect) => defect !== null);
+    if (defects.length > 0) {
+        throw new Error(`Invalid NEOTOMA_OAUTH_TRUSTED_CALLBACK_URLS: ${defects.length} of ${entries.length} ` +
+            `entries are not usable as trusted OAuth callback URLs.\n${defects.join("\n")}\n` +
+            `The whole list is rejected rather than partially applied, so the allowlist in force ` +
+            `always matches what is configured. Fix the entries above, or unset the variable to ` +
+            `fall back to the built-in allowlist (localhost, loopback, cursor:/vscode:/app:, this ` +
+            `instance's own origin, and the ChatGPT/Claude callbacks).`);
+    }
+    return entries;
+}
+/** Replace any `user:password@` in a URL-ish string, for safe echoing in errors. */
+function redactUrlUserinfo(value) {
+    return value.replace(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)[^/@]*@/, "$1<redacted>@");
+}
 export const config = {
     projectRoot,
     storageBackend,
@@ -196,6 +273,19 @@ export const config = {
     mcpCompactInstructions: (process.env.NEOTOMA_MCP_COMPACT_INSTRUCTIONS || "").toLowerCase() === "1" ||
         (process.env.NEOTOMA_MCP_COMPACT_INSTRUCTIONS || "").toLowerCase() === "true",
     oauthClientId: process.env.NEOTOMA_OAUTH_CLIENT_ID || "",
+    /**
+     * Additional exact callback URLs an operator trusts to receive an authorization
+     * code when the authorize request arrives via a tunnel (non-local Host).
+     *
+     * Comma-separated list of FULL callback URLs, not origins — `https://app.example.com/auth/callback`
+     * authorises that path and nothing else on that host. Entries must be https: unless
+     * they point at a loopback host. Empty by default: an operator who sets nothing keeps
+     * exactly the behaviour they had before this existed.
+     *
+     * Validated at load, fail-closed on the WHOLE list: one malformed entry rejects
+     * every entry and fails startup. See parseTrustedCallbackUrls above for why.
+     */
+    oauthTrustedCallbackUrls: parseTrustedCallbackUrls(process.env.NEOTOMA_OAUTH_TRUSTED_CALLBACK_URLS),
     requireKeyForOauth: (process.env.NEOTOMA_REQUIRE_KEY_FOR_OAUTH || "true").toLowerCase() !== "false",
     // Encryption settings (local backend)
     encryption: {

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAE9C,kFAAkF;AAClF,uEAAuE;AACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,aAAa,CAAC;AAErD,uFAAuF;AACvF,+FAA+F;AAC/F,8EAA8E;AAC9E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,SAAS,kBAAkB;IACzB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,+BAA+B;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QAAE,OAAO;IACjD,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;IACzC,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,iBAAiB;YAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,iBAAiB,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAoC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAsB,CAAC;QACvF,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAG1D,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC;QACtD,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B;IACpC,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxD,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC1C,CAAC;IACD,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAG,4BAA4B,EAAE,CAAC;IAC1D,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAClD,mFAAmF;IACnF,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9F,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,WAAW,GAAG,6BAA6B,EAAE,CAAC;AAEpD,oFAAoF;AACpF,2FAA2F;AAC3F,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;IACzB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,4BAA4B;AACnG,CAAC;KAAM,CAAC;IACN,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,yFAAyF;AACzF,+BAA+B,EAAE,CAAC;AAElC,SAAS,eAAe;IACtB,2EAA2E;IAC3E,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,wFAAwF;AACxF,MAAM,eAAe,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/D,MAAM,QAAQ,GAAG,QAAQ,CACvB,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,eAAe,EACzE,EAAE,CACH,CAAC;AACF,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC1E,MAAM,gBAAgB,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,MAAM,UAAU,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1E,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC;AACjF,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,sBAAsB;IAClC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAChC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,gBAAgB,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE1C;;;GAGG;AACH,SAAS,iBAAiB,CAAC,QAAgB,EAAE,kBAA2B;IACtE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACvB,iBAAyB,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,oBAAoB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC7F,OAAO,oBAAoB,QAAQ,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,WAAW,GAAG;QAClB,wBAAwB,EAAE,8BAA8B;QACxD,6BAA6B,EAAE,kCAAkC;KAClE,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC/C,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClC,4CAA4C;oBAC3C,iBAAyB,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;oBACvD,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;IAED,2CAA2C;IAC1C,iBAAyB,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,oBAAoB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7F,OAAO,oBAAoB,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7E,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;IACrD,MAAM,IAAI,KAAK,CACb,+BAA+B,OAAO,CAAC,GAAG,CAAC,kBAAkB,kCAAkC,CAChG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,WAAW;IACX,cAAc;IACd,OAAO;IACP,SAAS,EAAE,SAAgC;IAC3C,0FAA0F;IAC1F,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE;IACvC,6DAA6D;IAC7D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE;IACpD,UAAU,EACR,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC;IACxE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACrF,YAAY;IACZ,OAAO;IACP,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM;IACtE,iGAAiG;IACjG,aAAa,EAAE,EAAE;IACjB,cAAc,EAAE,EAAE;IAClB,YAAY,EAAE,eAAe,EAAE;IAC/B,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC;IAC1E,QAAQ;IACR,WAAW,EAAE,GAAG;IAChB,0BAA0B,EACxB,GAAG,KAAK,YAAY;QACpB,CAAC,OAAO,CAAC,GAAG,CAAC,wCAAwC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;IAC5F,OAAO,EACL,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,iBAAiB,CACf,QAAQ,EACR,GAAG,KAAK,YAAY;YAClB,CAAC,OAAO,CAAC,GAAG,CAAC,wCAAwC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAC7F;IACH,qBAAqB,EACnB,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE;IAC5F,gNAAgN;IAChN,sBAAsB,EACpB,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG;QAC1E,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;IAC/E,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE;IACxD,kBAAkB,EAChB,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO;IACjF,sCAAsC;IACtC,UAAU,EAAE;QACV,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,MAAM;QAC1D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE;QACpD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;QAC5C,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE;QACjE,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,MAAM;KAC5E;IAED,2BAA2B;IAC3B,cAAc,EAAE;QACd,OAAO,EACL,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACpF,OAAO;QACT,mBAAmB,EAAE,UAAU,CAC7B,OAAO,CAAC,GAAG,CAAC,uCAAuC;YACjD,OAAO,CAAC,GAAG,CAAC,+BAA+B;YAC3C,KAAK,CACR;QACD,KAAK,EACH,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,QAAQ;QAC5F,QAAQ,EAAE,QAAQ,CAChB,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,EAC3E,EAAE,CACH;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,UAAU,GAAI,iBAAyB,CAAC,WAAW,CAAC;IAE1D,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,qDAAqD,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CACT,mDAAmD,MAAM,CAAC,WAAW,qBAAqB,MAAM,CAAC,QAAQ,EAAE,CAC5G,CAAC;IACJ,CAAC;SAAM,IAAI,UAAU,EAAE,IAAI,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CACT,sEAAsE,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,GAAG,EAAE,CAC3G,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,mFAAmF,MAAM,CAAC,QAAQ,EAAE,CACrG,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAE9C,kFAAkF;AAClF,uEAAuE;AACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,aAAa,CAAC;AAErD,uFAAuF;AACvF,+FAA+F;AAC/F,8EAA8E;AAC9E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,SAAS,kBAAkB;IACzB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,+BAA+B;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QAAE,OAAO;IACjD,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC;IACzC,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,iBAAiB;YAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,iBAAiB,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAoC;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAsB,CAAC;QACvF,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAG1D,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC;QACtD,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B;IACpC,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxD,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC1C,CAAC;IACD,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAG,4BAA4B,EAAE,CAAC;IAC1D,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IAClD,mFAAmF;IACnF,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9F,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,WAAW,GAAG,6BAA6B,EAAE,CAAC;AAEpD,oFAAoF;AACpF,2FAA2F;AAC3F,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;IACzB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,4BAA4B;AACnG,CAAC;KAAM,CAAC;IACN,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,yFAAyF;AACzF,+BAA+B,EAAE,CAAC;AAElC,SAAS,eAAe;IACtB,2EAA2E;IAC3E,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,wFAAwF;AACxF,MAAM,eAAe,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/D,MAAM,QAAQ,GAAG,QAAQ,CACvB,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,eAAe,EACzE,EAAE,CACH,CAAC;AACF,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC1E,MAAM,gBAAgB,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,MAAM,UAAU,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1E,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC;AACjF,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,sBAAsB;IAClC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAChC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,gBAAgB,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAE1C;;;GAGG;AACH,SAAS,iBAAiB,CAAC,QAAgB,EAAE,kBAA2B;IACtE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACvB,iBAAyB,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,oBAAoB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC7F,OAAO,oBAAoB,QAAQ,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,WAAW,GAAG;QAClB,wBAAwB,EAAE,8BAA8B;QACxD,6BAA6B,EAAE,kCAAkC;KAClE,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC/C,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClC,4CAA4C;oBAC3C,iBAAyB,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;oBACvD,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;IAED,2CAA2C;IAC1C,iBAAyB,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,oBAAoB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7F,OAAO,oBAAoB,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7E,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;IACrD,MAAM,IAAI,KAAK,CACb,+BAA+B,OAAO,CAAC,GAAG,CAAC,kBAAkB,kCAAkC,CAChG,CAAC;AACJ,CAAC;AAED,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE1F;;;GAGG;AACH,SAAS,6BAA6B,CAAC,KAAa;IAClD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iHAAiH,CAAC;IAC3H,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClD,OAAO,WAAW,QAAQ,yEAAyE,CAAC;IACtG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,+GAA+G,CAAC;IACzH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,2GAA2G,CAAC;IACrH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,wBAAwB,CAAC,GAAuB;IACvD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;SACxB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEvC,MAAM,OAAO,GAAG,OAAO;SACpB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACpD,wEAAwE;QACxE,0EAA0E;QAC1E,yDAAyD;QACzD,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAEzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,gDAAgD,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,GAAG;YACpF,2DAA2D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACjF,sFAAsF;YACtF,qFAAqF;YACrF,uFAAuF;YACvF,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,wCAAwC,EAAE,eAAe,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,WAAW;IACX,cAAc;IACd,OAAO;IACP,SAAS,EAAE,SAAgC;IAC3C,0FAA0F;IAC1F,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE;IACvC,6DAA6D;IAC7D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE;IACpD,UAAU,EACR,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC;IACxE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACrF,YAAY;IACZ,OAAO;IACP,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM;IACtE,iGAAiG;IACjG,aAAa,EAAE,EAAE;IACjB,cAAc,EAAE,EAAE;IAClB,YAAY,EAAE,eAAe,EAAE;IAC/B,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC;IAC1E,QAAQ;IACR,WAAW,EAAE,GAAG;IAChB,0BAA0B,EACxB,GAAG,KAAK,YAAY;QACpB,CAAC,OAAO,CAAC,GAAG,CAAC,wCAAwC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;IAC5F,OAAO,EACL,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,iBAAiB,CACf,QAAQ,EACR,GAAG,KAAK,YAAY;YAClB,CAAC,OAAO,CAAC,GAAG,CAAC,wCAAwC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAC7F;IACH,qBAAqB,EACnB,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE;IAC5F,gNAAgN;IAChN,sBAAsB,EACpB,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG;QAC1E,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;IAC/E,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE;IACxD;;;;;;;;;;;OAWG;IACH,wBAAwB,EAAE,wBAAwB,CAChD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAChD;IACD,kBAAkB,EAChB,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO;IACjF,sCAAsC;IACtC,UAAU,EAAE;QACV,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,MAAM;QAC1D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE;QACpD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;QAC5C,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE;QACjE,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,MAAM;KAC5E;IAED,2BAA2B;IAC3B,cAAc,EAAE;QACd,OAAO,EACL,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACpF,OAAO;QACT,mBAAmB,EAAE,UAAU,CAC7B,OAAO,CAAC,GAAG,CAAC,uCAAuC;YACjD,OAAO,CAAC,GAAG,CAAC,+BAA+B;YAC3C,KAAK,CACR;QACD,KAAK,EACH,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,QAAQ;QAC5F,QAAQ,EAAE,QAAQ,CAChB,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,EAC3E,EAAE,CACH;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,UAAU,GAAI,iBAAyB,CAAC,WAAW,CAAC;IAE1D,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,qDAAqD,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CACT,mDAAmD,MAAM,CAAC,WAAW,qBAAqB,MAAM,CAAC,QAAQ,EAAE,CAC5G,CAAC;IACJ,CAAC;SAAM,IAAI,UAAU,EAAE,IAAI,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CACT,sEAAsE,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,GAAG,EAAE,CAC3G,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,mFAAmF,MAAM,CAAC,QAAQ,EAAE,CACrG,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7D,CAAC"}

package/dist/docs/api/rest_api.md

@@ -375,6 +375,87 @@ GET /health
 
 **No authentication required.**
 
+### Usage Statistics
+
+Get aggregate usage statistics for the authenticated user. Powers the Neotoma Inspector dashboard summary tiles. Figures are computed on each request from live data — no server-side cache.
+
+**Endpoint:** `GET /usage`
+
+**Authentication:** Required — Bearer token, AAuth grant, or MCP OAuth token. Guest principals are rejected with `401`.
+
+**Query parameters:**
+
+| Parameter | Type        | Required | Description                                                                            |
+| --------- | ----------- | -------- | -------------------------------------------------------------------------------------- |
+| `user_id` | UUID string | No       | Must match authenticated user if supplied. AAuth-admitted agents cannot override this. |
+
+**Request:**
+
+```http
+GET /usage HTTP/1.1
+Authorization: Bearer <NEOTOMA_BEARER_TOKEN>
+```
+
+**curl example:**
+
+```bash
+curl -s \
+  -H "Authorization: Bearer $NEOTOMA_BEARER_TOKEN" \
+  http://localhost:3080/usage | jq .
+```
+
+**Response:** `200 OK`
+
+```json
+{
+  "entities_by_type": {
+    "conversation": 214,
+    "task": 156,
+    "contact": 88
+  },
+  "total_entities": 500,
+  "observations_by_source": {
+    "human": 310,
+    "llm_summary": 140,
+    "sensor": 50
+  },
+  "total_observations": 500,
+  "entities_created_last_7_days": 34,
+  "entities_created_last_30_days": 112,
+  "entity_types_with_schema": 6,
+  "entity_types_total": 10,
+  "last_updated": "2026-06-19T09:00:00.000Z"
+}
+```
+
+**Response fields:**
+
+| Field                           | Type                     | Description                                                                                   |
+| ------------------------------- | ------------------------ | --------------------------------------------------------------------------------------------- |
+| `entities_by_type`              | `Record<string, number>` | Active entity counts per type, sorted by count descending.                                    |
+| `total_entities`                | `number`                 | Total active (non-merged) entities.                                                           |
+| `observations_by_source`        | `Record<string, number>` | Observation counts per `observation_source`; unsourced rows appear as `"unclassified"`.       |
+| `total_observations`            | `number`                 | Total observations.                                                                           |
+| `entities_created_last_7_days`  | `number`                 | Entities created within the last 7 days.                                                      |
+| `entities_created_last_30_days` | `number`                 | Entities created within the last 30 days.                                                     |
+| `entity_types_with_schema`      | `number`                 | Distinct entity types present in the data that also have an active registered schema.         |
+| `entity_types_total`            | `number`                 | Total distinct entity types present across all active entities.                               |
+| `last_updated`                  | `string` (ISO-8601)      | Timestamp when these aggregates were computed (reflects request time, not a cache watermark). |
+
+**Error responses:**
+
+| Status | `error_code`      | Cause                                                    |
+| ------ | ----------------- | -------------------------------------------------------- |
+| `401`  | `AUTH_REQUIRED`   | Missing or invalid token; guest principal.               |
+| `403`  | `FORBIDDEN`       | `user_id` query param does not match authenticated user. |
+| `500`  | `DB_QUERY_FAILED` | Database query failure.                                  |
+
+**OpenAPI:** `operationId: getUsage` — see `openapi.yaml` and `src/shared/openapi_types.ts` (`UsageStats` schema).
+
+**CLI equivalent:** `neotoma request --operation getUsage`
+
+**See also:** [`docs/subsystems/usage_digest.md`](../subsystems/usage_digest.md#usage-http-api-endpoint) for the full endpoint reference including the distinction between `/usage` HTTP aggregates and `usage_digest` telemetry entities.
+
 ### OpenAPI Specification
 
 Get OpenAPI spec for API documentation.

package/dist/docs/developer/getting_started.md

@@ -118,6 +118,51 @@ npm run type-check
 npm run lint
 ```
 
+`npm test` runs the whole Vitest suite, which is wider than the CI baseline lane
+(that lane runs `npm run test:unit`). The extra lanes — `tests/integration`,
+`tests/fixtures` and `inspector/src` — reach build artifacts a plain `npm ci`
+does not produce: the built Inspector SPA at `dist/inspector`, the Inspector's
+own `inspector/node_modules`, and the compiled `packages/cursor-hooks/dist`.
+
+### Local prerequisites and the skip policy
+
+On a fresh clone those artifacts are absent, and the suites that need them
+**skip with a named reason** rather than fail. The reason is printed at the top
+of the run:
+
+```
+[neotoma] SKIP inspector-shell suites — missing prerequisite: built inspector assets — npm run build:inspector (or npm run test:setup)
+```
+
+So `npm test` and the pre-commit hook both pass on a fresh clone with no extra
+setup, and any failure you see is attributable to your own change. This is
+deliberate: a failure caused by a missing local build step is indistinguishable
+from a real regression, and that ambiguity is what drove contributors to
+`--no-verify`.
+
+To actually **run** the skipped suites — do this before trusting a green run on
+a change that touches the Inspector or the cursor hooks — install and build
+their prerequisites once per checkout:
+
+```bash
+npm run test:setup
+```
+
+Skips are opt-out by construction: the moment the artifact exists the suite runs
+again, with no flag to remember.
+
+### If `dist/` is missing
+
+`npm test` builds the server first via `pretest`, so this only bites when you
+invoke Vitest directly. A raw `npx vitest run` on an unbuilt checkout stops
+immediately with:
+
+```
+[neotoma] dist/ is missing. Run `npm test` (pretest builds server) or `npm run build:server` before `npx vitest run`.
+```
+
+rather than emitting hundreds of unrelated failures across `tests/cli/**`.
+
 ## Feature guides
 
 - [Plans](plans_guide.md) — store engineering plans as entities, with optional disk mirror.

package/dist/docs/developer/mcp/proxy.md

@@ -8,27 +8,27 @@ Canonical Cursor wiring, screenshots, and transport choice live in **[`mcp_curso
 
 Stable **`mcp.json` `command` paths** stay at the repo-root `scripts/` filenames below (no subdirectory indirection). Optional relocation under e.g. `scripts/mcp_launchers/` with thin forwarders was deferred to avoid churn for operators who hardcode absolute paths. Shared behavior lives in **`scripts/lib/neotoma_mcp_source_env.sh`** (`.env.dev` → `.env` → `.env.development`, first file found) and **`scripts/lib/neotoma_mcp_resolve_downstream_url.sh`** (port-file + TCP probe for `MCP_PROXY_DOWNSTREAM_URL`, used by both HTTP proxy shims).
 
-| Script | Transport | Signing / worker | Reload | Default downstream / entry | Env files (via lib) |
-|--------|-----------|------------------|--------|------------------------------|---------------------|
-| `run_neotoma_mcp_stdio.sh` | stdio → in-process MCP | None (`dist/index.js` or `tsx src/index.ts`) | Manual reconnect after code change | n/a | `.env.dev`, `.env`, `.env.development` |
-| `run_neotoma_mcp_stdio_dev_watch.sh` | stdio → `tsx watch src/index.ts` | None | `tsx watch` (stdout risk; not for installed MCP) | n/a | same |
-| `run_neotoma_mcp_stdio_prod.sh` | stdio → in-process MCP | None; **`NEOTOMA_ENV=production`** | Manual | n/a | same |
-| `run_neotoma_mcp_stdio_prod_watch.sh` | stdio → plain `tsx src/index.ts` | None; prod env | Manual (comment warns: no `watch` on stdio) | n/a | same |
-| `run_neotoma_mcp_stdio_dev_shim.sh` | stdio → **`mcp_dev_shim`** | Worker default in-process MCP | Shim restarts worker on file change | n/a | same |
-| `run_neotoma_mcp_signed_stdio_dev_shim.sh` | stdio → shim → **HTTP `/mcp`** | **`mcp proxy --aauth`** (AAuth) | Shim + worker reload | `http://127.0.0.1:3080/mcp` unless port file / env | same |
-| `run_neotoma_mcp_unsigned_stdio_dev_shim.sh` | stdio → **`mcp proxy`** (no forced AAuth) | `neotoma mcp proxy` | No shim watch (restart MCP to pick up code) | `http://127.0.0.1:3080/mcp` unless port file / env | same |
-| `run_neotoma_mcp_unsigned_stdio_proxy.sh` | same as unsigned shim | Deprecated forwarder: **`exec`** unsigned shim | same | same | n/a |
+| Script                                       | Transport                                 | Signing / worker                               | Reload                                           | Default downstream / entry                         | Env files (via lib)                    |
+| -------------------------------------------- | ----------------------------------------- | ---------------------------------------------- | ------------------------------------------------ | -------------------------------------------------- | -------------------------------------- |
+| `run_neotoma_mcp_stdio.sh`                   | stdio → in-process MCP                    | None (`dist/index.js` or `tsx src/index.ts`)   | Manual reconnect after code change               | n/a                                                | `.env.dev`, `.env`, `.env.development` |
+| `run_neotoma_mcp_stdio_dev_watch.sh`         | stdio → `tsx watch src/index.ts`          | None                                           | `tsx watch` (stdout risk; not for installed MCP) | n/a                                                | same                                   |
+| `run_neotoma_mcp_stdio_prod.sh`              | stdio → in-process MCP                    | None; **`NEOTOMA_ENV=production`**             | Manual                                           | n/a                                                | same                                   |
+| `run_neotoma_mcp_stdio_prod_watch.sh`        | stdio → plain `tsx src/index.ts`          | None; prod env                                 | Manual (comment warns: no `watch` on stdio)      | n/a                                                | same                                   |
+| `run_neotoma_mcp_stdio_dev_shim.sh`          | stdio → **`mcp_dev_shim`**                | Worker default in-process MCP                  | Shim restarts worker on file change              | n/a                                                | same                                   |
+| `run_neotoma_mcp_signed_stdio_dev_shim.sh`   | stdio → shim → **HTTP `/mcp`**            | **`mcp proxy --aauth`** (AAuth)                | Shim + worker reload                             | `http://127.0.0.1:3080/mcp` unless port file / env | same                                   |
+| `run_neotoma_mcp_unsigned_stdio_dev_shim.sh` | stdio → **`mcp proxy`** (no forced AAuth) | `neotoma mcp proxy`                            | No shim watch (restart MCP to pick up code)      | `http://127.0.0.1:3080/mcp` unless port file / env | same                                   |
+| `run_neotoma_mcp_unsigned_stdio_proxy.sh`    | same as unsigned shim                     | Deprecated forwarder: **`exec`** unsigned shim | same                                             | same                                               | n/a                                    |
 
 ## Downstream URL and signing
 
-| Variable | Default / notes |
-|----------|-----------------|
-| `MCP_PROXY_DOWNSTREAM_URL` | `http://127.0.0.1:3080/mcp` when unset (override per environment). |
-| `MCP_PROXY_AAUTH` | When truthy, load `~/.neotoma/aauth/` keys and sign requests (`neotoma mcp proxy --aauth`). |
-| `MCP_PROXY_CLIENT_NAME`, `MCP_PROXY_CLIENT_VERSION`, `MCP_PROXY_AGENT_LABEL` | Self-report for `clientInfo` injection. |
-| `MCP_PROXY_BEARER_TOKEN`, `MCP_PROXY_CONNECTION_ID` | Optional auth headers. |
-| `MCP_PROXY_SESSION_PREFLIGHT`, `MCP_PROXY_SESSION_PREFLIGHT_BASE`, `MCP_PROXY_FAIL_CLOSED` | Trust / preflight behavior. See `src/cli/mcp_proxy.ts` and `src/proxy/mcp_stdio_proxy.ts`. |
-| `NEOTOMA_AAUTH_AUTHORITY_OVERRIDE` | Canonical host for signing when downstream uses `127.0.0.1` (often `localhost:<port>`). The signed **stdio shim** script can derive this from `MCP_PROXY_DOWNSTREAM_URL` when unset. |
+| Variable                                                                                   | Default / notes                                                                                                                                                                      |
+| ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `MCP_PROXY_DOWNSTREAM_URL`                                                                 | `http://127.0.0.1:3080/mcp` when unset (override per environment).                                                                                                                   |
+| `MCP_PROXY_AAUTH`                                                                          | When truthy, load `~/.neotoma/aauth/` keys and sign requests (`neotoma mcp proxy --aauth`).                                                                                          |
+| `MCP_PROXY_CLIENT_NAME`, `MCP_PROXY_CLIENT_VERSION`, `MCP_PROXY_AGENT_LABEL`               | Self-report for `clientInfo` injection.                                                                                                                                              |
+| `MCP_PROXY_BEARER_TOKEN`, `MCP_PROXY_CONNECTION_ID`                                        | Optional auth headers.                                                                                                                                                               |
+| `MCP_PROXY_SESSION_PREFLIGHT`, `MCP_PROXY_SESSION_PREFLIGHT_BASE`, `MCP_PROXY_FAIL_CLOSED` | Trust / preflight behavior. See `src/cli/mcp_proxy.ts` and `src/proxy/mcp_stdio_proxy.ts`.                                                                                           |
+| `NEOTOMA_AAUTH_AUTHORITY_OVERRIDE`                                                         | Canonical host for signing when downstream uses `127.0.0.1` (often `localhost:<port>`). The signed **stdio shim** script can derive this from `MCP_PROXY_DOWNSTREAM_URL` when unset. |
 
 > **Operator security note:** Hosted and operator-managed deployments should set **`MCP_PROXY_FAIL_CLOSED=1`** (or the equivalent `failClosed: true` proxy option) whenever AAuth signing is required. This prevents the proxy from forwarding unsigned downstream requests if signing or session preflight fails.
 
@@ -57,11 +57,11 @@ When **`NEOTOMA_MCP_USE_LOCAL_PORT_FILE=1`** (or `true`) is set in **`mcp.json`
 
 **Verification:** on MCP spawn, stderr should show `[neotoma-mcp-signed-shim]` or `[neotoma-mcp-unsigned-stdio-dev-shim]` for port-file resolution lines, then `[neotoma-mcp-proxy] Starting proxy: downstream=…`.
 
-| Variable | Purpose |
-|----------|---------|
-| `NEOTOMA_MCP_USE_LOCAL_PORT_FILE` | `1` / `true` → resolve downstream URL from port files + TCP probe. |
+| Variable                              | Purpose                                                                         |
+| ------------------------------------- | ------------------------------------------------------------------------------- |
+| `NEOTOMA_MCP_USE_LOCAL_PORT_FILE`     | `1` / `true` → resolve downstream URL from port files + TCP probe.              |
 | `NEOTOMA_MCP_LOCAL_HTTP_PORT_PROFILE` | `dev` or `prod` — which port file(s) to read (preset A sets this per MCP slot). |
-| `NEOTOMA_MCP_PORT_PROBE_MS` | TCP probe timeout in ms (default `1200`, max `5000`). |
+| `NEOTOMA_MCP_PORT_PROBE_MS`           | TCP probe timeout in ms (default `1200`, max `5000`).                           |
 
 **CLI parity:** When the same env vars are set in the shell (not only in `mcp.json`), the **`neotoma` CLI** `resolveBaseUrl()` path uses the same profile rules and TCP probe after session port env and before `config.json` `base_url`, returning `http://localhost:<port>` so AAuth authority matches the API (for example `neotoma inspector admin unlock`). Profile follows **`NEOTOMA_MCP_LOCAL_HTTP_PORT_PROFILE`** if set, else **`NEOTOMA_ENV`**. Project root: `NEOTOMA_PROJECT_ROOT`, then `project_root` / `repo_root` in `~/.config/neotoma/config.json`, else `cwd`.
 
@@ -75,15 +75,35 @@ Streamable HTTP MCP keeps each session in **process memory** (`mcpTransports` in
 
 As of neotoma#1923, an unknown/expired session returns **404** (not 503), per the [MCP Streamable HTTP session management spec](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#session-management) — this lets spec-compliant clients auto-reinitialize instead of treating the server as unavailable. Servers predating that fix return 503 for the same condition; `neotoma mcp proxy` recognizes both.
 
-| Symptom | Typical cause | What to do |
-|--------|----------------|------------|
-| **400** — no session header on a non-`initialize` POST | Proxy never stored an id (failed init, stripped response header) or client skipped `initialize` | Restart the MCP server in the IDE; confirm proxy stderr shows a successful downstream `initialize` and that your reverse proxy **forwards** `mcp-session-id` on responses and requests (custom headers are not hop-by-hop but some templates hide unknown headers). |
-| **404** (or, against an older server, **503**) — session header present but unknown on this instance | **Load-balanced replicas** without affinity: `initialize` hit instance A, `tools/call` hit B | Use **sticky sessions** for `POST /mcp` (same as [`/mcp/oauth`](../subsystems/auth.md) guidance), scale MCP to **one** API replica for `/mcp`, or terminate TLS on a single Node process. |
-| **404** (or **503**) — same, while using **`neotoma mcp proxy`** | Transient replica drift or API restart after the IDE finished `initialize` | The proxy **replays `initialize` to downstream once** (without emitting a second `initialize` on stdout), captures a fresh `mcp-session-id`, and **retries the failing RPC once**. If the second attempt still fails, fix infra (sticky sessions / single `/mcp` worker) or restart the MCP client. |
-| **404** / **503** / **400** after deploy or restart | In-memory map cleared | Restart the MCP client once so `initialize` runs again. |
+| Symptom                                                                                                                        | Typical cause                                                                                              | What to do                                                                                                                                                                                                                                                                                          |
+| ------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **400** — no session header on a non-`initialize` POST                                                                         | Proxy never stored an id (failed init, stripped response header) or client skipped `initialize`            | Restart the MCP server in the IDE; confirm proxy stderr shows a successful downstream `initialize` and that your reverse proxy **forwards** `mcp-session-id` on responses and requests (custom headers are not hop-by-hop but some templates hide unknown headers).                                 |
+| **404** (or, against an older server, **503**) — session header present but unknown on this instance                           | **Load-balanced replicas** without affinity: `initialize` hit instance A, `tools/call` hit B               | Use **sticky sessions** for `POST /mcp` (same as [`/mcp/oauth`](../subsystems/auth.md) guidance), scale MCP to **one** API replica for `/mcp`, or terminate TLS on a single Node process.                                                                                                           |
+| **404** (or **503**) — same, while using **`neotoma mcp proxy`**                                                               | Transient replica drift or API restart after the IDE finished `initialize`                                 | The proxy **replays `initialize` to downstream once** (without emitting a second `initialize` on stdout), captures a fresh `mcp-session-id`, and **retries the failing RPC once**. If the second attempt still fails, fix infra (sticky sessions / single `/mcp` worker) or restart the MCP client. |
+| **404** / **503** / **400** after deploy or restart                                                                            | In-memory map cleared                                                                                      | Restart the MCP client once so `initialize` runs again.                                                                                                                                                                                                                                             |
+| `handshake_unreachable` — the first `initialize` never reached a server (CONNECT_TIMEOUT, ECONNREFUSED, socket closed)         | Backend down, restarting, or the wrong `--downstream-url`                                                  | The proxy already retried with backoff (neotoma#2321) and the backend stayed unreachable for the whole window. Check `/health` and the downstream URL, then restart the MCP client once the backend answers.                                                                                        |
+| `handshake_server_error` — the first `initialize` reached the server, which failed internally (5xx, or `-32603` through a 200) | Substrate crash surfacing through the handshake (e.g. neotoma#2316's "DB request aborted by caller")       | Also already retried. The server is broken rather than refusing you: check server logs and `/health`, redeploy if needed, then restart the MCP client.                                                                                                                                              |
+| `handshake_auth_rejected` — the first `initialize` was refused for authentication (401)                                        | Invalid/expired bearer, encryption-mode token required, unauthenticated POST, or invalid `X-Connection-Id` | **Not retried, deliberately** — a replay cannot fix a credential. Fix the credential: re-run `neotoma auth mcp-token`, or remove `Authorization` / `X-Connection-Id` from `mcp.json` and reconnect.                                                                                                 |
+| Tools appear missing / the agent answers about the graph "from silence"                                                        | An exhausted handshake leaves a session with no tools                                                      | An exhausted handshake is a **connection failure, not a missing tool** — its error says so explicitly (`NOT a missing tool`). Check proxy stderr for `initialize exhausted` before concluding a tool does not exist.                                                                                |
 
 When debugging, read the proxy line `Downstream error status=… body=…` (stderr): the JSON body includes the real `message` from Neotoma or the MCP SDK.
 
+### Handshake retry (neotoma#2321)
+
+Session-loss recovery cannot help an `initialize` that never succeeded — there is no session to recover and no cached handshake to replay — so a failed handshake used to be permanent for the life of the client. Every session opened during an outage stayed dark long after the backend recovered, while sessions already established were fine.
+
+The proxy now retries the handshake, but only on a failure a replay can fix: a transport failure that never reached a server, or a server that answered with its own internal error. An `initialize` refused for **authentication is never retried**, because retrying would hammer a server that is correctly rejecting a credential and mask the real cause.
+
+Retries are bounded twice over: by `NEOTOMA_MCP_PROXY_MAX_ATTEMPTS` (default 4) and by a wall-clock budget, `NEOTOMA_MCP_PROXY_HANDSHAKE_BUDGET_MS` (default 45s). The wall-clock bound matters because the proxy emits nothing until it resolves, so the client sits blocked on its own `initialize` timeout — 60s by default in the MCP SDK — for the whole retry window. Overrunning that would turn a recoverable handshake into a client-side abort.
+
+A recovered handshake looks like this on stderr — note the client never sees the intermediate failures, only the successful `initialize`:
+
+```
+[neotoma-mcp-proxy] initialize retry attempt=1/4 (retryable_transport): fetch failed cause=ECONNREFUSED — retrying
+[neotoma-mcp-proxy] initialize retry attempt=2/4 (retryable_server): downstream status=500 — retrying
+[neotoma-mcp-proxy] initialize recovered after 3 attempts
+```
+
 ## Related
 
 - [`mcp_cursor_setup.md`](../mcp_cursor_setup.md) — Cursor `mcp.json` examples, signed shim, port file JSON.

package/dist/docs/developer/npm_scripts.md

@@ -102,14 +102,20 @@ Keep these aliases for one minor release, update docs and automation to the cano
 
 ## Generated files
 
-Some committed files are generated from source and must be kept in sync. Run the generator after making the relevant source change; use `--check` in CI to fail when the file drifts.
+Some committed files are generated from source and must be kept in sync. Run the generator after making the relevant source change. CI policy differs by artifact: a pure tree inventory is re-rendered; contract/registration derivatives still fail on drift.
 
 | Script | What it does | When to run | CI usage |
 |--------|-------------|-------------|----------|
-| `generate:test-catalog` | Regenerates `docs/testing/automated_test_catalog.md` from the test tree | After adding, removing, or renaming a test file | `npm run validate:test-catalog` (fails on drift) |
-| `validate:test-catalog` | Checks that `docs/testing/automated_test_catalog.md` matches the current test tree | Before every merge | Runs in baseline CI lane |
+| `generate:test-catalog` | Regenerates `docs/testing/automated_test_catalog.md` from the test tree | After adding, removing, or renaming a test file | Baseline lane runs `npm run generate:test-catalog` (render; does not fail on pre-existing staleness) |
+| `validate:test-catalog` | Checks that `docs/testing/automated_test_catalog.md` matches the current test tree | Locally, before opening a PR | Advisory. Not used in CI — the baseline lane runs `generate:test-catalog` instead |
 | `generate:capability-manifest` | Regenerates `src/shared/capability_manifest.json` by walking git `vX.Y.Z` release tags and recording first/last appearance of each MCP tool in `src/tool_definitions.ts` | After adding or removing an MCP tool, or after cutting a new release tag | `npm run validate:capability-manifest` (fails on drift) |
-| `validate:capability-manifest` | Checks that `src/shared/capability_manifest.json` matches what the generator would produce | Before every merge | Runs in CI alongside `validate:test-catalog` |
+| `validate:capability-manifest` | Checks that `src/shared/capability_manifest.json` matches what the generator would produce | Before every merge | Runs in CI alongside `generate:test-catalog` |
+
+Sibling artifacts that look similar but are intentionally different:
+
+- `openapi.yaml` is an **authored** API contract (not generated). Do not treat staleness of a generated catalog as a reason to auto-rewrite it.
+- `src/shared/openapi_types.ts` is derived from authored `openapi.yaml`. CI regenerates then **fails on `git diff`** — drift means the YAML changed without committing types, which is registration/contract drift, not a pure inventory refresh.
+- `src/shared/capability_manifest.json` stays **fail-on-drift** (`validate:capability-manifest`) because a missed regen is tool/release registration drift, not a filename inventory refresh.
 
 ## Validation
 

package/dist/docs/infrastructure/client_instance_deployment.md

@@ -27,8 +27,12 @@ Fly config from the repo; do not reintroduce it.
 git worktree add ~/repos/neotoma-deploy origin/main
 cd ~/repos/neotoma-deploy
 
+# ALWAYS check drift first. This is not optional — see rule 0 below.
+scripts/check_fly_config_drift.sh --app "$CLIENT_FLY_APP" -c fly.operator.toml
+
 flyctl deploy \
   --app "$CLIENT_FLY_APP" \
+  -c fly.operator.toml \
   --build-arg VITE_NEOTOMA_SANDBOX_UI="" \
   --build-arg VITE_PUBLIC_BASE_PATH="/" \
   --no-cache
@@ -36,6 +40,41 @@ flyctl deploy \
 
 Everything below explains why each of those pieces is load-bearing.
 
+### 0. Check for config drift before every deploy
+
+`flyctl deploy` reapplies the committed `[[vm]]` and `[http_service]` blocks
+over the running machine. It does **not** merge, and it prints **no warning
+when it shrinks one**. Whatever the config in your checkout says is what the
+machine becomes.
+
+On 2026-09-01 a deploy run from a checkout **139 commits behind main**
+reapplied that checkout's `1gb` / `shared-cpu-1x` guest over an instance
+running `performance` / 2 CPU / 8GB, and dropped its health check. The instance
+went from slow to unreachable for roughly 30 minutes. Throughout, `flyctl
+status` reported `started`, `flyctl machine restart` printed "No health checks
+found", and the `CHECKS` column was empty — nothing anywhere reported a
+problem. It was noticed only because an agent failed to write.
+
+Two lessons, both mechanical rather than a matter of care:
+
+```bash
+# 1. Deploy from a checkout that is actually current.
+git -C ~/repos/neotoma-deploy fetch origin && \
+  git -C ~/repos/neotoma-deploy status -sb   # must show no "behind"
+
+# 2. Compare the config against the live machine before applying it.
+scripts/check_fly_config_drift.sh --app "$CLIENT_FLY_APP" -c fly.operator.toml
+```
+
+Exit 0 means the deploy will not resize the machine or drop its checks. Exit 1
+means it would — resolve that before deploying. Exit 2 means the check could
+not run (no `flyctl`, no `jq`, app unreachable); treat that as unknown, never
+as "fine".
+
+**A machine scaled up by hand will be reverted by the next deploy.** If an
+instance was resized to address load, that new size has to be written into the
+config it deploys from, or it lasts exactly until the next release.
+
 ## The five load-bearing rules
 
 ### 1. Deploy from `main`, not a feature branch
@@ -48,11 +87,20 @@ a repeated source of breakage. Deploy from a clean `origin/main` checkout.
 
 ### 2. Pass `--app <name>` explicitly — do NOT rely on `-c fly.toml`
 
-The repo's `fly.toml` declares `app = 'neotoma-sandbox'`. A bare `flyctl deploy`
-in the repo therefore targets the **sandbox app**, not the client instance.
+`fly.toml` deliberately declares **no** `app` key (#2013), so a bare `flyctl
+deploy` fails with "the config for your app is missing an app name" rather than
+succeeding against whichever app the file happens to name. It previously said
+`app = 'neotoma-sandbox'`, and a deploy meant for a client instance would
+silently retarget the sandbox and report success.
+
 Always pass `--app "$CLIENT_FLY_APP"` explicitly. Read the app name from the
 operator binding (below), never hardcode it here.
 
+Note what `--app` does and does not override: it changes the deploy **target**
+only. The `[[vm]]` and `[http_service]` blocks in whichever config is loaded
+still apply to that target — which is why rule 0's drift check matters even
+when the app name is correct.
+
 ### 3. Never use `fly.sandbox.toml` for a client instance
 
 `fly.sandbox.toml` is for the public sandbox only. It sets:

package/dist/docs/operations/configuration.md

@@ -32,7 +32,8 @@ Resolution order for the data directory and variables: a project-local `.env`, t
 | `NEOTOMA_DB_BACKEND` | DB driver: `sqlite` (synchronous, zero-config) or `libsql` (concurrent — statements run off the event loop via worker-hosted driver for local files, or @libsql/client for remote sqld/Turso, so slow queries can't freeze the server; recommended for hosted/agent-heavy/shared instances) | `sqlite` |
 | `NEOTOMA_DB_URL` | libsql connection URL (`file:` for embedded local, `http(s)://`/`libsql://` for remote sqld/Turso) | `file:{NEOTOMA_SQLITE_PATH}` |
 | `NEOTOMA_DB_AUTH_TOKEN` | Auth token for remote libsql connections | unset |
-| `NEOTOMA_DB_READER_WORKERS` | Read-only worker connections for the local `libsql` backend (WAL lets them run concurrently with the writer) | `2` |
+| `NEOTOMA_DB_READER_WORKERS` | Read-only worker connections for the local `libsql` backend (WAL lets them run concurrently with the writer). Reads go to the least-loaded reader, so raising this adds capacity rather than just slots | `2` |
+| `NEOTOMA_DB_STATEMENT_TIMEOUT_MS` | Per-statement budget for reads on that reader pool. On expiry the reader is terminated (the synchronous driver cannot be interrupted mid-statement) and respawns on the next read, so one runaway query cannot hold a pool slot indefinitely. Writes and statements inside a transaction are never timed out. `0` disables | `30000` |
 | `NEOTOMA_RAW_STORAGE_DIR` | Content-addressed source files | `{dataDir}/sources` |
 | `NEOTOMA_LOGS_DIR` / `NEOTOMA_EVENT_LOG_PATH` | Log directory and event log file | under `{dataDir}/logs` |
 | `NEOTOMA_HOST_URL` / `NEOTOMA_PUBLIC_BASE_URL` | Public URL of this instance | auto-discovered or unset |
@@ -61,9 +62,51 @@ See [Running the Server](running_the_server.md) for transports and processes.
 | --- | --- |
 | `NEOTOMA_REQUIRE_KEY_FOR_OAUTH` | Require a key for OAuth connections |
 | `NEOTOMA_OAUTH_CLIENT_ID` | MCP OAuth client id (hosted mode) |
+| `NEOTOMA_OAUTH_TRUSTED_CALLBACK_URLS` | Comma-separated **exact** callback URLs additionally trusted to receive an authorization code when the authorize request arrives via a tunnel. Empty by default. See below. |
 | `NEOTOMA_SANDBOX_MODE` | Opt into the public hosted-sandbox profile |
 | `NEOTOMA_REFUSE_MODE` | `warn` or `enforce` when a no-auth, non-loopback topology is detected |
 
+### Trusted OAuth callback URLs
+
+When an authorize request reaches a local-backend instance over a tunnel, the `redirect_uri` must be on an allowlist, so an authorization code is never handed to a third-party site. Built in are the `cursor:`/`vscode:`/`app:` schemes, localhost and loopback, this instance's own origin, and the ChatGPT and Claude callbacks.
+
+To let a **self-hosted first-party app** complete sign-in against a hosted instance, set its callback URL:
+
+```bash
+NEOTOMA_OAUTH_TRUSTED_CALLBACK_URLS=https://app.example.com/auth/callback
+```
+
+Several entries are comma-separated. Rules worth knowing before you set it:
+
+- **Exact full URLs, not origins.** The example above authorises `https://app.example.com/auth/callback` and **not** `https://app.example.com/anything-else`. Configure every callback path you need.
+- **https only**, unless the host is loopback. A plaintext `http://` entry to any other host is rejected rather than honoured.
+- **A bad entry rejects the whole list, and the server will not start.** See below.
+
+#### What the server compares
+
+A redirect is accepted when the request's callback and a configured entry agree on **scheme, host, port and path** — all four. In detail:
+
+| Part | How it is compared |
+| --- | --- |
+| Scheme | Must match. `https` does not authorise its `http` twin. |
+| Host | Case-**insensitive**. `APP.EXAMPLE.COM` matches `app.example.com`. |
+| Port | Must match, but a default port is equivalent to none: `https://app.example.com` = `https://app.example.com:443`. |
+| Path | Case-**sensitive**. `/Auth/Callback` does **not** match `/auth/callback`. A trailing slash is insignificant in either direction. Dot segments resolve first, so `/auth/callback/../admin` is compared as `/auth/admin`. An encoded slash (`%2F`) is not a path separator. |
+| Query and fragment | **Ignored on both sides**, so the usual `?code=...&state=...` callback matches. |
+| Userinfo | Any URL carrying `user:password@` is rejected. |
+
+If a redirect is refused, the `400` response names the callback URL the server actually compared (scheme, host and path — query and fragment are stripped) and says how many entries are configured. That is usually enough to tell a near miss — a trailing slash, a port, a case difference — from a typo or an unset variable, without needing server logs.
+
+#### A malformed entry fails the whole list, loudly
+
+If **any** entry cannot be used as a trusted callback URL, the entire list is rejected and **the server fails to start** with an error naming the offending entry by position and value. Entries 1 and 3 do not quietly survive a bad entry 2.
+
+This is deliberate. The friendlier alternative — skip the bad entry, honour the rest — makes the allowlist enforce something other than what you wrote, with no signal that it did: the refusal a dropped entry produces looks exactly like an exact-match miss. A startup failure is noisy, but it happens immediately and before any sign-in is served, rather than surfacing weeks later as an unexplained OAuth failure.
+
+Entries are rejected when they are unparseable, use a scheme other than `https:`/`http:`, are plaintext `http:` to a non-loopback host, or carry `user:password@` userinfo. To recover, either fix the entry the error names, or unset the variable entirely to fall back to the built-in allowlist.
+
+> The variable is `NEOTOMA_OAUTH_TRUSTED_CALLBACK_URLS`. Early planning notes for this feature called it `NEOTOMA_TRUSTED_OAUTH_CALLBACKS`; that name was never implemented and setting it has no effect.
+
 See [Deployment Modes](deployment.md) and [Agent Access Control](agent_access_control.md).
 
 ## Encryption