@bike4mind/cli 0.18.3 → 0.18.5

package/dist/{ConfigStore-DL7p3ZiY.mjs → ConfigStore-D39UqFnY.mjs}

@@ -476,6 +476,25 @@ z.enum({
 	...SpeechToTextModels,
 	...VideoModels
 });
+/**
+* Integer credits charged per $1 of provider cost. Derived once with rounding
+* because the raw division carries float noise (0.0006 is inexact in binary):
+* naive ceil((usd * 3) / 0.0006) charges a phantom credit on exact multiples.
+*/
+const CREDITS_PER_USD_COST = Math.round(3 / 6e-4);
+/**
+* Converts a USD cost to credits, including markup
+* @param usd - The raw provider cost in USD to convert
+* @returns The number of credits with markup, rounded up to the nearest whole number (minimum 1)
+*
+* Examples:
+* $1 USD = 5000 credits (3× markup at $0.0006/credit)
+* $0.001 USD = 5 credits
+* $0.0001 USD = 1 credit (minimum)
+*/
+const usdToCredits = (usd) => {
+	return Math.max(1, Math.ceil(usd * CREDITS_PER_USD_COST));
+};
 z$1.enum([
 	"openai",
 	"test",
@@ -1242,6 +1261,51 @@ const CREDIT_DEDUCT_TRANSACTION_TYPES = [
 	"transfer_credit",
 	"generic_deduct"
 ];
+z.object({
+	id: z.string().optional(),
+	/** App-level correlation id: questId for chat/image/video, session/run id otherwise. */
+	requestId: z.string(),
+	userId: z.string(),
+	/** Credit holder actually debited (user or organization). */
+	ownerId: z.string(),
+	ownerType: z.enum(CreditHolderType),
+	sessionId: z.string().optional(),
+	feature: z.enum([
+		"chat",
+		"image_generation",
+		"image_edit",
+		"video_generation",
+		"voice",
+		"transcription",
+		"agent_execution",
+		"completion_api",
+		"tool"
+	]),
+	/** Provider/backend, e.g. 'bedrock', 'openai', 'gemini'. */
+	provider: z.string(),
+	/** Exact model id string used for the call. */
+	model: z.string(),
+	inputTokens: z.number().default(0),
+	outputTokens: z.number().default(0),
+	cachedInputTokens: z.number().default(0),
+	cacheWriteTokens: z.number().default(0),
+	providerInputTokens: z.number().optional(),
+	providerOutputTokens: z.number().optional(),
+	/** Images generated / video seconds, for per-unit modalities. */
+	units: z.number().optional(),
+	/** True provider COGS in USD, computed and frozen at write time. */
+	costUsd: z.number(),
+	/** Credits actually debited from the owner for this call. */
+	creditsCharged: z.number(),
+	status: z.enum([
+		"ok",
+		"error",
+		"timeout"
+	]).default("ok"),
+	latencyMs: z.number().optional(),
+	createdAt: z.date(),
+	updatedAt: z.date()
+});
 let ResearchTaskExecutionType = /* @__PURE__ */ function(ResearchTaskExecutionType) {
 	/**
 	* The task is executed on demand
@@ -1628,6 +1692,23 @@ let SupportedFabFileMimeTypes = /* @__PURE__ */ function(SupportedFabFileMimeTyp
 	return SupportedFabFileMimeTypes;
 }({});
 /**
+* The canonical set of MIME types the ingest pipeline can actually chunk +
+* vectorize. Kept in lockstep with the `SmartChunker` switch in
+* `@bike4mind/fab-pipeline`.
+*/
+const SUPPORTED_FAB_FILE_MIME_TYPES = new Set(Object.values(SupportedFabFileMimeTypes));
+/**
+* Type guard: is a claimed MIME type one we actually support ingesting?
+*
+* Used to gate uploads so unsupported/binary files (e.g. `.exe`) are rejected
+* with a clear error instead of being stored and silently "vectorized" into 0
+* chunks. Node-free so it can run on both the client (upload UI) and server
+* (ingest endpoints).
+*/
+function isSupportedFabFileMimeType(mimeType) {
+	return !!mimeType && SUPPORTED_FAB_FILE_MIME_TYPES.has(mimeType);
+}
+/**
 * Canonical agent execution status tuple. Shared between the database model
 * (`AgentExecutionModel`), the client store (`useAgentExecutionStore`), and
 * wire schemas (`ChildExecutionSnapshotSchema`, etc.) so the value space can't
@@ -2071,6 +2152,17 @@ const DataLakeBatchProgressAction = z.object({
 		"cancelled"
 	]).optional()
 });
+/** Verdict for a freshly-uploaded FabFile after the S3-event moderation scan (#9776 Q2b). */
+const ImageModerationStatusAction = z.object({
+	action: z.literal("image_moderation_status"),
+	clientId: z.string().optional(),
+	fabFileId: z.string(),
+	moderationStatus: z.enum([
+		"pending",
+		"clean",
+		"blocked"
+	])
+});
 const UpdateResearchTaskStatusAction = z.object({
 	action: z.literal("update_research_task_status"),
 	clientId: z.string().optional(),
@@ -2969,6 +3061,7 @@ z.discriminatedUnion("action", [
 	TavernStockUpdateAction,
 	JupyterNotebookProgressAction,
 	DataLakeBatchProgressAction,
+	ImageModerationStatusAction,
 	CcAgentCommandAction,
 	QuantumRunUpdatedAction,
 	ExecutionStartedAction,
@@ -3574,14 +3667,27 @@ z$1.object({
 	prefix: z$1.string().optional()
 });
 /**
-* Constants for BFL safety tolerance settings
+* Constants for BFL safety tolerance settings.
+*
+* BFL scale: 0 = strictest filtering, 6 = effectively unfiltered. MAX is a
+* hard cap (#9776, 18 U.S.C. §2258A exposure) — enforced in the zod schemas
+* here AND clamped last-mile in BFLImageService, so no caller can raise it.
+* BFL itself caps its editing endpoints at 2.
 */
 const BFL_SAFETY_TOLERANCE = {
 	MIN: 0,
-	MAX: 6,
-	DEFAULT: 4
+	MAX: 2,
+	DEFAULT: 2,
+	/** Pre-cap sessions may have stored up to 6 — accepted as input, clamped to MAX on parse. */
+	LEGACY_INPUT_MAX: 6
 };
 /**
+* Shared safety_tolerance schema: accepts the legacy 0-6 stored range but
+* clamps the parsed output to the hard cap (coerce, not reject — rejecting
+* would break image generation for sessions saved before the cap existed).
+*/
+const BFLSafetyToleranceSchema = z.number().min(BFL_SAFETY_TOLERANCE.MIN).max(BFL_SAFETY_TOLERANCE.LEGACY_INPUT_MAX).optional().prefault(BFL_SAFETY_TOLERANCE.DEFAULT).transform((value) => Math.min(value, BFL_SAFETY_TOLERANCE.MAX));
+/**
 * List of image models supported by BlackForest Labs
 */
 const BFL_IMAGE_MODELS = [
@@ -3594,7 +3700,7 @@ const BFL_IMAGE_MODELS = [
 ];
 const CommonBFLParams = z.object({
 	prompt: z.string().nullable().optional(),
-	safety_tolerance: z.number().min(BFL_SAFETY_TOLERANCE.MIN).max(BFL_SAFETY_TOLERANCE.MAX).optional().prefault(BFL_SAFETY_TOLERANCE.DEFAULT),
+	safety_tolerance: BFLSafetyToleranceSchema,
 	output_format: z.enum(["jpeg", "png"]).nullable().optional().prefault("jpeg"),
 	image_prompt: z.string().nullable().optional(),
 	webhook_url: z.string().min(1).max(2083).nullable().optional(),
@@ -3966,6 +4072,7 @@ z.enum([
 	"EnableInertArtifactRender",
 	"pricePerCredit",
 	"ModerationEnabled",
+	"ImageModerationEnabled",
 	"tagLineMain",
 	"tagLineSub",
 	"defaultTags",
@@ -4025,6 +4132,7 @@ z.enum([
 	"enforceCredits",
 	"enableTeamPlan",
 	"allowOpenRegistration",
+	"blockDisposableEmails",
 	"defaultFreeCredits",
 	"enableGoogleCalendar",
 	"googleCalendarServiceAccountEmail",
@@ -4040,6 +4148,7 @@ z.enum([
 	"SlackLiveopsWebhookUrl",
 	"SlackUserActivityWebhookUrl",
 	"SlackFeedbackWebhookUrl",
+	"SlackEmailAuditWebhookUrl",
 	"slackSigningSecret",
 	"slackBotToken",
 	"enforceMFA",
@@ -4050,7 +4159,6 @@ z.enum([
 	"voiceSessionTranscriptionModel",
 	"voiceSessionVadType",
 	"voiceSessionVadEagerness",
-	"pdfjsExpressViewerKey",
 	"EnableEmailAnalysis",
 	"EmailAnalysisModel",
 	"EmailAnalysisTemperature",
@@ -4081,6 +4189,9 @@ z.enum([
 	"contextTelemetryAlerts",
 	"sreAgentConfig",
 	"secopsTriageConfig",
+	"apiRateLimitFreePerMin",
+	"apiRateLimitBasicPerMin",
+	"apiRateLimitProPerMin",
 	"overwatchRollupSync",
 	"orchestrationDefaults"
 ]);
@@ -4979,6 +5090,10 @@ const API_SERVICE_GROUPS = {
 				key: "SlackUserActivityWebhookUrl",
 				order: 6
 			},
+			{
+				key: "SlackEmailAuditWebhookUrl",
+				order: 6.5
+			},
 			{
 				key: "FeedbackSendEmailUsername",
 				order: 7
@@ -5384,16 +5499,6 @@ const API_SERVICE_GROUPS = {
 			order: 1
 		}]
 	},
-	PDF_VIEWER: {
-		id: "pdfViewerService",
-		name: "PDF Viewer",
-		description: "PDF.js Express Viewer settings",
-		icon: "PictureAsPdf",
-		settings: [{
-			key: "pdfjsExpressViewerKey",
-			order: 1
-		}]
-	},
 	DATETIME_ASTRONOMY: {
 		id: "datetimeAstronomyService",
 		name: "Time Machine & Night Sky",
@@ -5413,13 +5518,33 @@ const API_SERVICE_GROUPS = {
 				order: 3
 			}
 		]
+	},
+	RATE_LIMITING: {
+		id: "rateLimitingService",
+		name: "API Rate Limiting",
+		description: "Per-user request rate limits on /chat and /opti, tunable per subscription tier (#9780)",
+		icon: "Speed",
+		settings: [
+			{
+				key: "apiRateLimitFreePerMin",
+				order: 1
+			},
+			{
+				key: "apiRateLimitBasicPerMin",
+				order: 2
+			},
+			{
+				key: "apiRateLimitProPerMin",
+				order: 3
+			}
+		]
 	}
 };
 const settingsMap = {
 	DefaultAPIModel: makeStringSetting({
 		key: "DefaultAPIModel",
 		name: "Default API Model",
-		defaultValue: "claude-sonnet-5",
+		defaultValue: "global.anthropic.claude-sonnet-5",
 		description: "The default AI model to use for API requests when no model is specified.",
 		options: CHAT_MODELS,
 		category: "AI",
@@ -5699,6 +5824,13 @@ const settingsMap = {
 		description: "Whether to enable moderation for LLM prompts.",
 		category: "AI Moderation"
 	}),
+	ImageModerationEnabled: makeBooleanSetting({
+		key: "ImageModerationEnabled",
+		name: "Image Moderation Enabled",
+		defaultValue: true,
+		description: "Whether to run generated images through content moderation (Rekognition) and block explicit content. Legal-safety control (#9776) — default ON.",
+		category: "AI Moderation"
+	}),
 	FormatPromptTemplate: makeStringSetting({
 		key: "FormatPromptTemplate",
 		name: "Format Prompt Template",
@@ -5748,6 +5880,39 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.CREDITS.id,
 		order: 1
 	}),
+	apiRateLimitFreePerMin: makeNumberSetting({
+		key: "apiRateLimitFreePerMin",
+		name: "API Rate Limit — Free (requests/min)",
+		defaultValue: 10,
+		min: 1,
+		max: 1e5,
+		description: "Max /chat and /opti requests per minute for users with no active paid subscription.",
+		category: "SecOps",
+		group: API_SERVICE_GROUPS.RATE_LIMITING.id,
+		order: 1
+	}),
+	apiRateLimitBasicPerMin: makeNumberSetting({
+		key: "apiRateLimitBasicPerMin",
+		name: "API Rate Limit — Basic (requests/min)",
+		defaultValue: 30,
+		min: 1,
+		max: 1e5,
+		description: "Max /chat and /opti requests per minute for Basic-tier subscribers (e.g. Professional plan).",
+		category: "SecOps",
+		group: API_SERVICE_GROUPS.RATE_LIMITING.id,
+		order: 2
+	}),
+	apiRateLimitProPerMin: makeNumberSetting({
+		key: "apiRateLimitProPerMin",
+		name: "API Rate Limit — Pro (requests/min)",
+		defaultValue: 60,
+		min: 1,
+		max: 1e5,
+		description: "Max /chat and /opti requests per minute for Pro-tier subscribers.",
+		category: "SecOps",
+		group: API_SERVICE_GROUPS.RATE_LIMITING.id,
+		order: 3
+	}),
 	tagLineMain: makeStringSetting({
 		key: "tagLineMain",
 		name: "Tag Line Main",
@@ -5889,6 +6054,16 @@ const settingsMap = {
 		order: 7,
 		isSensitive: true
 	}),
+	SlackEmailAuditWebhookUrl: makeStringSetting({
+		key: "SlackEmailAuditWebhookUrl",
+		name: "Email Audit Channel Webhook URL",
+		defaultValue: "",
+		description: "Incoming-webhook URL for mirroring a redacted copy of every outbound email to a dedicated audit Slack channel (e.g. #b4m-emails) for real-time visibility (#9872). Use a PRIVATE, need-to-know channel — mirrored copies contain recipient email addresses. Secrets/tokens (reset & verification links) are redacted before posting.",
+		category: "Feedback",
+		group: API_SERVICE_GROUPS.FEEDBACK.id,
+		order: 8,
+		isSensitive: true
+	}),
 	liveFeedbackEmail: makeStringSetting({
 		key: "liveFeedbackEmail",
 		name: "Live Feedback Email",
@@ -6075,6 +6250,14 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users"
 	}),
+	blockDisposableEmails: makeBooleanSetting({
+		key: "blockDisposableEmails",
+		name: "Block Disposable Emails",
+		defaultValue: true,
+		description: "Rejects new registrations whose email domain (or any parent domain) is a known disposable/burner provider — free credits cannot be farmed with throwaway inboxes (#9779). Applies at registration only; existing accounts on such domains can still sign in. Turn OFF only to work around a false positive.",
+		group: API_SERVICE_GROUPS.CREDITS.id,
+		category: "Users"
+	}),
 	defaultFreeCredits: makeNumberSetting({
 		key: "defaultFreeCredits",
 		name: "Default Free Credits",
@@ -6662,16 +6845,6 @@ const settingsMap = {
 		order: 10,
 		schema: RapidReplySettingsSchema
 	}),
-	pdfjsExpressViewerKey: makeStringSetting({
-		key: "pdfjsExpressViewerKey",
-		name: "PDF.js Express Viewer Key",
-		defaultValue: "",
-		description: "The license key for PDF.js Express Viewer for PDF document viewing.",
-		isSensitive: true,
-		category: "Tools",
-		group: API_SERVICE_GROUPS.PDF_VIEWER.id,
-		order: 1
-	}),
 	EnableEmailAnalysis: makeBooleanSetting({
 		key: "EnableEmailAnalysis",
 		name: "Enable Email Analysis",
@@ -8314,7 +8487,8 @@ z$1.object({
 	description: z$1.string().max(2e3).optional(),
 	fileTagPrefix: z$1.string().min(2).max(30).refine((s) => s.endsWith(":"), "Tag prefix must end with \":\" (e.g. \"acme:\")"),
 	requiredUserTag: z$1.string().min(1).max(100).optional(),
-	requiredEntitlement: z$1.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")").optional()
+	requiredEntitlement: z$1.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")").optional(),
+	organizationId: z$1.string().optional()
 });
 z$1.object({
 	name: z$1.string().min(1).max(200).optional(),
@@ -8464,6 +8638,7 @@ const PromptBatchQuerySchema = z.object({
 z.object({ queries: z.array(PromptBatchQuerySchema).min(1).max(32).refine((qs) => new Set(qs.map((q) => q.key)).size === qs.length, { message: "Batch query keys must be unique" }) });
 const DATA_LAKES = [{
 	id: "ionq-sales",
+	slug: "ionq-sales",
 	name: "IonQ Sales Intelligence",
 	requiredUserTag: "Opti",
 	requiredEntitlement: "optihashi:pro",
@@ -8471,6 +8646,7 @@ const DATA_LAKES = [{
 	datalakeTag: "datalake:ionq-sales"
 }, {
 	id: "opti-knowledge",
+	slug: "opti-knowledge",
 	name: "Optimization Knowledge Base",
 	requiredUserTag: "Opti",
 	requiredEntitlement: "optihashi:pro",
@@ -8511,12 +8687,14 @@ function lakeMatchesAccess(lake, normalizedUserTags, normalizedKeys) {
 function toDataLakeConfig(dl) {
 	return {
 		id: dl.id,
+		slug: dl.slug,
 		name: dl.name,
 		requiredUserTag: dl.requiredUserTag,
 		requiredEntitlement: dl.requiredEntitlement,
 		fileTagPrefix: dl.fileTagPrefix,
 		datalakeTag: dl.datalakeTag,
-		organizationId: dl.organizationId
+		organizationId: dl.organizationId,
+		description: dl.description
 	};
 }
 /**
@@ -8773,7 +8951,8 @@ z.object({
 			"classifier",
 			"mention",
 			"user-default",
-			"agent_literal"
+			"agent_literal",
+			"complexity"
 		])
 	}).optional()
 }).extend({
@@ -9425,6 +9604,28 @@ z.object({
 	/** Custom notebook name (optional, defaults to curated-notebook-{sessionId}) */
 	customNotebookName: z.string().optional()
 });
+/**
+* ImageModerationIncident — audit record for a generated image blocked by
+* auto-moderation (#9776 Q2a). Metadata-only (no image bytes); byte
+* preservation for §2258A retention is a later quest.
+*/
+const ModerationLabelHitSchema = z.object({
+	name: z.string(),
+	parentName: z.string(),
+	confidence: z.number()
+});
+z.object({
+	userId: z.string(),
+	sessionId: z.string().optional(),
+	questId: z.string().optional(),
+	/** Uploaded-image incidents (#9776 Q2b) reference the FabFile instead of a quest/session. */
+	fabFileId: z.string().optional(),
+	provider: z.string(),
+	model: z.string(),
+	labels: z.array(ModerationLabelHitSchema),
+	createdAt: z.union([z.string(), z.date()]).optional(),
+	updatedAt: z.union([z.string(), z.date()]).optional()
+});
 function isGPTImageModel(model) {
 	if (!model) return false;
 	return OPENAI_IMAGE_MODELS.includes(model) || model.startsWith("gpt-image-");
@@ -9597,7 +9798,7 @@ z.array(triggerWordSchema).max(20, "Up to 20 trigger words allowed.").transform(
 *   - `$1`, `$2`, ... — individual positional args
 *
 * Why a shared helper: the CLI already implemented this in
-* `apps/cli/src/utils/argumentSubstitution.ts`. Centralizing here avoids a
+* `packages/cli/src/utils/argumentSubstitution.ts`. Centralizing here avoids a
 * second drift surface — a skill body authored on the web and run in the CLI
 * (or vice versa) must expand identically.
 */
@@ -9706,6 +9907,33 @@ function intersectAllowedTools(skillAllowedTools, invokerAllowedTools) {
 	const invokerSet = new Set(invokerAllowedTools);
 	return skillAllowedTools.filter((tool) => invokerSet.has(tool));
 }
+/**
+* Serve gate for uploaded FabFiles (#9776 Q2b, hold-until-scanned; P1-1 fail-closed on ALL
+* mime types, not just images). A file is serveable only once moderation has run to
+* completion on it — REGARDLESS of its declared `mimeType`.
+*
+* Why gate non-images too: `mimeType` is client-declared at upload time and is only
+* corrected by the S3 scan ~1-2s later (see `moderateUploadedFile`'s byte-sniffing). If this
+* gate special-cased "non-images always serveable" based on that same untrusted declared
+* mimeType, a file uploaded as `application/pdf` but actually a PNG (or vice versa) would be
+* served during that window before the sniff/scan ever runs. Gating on `moderationStatus`
+* alone closes that window for every file, image or not.
+*
+* `moderationStatus` semantics:
+*  - 'clean'                      -> serveable
+*  - 'pending' | 'scanning'       -> NOT serveable (not yet through the scan)
+*  - 'blocked'                    -> NOT serveable (confirmed block / unscannable format)
+*  - null | undefined             -> NOT serveable (fail-closed; legacy pre-Q2b rows are
+*                                    backfilled to 'clean', see backfill-fabfile-moderation-status.ts)
+*
+* Non-image files (PDFs, docs, text, ...) are NOT scanned by Rekognition, but they still
+* pass through `moderateUploadedFile`/`objectCreated`, which resolves them to 'clean'
+* immediately (no image bytes to hold on) — so the hold is brief (one S3 event round trip),
+* not an indefinite block.
+*/
+function isImageServeable(f) {
+	return f.moderationStatus === "clean";
+}
 const VIEW_REGISTRY = [
 	{
 		id: "opti.root",
@@ -10693,7 +10921,7 @@ QWORK_PROVIDERS.filter((p) => QWORK_PROVIDER_CAPABILITIES[p].enabled);
 //#region src/utils/apiUrl.ts
 /**
 * Default service endpoint, baked in at build time via tsdown's `env` option
-* (see `apps/cli/tsdown.config.ts`). The hosted publisher builds with its own
+* (see `packages/cli/tsdown.config.ts`). The hosted publisher builds with its own
 * service as the default; a fork sets `B4M_DEFAULT_API_URL` to publish under a
 * different brand, so a fork's bundle never embeds the upstream brand literal.
 * Empty when unset — the user then supplies an endpoint via `/set-api` or the
@@ -11130,7 +11358,7 @@ const CliConfigSchema = z.object({
 		enableCoordinatorMode: z.boolean().optional().prefault(false),
 		/**
 		* System-prompt variant. 'current' uses the elaborate behavioral-scaffolding
-		* prompt; 'minimal' uses a pi-style short prompt. See apps/cli/src/core/prompts.ts.
+		* prompt; 'minimal' uses a pi-style short prompt. See packages/cli/src/core/prompts.ts.
 		* Defaults to 'current' for backward compatibility; switch via /config or by
 		* editing the config file directly.
 		*/
@@ -11884,4 +12112,4 @@ var ConfigStore = class {
 	}
 };
 //#endregion
-export { PermissionDeniedError as $, wrapUntrustedSkillBody as $t, FriendshipEvents as A, XAI_IMAGE_MODELS as At, InboxEvents as B, isSupportedEmbeddingModel as Bt, CorruptedFileError as C, TransferCreditTransaction as Ct, FeedbackEvents as D, VIDEO_SIZE_CONSTRAINTS as Dt, FavoriteDocumentType as E, UnprocessableEntityError as Et, HTTPError as F, getViewById as Ft, LLMEvents as G, resolveNavigationIntents as Gt, InviteEvents as H, mapMimeTypeToArtifactType as Ht, HttpStatus as I, intersectAllowedTools as It, ModelBackend as J, settingsMap as Jt, MiscEvents as K, sanitizeTelemetryError as Kt, ImageEditUsageTransaction as L, isGPTImage2Model as Lt, GenerateImageToolCallSchema as M, dayjsConfig_default as Mt, GenericCreditAddTransaction as N, getAccessibleDataLakes as Nt, FileEvents as O, VideoGenerationUsageTransaction as Ot, GenericCreditDeductTransaction as P, getMcpProviderMetadata as Pt, Permission as Q, validateNotebookPath as Qt, ImageGenerationUsageTransaction as R, isGPTImageModel as Rt, CompletionApiUsageTransaction as S, ToolUsageTransaction as St, ElabsEvents as T, UnauthorizedError as Tt, InviteType as U, obfuscateApiKey as Ut, InternalServerError as V, isZodError as Vt, KnowledgeType as W, parseSkillArguments as Wt, OpenAIEmbeddingModel as X, toDataLakeConfig as Xt, NotFoundError as Y, substituteArguments as Yt, OpenAIImageGenerationInput as Z, validateJupyterKernelName as Zt, BadRequestError as _, SupportedFabFileMimeTypes as _t, getDefaultApiUrl as a, QuestMasterParamsSchema as at, ChatModels as b, TextGenerationUsageTransaction as bt, AiEvents as c, RechartsChartTypeList as ct, ApiKeyType as d, ResearchTaskExecutionType as dt, buildRateLimitLogEntry as en, ProfileEvents as et, AppFileEvents as f, ResearchTaskPeriodicFrequencyType as ft, BFL_SAFETY_TOLERANCE as g, SubscriptionCreditTransaction as gt, BFL_IMAGE_MODELS as h, SpeechToTextUsageTransaction as ht, getCreditsUrl as i, CollectionType as in, PurchaseTransaction as it, GEMINI_IMAGE_MODELS as j, b4mLLMTools as jt, ForbiddenError as k, VideoModels as kt, ApiKeyEvents as l, RegInviteEvents as lt, AuthEvents as m, SessionEvents as mt, logger as n, isNearLimit as nn, PromptIntentSchema as nt, getEnvironmentName as o, RealtimeVoiceUsageTransaction as ot, ArtifactTypeSchema as p, ResearchTaskType as pt, ModalEvents as q, secureParameters as qt, getApiUrl as r, parseRateLimitHeaders as rn, PromptMetaZodSchema as rt, ALERT_THRESHOLDS as s, ReceivedCreditTransaction as st, ConfigStore as t, extractSnippetMeta as tn, ProjectEvents as tt, ApiKeyScope as u, ResearchModeParamsSchema as ut, CREDIT_DEDUCT_TRANSACTION_TYPES as v, TagType as vt, DashboardParamsSchema as w, UiNavigationEvents as wt, ClaudeArtifactMimeTypes as x, TooManyRequestsError as xt, ChatCompletionCreateInputSchema as y, TaskScheduleHandler as yt, ImageModels as z, isModelAccessible as zt };
+export { Permission as $, toDataLakeConfig as $t, ForbiddenError as A, VideoModels as At, ImageModels as B, isImageServeable as Bt, CompletionApiUsageTransaction as C, ToolUsageTransaction as Ct, FavoriteDocumentType as D, UnprocessableEntityError as Dt, ElabsEvents as E, UnauthorizedError as Et, GenericCreditDeductTransaction as F, getMcpProviderMetadata as Ft, KnowledgeType as G, mapMimeTypeToArtifactType as Gt, InternalServerError as H, isSupportedEmbeddingModel as Ht, HTTPError as I, getViewById as It, ModalEvents as J, resolveNavigationIntents as Jt, LLMEvents as K, obfuscateApiKey as Kt, HttpStatus as L, intersectAllowedTools as Lt, GEMINI_IMAGE_MODELS as M, b4mLLMTools as Mt, GenerateImageToolCallSchema as N, dayjsConfig_default as Nt, FeedbackEvents as O, VIDEO_SIZE_CONSTRAINTS as Ot, GenericCreditAddTransaction as P, getAccessibleDataLakes as Pt, OpenAIImageGenerationInput as Q, substituteArguments as Qt, ImageEditUsageTransaction as R, isGPTImage2Model as Rt, ClaudeArtifactMimeTypes as S, TooManyRequestsError as St, DashboardParamsSchema as T, UiNavigationEvents as Tt, InviteEvents as U, isSupportedFabFileMimeType as Ut, InboxEvents as V, isModelAccessible as Vt, InviteType as W, isZodError as Wt, NotFoundError as X, secureParameters as Xt, ModelBackend as Y, sanitizeTelemetryError as Yt, OpenAIEmbeddingModel as Z, settingsMap as Zt, BFL_SAFETY_TOLERANCE as _, SubscriptionCreditTransaction as _t, getDefaultApiUrl as a, extractSnippetMeta as an, PurchaseTransaction as at, ChatCompletionCreateInputSchema as b, TaskScheduleHandler as bt, AiEvents as c, CollectionType as cn, ReceivedCreditTransaction as ct, ApiKeyType as d, ResearchModeParamsSchema as dt, usdToCredits as en, PermissionDeniedError as et, AppFileEvents as f, ResearchTaskExecutionType as ft, BFL_IMAGE_MODELS as g, SpeechToTextUsageTransaction as gt, BFLSafetyToleranceSchema as h, SessionEvents as ht, getCreditsUrl as i, buildRateLimitLogEntry as in, PromptMetaZodSchema as it, FriendshipEvents as j, XAI_IMAGE_MODELS as jt, FileEvents as k, VideoGenerationUsageTransaction as kt, ApiKeyEvents as l, RechartsChartTypeList as lt, AuthEvents as m, ResearchTaskType as mt, logger as n, validateNotebookPath as nn, ProjectEvents as nt, getEnvironmentName as o, isNearLimit as on, QuestMasterParamsSchema as ot, ArtifactTypeSchema as p, ResearchTaskPeriodicFrequencyType as pt, MiscEvents as q, parseSkillArguments as qt, getApiUrl as r, wrapUntrustedSkillBody as rn, PromptIntentSchema as rt, ALERT_THRESHOLDS as s, parseRateLimitHeaders as sn, RealtimeVoiceUsageTransaction as st, ConfigStore as t, validateJupyterKernelName as tn, ProfileEvents as tt, ApiKeyScope as u, RegInviteEvents as ut, BadRequestError as v, SupportedFabFileMimeTypes as vt, CorruptedFileError as w, TransferCreditTransaction as wt, ChatModels as x, TextGenerationUsageTransaction as xt, CREDIT_DEDUCT_TRANSACTION_TYPES as y, TagType as yt, ImageGenerationUsageTransaction as z, isGPTImageModel as zt };

package/dist/commands/apiCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as getDefaultApiUrl, t as ConfigStore } from "../ConfigStore-DL7p3ZiY.mjs";
+import { a as getDefaultApiUrl, t as ConfigStore } from "../ConfigStore-D39UqFnY.mjs";
 //#region src/commands/apiCommand.ts
 /**
 * External API config command (--api-url / --reset-api)

package/dist/commands/doctorCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-B-ONmxJ7.mjs";
+import { t as version } from "../package-I_v_WFUn.mjs";
 import { a as fetchLatestVersion, c as isNpmPrefixWritable, i as compareSemver } from "../updateChecker-C8xsNY2L.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync } from "child_process";

package/dist/commands/envCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-DL7p3ZiY.mjs";
+import { t as ConfigStore } from "../ConfigStore-D39UqFnY.mjs";
 //#region src/commands/envCommand.ts
 /**
 * Environment switching for the `--dev` / `--prod` launch flags.

package/dist/commands/headlessCommand.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, T as createAgentDelegateTool, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, b as createWriteTodosTool, et as SessionStore, i as McpManager, n as SubagentOrchestrator, o as WebSocketConnectionManager, q as buildSystemPrompt, r as AgentStore, s as WebSocketLlmBackend, t as BackgroundAgentManager, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore } from "../BackgroundAgentManager-H_MnlEXz.mjs";
-import { n as logger, r as getApiUrl, t as ConfigStore } from "../ConfigStore-DL7p3ZiY.mjs";
+import { C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, T as createAgentDelegateTool, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, b as createWriteTodosTool, et as SessionStore, i as McpManager, n as SubagentOrchestrator, o as WebSocketConnectionManager, q as buildSystemPrompt, r as AgentStore, s as WebSocketLlmBackend, t as BackgroundAgentManager, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore } from "../BackgroundAgentManager-D-xsWd3C.mjs";
+import { n as logger, r as getApiUrl, t as ConfigStore } from "../ConfigStore-D39UqFnY.mjs";
 import { t as DEFAULT_SANDBOX_CONFIG } from "../types-LyRNHOiS.mjs";
 import { t as createSandboxRuntime } from "../SandboxRuntimeAdapter-ChGlxSGQ.mjs";
 import { t as SandboxOrchestrator } from "../SandboxOrchestrator-BoINxbX4.mjs";

package/dist/commands/mcpCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-DL7p3ZiY.mjs";
+import { t as ConfigStore } from "../ConfigStore-D39UqFnY.mjs";
 //#region src/commands/mcpCommand.ts
 /**
 * External MCP commands (b4m mcp list, b4m mcp add, etc.)

package/dist/commands/updateCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-B-ONmxJ7.mjs";
+import { t as version } from "../package-I_v_WFUn.mjs";
 import { c as isNpmPrefixWritable, l as setAutoUpdatePreference, n as REEXEC_GUARD_ENV, o as forceCheckForUpdate, r as checkForUpdate, s as getAutoUpdatePreference, t as INSTALL_CMD, u as shouldAttemptAutoUpdate } from "../updateChecker-C8xsNY2L.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync, spawnSync } from "child_process";

package/dist/index.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as CommandHistoryStore, A as substituteArguments, B as DEFAULT_RETRY_CONFIG, C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, H as clearFeatureModuleTools, I as getProcessHooks, J as buildSkillsPromptSection, K as getPlanModeFilePath, L as ALWAYS_DENIED_FOR_AGENTS, M as extractCompactInstructions, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, R as DEFAULT_AGENT_MODEL, S as parseAgentConfig, T as createAgentDelegateTool, U as registerFeatureModuleTools, V as DEFAULT_THOROUGHNESS, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, at as mergeCommands, b as createWriteTodosTool, c as createReviewGateStore, ct as warmFileCache, d as createBlockerStore, et as SessionStore, f as createBlockerTools, g as formatDecisionsOutput, h as createDecisionStore, i as McpManager, it as searchCommands, j as formatStep, k as isTransientNetworkError, l as createReviewGateTool, m as createDecisionLogTool, n as SubagentOrchestrator, nt as hasFileReferences, o as WebSocketConnectionManager, ot as formatFileSize, p as formatBlockersOutput, q as buildSystemPrompt, r as AgentStore, rt as processFileReferences, s as WebSocketLlmBackend, st as searchFiles, t as BackgroundAgentManager, tt as OAuthClient, u as formatReviewGatesOutput, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore, z as DEFAULT_MAX_ITERATIONS } from "./BackgroundAgentManager-H_MnlEXz.mjs";
+import { $ as CommandHistoryStore, A as substituteArguments, B as DEFAULT_RETRY_CONFIG, C as createCoordinateTaskTool, D as FallbackLlmBackend, E as ApiClient, F as generateCliTools, G as ReActAgent, H as clearFeatureModuleTools, I as getProcessHooks, J as buildSkillsPromptSection, K as getPlanModeFilePath, L as ALWAYS_DENIED_FOR_AGENTS, M as extractCompactInstructions, N as loadContextFiles, O as ServerLlmBackend, P as PermissionManager, Q as CheckpointStore, R as DEFAULT_AGENT_MODEL, S as parseAgentConfig, T as createAgentDelegateTool, U as registerFeatureModuleTools, V as DEFAULT_THOROUGHNESS, W as setWebSocketToolExecutor, X as RemoteSkillSource, Y as isReadOnlyTool, Z as CustomCommandStore, _ as createGetFileStructureTool, a as WebSocketToolExecutor, at as mergeCommands, b as createWriteTodosTool, c as createReviewGateStore, ct as warmFileCache, d as createBlockerStore, et as SessionStore, f as createBlockerTools, g as formatDecisionsOutput, h as createDecisionStore, i as McpManager, it as searchCommands, j as formatStep, k as isTransientNetworkError, l as createReviewGateTool, m as createDecisionLogTool, n as SubagentOrchestrator, nt as hasFileReferences, o as WebSocketConnectionManager, ot as formatFileSize, p as formatBlockersOutput, q as buildSystemPrompt, r as AgentStore, rt as processFileReferences, s as WebSocketLlmBackend, st as searchFiles, t as BackgroundAgentManager, tt as OAuthClient, u as formatReviewGatesOutput, v as createFindDefinitionTool, w as createBackgroundAgentTools, x as createSkillTool, y as createTodoStore, z as DEFAULT_MAX_ITERATIONS } from "./BackgroundAgentManager-D-xsWd3C.mjs";
 import { n as useCliStore, t as selectActiveBackgroundAgents } from "./store-DV5s-qni.mjs";
-import { Qt as validateNotebookPath$1, Zt as validateJupyterKernelName, b as ChatModels, i as getCreditsUrl, n as logger, o as getEnvironmentName, r as getApiUrl, t as ConfigStore, v as CREDIT_DEDUCT_TRANSACTION_TYPES } from "./ConfigStore-DL7p3ZiY.mjs";
-import { t as version } from "./package-B-ONmxJ7.mjs";
+import { i as getCreditsUrl, n as logger, nn as validateNotebookPath$1, o as getEnvironmentName, r as getApiUrl, t as ConfigStore, tn as validateJupyterKernelName, x as ChatModels, y as CREDIT_DEDUCT_TRANSACTION_TYPES } from "./ConfigStore-D39UqFnY.mjs";
+import { t as version } from "./package-I_v_WFUn.mjs";
 import { r as checkForUpdate } from "./updateChecker-C8xsNY2L.mjs";
 import React, { useCallback, useEffect, useMemo, useReducer, useRef, useState } from "react";
 import { Box, Static, Text, render, useApp, useInput, usePaste, useStdout } from "ink";
@@ -3005,7 +3005,7 @@ async function writeLocalHandoffFile(session, options = {}) {
 * and falling back would mask a real bug.
 *
 * Keep the substring matches below in sync with the error strings thrown by
-* `apps/cli/src/llm/ServerLlmBackend.ts` (see its catch block around the
+* `packages/cli/src/llm/ServerLlmBackend.ts` (see its catch block around the
 * `Request failed with status` / `Authentication ...` / `Cannot connect ...`
 * / `Failed to complete LLM request` throws). Renames there will silently
 * break the auto-fallback — a typed error hierarchy would be a more robust

package/dist/{package-B-ONmxJ7.mjs → package-I_v_WFUn.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 //#region package.json
-var version = "0.18.3";
+var version = "0.18.5";
 //#endregion
 export { version as t };