@bike4mind/cli 0.20.0 → 0.20.2

package/dist/{ConfigStore-DD3DcC3-.mjs → ConfigStore-cIyF7hDg.mjs}

@@ -7,7 +7,7 @@ import path from "path";
 import { v4 } from "uuid";
 import * as z$2 from "zod";
 import z, { ZodError, z as z$1 } from "zod";
-import { hearthEventKindSchema, hearthEventRefsSchema, hearthMachineBodySchema } from "@bike4mind/hearth";
+import { actorKindSchema, hearthEventKindSchema, hearthEventRefsSchema, hearthMachineBodySchema } from "@bike4mind/hearth";
 import dayjs from "dayjs";
 import timezone from "dayjs/plugin/timezone.js";
 import utc from "dayjs/plugin/utc.js";
@@ -699,6 +699,12 @@ let KnowledgeType = /* @__PURE__ */ function(KnowledgeType) {
 * so the client can branch to a targeted error UI (see `IChatHistoryItem.errorCode`).
 * Single source of truth: the streamed-action Zod enum in `schemas/actions.ts`
 * derives its values from this tuple, so the two can never drift.
+*
+* SSE-frame scoped, and a NARROWING of the platform-wide `API_ERROR_CODES`: a
+* quest fails for billing reasons, never for the provider-configuration reasons
+* the HTTP surface reports. The `satisfies` is what keeps it a narrowing rather
+* than a second vocabulary - a code added here that is not in `API_ERROR_CODES`
+* fails the build.
 */
 const QUEST_ERROR_CODES = ["insufficient_credits", "spend_cap_exceeded"];
 z$1.union([
@@ -896,6 +902,12 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 const CHAT_MODELS = Object.values(ChatModels);
 const supportedChatModels = z$1.enum(ChatModels);
 /**
+* Every `ChatModels` Gemini entry is named `gemini...` (see the GEMINI block above) - a prefix
+* check tracks that naming convention automatically as new Gemini models are added, unlike an
+* explicit id list that would need updating in lockstep and could silently miss one.
+*/
+const isGeminiModelId = (model) => model.startsWith("gemini");
+/**
 * Models that support the reasoning_effort parameter.
 * o1-preview and o1-mini do NOT support reasoning_effort.
 */
@@ -1369,6 +1381,12 @@ z$1.object({
 	ownerId: z$1.string(),
 	ownerType: z$1.enum(CreditHolderType),
 	sessionId: z$1.string().optional(),
+	/**
+	* Data lake this call is 1:1 attributable to (ingestion embeds only - a query
+	* embedding can span multiple lakes and is never attributed here). Unset for
+	* every other feature/call.
+	*/
+	dataLakeId: z$1.string().optional(),
 	feature: z$1.enum([
 		"chat",
 		"image_generation",
@@ -2108,6 +2126,37 @@ z$1.object({
 	createdAt: true,
 	updatedAt: true
 });
+z$1.object({
+	id: z$1.string().optional(),
+	/** UTC month, YYYY-MM. */
+	month: z$1.string().regex(/^\d{4}-\d{2}$/, "month must be YYYY-MM"),
+	/** Matches UsageEvent.provider values (e.g. "anthropic", "openai"). */
+	provider: z$1.string().min(1),
+	/** Provider-reported spend in USD for the month. */
+	providerUsd: z$1.number().finite().nonnegative(),
+	/** Our internal COGS estimate from UsageEvent aggregation. */
+	internalUsd: z$1.number().finite().nonnegative(),
+	/** providerUsd - internalUsd; positive = we underestimate. */
+	deltaUsd: z$1.number().finite(),
+	/** Absolute delta as a percentage of max(providerUsd, internalUsd) (0-100). */
+	deltaPct: z$1.number().finite().nonnegative(),
+	/** How the provider figure was obtained. */
+	source: z$1.enum([
+		"anthropic_admin_api",
+		"openai_usage_api",
+		"manual"
+	]),
+	/** Optional detail: per-key or per-model breakdown from the provider. */
+	providerBreakdown: z$1.record(z$1.string(), z$1.number()).optional(),
+	/** Human-readable note (error messages, partial data warnings, etc.). */
+	note: z$1.string().optional(),
+	createdAt: z$1.date(),
+	updatedAt: z$1.date()
+}).omit({
+	id: true,
+	createdAt: true,
+	updatedAt: true
+});
 z$1.object({
 	id: z$1.string().optional(),
 	ownerId: z$1.string(),
@@ -2184,6 +2233,76 @@ function isPlaceholderApiKey(value) {
 	if (!normalized) return true;
 	return PLACEHOLDER_API_KEY_REGEX.test(normalized);
 }
+z$1.object({
+	/**
+	* The granting lake's Mongo `_id`. ALWAYS a persisted DB lake: a hardcoded/fallback lake has no
+	* backing document to hang a grant on (its id is a human slug, never an ObjectId), so the write
+	* boundary refuses one via `assertLakeGrantable`. That is the explicit fallback carve-out issue
+	* #1667 calls for - enforced at the service layer, where the static registry is known, not here.
+	*/
+	dataLakeId: z$1.string(),
+	principalType: z$1.enum(["user", "organization"]),
+	/** The granted principal's id - a userId or an organizationId, per `principalType`. */
+	principalId: z$1.string(),
+	role: z$1.enum([
+		"owner",
+		"curator",
+		"reader"
+	]),
+	/** The actor (userId) who created the grant. */
+	grantedByUserId: z$1.string(),
+	/**
+	* Optional expiry for a time-boxed grant (trials, temporary internal collaborators,
+	* evaluations). A grant is expired once `expiresAt` is set and in the past. Expired rows are
+	* filtered at READ time by grant resolution (#1673) and are deliberately NOT swept from the
+	* collection, so an owner-facing membership view (#1672) and the audit trail (#1663) can still
+	* render a lapsed grant. Absent/null = never expires.
+	*
+	* Only meaningful for a principal INSIDE the lake's organization: membership never crosses
+	* organizations (epic decision 12), so this is not a cross-org mechanism.
+	*/
+	expiresAt: z$1.date().nullish()
+});
+/**
+* Every `IDataLake` field, classified as audited or not. A TOTAL map keyed by `keyof IDataLake`,
+* exactly like `LAKE_FIELD_VISIBILITY` in redactLakeForActor.ts and for the same reason: a list of
+* strings cannot notice an ABSENCE, so a new config field would simply never be audited and nobody
+* would find out. Keyed this way, a field added to the entity and classified nowhere is a COMPILE
+* error here, which is the only forcing function that actually works.
+*
+* `excluded` is for fields no operator chooses and which steer no answer: the content stats, the
+* teardown bookkeeping stamps, the cost meter and the lake-memory lease. They change constantly and
+* a history full of them would bury the changes that matter.
+*/
+const LAKE_CONFIG_FIELD_AUDIT = {
+	name: "audited",
+	slug: "audited",
+	description: "audited",
+	systemPrompt: "audited",
+	preferredSystemPromptId: "audited",
+	groundingMode: "audited",
+	requiredPassageTokenTarget: "audited",
+	fileTagPrefix: "audited",
+	datalakeTag: "audited",
+	requiredUserTag: "audited",
+	requiredEntitlement: "audited",
+	organizationId: "audited",
+	isPublic: "audited",
+	auditQueryTextEnabled: "audited",
+	status: "audited",
+	createdByUserId: "audited",
+	lastUpdatedByUserId: "excluded",
+	fileCount: "excluded",
+	totalSizeBytes: "excluded",
+	totalChunkedChars: "excluded",
+	embeddingSpendMicroUsd: "excluded",
+	lastSyncAt: "excluded",
+	filesDeletedAt: "excluded",
+	filesArchivedAt: "excluded",
+	lakeMemoryExtractionAt: "excluded",
+	lakeMemoryCursor: "excluded"
+};
+[...Object.keys(LAKE_CONFIG_FIELD_AUDIT).filter((field) => LAKE_CONFIG_FIELD_AUDIT[field] === "audited")];
 /**
 * SRE Agent Trio - Shared Types
 *
@@ -2982,6 +3101,66 @@ z.enum([
 	"xai",
 	"gemini"
 ]);
+z$1.object({
+	sessionId: z$1.string().nullish(),
+	message: z$1.string(),
+	organizationId: z$1.string().optional(),
+	model: z$1.string().optional(),
+	temperature: z$1.number().min(0).max(2).optional(),
+	max_tokens: z$1.number().positive().optional(),
+	maxTokens: z$1.number().positive().optional(),
+	maxOutputTokens: z$1.number().positive().optional(),
+	stream: z$1.boolean().prefault(false),
+	historyCount: z$1.number().positive().default(10),
+	fileIds: z$1.array(z$1.string()).prefault([]),
+	wait: z$1.boolean().prefault(false),
+	enableTools: z$1.boolean().prefault(false),
+	toolMode: z$1.enum(["fast", "smart"]).optional(),
+	tools: z$1.array(z$1.string()).optional(),
+	enableQuestMaster: z$1.boolean().optional(),
+	enableMementos: z$1.boolean().optional(),
+	enableAgents: z$1.boolean().optional(),
+	promptMode: z$1.enum([
+		"raw",
+		"grounded",
+		"surface"
+	]).optional(),
+	includePromptDetails: z$1.boolean().optional(),
+	includeSystemPrompt: z$1.boolean().optional()
+});
+z$1.object({
+	id: z$1.string(),
+	status: z$1.string(),
+	message_received: z$1.boolean(),
+	timestamp: z$1.string(),
+	model: z$1.string(),
+	message: z$1.string().optional(),
+	tracking_info: z$1.object({
+		quest_id: z$1.string(),
+		check_status_url: z$1.string(),
+		poll_url: z$1.string().optional()
+	})
+});
+/**
+* Reusable JSON error envelope (plain; the OpenAPI layer annotates it).
+*
+* Must stay in sync with the published `ErrorResponse` component
+* (../openapi/schemas.ts) - `openapi/errorEnvelopeParity.test.ts` pins the two
+* together, and apps/client's errorHandler test uses this shape as the stand-in for
+* the component, which is generate-time only and cannot be imported at runtime.
+*/
+const ApiErrorSchema = z$1.object({
+	error: z$1.string(),
+	request_id: z$1.string().optional(),
+	/**
+	* Deprecated, sunset 2026-12-01. The `name` of whatever was thrown - our own error
+	* classes usually, a library/driver class name on an unhandled 500 - added to every
+	* body by apps/client's errorHandler. Documented here so the runtime and the spec
+	* agree while it is still served; do not build on it. See CONVENTIONS.md section 1.
+	*/
+	name: z$1.string().optional()
+});
+ApiErrorSchema.extend({ errorCode: z$1.literal("insufficient_credits").optional() });
 const supportedVoiceGenerationVendor = z.enum(["openai", "elevenlabs"]);
 const voiceOutputFormatSchema = z.enum([
 	"mp3",
@@ -3010,6 +3189,49 @@ z.object({
 	languageCode: ttsLanguageCodeSchema.optional(),
 	preview: z.boolean().optional()
 });
+/**
+* Why a browsable copy of generated audio was not kept. Saving is best-effort and
+* never fatal (the caller was already billed for the bytes it is being handed), so
+* this is reported alongside a successful response rather than as an error.
+*
+* Must stay in sync with `PersistGeneratedAudioResult` in
+* apps/client/server/utils/persistGeneratedAudio.ts, which derives its `reason`
+* from this schema.
+*/
+const audioSaveSkippedReasonSchema = z.enum([
+	"storage_limit",
+	"file_too_large",
+	"error"
+]);
+z.object({
+	/** Base64-encoded audio payload. */
+	audio: z.string(),
+	format: voiceOutputFormatSchema,
+	contentType: z.string(),
+	saved: z.boolean().optional(),
+	fabFileId: z.string().optional(),
+	fileUrl: z.string().optional(),
+	saveSkippedReason: audioSaveSkippedReasonSchema.optional(),
+	/** The provider that actually produced the audio, present only on a fallback. */
+	provider: supportedVoiceGenerationVendor.optional(),
+	/** The originally requested provider that could not serve the request. */
+	fallbackFrom: supportedVoiceGenerationVendor.optional()
+});
+ApiErrorSchema.extend({
+	provider: supportedVoiceGenerationVendor.optional(),
+	errorCode: z.enum([
+		"insufficient_credits",
+		"provider_not_configured",
+		"provider_rejected"
+	]).optional()
+});
+z.object({
+	error: z.string(),
+	provider: supportedVoiceGenerationVendor,
+	saved: z.literal(true).optional(),
+	fabFileId: z.string().optional(),
+	fileUrl: z.string().optional()
+});
 z.enum(["openai"]);
 /**
 * Supported sound-effects generation vendors. Currently only ElevenLabs.
@@ -3939,6 +4161,7 @@ const HearthEventAction = z$1.object({
 		seq: z$1.number(),
 		actorId: z$1.string(),
 		actorName: z$1.string().optional(),
+		actorKind: actorKindSchema.optional(),
 		kind: hearthEventKindSchema,
 		human: z$1.object({
 			text: z$1.string(),
@@ -4516,50 +4739,6 @@ z$1.discriminatedUnion("action", [
 	PermissionRequestAction,
 	ReconnectResultAction
 ]);
-z$1.object({
-	sessionId: z$1.string().nullish(),
-	message: z$1.string(),
-	model: z$1.string().optional(),
-	temperature: z$1.number().min(0).max(2).optional(),
-	max_tokens: z$1.number().positive().optional(),
-	maxTokens: z$1.number().positive().optional(),
-	maxOutputTokens: z$1.number().positive().optional(),
-	stream: z$1.boolean().prefault(false),
-	historyCount: z$1.number().positive().default(10),
-	fileIds: z$1.array(z$1.string()).prefault([]),
-	wait: z$1.boolean().prefault(false),
-	enableTools: z$1.boolean().prefault(false),
-	toolMode: z$1.enum(["fast", "smart"]).optional(),
-	tools: z$1.array(z$1.string()).optional(),
-	enableQuestMaster: z$1.boolean().optional(),
-	enableMementos: z$1.boolean().optional(),
-	enableAgents: z$1.boolean().optional(),
-	promptMode: z$1.enum([
-		"raw",
-		"grounded",
-		"surface"
-	]).optional(),
-	includePromptDetails: z$1.boolean().optional(),
-	includeSystemPrompt: z$1.boolean().optional()
-});
-z$1.object({
-	id: z$1.string(),
-	status: z$1.string(),
-	message_received: z$1.boolean(),
-	timestamp: z$1.string(),
-	model: z$1.string(),
-	message: z$1.string().optional(),
-	tracking_info: z$1.object({
-		quest_id: z$1.string(),
-		check_status_url: z$1.string(),
-		poll_url: z$1.string().optional()
-	})
-});
-/** Reusable JSON error envelope (plain; the OpenAPI layer annotates it). */
-const ApiErrorSchema = z$1.object({
-	error: z$1.string(),
-	request_id: z$1.string().optional()
-});
 /**
 * Tool schema matching ICompletionOptionTools.toolSchema. The Zod surface only
 * covers wire-format fields (toolFn is server-side). Replaces the historical
@@ -4653,6 +4832,7 @@ const CompletionContentEventSchema = z$1.object({
 		"tool_use",
 		"best-effort"
 	]).optional(),
+	stopReason: z$1.string().optional(),
 	thinking: z$1.array(z$1.any()).optional()
 });
 const CompletionSseErrorEventSchema = z$1.object({
@@ -5231,7 +5411,7 @@ const BFL_SAFETY_TOLERANCE = {
 */
 const BFLSafetyToleranceSchema = z$1.number().min(BFL_SAFETY_TOLERANCE.MIN).max(BFL_SAFETY_TOLERANCE.LEGACY_INPUT_MAX).optional().prefault(BFL_SAFETY_TOLERANCE.DEFAULT).transform((value) => Math.min(value, BFL_SAFETY_TOLERANCE.MAX));
 /**
-* List of image models supported by BlackForest Labs
+* List of image models supported by Black Forest Labs
 */
 const BFL_IMAGE_MODELS = [
 	"flux-pro-1.1",
@@ -5532,6 +5712,32 @@ z$1.enum([
 	"complex"
 ]);
 z$1.preprocess((v) => Array.isArray(v) ? v.at(-1) : v, z$1.union([z$1.boolean(), z$1.string()])).prefault(false).transform((v) => ["true", "1"].includes(String(v).toLowerCase())).catch(false);
+const SessionTagSchema = z$1.object({
+	name: z$1.string(),
+	strength: z$1.number()
+});
+z$1.object({
+	name: z$1.string().min(1).optional(),
+	knowledgeIds: z$1.array(z$1.string()).optional(),
+	artifactIds: z$1.array(z$1.string()).optional(),
+	tags: z$1.array(SessionTagSchema).optional(),
+	lastUsedModel: z$1.string().min(1).nullish().describe("Pin a specific model id, or omit/send null to leave the current pin unchanged. Sending null does NOT clear it."),
+	forceKnowledgeRetrieval: z$1.boolean().optional(),
+	propagateToProjects: z$1.boolean().optional().describe("Defaults to true when omitted. When knowledgeIds grows, the newly-added file ids are also appended to every project that contains this session, granting every member of that project access to those files. This propagation is append-only and cannot be undone through the UI - pass false if newly-attached files should not be shared with the project.")
+});
+z$1.object({ id: z$1.string().min(1) });
+z$1.object({
+	id: z$1.string(),
+	name: z$1.string(),
+	userId: z$1.string(),
+	knowledgeIds: z$1.array(z$1.string()).optional(),
+	artifactIds: z$1.array(z$1.string()).optional(),
+	tags: z$1.array(SessionTagSchema).optional(),
+	forceKnowledgeRetrieval: z$1.boolean().optional(),
+	lastUsedModel: z$1.string().nullish(),
+	firstCreated: z$1.date(),
+	lastUpdated: z$1.date()
+});
 z$2.enum([
 	"",
 	"TFG",
@@ -5598,6 +5804,130 @@ z$2.object({
 	lastActiveAt: z$2.date().optional(),
 	isOnline: z$2.boolean()
 });
+/**
+* A chunk larger than this (in tokens) marks a file whose chunking predates the passage-target
+* fix: a whole-document / whole-section blob rather than a ~512-token passage. Used to detect the
+* files a lake "Rebuild passages" pass should re-chunk. Deliberately well above
+* DEFAULT_PASSAGE_TOKEN_TARGET (512) so a correctly-chunked passage never trips it, and below the
+* ~6.5K model-window packing the old chunker produced, so every legacy blob does.
+*/
+const OVERSIZED_PASSAGE_TOKEN_THRESHOLD = 1500;
+/**
+* `FabFile.notes` marker written when the data-lake convergence kill switch abandons a vectorize
+* (#1676). The file keeps its chunks but has no vectors, so it is unsearchable until re-indexed, and
+* it does NOT auto-resume.
+*
+* Lives here rather than beside its writer (apps/client fabFileVectorize) because it is a
+* cross-layer contract: the queue handler writes it and the lake-health evaluator
+* (constants/lakeHealth.ts) reads it to tell a permanently-stalled file from one still in flight.
+* b4m-core cannot import from apps/client, so a copy there would have to drift silently.
+*/
+const CONVERGENCE_PAUSED_NOTE = "Indexing paused by the data-lake convergence kill switch - reprocess to complete.";
+/**
+* `FabFile.notes` marker for the OTHER half of the same kill switch: a re-chunk dropped before it
+* ran (#1676/#1681). Distinct from `CONVERGENCE_PAUSED_NOTE` because the damage is worse and the
+* wording has to say so - the producer resets a wave's chunk state BEFORE the messages are handled,
+* so a file halted here has NO chunks at all rather than chunks without vectors.
+*
+* Without a marker this state is invisible to every surface at once, which is the failure it exists
+* to prevent: `chunkCount: 0` with `error: null` reads as an image or a pending upload, so health
+* drops it from the denominator, convergence grades it `conformant` (its stale stamp still matches),
+* search does not withhold it because it is not "in flight", and the rescue sweep's own filter
+* passes over it. The file's passages are simply gone and nothing reports it.
+*
+* Same cross-layer reason as the constant above for living here: the queue handler writes it and
+* b4m-core's evaluators read it, and b4m-core cannot import from apps/client.
+*/
+const CONVERGENCE_PAUSED_CHUNK_NOTE = "Re-chunking paused by the data-lake convergence kill switch - its passages were removed and are rebuilt when convergence resumes.";
+/**
+* `FabFile.chunkRebuildRequestedAt`: stamped by `resetChunkStateByIds` in the SAME write that
+* clears a file's chunk rollups, so "this file's passages are being rebuilt" can never be lost the
+* way the pair of steps that creates the state can be. The reset and the queue send are two
+* operations - kill the producer between them, or lose the consumer's marker write, and the file
+* sits at `chunkCount: 0` with `error: null` and `notes: ''`, a shape indistinguishable from an
+* image or a still-uploading row. It then drops out of lake health's denominator, out of the
+* convergence plan and out of the retrieval withhold at the same moment: every rollup says its
+* passages are gone, and nothing reports it.
+*
+* Deliberately NOT `CONVERGENCE_PAUSED_CHUNK_NOTE` pre-written by the producer, which is the obvious
+* fix and the wrong one: that marker means "halted, needs an administrator", so a file awaiting an
+* ORDINARY rebuild would read to every reader as permanently paused for the whole rebuild - search
+* would tell readers it does not return on its own, health would hard-fail P3, and "Rebuild
+* passages" would offer to repair a file that is already repairing. A flag that cries wolf on the
+* normal path is worse than the rare window it closes.
+*
+* So the two facts are distinct states, and the consumer UPGRADES one to the other: pending means
+* "in flight, returns on its own", the paused note means "halted, needs intervention". A LOST
+* upgrade therefore degrades to mislabelled-but-visible rather than invisible, which is the trade
+* this field exists to make - invisibility is the real harm, labelling is secondary.
+*
+* A dedicated field rather than a third `notes` string on purpose: `notes` already carries two
+* unrelated facts (the user's own note / NO_EXTRACTABLE_TEXT, and the kill-switch markers), so every
+* writer of it clobbers the others.
+*
+* Cleared by `commitFabFileChunks` (the rebuild landed) and by the chunk handler's pause write (the
+* rebuild was halted instead). A file carrying `error` is settled regardless - see
+* `isMemberIndexingInFlight`, which is where the precedence between these three lives.
+*/
+function isChunkRebuildPending(requestedAt) {
+	return requestedAt !== null && requestedAt !== void 0 && requestedAt !== "";
+}
+/**
+* Whether a file's `notes` marks it as stalled by the convergence kill switch, by either arm.
+* THE predicate every reader uses, so adding a third stall marker reaches health, convergence and
+* retrieval without three separate string comparisons drifting apart.
+*/
+function isConvergencePausedNote(notes) {
+	return CONVERGENCE_PAUSED_NOTES.includes(notes);
+}
+/**
+* Datastore mirror of `isConvergencePausedNote`, for a Mongo `notes: { $in: [...] }`. Exported so a
+* query and the in-memory predicate cannot drift: adding a third stall marker to this array reaches
+* both. Declared after the two constants it names so the function above can close over it.
+*/
+const CONVERGENCE_PAUSED_NOTES = [CONVERGENCE_PAUSED_NOTE, CONVERGENCE_PAUSED_CHUNK_NOTE];
+/** Ceiling so "adjustable" cannot mean "unbounded" in either direction. */
+const LAKE_ACCESS_AUDIT_RETENTION_MAX_DAYS = 2555;
+/**
+* Lake CONFIG-change audit retention and value caps.
+*
+* Twin of `constants/lakeAccessAudit.ts` and here for the same reason: the values are needed by
+* both the admin-settings schema in this package and by the repository that applies them
+* (`packages/database`, which cannot import an app-server layer).
+*
+* DELIBERATELY NOT the same numbers as the read audit, and deliberately not the same lever. A
+* retrieval is frequent, low-value and cheap to lose; a config change is rare, high-value and
+* alters every future answer the lake gives, so the two want opposite retention. Folding config
+* changes into the read collection would force one of them onto the other's clock - either a
+* config change expiring on a read-volume schedule, or a high-volume collection's storage
+* multiplied to serve a low-volume need.
+*
+* Same one-way ratchet as the read side (#1658's levers rule): `resolveLakeConfigAuditRetentionDays`
+* can only raise a configured value to the floor, never lower it, so an org cannot configure its
+* own retention down to nothing and defeat the control. Platform-level, not per-org: the setting
+* carries no `scope.settableAt`, so #1660's resolver returns the platform value at every scope.
+*/
+/** 3 years: long enough to outlive a typical contract and audit cycle, on a collection whose
+* volume is a few rows per lake per year. Longer than the read audit's 450 days on purpose - the
+* rarer and more consequential the event, the longer it is worth keeping. */
+const LAKE_CONFIG_AUDIT_RETENTION_FLOOR_DAYS = 1095;
+/** A separate constant from the floor on purpose, even though they agree today - a future change
+* to one must not silently move the other. */
+const LAKE_CONFIG_AUDIT_RETENTION_DEFAULT_DAYS = 1095;
+/** Ceiling so "adjustable" cannot mean "unbounded" in either direction. */
+const LAKE_CONFIG_AUDIT_RETENTION_MAX_DAYS = 3650;
+/**
+* Forced-retrieval budget defaults, shared between the admin-settings schema in this package and
+* `ChatCompletionFeatures.ts` (which cannot import from `common`'s settings schema without a
+* dependency cycle, so the constant lives here instead).
+*
+* Only `FORCED_RETRIEVAL_CHAR_BUDGET_DEFAULT` is a lever (see the `forcedRetrievalCharBudget`
+* setting) - the char budget is the measured binding constraint on how much of a corpus reaches
+* the model on every Data-Lake-mode turn. The relevance floor is exported alongside it so the two
+* stay next to each other, not because it is tunable today.
+*/
+/** Total characters of retrieved chunk text injected into a forced-retrieval prompt. */
+const FORCED_RETRIEVAL_CHAR_BUDGET_DEFAULT = 12e3;
 let OpenAIEmbeddingModel = /* @__PURE__ */ function(OpenAIEmbeddingModel) {
 	OpenAIEmbeddingModel["TEXT_EMBEDDING_3_SMALL"] = "text-embedding-3-small";
 	OpenAIEmbeddingModel["TEXT_EMBEDDING_3_LARGE"] = "text-embedding-3-large";
@@ -5742,11 +6072,15 @@ const HELP_CENTER_PROMPT = `HELP CENTER: Bike4Mind has a built-in Help Center th
 *
 * Counterweight to the completeness pressure the rest of the system prompt applies: without an
 * explicit licence to abstain, the model treats "answer fully" as unconditional and fills gaps with
-* invented specifics about the user or their data. Measured as the single largest quality gain on
-* questions whose correct answer is a refusal, so it ships on every completion rather than only on
-* the grounded surfaces. Kept short on purpose - it must be cheap and behaviorally light.
+* invented specifics - including a named customer, competitor, deal or dollar figure a leading
+* question implied but no source supports, volunteered with citation-like framing so it reads as
+* sourced. In internal evaluation (a harness kept outside this repo) this was among the largest
+* quality gains on questions whose correct answer is a refusal, so it ships on every completion
+* rather than only on the grounded surfaces (it is also the only surface covering a turn that
+* answers WITHOUT searching the knowledge base). Kept short
+* on purpose - it must be cheap and behaviorally light.
 */
-const ABSTENTION_PROMPT = `When a request is underspecified or your sources do not cover it, say so and name what is missing. "I do not have enough to answer that" is a correct, high-value answer. Never invent facts about the user, their business, or their data.`;
+const ABSTENTION_PROMPT = `When a request is underspecified or your sources do not cover it, say so and name what is missing. "I do not have enough to answer that" is a correct, high-value answer. Never invent facts about the user, their business, or their data, and never state a specific customer, competitor, deal, or figure as fact - or cite a source for it - unless your sources support it, even when the question assumes it.`;
 /**
 * Default text for the formatting system message. Runtime fallback used by
 * `includeHardcodedSystemMessage` (b4m-core/utils/src/llm/utils.ts) when the `FormatPromptTemplate`
@@ -5800,8 +6134,14 @@ z$1.enum([
 	"EnableDataLakes",
 	"EnableDataLakesDefault",
 	"EnableDataLakeSlackAdd",
+	"EnableDataLakeGroundingMode",
 	"EnableLakeMemory",
 	"EnableDataLakeVectorSearch",
+	"PauseLakeConvergence",
+	"LakeConvergenceBulkChangeSharePct",
+	"EnforceLakeReadGrants",
+	"EnableDataLakeDrivePoll",
+	"EnforceLakeAdmission",
 	"EnableBriefcase",
 	"EnableBriefcaseDefault",
 	"EnableImageTemplates",
@@ -5827,6 +6167,7 @@ z$1.enum([
 	"ReferralCreditsAmount",
 	"registrationLink",
 	"FeedbackReceiveEmail",
+	"FeedbackReceiveEmailNonProd",
 	"FeedbackKyle",
 	"EnableFeedBackToEmail",
 	"EnableFeedBackToSlack",
@@ -5892,6 +6233,22 @@ z$1.enum([
 	"defaultEmbeddingModel",
 	"dataLakeSearchMaxFiles",
 	"dataLakeSearchMaxChunks",
+	"forcedRetrievalCharBudget",
+	"kbSearchDefaultResults",
+	"kbSearchResultTokenBudget",
+	"kbSearchMinRelevancePct",
+	"dataLakeEmbeddingSpendEnabled",
+	"dataLakeEmbeddingBudgetPerRunUsd",
+	"dataLakeEmbeddingBudgetPerLakeUsd",
+	"dataLakeEmbeddingBudgetPerPeriodUsd",
+	"dataLakeEmbeddingBudgetPeriodHours",
+	"dataLakeEmbeddingMaxCallsPerMinute",
+	"dataLakeVectorizeChunkBatchSize",
+	"dataLakeEmbeddingTierMultiplierIndividual",
+	"dataLakeEmbeddingTierMultiplierOrganization",
+	"LakeAccessAuditRetentionDays",
+	"LakeAccessQueryTextRetentionDays",
+	"LakeConfigAuditRetentionDays",
 	"MaxContentLength",
 	"enableAutoChunk",
 	"SlackDefaultWebhookUrl",
@@ -5899,6 +6256,7 @@ z$1.enum([
 	"SlackLiveopsWebhookUrl",
 	"SlackUserActivityWebhookUrl",
 	"SlackFeedbackWebhookUrl",
+	"SlackNonProdFeedbackWebhookUrl",
 	"SlackEmailAuditWebhookUrl",
 	"slackSigningSecret",
 	"slackBotToken",
@@ -5960,7 +6318,11 @@ z$1.enum([
 	"modelDiscoveryAutoEnable",
 	"modelDiscoveryAllowEgress",
 	"modelDiscoveryPriceBandPct",
-	"modelDiscoveryAutoRemap"
+	"modelDiscoveryAutoRemap",
+	"prReportRepo",
+	"prReportIdentityMap",
+	"prReportWebhookUrl",
+	"prReportEgressAllowlist"
 ]);
 /**
 * Intent-classifier sub-config. Drives the LLM-based silent
@@ -6077,6 +6439,9 @@ function makeStringSetting(config) {
 */
 const DATA_LAKE_SEARCH_MAX_FILES_DEFAULT = 5e3;
 const DATA_LAKE_SEARCH_MAX_CHUNKS_DEFAULT = 1e5;
+const DATA_LAKE_EMBEDDING_BUDGET_PER_LAKE_USD_MAX = 1e4;
+const DATA_LAKE_EMBEDDING_BUDGET_PER_PERIOD_USD_MAX = 5e3;
+const DATA_LAKE_EMBEDDING_MAX_CALLS_PER_MINUTE_MAX = 1e4;
 function makeNumberSetting(config) {
 	let numberSchema = z$1.coerce.number();
 	if (config.min !== void 0) numberSchema = numberSchema.min(config.min);
@@ -6665,6 +7030,66 @@ const API_SERVICE_GROUPS = {
 			{
 				key: "dataLakeSearchMaxChunks",
 				order: 3
+			},
+			{
+				key: "forcedRetrievalCharBudget",
+				order: 4
+			},
+			{
+				key: "kbSearchDefaultResults",
+				order: 5
+			},
+			{
+				key: "kbSearchResultTokenBudget",
+				order: 6
+			},
+			{
+				key: "kbSearchMinRelevancePct",
+				order: 7
+			}
+		]
+	},
+	DATA_LAKE_COST: {
+		id: "dataLakeCostGovernance",
+		name: "Data Lake Cost Governance",
+		description: "Spend levers for data-lake embedding work (ingestion, reprocessing, convergence). Budgets are USD; 0 means stop spending, not \"use the default\". The two tier multipliers scale the per-run and per-lake budgets by whether a lake is individual- or organization-owned.",
+		icon: "Savings",
+		settings: [
+			{
+				key: "dataLakeEmbeddingSpendEnabled",
+				order: 1
+			},
+			{
+				key: "dataLakeEmbeddingBudgetPerRunUsd",
+				order: 2
+			},
+			{
+				key: "dataLakeEmbeddingBudgetPerLakeUsd",
+				order: 3
+			},
+			{
+				key: "dataLakeEmbeddingBudgetPerPeriodUsd",
+				order: 4
+			},
+			{
+				key: "dataLakeEmbeddingBudgetPeriodHours",
+				order: 5
+			},
+			{
+				key: "dataLakeEmbeddingMaxCallsPerMinute",
+				order: 6
+			},
+			{
+				key: "dataLakeVectorizeChunkBatchSize",
+				order: 7
+			},
+			{
+				key: "dataLakeEmbeddingTierMultiplierIndividual",
+				order: 8
+			},
+			{
+				key: "dataLakeEmbeddingTierMultiplierOrganization",
+				order: 9
 			}
 		]
 	},
@@ -6913,6 +7338,14 @@ const API_SERVICE_GROUPS = {
 				key: "SlackEmailAuditWebhookUrl",
 				order: 6.5
 			},
+			{
+				key: "SlackFeedbackWebhookUrl",
+				order: 6.75
+			},
+			{
+				key: "SlackNonProdFeedbackWebhookUrl",
+				order: 6.8
+			},
 			{
 				key: "FeedbackSendEmailUsername",
 				order: 7
@@ -6925,6 +7358,10 @@ const API_SERVICE_GROUPS = {
 				key: "FeedbackReceiveEmail",
 				order: 9
 			},
+			{
+				key: "FeedbackReceiveEmailNonProd",
+				order: 9.5
+			},
 			{
 				key: "liveFeedbackEmail",
 				order: 10
@@ -7437,6 +7874,26 @@ const API_SERVICE_GROUPS = {
 				order: 3
 			}
 		]
+	},
+	DATA_LAKE_AUDIT: {
+		id: "dataLakeAuditService",
+		name: "Data Lake Audit",
+		description: "Retention for the lake audit trail: who READ a lake (plus the opt-in query-text log) and who CHANGED its configuration",
+		icon: "Security",
+		settings: [
+			{
+				key: "LakeAccessAuditRetentionDays",
+				order: 1
+			},
+			{
+				key: "LakeAccessQueryTextRetentionDays",
+				order: 2
+			},
+			{
+				key: "LakeConfigAuditRetentionDays",
+				order: 3
+			}
+		]
 	}
 };
 const settingsMap = {
@@ -7541,13 +7998,23 @@ const settingsMap = {
 	EnableDataLakeSlackAdd: makeBooleanSetting({
 		key: "EnableDataLakeSlackAdd",
 		name: "Data Lakes: Slack \"@datalake add\" path",
-		defaultValue: false,
-		description: "Server-side gate for adding content to a Data Lake from Slack via \"@datalake add\". Off by default - the Slack command is intercepted deterministically but performs no ingest until this is turned on.",
+		defaultValue: true,
+		description: "Server-side gate for adding content to a Data Lake from Slack via \"@datalake add\". On by default. Turn OFF to make the Slack command inert - it is still intercepted deterministically, so the bot stays silent rather than falling through to the LLM.",
 		category: "Experimental",
 		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
 		order: 90,
 		dependsOn: "EnableDataLakes"
 	}),
+	EnableDataLakeGroundingMode: makeBooleanSetting({
+		key: "EnableDataLakeGroundingMode",
+		name: "Data Lakes: Per-lake grounding mode",
+		defaultValue: true,
+		description: "Global rollback lever for the per-lake grounding mode (inline vs retrieve vs auto-by-size). On by default. Turn OFF to ignore every lake's configured mode and fall back to pure size-only corpus deferral (CorpusRetrievalMinInlineTokensPerDoc), reverting the retrieve-by-default behavior for all lakes at once without editing each lake.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 92,
+		dependsOn: "EnableDataLakes"
+	}),
 	EnableLakeMemory: makeBooleanSetting({
 		key: "EnableLakeMemory",
 		name: "Data Lakes: Lake memory profile (extraction)",
@@ -7568,6 +8035,72 @@ const settingsMap = {
 		order: 92,
 		dependsOn: "EnableDataLakes"
 	}),
+	PauseLakeConvergence: makeBooleanSetting({
+		key: "PauseLakeConvergence",
+		name: "Data Lakes: Pause background convergence work",
+		defaultValue: false,
+		description: "Kill switch for background data-lake ingestion work (convergence sweeps, rescue re-chunking) - NOT real-time user uploads, which are always honored. Off by default. Turn ON to halt in-flight background chunk/vectorize messages the next time the handler picks them up (a re-check inside the shared handler, so it takes effect on work already queued, not just the next scheduling pass). The platform value pauses every lake at once; a per-lake (or per-org / per-owner) override pauses a subset while the rest keep running. A platform-level flip applies immediately to lake-wide work and within ~5 min to per-lake-scoped work (settings cache).",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 93,
+		dependsOn: "EnableDataLakes",
+		scope: { settableAt: [
+			"organization",
+			"owner",
+			"lake"
+		] }
+	}),
+	LakeConvergenceBulkChangeSharePct: makeNumberSetting({
+		key: "LakeConvergenceBulkChangeSharePct",
+		name: "Data Lakes: Convergence bulk-change confirmation threshold (%)",
+		defaultValue: 25,
+		min: 1,
+		max: 100,
+		description: "Share of a data lake, as a percentage of its gradable members, above which owner-triggered convergence (#1681) requires an explicit confirmation before it rewrites anything. A mass rewrite is the signature of a misconfigured chunk policy, and every individual change inside one looks locally reasonable, so the share is the only place the mistake is visible. The guard is suppressed on lakes with fewer gradable members than the plan needs for a percentage to mean anything. Lower it to make convergence ask more often; it never blocks a confirmed run.",
+		category: "AI",
+		order: 4,
+		dependsOn: "EnableDataLakes",
+		scope: { settableAt: [
+			"organization",
+			"owner",
+			"lake"
+		] }
+	}),
+	EnforceLakeReadGrants: makeBooleanSetting({
+		key: "EnforceLakeReadGrants",
+		name: "Data Lakes: Enforce read-time grant resolution",
+		defaultValue: false,
+		description: "Read-time grant cutover (#1673). OFF by default = report-only: the read gate resolves a persisted READER/org grant into an ephemeral membership view and logs where it WOULD change access ([lakeReadGrantCutover] lines), but the enforced decision stays the legacy owner/org/tag/entitlement/public rule so no one gains or loses access. NOTE: turning this ON is currently a NO-OP guarded by a source-level interlock (READ_GRANT_ENFORCEMENT_READY) - enforcement will not activate until the follow-up code (member-management write path + retrieval arm) lands and flips it, and a premature toggle just logs a warning and stays report-only. This is deliberate so the setting cannot half-enable a half-wired gate. Platform altitude on purpose: a one-time install-wide migration cutover, not a per-lake lever. Tag and entitlement grants always resolve live and are never affected by this flag; only persisted reader/org rows are gated by it.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 94,
+		dependsOn: "EnableDataLakes"
+	}),
+	EnableDataLakeDrivePoll: makeBooleanSetting({
+		key: "EnableDataLakeDrivePoll",
+		name: "Data Lakes: Google Drive auto re-sync poll",
+		defaultValue: false,
+		description: "Server-side gate for the scheduled poll that keeps connected Google Drive folders in sync with their data lakes (adds/edits/removals). Off by default - a connected folder still syncs on demand via the Re-sync button; turn this on to also reconcile it automatically on a schedule.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 95,
+		dependsOn: "EnableDataLakes"
+	}),
+	EnforceLakeAdmission: makeBooleanSetting({
+		key: "EnforceLakeAdmission",
+		name: "Data Lakes: Enforce the admission contract",
+		defaultValue: false,
+		description: "Retrievability contract at admission (#1680). OFF by default = report-only: a file whose chunks cannot honor the chunk policy a lake REQUIRES is logged as quarantined ([admission] lines) but still joins the lake, exactly as today. ON refuses the membership write instead, so unretrievable content never becomes a member and no embedding spend is incurred for it; the caller gets an error naming the required and actual passage targets. Enforcement applies to NEW memberships only - files already in a lake are never evicted, and no query is ever blocked on lake health, which is advisory permanently. Turn this on only after the lake health report shows how many members would be refused. The lake rung is the one that matters (a lake enforces its own contract); the org and owner rungs enforce across every lake in that scope at once. A flip is not instantaneous: the settings cache is per-instance, so it applies immediately on the instance that served the change and within ~5 min (one cache TTL) everywhere else - an upload that still succeeds right after turning this on is stale cache, not a broken lever.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 96,
+		dependsOn: "EnableDataLakes",
+		scope: { settableAt: [
+			"organization",
+			"owner",
+			"lake"
+		] }
+	}),
 	EnableBriefcase: makeBooleanSetting({
 		key: "EnableBriefcase",
 		name: "Enable Briefcase",
@@ -7790,9 +8323,14 @@ const settingsMap = {
 		name: "Default Chunk Size",
 		defaultValue: 512,
 		min: 64,
-		description: "Passage target in TOKENS for splitting large documents. The DEFAULT matches the chunker; a value stored here overrides it, and a stored value larger than the chunker default makes the UI reprocess path produce coarser chunks than /api/files/reprocess. Coarser chunks measurably worsen retrieval.",
+		max: OVERSIZED_PASSAGE_TOKEN_THRESHOLD,
+		description: "Passage target in TOKENS for splitting large documents. The DEFAULT matches the chunker; a value stored here overrides it, and a stored value larger than the chunker default makes the UI reprocess path produce coarser chunks than /api/files/reprocess. Coarser chunks measurably worsen retrieval, and values above the under-chunked detection threshold also stop \"Rebuild passages\" converging, so the accepted range is capped there. Resolves at file-OWNER altitude: an org/individual owner may pin their own default above the platform value; a data lake does NOT override it (epic decision 7) - a lake declares the policy it REQUIRES and a file that cannot satisfy every lake it belongs to is reported as a conflict rather than silently re-chunked.",
 		category: "AI",
-		order: 3
+		order: 3,
+		scope: {
+			settableAt: ["organization", "owner"],
+			clamp: (value) => Math.min(Math.max(Math.floor(value), 64), OVERSIZED_PASSAGE_TOKEN_THRESHOLD)
+		}
 	}),
 	ModerationEnabled: makeBooleanSetting({
 		key: "ModerationEnabled",
@@ -7836,7 +8374,7 @@ const settingsMap = {
 		key: "AbstentionPrompt",
 		name: "Abstention Prompt",
 		defaultValue: ABSTENTION_PROMPT,
-		description: "Short system prompt licensing the model to say \"I do not have enough to answer that\" and to name what is missing instead of inventing facts about the user or their data. Injected on every chat completion. Live-editable; clearing it reverts to the built-in default.",
+		description: "Short system prompt licensing the model to say \"I do not have enough to answer that\" and to name what is missing instead of inventing facts about the user or their data. Injected on every chat completion. Live-editable; clearing it reverts to the built-in default. After an upgrade, diff a saved copy against that default: a saved copy pins the wording from whenever it was saved and will not pick up fixes made since.",
 		category: "AI",
 		order: 11
 	}),
@@ -7962,6 +8500,15 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.FEEDBACK.id,
 		order: 9
 	}),
+	FeedbackReceiveEmailNonProd: makeStringSetting({
+		key: "FeedbackReceiveEmailNonProd",
+		name: "Non-Production Feedback Email",
+		defaultValue: "",
+		description: "Comma-separated recipient list for feedback submitted from every non-production stage (dev, staging, previews). Does not apply to a self-host install, which routes through FeedbackReceiveEmail like production. Leave empty to suppress non-production email entirely - it never falls back to the production recipient list.",
+		category: "Feedback",
+		group: API_SERVICE_GROUPS.FEEDBACK.id,
+		order: 9.5
+	}),
 	FeedbackKyle: makeStringSetting({
 		key: "FeedbackKyle",
 		name: "Kyle Feedback Email",
@@ -8036,7 +8583,17 @@ const settingsMap = {
 		description: "The webhook URL for sending feedback to the #bike4mind-feedback Slack channel.",
 		category: "Feedback",
 		group: API_SERVICE_GROUPS.FEEDBACK.id,
-		order: 7,
+		order: 6.75,
+		isSensitive: true
+	}),
+	SlackNonProdFeedbackWebhookUrl: makeStringSetting({
+		key: "SlackNonProdFeedbackWebhookUrl",
+		name: "Non-Production Feedback Channel Webhook URL",
+		defaultValue: "",
+		description: "Incoming-webhook URL that receives feedback submitted from every non-production stage (dev, staging, previews). Does not apply to a self-host install, which routes through SlackFeedbackWebhookUrl like production. Leave empty to suppress non-production feedback entirely - it never falls back to the production feedback channel.",
+		category: "Feedback",
+		group: API_SERVICE_GROUPS.FEEDBACK.id,
+		order: 6.8,
 		isSensitive: true
 	}),
 	SlackEmailAuditWebhookUrl: makeStringSetting({
@@ -8643,9 +9200,9 @@ const settingsMap = {
 	}),
 	bflApiKey: makeStringSetting({
 		key: "bflApiKey",
-		name: "BlackForest Labs API Key",
+		name: "Black Forest Labs API Key",
 		defaultValue: "",
-		description: "The API Key for BlackForest Labs image generation service.",
+		description: "The API Key for Black Forest Labs image generation service.",
 		isSensitive: true,
 		category: "AI",
 		group: API_SERVICE_GROUPS.IMAGE_GENERATION.id,
@@ -8673,7 +9230,12 @@ const settingsMap = {
 		description: "Most files one data-lake semantic search will scope. Beyond this the search reports itself as truncated rather than silently ignoring the rest. Raising it well past a few thousand also deepens the paging offset, so prefer reporting truncation over a very large value.",
 		category: "AI",
 		group: API_SERVICE_GROUPS.EMBEDDING.id,
-		order: 2
+		order: 2,
+		scope: { settableAt: [
+			"organization",
+			"owner",
+			"lake"
+		] }
 	}),
 	dataLakeSearchMaxChunks: makeNumberSetting({
 		key: "dataLakeSearchMaxChunks",
@@ -8683,8 +9245,190 @@ const settingsMap = {
 		description: "Most chunk vectors one data-lake semantic search will score. Raising it trades query latency for coverage; lowering it makes truncation more likely (and reported).",
 		category: "AI",
 		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 3,
+		scope: { settableAt: [
+			"organization",
+			"owner",
+			"lake"
+		] }
+	}),
+	forcedRetrievalCharBudget: makeNumberSetting({
+		key: "forcedRetrievalCharBudget",
+		name: "Forced Retrieval Char Budget",
+		defaultValue: FORCED_RETRIEVAL_CHAR_BUDGET_DEFAULT,
+		min: 1e3,
+		max: 1e5,
+		description: "Total characters of retrieved chunk text injected into a Data-Lake-mode turn. Measured saturating on every turn against a 47-document lake, so this is the binding constraint on how much of a corpus reaches the model - not the relevance floor. Raising it admits more passages at the cost of prompt tokens and latency on every Data-Lake turn; it is NOT automatically better, since more context can dilute ranking. Platform-only for now: this read does not go through the scoped-settings resolver, so a `settableAt` block here would be inert metadata at best and could arm the resolver's fail-loud owner check at worst.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 4
+	}),
+	kbSearchDefaultResults: makeNumberSetting({
+		key: "kbSearchDefaultResults",
+		name: "Knowledge Base Search Default Results",
+		defaultValue: 5,
+		min: 1,
+		max: 10,
+		description: "Passages the search_knowledge_base tool returns when a model call omits max_results, which is most calls. This is the exact bound while kbSearchResultTokenBudget is unset (0). Once a token budget is set, it takes over as the primary bound for search results (this setting's own value is then unused there, though it still governs the keyword-search fallback, and the count served if token pricing itself fails). Does NOT raise the tool's hard ceiling of 10 passages per call - a model that reads max_results up to 10 from its own tool schema won't ask for more than that regardless of this setting.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 5,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
+	kbSearchResultTokenBudget: makeNumberSetting({
+		key: "kbSearchResultTokenBudget",
+		name: "Knowledge Base Search Result Token Budget",
+		defaultValue: 0,
+		min: 0,
+		max: 2e4,
+		description: "Approximate tokens of served passage TEXT (post-trim, post-clip - what the model actually receives, not the raw stored chunk) the search_knowledge_base tool may return in one call. Counted with a fixed tokenizer as a proxy, not billed against any specific model. Replaces a passage count as the primary bound once set, since it is invariant to chunk size - a lake chunked smaller no longer silently returns less material for the same setting. 0 (default) disables it: search_knowledge_base then serves exactly kbSearchDefaultResults passages, unchanged from before this setting existed. The FIRST matching passage is always returned even if it alone exceeds the budget - a search that found something never returns nothing.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 6,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
+	kbSearchMinRelevancePct: makeNumberSetting({
+		key: "kbSearchMinRelevancePct",
+		name: "Knowledge Base Search Minimum Relevance (%)",
+		defaultValue: 0,
+		min: 0,
+		max: 100,
+		description: "Minimum cosine relevance, as a percent, a passage must clear to be returned by search_knowledge_base. 0 (default) matches current behavior (no relevance floor beyond a non-negative cosine score). Raising it lets breadth adapt per query - a narrow question can return fewer, more relevant passages instead of always padding out to the configured count. Cosine similarity is not comparable across embedding models: a floor tuned for one model can filter out an entire alternate model, when a lake mixes embedding models, more aggressively than intended. Start low and raise gradually while watching the tool's own retrieval-skipped notices.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 7,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
+	LakeAccessAuditRetentionDays: makeNumberSetting({
+		key: "LakeAccessAuditRetentionDays",
+		name: "Lake Access Audit Retention (days)",
+		defaultValue: 450,
+		min: 450,
+		max: LAKE_ACCESS_AUDIT_RETENTION_MAX_DAYS,
+		description: "How long a lake access audit event (who read a lake, and when) is retained, in days. Has a floor of 450 days (12 months live plus a Type II observation tail) - this is a platform-wide value, not per-organization, until a scoped settings resolver exists. Applies only to events written after a change: expiresAt is computed once at write time and is immutable, so raising or lowering this value never affects rows already recorded.",
+		category: "SecOps",
+		group: API_SERVICE_GROUPS.DATA_LAKE_AUDIT.id,
+		order: 1
+	}),
+	LakeAccessQueryTextRetentionDays: makeNumberSetting({
+		key: "LakeAccessQueryTextRetentionDays",
+		name: "Lake Access Query Text Retention (days)",
+		defaultValue: 30,
+		min: 1,
+		max: 90,
+		description: "How long the opt-in query-text log (the natural-language question behind a lake retrieval) is retained, in days. Always resolved shorter than the audit event retention itself, regardless of this value, since the query text is more sensitive than the event metadata. Applies only to events written after a change - already-recorded rows keep the expiry computed at write time and are not retroactively shortened or extended.",
+		category: "SecOps",
+		group: API_SERVICE_GROUPS.DATA_LAKE_AUDIT.id,
+		order: 2
+	}),
+	LakeConfigAuditRetentionDays: makeNumberSetting({
+		key: "LakeConfigAuditRetentionDays",
+		name: "Lake Config Change Audit Retention (days)",
+		defaultValue: LAKE_CONFIG_AUDIT_RETENTION_DEFAULT_DAYS,
+		min: LAKE_CONFIG_AUDIT_RETENTION_FLOOR_DAYS,
+		max: LAKE_CONFIG_AUDIT_RETENTION_MAX_DAYS,
+		description: "How long a lake CONFIG-change event (who changed a lake, what they changed, and which manage rung authorized it) is retained, in days. Floored at 1095 days - deliberately longer than the access-audit retention above, because a config change is rare and alters every future answer the lake gives, where a read is one turn. Platform-wide, not per-organization, until a scoped settings resolver exists.",
+		category: "SecOps",
+		group: API_SERVICE_GROUPS.DATA_LAKE_AUDIT.id,
 		order: 3
 	}),
+	dataLakeEmbeddingSpendEnabled: makeBooleanSetting({
+		key: "dataLakeEmbeddingSpendEnabled",
+		name: "Data Lake Embedding Spend Enabled",
+		defaultValue: true,
+		description: "Master switch for data-lake embedding spend (ingestion, reprocessing, convergence). Off halts all provider embedding calls on those paths; cached embeddings still apply.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 1
+	}),
+	dataLakeEmbeddingBudgetPerRunUsd: makeNumberSetting({
+		key: "dataLakeEmbeddingBudgetPerRunUsd",
+		name: "Embedding Budget Per Run (USD)",
+		defaultValue: 5,
+		min: 0,
+		max: 500,
+		description: "Most USD one ingestion/reprocess run (upload batch) may spend on embedding calls. 0 stops runs from spending at all.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 2
+	}),
+	dataLakeEmbeddingBudgetPerLakeUsd: makeNumberSetting({
+		key: "dataLakeEmbeddingBudgetPerLakeUsd",
+		name: "Embedding Budget Per Lake (USD)",
+		defaultValue: 100,
+		min: 0,
+		max: DATA_LAKE_EMBEDDING_BUDGET_PER_LAKE_USD_MAX,
+		description: "Most USD one data lake may spend on embedding calls over its lifetime. 0 stops all spend for every lake.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 3
+	}),
+	dataLakeEmbeddingBudgetPerPeriodUsd: makeNumberSetting({
+		key: "dataLakeEmbeddingBudgetPerPeriodUsd",
+		name: "Embedding Budget Per Period (USD)",
+		defaultValue: 50,
+		min: 0,
+		max: DATA_LAKE_EMBEDDING_BUDGET_PER_PERIOD_USD_MAX,
+		description: "Most USD the whole platform may spend on data-lake embedding calls per rolling period (see the period-hours setting). 0 stops all spend.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 4
+	}),
+	dataLakeEmbeddingBudgetPeriodHours: makeNumberSetting({
+		key: "dataLakeEmbeddingBudgetPeriodHours",
+		name: "Embedding Budget Period (hours)",
+		defaultValue: 24,
+		min: 1,
+		max: 720,
+		description: "Length of the per-period budget window in hours. Not a spend value itself, so 0 is not meaningful here (min 1).",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 5
+	}),
+	dataLakeEmbeddingMaxCallsPerMinute: makeNumberSetting({
+		key: "dataLakeEmbeddingMaxCallsPerMinute",
+		name: "Embedding Max Calls Per Minute",
+		defaultValue: 120,
+		min: 0,
+		max: DATA_LAKE_EMBEDDING_MAX_CALLS_PER_MINUTE_MAX,
+		description: "Most provider embedding API calls per minute across all data-lake work. The real throttle in front of the embed call (the queue concurrency in infra is a deploy-time constant, not this lever). 0 stops all calls.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 6
+	}),
+	dataLakeVectorizeChunkBatchSize: makeNumberSetting({
+		key: "dataLakeVectorizeChunkBatchSize",
+		name: "Vectorize Chunk Batch Size",
+		defaultValue: 50,
+		min: 1,
+		max: 500,
+		description: "How many chunks the chunk handler packs into one vectorize-queue message. Smaller batches smooth the fan-out; not a spend value, so min 1.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 7
+	}),
+	dataLakeEmbeddingTierMultiplierIndividual: makeNumberSetting({
+		key: "dataLakeEmbeddingTierMultiplierIndividual",
+		name: "Cost Tier Multiplier - Individual-Owned Lakes",
+		defaultValue: 1,
+		min: 0,
+		max: 100,
+		description: "Scales the per-run and per-lake embedding budgets for lakes owned by an individual user. 1 means those lakes get exactly the configured budgets; 0 stops them spending at all. The effective budget is still capped by the same hard rail as the untiered value.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 8
+	}),
+	dataLakeEmbeddingTierMultiplierOrganization: makeNumberSetting({
+		key: "dataLakeEmbeddingTierMultiplierOrganization",
+		name: "Cost Tier Multiplier - Organization-Owned Lakes",
+		defaultValue: 5,
+		min: 0,
+		max: 100,
+		description: "Scales the per-run and per-lake embedding budgets for lakes owned by an organization, which serve a whole team rather than one person. 0 stops org-owned lakes spending at all. The effective budget is still capped by the same hard rail as the untiered value.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 9
+	}),
 	slackSigningSecret: makeStringSetting({
 		key: "slackSigningSecret",
 		name: "Slack Signing Secret",
@@ -9393,6 +10137,40 @@ const settingsMap = {
 		category: "AI",
 		group: API_SERVICE_GROUPS.MODEL_DISCOVERY.id,
 		order: 6
+	}),
+	prReportRepo: makeStringSetting({
+		key: "prReportRepo",
+		name: "PR Report Repository",
+		defaultValue: "",
+		description: "The `owner/repo` whose open pull requests the PR status digest reports on. Validated against an anchored GitHub repo grammar before it is interpolated into any authenticated outbound URL (SSRF guard) - a value with an empty or `..` segment is rejected.",
+		category: "Admin",
+		order: 141
+	}),
+	prReportIdentityMap: makeStringSetting({
+		key: "prReportIdentityMap",
+		name: "PR Report Identity Map",
+		defaultValue: "",
+		description: "Maps GitHub logins and synthetic role keys (`qa_*`, `devops_*`, `reviewer_*`) to Slack member IDs, one mapping per line. Accepts `key value`, `key=value` or `key: value`; blank and `#` comment lines are ignored. Values must be real Slack member IDs - display names do not produce notification mentions.",
+		category: "Admin",
+		order: 142
+	}),
+	prReportWebhookUrl: makeStringSetting({
+		key: "prReportWebhookUrl",
+		name: "PR Report Slack Webhook URL",
+		defaultValue: "",
+		isSensitive: true,
+		description: "Slack Incoming Webhook URL the PR status digest posts to (https://hooks.slack.com/services/...). It already encodes its channel and workspace, so no bot token or channel ID is needed to send. Bearer-equivalent: anyone holding it can post to the channel, so it is stored encrypted and never returned to the browser.",
+		category: "Slack",
+		order: 143
+	}),
+	prReportEgressAllowlist: makeObjectSetting({
+		key: "prReportEgressAllowlist",
+		name: "PR Report Egress Allowlist",
+		defaultValue: { hosts: ["hooks.slack.com"] },
+		description: "Hosts the PR digest may post to, checked against the webhook URL its own hostname. FAILS CLOSED: an empty list rejects every send rather than degrading to allow-any, because the post body carries PR titles, author logins and the staffing implied by the role rosters. Slack incoming webhooks live at hooks.slack.com, so that is the default.",
+		category: "Slack",
+		order: 144,
+		schema: z$1.object({ hosts: z$1.array(z$1.string()).default([]) })
 	})
 };
 /**
@@ -9781,6 +10559,7 @@ const PromptMetaTokenUsageSchema = z$1.object({
 	actualOutputTokens: z$1.number().optional(),
 	actualTotalTokens: z$1.number().optional(),
 	cacheReadInputTokens: z$1.number().optional(),
+	cacheCreationInputTokens: z$1.number().optional(),
 	settledBasis: z$1.enum(["provider", "local"]).optional(),
 	estimatedCost: z$1.number().optional(),
 	creditsUsed: z$1.number().optional()
@@ -9980,10 +10759,67 @@ const CitableSourceSchema = z$1.object({
 		fullContext: z$1.string().optional()
 	}).optional()
 });
+/**
+* Per-turn retrieval outcome (#1867): whether retrieval was attempted this turn and what happened,
+* independent of whether the model then cited anything. Exists specifically to make the zero case
+* distinguishable from "never asked" - `context.lakeMemory` and `citables` both go silent on a
+* zero-result retrieval, so a turn that legitimately found nothing is indistinguishable from one
+* where retrieval never ran at all.
+*
+* Deliberately holds NO counts and NO chunk/document identifiers. Counts already exist and are
+* more precise: `citables.filter(c => c.type === 'document')` is deduped by id/url/title in
+* `applyQuestStatusChanges`, while this shape cannot dedupe (no identifiers to dedupe by) and
+* would have to sum - producing a second, disagreeing number for the same question. Similarity
+* scores live on `LakeAccessEvent`, not here.
+*
+* CAUTION, not a guarantee: the absence of chunk/document identifiers is what keeps this shape
+* OUT of `promptMetaRedaction.ts`'s scope (that helper is a functionCalls-only denylist and would
+* not catch a nested nonidentifier field like `dataLakeTags` regardless). It does NOT mean this
+* field never needs redaction consideration - `dataLakeTags` (which lakes were involved) already
+* reaches non-owner viewers the same way `lakeMemory.dataLakeTags` does (session shares, feedback
+* egress, admin logs, session clone - see redactedFeedback.ts, admin/model-logs.ts, clone.ts, none
+* of which touch this field). That exposure is not new in the general case, but it IS new
+* specifically on a zero-recall turn: `lakeMemory` was never written there before this field
+* existed, so a turn that previously carried no lake-identity signal at all now carries one.
+*
+* `attempted`/`outcome` on their own would still be ambiguous about WHICH lakes were searched on a
+* zero-recall turn (dataLakeTags otherwise lives only inside `lakeMemory`, written after the
+* zero-belief return), so this stamps the resolved tags at write time rather than making a reader
+* fall back to the session's current (possibly since-changed) `retrievalTags`.
+*
+* Absent-or-fully-present, matching `lakeMemory` above - see the Mongoose-side subSchema comment
+* in QuestModel.ts for why partial-write and default-array shapes are unsafe here.
+*/
+const RetrievalSummarySchema = z$1.object({
+	/** True once a retrieval-capable surface actually ran (not merely offered) this turn. */
+	attempted: z$1.boolean(),
+	/**
+	* 'ok' - ran, whether or not anything came back (the zero case is a legitimate 'ok').
+	* 'no_lakes' - ran but the user had no entitled/selected lake in scope.
+	* 'failed' - threw; recall did not complete.
+	* On multiple retrieval calls within one turn, merge priority is failed > ok > no_lakes (see
+	* retrievalSummaryMerge.ts's mergeRetrievalSummary): a single failure is never masked by a later
+	* success or abstain, and a real success on one surface is never masked by another surface's
+	* "no lakes in scope" abstain in the same turn.
+	*/
+	outcome: z$1.enum([
+		"ok",
+		"no_lakes",
+		"failed"
+	]),
+	/** Which retrieval-capable surface(s) ran this turn, e.g. 'lake-memory', 'knowledgeBaseSearch'. */
+	surfaces: z$1.array(z$1.string()),
+	/** Lakes resolved at the moment retrieval ran, stamped point-in-time (not read live from the session). */
+	dataLakeTags: z$1.array(z$1.string())
+});
 z$1.object({
 	model: PromptMetaModelSchema.optional(),
 	tokenUsage: PromptMetaTokenUsageSchema.optional(),
 	context: PromptMetaContextSchema.optional(),
+	/** Per-turn retrieval outcome - see RetrievalSummarySchema. Top-level (not under `context`)
+	* deliberately: applyQuestStatusChanges does a one-level spread merge, so a field nested under
+	* `context` would be replaced wholesale by any tool-arm write instead of merging. */
+	retrieval: RetrievalSummarySchema.optional(),
 	functionCalls: z$1.array(PromptMetaFunctionCallSchema).optional(),
 	/**
 	* Names of the tools actually offered to the model this turn - the output of `buildTools`
@@ -10594,6 +11430,24 @@ z$1.object({
 */
 const DATALAKE_TAG_PREFIX = "datalake:";
 /**
+* How a lake's attached corpus is grounded into a chat turn, as a DELIBERATE per-lake product
+* choice rather than a side effect of who is asking (see IDataLake.groundingMode):
+* - `inline`: paste the corpus into the prompt (never defer to the search tool).
+* - `retrieve`: leave the corpus to the offered search_knowledge_base tool (always defer the
+*   tool-retrievable subset), so an owner and an entitlement-only reader ground identically.
+* - `auto-by-size`: keep the size heuristic - defer only when the per-doc even-split inline depth
+*   falls below the `CorpusRetrievalMinInlineTokensPerDoc` floor (see shouldDeferCorpusToRetrieval).
+*
+* The resolution seam is create-time (resolveLakeSessionDefaults -> session.corpusGroundingMode);
+* the enforcement seam is the completion-path defer plan. Keep this tuple and DataLakeGroundingMode
+* as the single source both the Zod schema and the Mongoose enum derive from.
+*/
+const DATA_LAKE_GROUNDING_MODES = [
+	"inline",
+	"retrieve",
+	"auto-by-size"
+];
+/**
 * True when a would-be `fileTagPrefix` sits inside the `datalake:` namespace, which holds every
 * lake's membership meta-tag. Such a prefix would make one lake's content prefix match other
 * lakes' membership tags. Shared by the create schema and the wizard's client-side gate so the
@@ -10613,7 +11467,16 @@ const INVISIBLE_INK = /\u115F|\u1160|\u17B4|\u17B5|\u2800|\u3164|\uFFA0/g;
 const hasBlankTagPrefixSegment = (prefix) => {
 	return (prefix.endsWith(":") ? prefix.slice(0, -1) : prefix).split(":").some((part) => !/[\p{L}\p{N}\p{P}\p{S}\p{M}]/u.test(part.replace(INVISIBLE_INK, "")));
 };
-[...(() => {
+const DATA_LAKE_SLUG_REGEX = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+const DATA_LAKES = [{
+	id: "opti-knowledge",
+	slug: "opti-knowledge",
+	name: "Optimization Knowledge Base",
+	requiredUserTag: "Opti",
+	requiredEntitlement: "optihashi:pro",
+	fileTagPrefix: "opti:",
+	datalakeTag: "datalake:opti-knowledge"
+}, ...(() => {
 	const raw = process.env.NEXT_PUBLIC_PREMIUM_DATA_LAKES;
 	if (!raw) return [];
 	try {
@@ -10623,6 +11486,7 @@ const hasBlankTagPrefixSegment = (prefix) => {
 		return [];
 	}
 })()];
+new Set(DATA_LAKES.map((l) => l.id));
 /**
 * Canonical normalization for entitlement keys + `requiredEntitlement` values - the ONE
 * rule, applied at write time (create/update/stamp) and at match time. Mirrors the
@@ -10630,11 +11494,10 @@ const hasBlankTagPrefixSegment = (prefix) => {
 * casing matches the lowercase keys the resolver produces.
 */
 const normalizeEntitlementKey = (key) => key.trim().toLowerCase();
-const slugRegex = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 const sha256Regex = /^[a-f0-9]{64}$/;
 z.object({
 	name: z.string().min(1).max(200),
-	slug: z.string().min(2).max(60).regex(slugRegex, "Slug must be lowercase alphanumeric with hyphens (e.g. \"my-data-lake\")"),
+	slug: z.string().min(2).max(60).regex(DATA_LAKE_SLUG_REGEX, "Slug must be lowercase alphanumeric with hyphens (e.g. \"my-data-lake\")"),
 	description: z.string().max(2e3).optional(),
 	fileTagPrefix: z.string().trim().min(2).max(30).refine((s) => s.endsWith(":"), "Tag prefix must end with \":\" (e.g. \"acme:\")").refine((s) => !hasBlankTagPrefixSegment(s), "Tag prefix segments must be non-empty (e.g. \"acme:\" or \"acme:legal:\")").refine((s) => !isReservedTagPrefix(s), `Tag prefix cannot use the reserved "${DATALAKE_TAG_PREFIX}" namespace`),
 	requiredUserTag: z.string().min(1).max(100).optional(),
@@ -10646,8 +11509,16 @@ z.object({
 	description: z.string().max(2e3).optional(),
 	systemPrompt: z.string().optional(),
 	preferredSystemPromptId: z.union([z.literal(""), z.string().min(1).max(200)]).optional(),
+	groundingMode: z.enum(DATA_LAKE_GROUNDING_MODES).optional(),
 	requiredUserTag: z.union([z.literal(""), z.string().min(1).max(100)]).optional(),
-	requiredEntitlement: z.union([z.literal(""), z.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")")]).optional()
+	requiredEntitlement: z.union([z.literal(""), z.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")")]).optional(),
+	auditQueryTextEnabled: z.boolean().optional(),
+	requiredPassageTokenTarget: z.number().int().min(64).max(OVERSIZED_PASSAGE_TOKEN_THRESHOLD).nullable().optional()
+});
+z.object({
+	groundingMode: z.enum(DATA_LAKE_GROUNDING_MODES).optional(),
+	preferredSystemPromptId: z.union([z.literal(""), z.string().min(1).max(200)]).optional(),
+	systemPrompt: z.string().optional()
 });
 z.object({
 	organizationId: z.string().optional(),
@@ -10834,6 +11705,45 @@ z$1.object({
 }).omit({ model: true }).partial();
 z$1.union([ToolExecutionResponseSchema, ApiErrorSchema]);
 /**
+* Response details shared by the endpoints that return generated audio as raw
+* bytes (music, sound effects). Not a contract - just the pieces both of their
+* contracts declare, kept in one place so the published media types and headers
+* cannot describe one endpoint and not the other.
+*/
+/**
+* Every Content-Type the ElevenLabs generators map an `output_format` token to
+* (`contentTypeForFormat` in ElevenLabsMusicGenerator / ElevenLabsSoundGenerator).
+* The first entry is the default (mp3); the rest are declared as alternates.
+* Must stay in sync with those two mappings.
+*/
+const GENERATED_AUDIO_CONTENT_TYPES = [
+	"audio/mpeg",
+	"audio/opus",
+	"audio/L16",
+	"audio/basic",
+	"application/octet-stream"
+];
+/**
+* Where the browsable copy of the generated audio ended up. These are the ONLY
+* channel for that information on these endpoints: the body is raw audio, so a
+* caller that wants the saved file has nowhere else to read it from.
+*/
+const GENERATED_AUDIO_SAVE_HEADERS = {
+	"X-B4M-Audio-Saved": "Whether a browsable copy was saved to the file browser (\"true\"/\"false\").",
+	"X-B4M-Audio-Fab-File-Id": "Id of the saved file. Present only when the copy was saved.",
+	"X-B4M-Audio-File-Name": "File name of the saved copy. Present only when the copy was saved.",
+	"X-B4M-Audio-File-Url": "Signed URL for the saved copy, minted at creation. Use this rather than re-resolving the file via GET /api/files/{id}, which fails closed until the async moderation scan completes."
+};
+/** The 200 response body of a raw-audio endpoint: default media type plus alternates. */
+const generatedAudioBody = () => ({
+	contentType: GENERATED_AUDIO_CONTENT_TYPES[0],
+	alsoReturns: GENERATED_AUDIO_CONTENT_TYPES.slice(1).map((contentType) => ({ contentType })),
+	headers: GENERATED_AUDIO_SAVE_HEADERS
+});
+({ ...generatedAudioBody() });
+({ ...generatedAudioBody() });
+z$1.enum(["user", "convergence"]).optional().catch(void 0), z$1.string().optional();
+/**
 * Blessed, self-hosted artifact library script paths (root-relative).
 *
 * Single source of truth shared across the artifact pipeline:
@@ -10937,6 +11847,10 @@ OpenAIImageGenerationInput.extend({
 	aspect_ratio: z$1.string().optional(),
 	fabFileIds: z$1.array(z$1.string()).prefault([]),
 	tools: z$1.array(z$1.union([b4mLLMTools, z$1.string()])).optional(),
+	safety_tolerance: BFLSafetyToleranceSchema,
+	prompt_upsampling: z$1.boolean().optional(),
+	seed: z$1.number().nullable().optional(),
+	output_format: z$1.enum(["jpeg", "png"]).nullable().optional(),
 	/** Resolved by the API route's prompt resolver. Defaults to 'fresh' for first-turn or sessions with no prior image. */
 	intent: PromptIntentSchema.optional(),
 	promptEnhancement: z$1.object({
@@ -11130,6 +12044,12 @@ z$1.object({
 	}).optional()
 });
 const MCP_PROVIDER_METADATA = {
+	notion: { defaultToolDescriptions: {
+		notion_search: "Search for pages and databases in the connected Notion workspace by text query. Returns matching page titles, IDs, and URLs.",
+		notion_create_page: "Create a new page in the connected Notion workspace. Requires write access to be enabled. The page is created under the configured root page or a specified parent.",
+		notion_read_page: "Read the content of a Notion page by its ID. Returns the child blocks (text, headings, lists, etc.) and a plain-text summary. Results are paginated; pass start_cursor with the returned next_cursor when has_more is true.",
+		notion_append_blocks: "Append content blocks (paragraphs, headings, lists, code, etc.) to an existing Notion page or block. Requires write access."
+	} },
 	atlassian: { defaultToolDescriptions: {
 		confluence_get_page: "Retrieve a Confluence page by ID or search by title within a space. Include page metadata and optional content.",
 		confluence_create_page: "Create a new Confluence page. Automatically uses your personal space when spaceId is omitted - no need to call confluence_get_current_user first.",
@@ -11575,6 +12495,7 @@ z$1.object({
 	reason: ReportReasonSchema,
 	details: z$1.string().max(2e3).optional()
 });
+const PublishTagsSchema = z$1.array(z$1.string().max(60)).max(20);
 z$1.object({
 	/** Short opaque id for short URLs (`/p/r/{publicId}`, `/p/f/{publicId}`) and lookups. */
 	publicId: z$1.string(),
@@ -11583,6 +12504,11 @@ z$1.object({
 	slug: SlugSchema,
 	title: z$1.string().min(1).max(200),
 	description: z$1.string().max(1e3).optional(),
+	/** Freeform owner-supplied labels, normalized by normalizePublishTags. Shares a vocabulary
+	*  with AppFile tags (see GET /api/publish/tags) so one label means one thing across the app,
+	*  but stored per artifact rather than in a central tag table - there is no tag entity to keep
+	*  in sync, and a tag nobody uses simply stops appearing. */
+	tags: PublishTagsSchema.prefault([]),
 	visibility: VisibilitySchema.prefault("private"),
 	/** Group id a viewer must belong to when gated cross-scope. */
 	gatedToGroupId: z$1.string().optional(),
@@ -11668,6 +12594,9 @@ z$1.object({
 	title: z$1.string().min(1).max(200),
 	description: z$1.string().max(1e3).optional(),
 	visibility: VisibilitySchema.optional(),
+	/** Optional at publish time so a client that already knows its labels - the CLI publish
+	*  skill - can set them in the same call instead of a follow-up PATCH. */
+	tags: PublishTagsSchema.optional(),
 	gatedToGroupId: z$1.string().optional(),
 	/** Who may annotate the published artifact. Defaults to `none` (read-only). */
 	commentPolicy: CommentPolicySchema.optional(),
@@ -11908,6 +12837,32 @@ function isModelAccessible(model, userTags, isAdmin = false, entitlementKeys = [
 	const normalizedAllowedEntitlements = (model.allowedEntitlements ?? []).map(normalizeEntitlementKey);
 	return normalizedKeys.some((key) => normalizedAllowedEntitlements.includes(key));
 }
+[...OPENAI_IMAGE_MODELS, ...GEMINI_IMAGE_MODELS];
+/** Generation was cut off against the output-token ceiling. */
+const TRUNCATED_FINISH_REASON = "max_tokens";
+/**
+* We aborted the stream ourselves because it degenerated into repetition
+* (`DEGENERATE_STREAM_STOP_REASON` in `@bike4mind/llm-adapters`). Distinct from
+* `max_tokens` because the useful advice differs: telling a user to continue is actively
+* wrong here, since resuming from a degenerated tail tends to reproduce the loop.
+*/
+const DEGENERATE_FINISH_REASON = "degenerate_repetition";
+/**
+* Every reason meaning "this reply stopped early". Membership rather than equality with a
+* single literal, so a newly-added early-stop reason surfaces a notice automatically.
+*/
+const EARLY_STOP_FINISH_REASONS = /* @__PURE__ */ new Set([TRUNCATED_FINISH_REASON, DEGENERATE_FINISH_REASON]);
+/**
+* Whether a reply stopped early, given the reason reported for it.
+*
+* An ABSENT reason is NOT an early stop. Plenty of paths never report one (a backend whose
+* complete() leaves it unset, an older server, a non-terminal chunk), and treating silence
+* as truncation would cry wolf on every one of them. Only a reason we recognize as an
+* early stop counts - an unrecognized value is left alone rather than guessed at.
+*/
+function isEarlyStop(stopReason) {
+	return !!stopReason && EARLY_STOP_FINISH_REASONS.has(stopReason);
+}
 /**
 * Trigger-word validation, shared between client form and server agent
 * endpoints so the validation rules can't drift.
@@ -12517,9 +13472,9 @@ Array.from(new Set([
 		requiresAdmin: true
 	},
 	{
-		id: "admin.feedbacks",
+		id: "admin.feedback",
 		section: "admin",
-		label: "Feedbacks",
+		label: "Feedback",
 		description: "View and manage user feedback, bug reports, and feature requests",
 		navigationType: "tab",
 		target: "2",
@@ -13540,7 +14495,7 @@ const CliConfigSchema = z$1.object({
 	}).optional(),
 	mcpServers: McpServersSchema,
 	preferences: z$1.object({
-		maxTokens: z$1.number(),
+		maxTokens: z$1.number().optional(),
 		temperature: z$1.number(),
 		autoSave: z$1.boolean(),
 		autoCompact: z$1.boolean().optional().prefault(true),
@@ -13635,10 +14590,27 @@ const ProjectLocalConfigSchema = z$1.object({
 	sandbox: PartialSandboxConfigSchema
 });
 /**
+* The output budget every pre-migration config was born with, back when
+* `preferences.maxTokens` was required and DEFAULT_CONFIG supplied this value. It is
+* indistinguishable from a user who deliberately typed 4096, and the migration reverts
+* it either way - acceptable only because the cleanup runs ONCE (see CONFIG_SCHEMA_VERSION):
+* a user who wanted 4096 sets it again and keeps it, while an install that never chose it
+* stops being capped by it. A value-keyed rule with no marker would instead make 4096
+* permanently unrepresentable, even though the /config select still offers it.
+*/
+const LEGACY_PINNED_MAX_TOKENS = 4096;
+/**
+* Schema version of the on-disk config, and the marker that makes the migrations in
+* `load()` one-time. A file stamped with anything else gets the upgrade pass and is
+* rewritten at the current version; a file already at it is left alone. Bump this when
+* adding a migration, and gate the new step on the version it needs to run from.
+*/
+const CONFIG_SCHEMA_VERSION = "0.2.0";
+/**
 * Default configuration
 */
 const DEFAULT_CONFIG = {
-	version: "0.1.0",
+	version: CONFIG_SCHEMA_VERSION,
 	userId: v4(),
 	defaultModel: ChatModels.CLAUDE_4_5_SONNET,
 	toolApiKeys: {
@@ -13647,7 +14619,6 @@ const DEFAULT_CONFIG = {
 	},
 	mcpServers: [],
 	preferences: {
-		maxTokens: 4096,
 		temperature: .7,
 		autoSave: true,
 		autoCompact: true,
@@ -13927,6 +14898,13 @@ var ConfigStore = class {
 					if (oldApiConfig.environment === "custom" && oldApiConfig.customUrl) rawConfig.apiConfig = { customUrl: oldApiConfig.customUrl };
 					else rawConfig.apiConfig = {};
 				}
+				if (rawConfig.version !== CONFIG_SCHEMA_VERSION) {
+					if (rawConfig.preferences?.maxTokens === LEGACY_PINNED_MAX_TOKENS) delete rawConfig.preferences.maxTokens;
+					rawConfig.version = CONFIG_SCHEMA_VERSION;
+					try {
+						await promises.writeFile(this.configPath, JSON.stringify(rawConfig, null, 2), "utf-8");
+					} catch {}
+				}
 				const validated = CliConfigSchema.parse(rawConfig);
 				const normalizedMcpServers = normalizeMcpServers(validated.mcpServers);
 				globalConfig = {
@@ -14357,4 +15335,4 @@ var ConfigStore = class {
 	}
 };
 //#endregion
-export { WORK_ITEM_STATUSES as $, HttpStatus as A, usdToCredits as At, REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS as B, DEFAULT_MUSIC_MODEL_ID as C, mapMimeTypeToArtifactType as Ct, FORMAT_PROMPT_TEMPLATE as D, settingsMap as Dt, FIXED_TEMPERATURE_MODELS as E, secureParameters as Et, NO_TEMPERATURE_MODELS as F, isNearLimit as Ft, SupportedFabFileMimeTypes as G, REFUSAL_FALLBACK_MODELS as H, NotFoundError as I, parseRateLimitHeaders as It, UnauthorizedError as J, TTS_MAX_INPUT_CHARS as K, OllamaEmbeddingModel as L, InternalServerError as M, withRetry as Mt, MODEL_INFO_FIELD_GROUP_OF as N, buildRateLimitLogEntry as Nt, ForbiddenError as O, toModelInfo as Ot, ModelBackend as P, extractSnippetMeta as Pt, VoyageAIEmbeddingModel as Q, OpenAIEmbeddingModel as R, CorruptedFileError as S, isZodError as St, FIELD_GROUP_OF as T, resolveHistoryFetchLimit as Tt, RESPONSES_API_TOOL_MODELS as U, REASONING_SUPPORTED_MODELS as V, SpeechToTextModels as W, VIDEO_SIZE_CONSTRAINTS as X, UnprocessableEntityError as Y, VideoModels as Z, BadRequestError as _, isRenderableModelType as _t, getCreditsUrl as a, getQuestErrorCode as at, CREDIT_DEDUCT_TRANSACTION_TYPES as b, isUnlimitedHistory as bt, requireApiUrl as c, isFieldGroup as ct, AGENT_QUEST_MANIFEST as d, isImageAttachment as dt, applyModelPriceCatalog as et, AGENT_QUEST_MCP_URI as f, isImageServeable as ft, BFL_SAFETY_TOLERANCE as g, isPlaceholderApiKey as gt, BEDROCK_NO_PROMPT_CACHING_MODELS as h, isModelDeprecated as ht, LOCAL_DEV_URL as i, getMcpProviderMetadata as it, ImageModels as j, usdToCreditsStochastic as jt, HTTPError as k, toModelRecord as kt, resolveApiEndpoint as l, isGPTImage2Model as lt, ApiKeyType as m, isModelAccessible as mt, logger as n, dayjsConfig_default as nt, getEnvironmentName as o, getRetryAfterMs as ot, ARTIFACT_ATTRS_PATTERN as p, isMediaModelType as pt, TooManyRequestsError as q, ApiEndpointUnconfiguredError as r, defaultEmbeddingModelForEnv as rt, parseApiUrl as s, isAudioMimeType as st, ConfigStore as t, calculateRetryDelay as tt, AGENT_QUEST_ID as u, isGPTImageModel as ut, BedrockEmbeddingModel as v, isRetryableError as vt, DEFAULT_UNKNOWN_CONTEXT_WINDOW as w, obfuscateApiKey as wt, ChatModels as x, isUserInitiatedAbort as xt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as y, isSupportedFabFileMimeType as yt, PermissionDeniedError as z };
+export { VoyageAIEmbeddingModel as $, HTTPError as A, resolveHistoryFetchLimit as At, PermissionDeniedError as B, isNearLimit as Bt, DEFAULT_MUSIC_MODEL_ID as C, isRetryableError as Ct, FIXED_TEMPERATURE_MODELS as D, isZodError as Dt, FIELD_GROUP_OF as E, isUserInitiatedAbort as Et, ModelBackend as F, usdToCredits as Ft, SpeechToTextModels as G, REASONING_SUPPORTED_MODELS as H, NO_TEMPERATURE_MODELS as I, usdToCreditsStochastic as It, TooManyRequestsError as J, SupportedFabFileMimeTypes as K, NotFoundError as L, withRetry as Lt, ImageModels as M, settingsMap as Mt, InternalServerError as N, toModelInfo as Nt, FORMAT_PROMPT_TEMPLATE as O, mapMimeTypeToArtifactType as Ot, MODEL_INFO_FIELD_GROUP_OF as P, toModelRecord as Pt, VideoModels as Q, OllamaEmbeddingModel as R, buildRateLimitLogEntry as Rt, CorruptedFileError as S, isRenderableModelType as St, DEGENERATE_FINISH_REASON as T, isUnlimitedHistory as Tt, REFUSAL_FALLBACK_MODELS as U, REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS as V, parseRateLimitHeaders as Vt, RESPONSES_API_TOOL_MODELS as W, UnprocessableEntityError as X, UnauthorizedError as Y, VIDEO_SIZE_CONSTRAINTS as Z, BadRequestError as _, isImageServeable as _t, getCreditsUrl as a, getMcpProviderMetadata as at, CREDIT_DEDUCT_TRANSACTION_TYPES as b, isModelDeprecated as bt, requireApiUrl as c, isAudioMimeType as ct, AGENT_QUEST_MANIFEST as d, isEarlyStop as dt, WORK_ITEM_STATUSES as et, AGENT_QUEST_MCP_URI as f, isFieldGroup as ft, BFL_SAFETY_TOLERANCE as g, isImageAttachment as gt, BEDROCK_NO_PROMPT_CACHING_MODELS as h, isGeminiModelId as ht, LOCAL_DEV_URL as i, defaultEmbeddingModelForEnv as it, HttpStatus as j, secureParameters as jt, ForbiddenError as k, obfuscateApiKey as kt, resolveApiEndpoint as l, isChunkRebuildPending as lt, ApiKeyType as m, isGPTImageModel as mt, logger as n, calculateRetryDelay as nt, getEnvironmentName as o, getQuestErrorCode as ot, ARTIFACT_ATTRS_PATTERN as p, isGPTImage2Model as pt, TTS_MAX_INPUT_CHARS as q, ApiEndpointUnconfiguredError as r, dayjsConfig_default as rt, parseApiUrl as s, getRetryAfterMs as st, ConfigStore as t, applyModelPriceCatalog as tt, AGENT_QUEST_ID as u, isConvergencePausedNote as ut, BedrockEmbeddingModel as v, isMediaModelType as vt, DEFAULT_UNKNOWN_CONTEXT_WINDOW as w, isSupportedFabFileMimeType as wt, ChatModels as x, isPlaceholderApiKey as xt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as y, isModelAccessible as yt, OpenAIEmbeddingModel as z, extractSnippetMeta as zt };