@bike4mind/cli 0.20.1 → 0.21.0

package/dist/{ConfigStore-CNfbeaJf.mjs → ConfigStore-CoY0l0gr.mjs}

@@ -7,7 +7,6 @@ import path from "path";
 import { v4 } from "uuid";
 import * as z$2 from "zod";
 import z, { ZodError, z as z$1 } from "zod";
-import { actorKindSchema, hearthEventKindSchema, hearthEventRefsSchema, hearthMachineBodySchema } from "@bike4mind/hearth";
 import dayjs from "dayjs";
 import timezone from "dayjs/plugin/timezone.js";
 import utc from "dayjs/plugin/utc.js";
@@ -52,7 +51,7 @@ const extractSnippetMeta = (content) => {
 	}
 	return { sections };
 };
-function getHeader(headers, name) {
+function getHeader$1(headers, name) {
 	if (!headers || typeof headers !== "object") return null;
 	if (typeof headers.get === "function") {
 		const val = headers.get(name);
@@ -76,10 +75,10 @@ function parseNumber(value) {
 * - `Retry-After` - seconds to wait (on 429 responses), or an HTTP-date
 */
 function parseRateLimitHeaders(headers) {
-	const limitStr = getHeader(headers, "X-RateLimit-Limit") ?? getHeader(headers, "x-ratelimit-limit");
-	const remainingStr = getHeader(headers, "X-RateLimit-Remaining") ?? getHeader(headers, "x-ratelimit-remaining");
-	const resetStr = getHeader(headers, "X-RateLimit-Reset") ?? getHeader(headers, "x-ratelimit-reset");
-	const retryAfterStr = getHeader(headers, "Retry-After") ?? getHeader(headers, "retry-after");
+	const limitStr = getHeader$1(headers, "X-RateLimit-Limit") ?? getHeader$1(headers, "x-ratelimit-limit");
+	const remainingStr = getHeader$1(headers, "X-RateLimit-Remaining") ?? getHeader$1(headers, "x-ratelimit-remaining");
+	const resetStr = getHeader$1(headers, "X-RateLimit-Reset") ?? getHeader$1(headers, "x-ratelimit-reset");
+	const retryAfterStr = getHeader$1(headers, "Retry-After") ?? getHeader$1(headers, "retry-after");
 	const limit = parseNumber(limitStr);
 	const remaining = parseNumber(remainingStr);
 	let resetAt = null;
@@ -110,13 +109,6 @@ function parseRateLimitHeaders(headers) {
 		usagePercent
 	};
 }
-/**
-* Check whether the current rate limit usage is near the threshold.
-*
-* @param info - Parsed rate limit info
-* @param thresholdPercent - Usage percentage threshold (default: 80)
-* @returns true if usage is at or above the threshold
-*/
 function isNearLimit(info, thresholdPercent = 80) {
 	if (info.usagePercent === null) return false;
 	return info.usagePercent >= thresholdPercent;
@@ -140,6 +132,151 @@ function buildRateLimitLogEntry(integration, endpoint, info, wasThrottled = fals
 	};
 }
 //#endregion
+//#region ../../b4m-core/hearth/dist/index.mjs
+/**
+* Zod validation for data crossing the Hearth boundary (API routes, CLI
+* tools, gateways). Must stay in sync with the types in types.ts.
+*/
+const actorKindSchema = z$1.enum([
+	"human",
+	"agent",
+	"gateway",
+	"device",
+	"system"
+]);
+/**
+* The kinds a caller may claim FOR ITSELF. 'human' and 'system' are reserved:
+* the human actor is derived from the authenticated session, never from a
+* request body, so no credential can post an event that renders as the account
+* owner. Claiming one of these three is a downgrade in trust, not a spoof.
+*
+* Single source for both self-identification paths - the actor override and the
+* per-session kind (see HearthActorParamSchema / HearthSessionParamSchema in
+* the client's hearthWire) - so the reserved set cannot drift between them.
+*/
+const selfClaimedActorKindSchema = z$1.enum([
+	"agent",
+	"gateway",
+	"device"
+]);
+const hearthEventKindSchema = z$1.enum([
+	"message",
+	"edit",
+	"reaction",
+	"artifact",
+	"presence",
+	"delegation",
+	"quest.update",
+	"gate.request",
+	"gate.resolve",
+	"system"
+]);
+const hearthHumanBodySchema = z$1.object({
+	text: z$1.string().min(1),
+	format: z$1.enum(["md", "text"])
+});
+const hearthMachineBodySchema = z$1.object({
+	schema: z$1.string().min(1),
+	payload: z$1.unknown()
+});
+const hearthEventRefsSchema = z$1.object({
+	threadRootId: z$1.string().min(1).optional(),
+	replyToId: z$1.string().min(1).optional(),
+	questId: z$1.string().min(1).optional(),
+	externalId: z$1.string().min(1).optional()
+});
+z$1.object({
+	channelId: z$1.string().min(1),
+	actorId: z$1.string().min(1),
+	kind: hearthEventKindSchema,
+	human: hearthHumanBodySchema,
+	machine: hearthMachineBodySchema.optional(),
+	refs: hearthEventRefsSchema
+});
+/** djb2. Deterministic across processes and restarts, which is the whole point. */
+function hashOf(value) {
+	let hash = 5381;
+	for (let i = 0; i < value.length; i++) hash = (hash << 5) + hash + value.charCodeAt(i) | 0;
+	return Math.abs(hash);
+}
+/**
+* Stable palette slot for an actor. Hash-derived, never array index or arrival
+* order: those repaint every actor whenever the tail changes or a reload
+* reorders the buffer, and a shifting color is worse than no color for telling
+* two agents apart.
+*/
+function actorColorIndex(actorId) {
+	if (!actorId) return 0;
+	return hashOf(actorId) % 4;
+}
+const ACTOR_COLOR_SLOTS = [
+	{
+		light: "#2a78d6",
+		dark: "#3987e5"
+	},
+	{
+		light: "#eda100",
+		dark: "#c98500"
+	},
+	{
+		light: "#e87ba4",
+		dark: "#d55181"
+	},
+	{
+		light: "#008300",
+		dark: "#008300"
+	}
+];
+/** Single-character marker for text-only surfaces (the CLI /hearth listing). */
+const ACTOR_KIND_MARKERS = {
+	human: "H",
+	agent: "A",
+	gateway: "G",
+	device: "D",
+	system: "S"
+};
+/**
+* Read through a Partial view on purpose. The type is closed within one build,
+* but the SPA bare-casts the WS payload, so a client running stale code against
+* a server that has added a kind receives one that is absent from these maps -
+* and a blank badge reads as "no kind stated" rather than "kind unknown", which
+* is the opposite of what the mitigation needs to say.
+*/
+function lookup(map, kind, fallback) {
+	if (!kind) return fallback;
+	return map[kind] ?? fallback;
+}
+function actorKindMarker(kind) {
+	return lookup(ACTOR_KIND_MARKERS, kind, "?");
+}
+z$1.object({
+	/** Claude Code lifecycle event name; the reason fallback for tiers 0 and 1. */
+	hook_event_name: z$1.string().nullish(),
+	session_id: z$1.string().nullish(),
+	slug: z$1.string().nullish(),
+	/** Workspace BASENAME. Never a full path - that is content. */
+	workspace: z$1.string().nullish(),
+	/**
+	* Which reporter wrote this. A LOOSE string, not an enum: a fourth surface
+	* posting an unrecognized value must land on the roster with its detail
+	* intact, and a strict enum would fail the whole parse and drop the row - the
+	* exact "a third reporter is expensive" cost this contract exists to remove.
+	*/
+	surface: z$1.string().nullish(),
+	/** Engine driving the session, where the reporter knows it. */
+	source: z$1.string().nullish(),
+	claude_version: z$1.string().nullish(),
+	activity: z$1.object({
+		reason: z$1.string().nullish(),
+		tool: z$1.string().nullish(),
+		permission_mode: z$1.string().nullish(),
+		effort: z$1.string().nullish(),
+		duration_ms: z$1.number().nullish(),
+		subagent: z$1.string().nullish(),
+		background_tasks: z$1.number().int().min(0).nullish()
+	}).nullish()
+});
+//#endregion
 //#region ../../b4m-core/common/dist/index.mjs
 let HttpStatus = /* @__PURE__ */ function(HttpStatus) {
 	HttpStatus[HttpStatus["Ok"] = 200] = "Ok";
@@ -148,9 +285,11 @@ let HttpStatus = /* @__PURE__ */ function(HttpStatus) {
 	HttpStatus[HttpStatus["Unauthorized"] = 401] = "Unauthorized";
 	HttpStatus[HttpStatus["Forbidden"] = 403] = "Forbidden";
 	HttpStatus[HttpStatus["NotFound"] = 404] = "NotFound";
+	HttpStatus[HttpStatus["Conflict"] = 409] = "Conflict";
 	HttpStatus[HttpStatus["UnprocessableEntity"] = 422] = "UnprocessableEntity";
 	HttpStatus[HttpStatus["TooManyRequests"] = 429] = "TooManyRequests";
 	HttpStatus[HttpStatus["InternalServerError"] = 500] = "InternalServerError";
+	HttpStatus[HttpStatus["BadGateway"] = 502] = "BadGateway";
 	return HttpStatus;
 }({});
 var HTTPError = class extends Error {
@@ -312,6 +451,7 @@ const b4mLLMTools = z$1.enum([
 	"chess_engine",
 	"retrieve_knowledge_content",
 	"count_knowledge_base",
+	"describe_knowledge_base",
 	"delegate_to_agent",
 	"optihashi_schedule",
 	"optihashi_formulate",
@@ -699,6 +839,12 @@ let KnowledgeType = /* @__PURE__ */ function(KnowledgeType) {
 * so the client can branch to a targeted error UI (see `IChatHistoryItem.errorCode`).
 * Single source of truth: the streamed-action Zod enum in `schemas/actions.ts`
 * derives its values from this tuple, so the two can never drift.
+*
+* SSE-frame scoped, and a NARROWING of the platform-wide `API_ERROR_CODES`: a
+* quest fails for billing reasons, never for the provider-configuration reasons
+* the HTTP surface reports. The `satisfies` is what keeps it a narrowing rather
+* than a second vocabulary - a code added here that is not in `API_ERROR_CODES`
+* fails the build.
 */
 const QUEST_ERROR_CODES = ["insufficient_credits", "spend_cap_exceeded"];
 z$1.union([
@@ -779,6 +925,62 @@ let ImageModels = /* @__PURE__ */ function(ImageModels) {
 Object.values(ImageModels);
 z$1.enum(ImageModels);
 /**
+* Image size constraints and options
+*/
+const IMAGE_SIZE_CONSTRAINTS = {
+	BFL: {
+		minWidth: 256,
+		maxWidth: 1440,
+		minHeight: 256,
+		maxHeight: 1440,
+		stepSize: 32,
+		defaultSize: "1280x960",
+		sizes: [
+			"1280x960",
+			"1024x768",
+			"800x600",
+			"1280x720",
+			"1024x576",
+			"1440x810",
+			"1024x1024",
+			"768x768",
+			"512x512",
+			"960x1280",
+			"768x1024",
+			"600x800"
+		]
+	},
+	GPT_IMAGE_1: {
+		sizes: [
+			"1024x1024",
+			"1024x1536",
+			"1536x1024"
+		],
+		defaultSize: "1024x1024"
+	},
+	GPT_IMAGE_2: {
+		/** Popular preset sizes shown in the UI. The API accepts any resolution meeting the constraints. */
+		sizes: [
+			"1024x1024",
+			"1536x1024",
+			"1024x1536",
+			"2048x2048",
+			"2048x1152",
+			"3840x2160",
+			"2160x3840"
+		],
+		defaultSize: "1024x1024",
+		/** Constraints for custom/flexible sizes */
+		constraints: {
+			maxEdge: 3840,
+			minTotalPixels: 655360,
+			maxTotalPixels: 8294400,
+			edgeMultiple: 16,
+			maxAspectRatio: 3
+		}
+	}
+};
+/**
 * Chat Models
 *
 * https://platform.openai.com/docs/models/continuous-model-upgrades
@@ -896,6 +1098,12 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 const CHAT_MODELS = Object.values(ChatModels);
 const supportedChatModels = z$1.enum(ChatModels);
 /**
+* Every `ChatModels` Gemini entry is named `gemini...` (see the GEMINI block above) - a prefix
+* check tracks that naming convention automatically as new Gemini models are added, unlike an
+* explicit id list that would need updating in lockstep and could silently miss one.
+*/
+const isGeminiModelId = (model) => model.startsWith("gemini");
+/**
 * Models that support the reasoning_effort parameter.
 * o1-preview and o1-mini do NOT support reasoning_effort.
 */
@@ -1110,6 +1318,14 @@ const SUBQUEST_STATUS_VALUES = [
 	"deleted"
 ];
 /**
+* Status of a review gate on a sub-quest
+*/
+const REVIEW_GATE_STATUS_VALUES = [
+	"pending",
+	"approved",
+	"rejected"
+];
+/**
 * Valid complexity ratings for quests.
 * Canonical vocabulary - matches what the planner generates and validates
 * (Easy < 1 hour, Medium 1-4 hours, Hard > 4 hours).
@@ -1369,6 +1585,12 @@ z$1.object({
 	ownerId: z$1.string(),
 	ownerType: z$1.enum(CreditHolderType),
 	sessionId: z$1.string().optional(),
+	/**
+	* Data lake this call is 1:1 attributable to (ingestion embeds only - a query
+	* embedding can span multiple lakes and is never attributed here). Unset for
+	* every other feature/call.
+	*/
+	dataLakeId: z$1.string().optional(),
 	feature: z$1.enum([
 		"chat",
 		"image_generation",
@@ -2170,6 +2392,13 @@ z$1.object({
 	createdAt: z$1.date(),
 	updatedAt: z$1.date()
 });
+let McpServerName = /* @__PURE__ */ function(McpServerName) {
+	McpServerName["LinkedIn"] = "linkedin";
+	McpServerName["Github"] = "github";
+	McpServerName["Atlassian"] = "atlassian";
+	McpServerName["Notion"] = "notion";
+	return McpServerName;
+}({});
 /**
 * Check if a value is a placeholder (not configured or SST default).
 * Uses case-insensitive comparison and trims whitespace to prevent bypass attempts.
@@ -2215,6 +2444,42 @@ function isPlaceholderApiKey(value) {
 	if (!normalized) return true;
 	return PLACEHOLDER_API_KEY_REGEX.test(normalized);
 }
+/**
+* Lake lifecycle. Stable states (draft/active/archived/deleted) plus transitional
+* states (archiving/unarchiving/restoring/deleting/purging) that exist to drive UI and make a crashed
+* mid-operation observable. draft -> active is one-way. It happens implicitly once the lake
+* holds its first member file (see `activateIfDraft` below), and unconditionally when an
+* archived or deleted lake is restored, which is how an empty lake can end up active.
+*
+* `purging` is the one transitional state that is NOT recoverable by retrying the same action:
+* it is claimed the moment a phase-2 hard delete is ACCEPTED (#1744), before the background
+* sweep runs, so that `listDeletedDataLakes` stops offering Restore on a lake whose
+* destruction is already irreversible. Everything else that reads `status` must treat it as
+* "going away", never as a lake to act on.
+*/
+const DATA_LAKE_STATUSES = [
+	"draft",
+	"active",
+	"archiving",
+	"archived",
+	"unarchiving",
+	"restoring",
+	"deleting",
+	"deleted",
+	"purging"
+];
+/**
+* Stable (non-transitional) lake statuses - a lake sitting in one of these is at rest, not
+* mid-operation. Load-bearing as the INPUT to `DATA_LAKE_TRANSITIONAL_STATUSES` below, which is
+* what drives the needs-attention list; it is not itself a filter any list path applies.
+*/
+const DATA_LAKE_STABLE_STATUSES = [
+	"draft",
+	"active",
+	"archived",
+	"deleted"
+];
+DATA_LAKE_STATUSES.filter((s) => !DATA_LAKE_STABLE_STATUSES.includes(s));
 z$1.object({
 	/**
 	* The granting lake's Mongo `_id`. ALWAYS a persisted DB lake: a hardcoded/fallback lake has no
@@ -2245,6 +2510,67 @@ z$1.object({
 	*/
 	expiresAt: z$1.date().nullish()
 });
+/** One prefix-arm content tag a lake held on a file, as captured at removal for later restore. */
+const LakeMembershipRemovalContentTag = z$1.object({
+	name: z$1.string(),
+	strength: z$1.number()
+});
+z$1.object({
+	dataLakeId: z$1.string(),
+	fabFileId: z$1.string(),
+	/** The principal who performed the removal - audit only, never a restore authorization input. */
+	actorUserId: z$1.string(),
+	/** The lake's prefix-arm tags the file carried, captured by `lakeMembershipSignals`. May be
+	*  empty - a meta-tag-only member and a non-creator-owned file both removed with no content
+	*  tags to restore, which is a complete and legitimate answer, not "nothing to record". */
+	contentTags: z$1.array(LakeMembershipRemovalContentTag),
+	removedAt: z$1.date(),
+	expiresAt: z$1.date()
+});
+/**
+* Every `IDataLake` field, classified as audited or not. A TOTAL map keyed by `keyof IDataLake`,
+* exactly like `LAKE_FIELD_VISIBILITY` in redactLakeForActor.ts and for the same reason: a list of
+* strings cannot notice an ABSENCE, so a new config field would simply never be audited and nobody
+* would find out. Keyed this way, a field added to the entity and classified nowhere is a COMPILE
+* error here, which is the only forcing function that actually works.
+*
+* `excluded` is for fields no operator chooses and which steer no answer: the content stats, the
+* teardown bookkeeping stamps, the cost meter and the lake-memory lease. They change constantly and
+* a history full of them would bury the changes that matter.
+*/
+const LAKE_CONFIG_FIELD_AUDIT = {
+	name: "audited",
+	slug: "audited",
+	description: "audited",
+	systemPrompt: "audited",
+	preferredSystemPromptId: "audited",
+	groundingMode: "audited",
+	requiredPassageTokenTarget: "audited",
+	fileTagPrefix: "audited",
+	datalakeTag: "audited",
+	requiredUserTag: "audited",
+	requiredEntitlement: "audited",
+	organizationId: "audited",
+	isPublic: "audited",
+	auditQueryTextEnabled: "audited",
+	lakeMemoryEnabled: "audited",
+	status: "audited",
+	createdByUserId: "audited",
+	lastUpdatedByUserId: "excluded",
+	fileCount: "excluded",
+	totalSizeBytes: "excluded",
+	totalChunkedChars: "excluded",
+	embeddingSpendMicroUsd: "excluded",
+	lastSyncAt: "excluded",
+	filesDeletedAt: "excluded",
+	filesArchivedAt: "excluded",
+	lakeMemoryExtractionAt: "excluded",
+	lakeMemoryCursor: "excluded",
+	lakeMemoryPurgedAt: "excluded",
+	inconsistencyReport: "excluded",
+	inconsistencyComputedAt: "excluded"
+};
+[...Object.keys(LAKE_CONFIG_FIELD_AUDIT).filter((field) => LAKE_CONFIG_FIELD_AUDIT[field] === "audited")];
 /**
 * SRE Agent Trio - Shared Types
 *
@@ -3036,6 +3362,71 @@ const usdToCreditsStochastic = (usd, rng = cryptoUniform, rate = CREDITS_PER_USD
 	const fraction = raw - base;
 	return base + (rng() < fraction ? 1 : 0);
 };
+/**
+* Output tokens the pre-flight credit hold prices when a request's max_tokens
+* ceiling exceeds it.
+*
+* max_tokens is a *ceiling*, not a prediction: adaptive reasoning models stop at
+* end_turn well short of it, so pricing the hold at the full window (128K on the
+* flagship models) reserved several thousand credits per turn regardless of answer
+* length. The excess was always refunded at settlement, but the hold IS the
+* insufficient-funds gate, so users whose balance sat between their real cost and
+* the worst case were falsely blocked.
+*
+* 16K covers the realistic long answer with headroom - the largest replies seen in
+* practice are HTML-artifact turns at roughly 10-11K output tokens (see
+* buildThinkingParams in llm-adapters/thinkingParams.ts, whose max_tokens floor was
+* sized off the same measurement).
+*
+* UNDER-RESERVATION IS ACCEPTED, NOT PREVENTED. A turn that emits more than this
+* settles as a shortfall debit at reconciliation, which is already a supported path
+* (provider-basis settlement could always exceed a hold priced on the local
+* estimate). The two sites clamp the shortfall differently: chat's
+* computeSettlementDelta (services/llm/ChatCompletionProcess.ts) floors the debit at
+* the balance snapshot taken at its OWN admission and reports the remainder as
+* writtenOffCredits; cliCompletions.ts does an unclamped $inc on success and only
+* logs an ALERT if it lands negative. Neither is a non-negativity guarantee: the
+* chat snapshot predates any sibling turn's spend (see that function's own "best
+* effort" note), and when the shortfall still fits the stale snapshot the debit
+* applies in full - writtenOffCredits 0, and no BILLING_SHORTFALL_CLAMP log - so a
+* concurrent holder can land negative there too. Either way the resulting balance
+* fails the *next* turn's own admission gate - but that bound is per turn, not per
+* holder: turns admitted concurrently are each checked against the balance at their
+* own admission and settle against a snapshot that predates their siblings' spend,
+* so a holder running turns in parallel can be shorted once per in-flight turn, not
+* once total.
+*/
+const PREFLIGHT_RESERVATION_OUTPUT_TOKENS = 16384;
+/**
+* Reservation ceiling for models that spend reasoning tokens inside their output
+* budget (see reasonsWithinOutputBudget in llm-adapters/thinkingParams.ts). Those
+* tokens bill as output on top of the visible answer, so the 16K figure above -
+* which was measured on visible artifact size alone - under-reserves them badly.
+*
+* Deliberately below ADAPTIVE_THINKING_MAX_TOKENS_FLOOR (64K), which sizes the
+* request's real ceiling and therefore has to cover the worst case: exceeding it
+* truncates a reply mid-tag, an unrecoverable failure. A hold has no such duty -
+* exceeding it settles as a shortfall debit - so it is sized for the long turn
+* (roughly 3x the largest observed visible answer, leaving the rest for the trace)
+* rather than the worst one, which is what keeps the gate off affordable requests.
+*/
+const PREFLIGHT_RESERVATION_REASONING_OUTPUT_TOKENS = 32768;
+/**
+* Output-token figure to price a pre-flight credit hold at, given the max_tokens
+* this request will actually send. Never raises the caller's ceiling: a request
+* that asks for less than the cap holds only what it can possibly spend.
+*
+* Reserving only, never gating: the per-member org credit cap is still priced on
+* the unshrunk ceiling at both call sites, since that check has no settlement
+* counterpart to correct an under-estimate. That is a strictly larger figure than
+* the hold, not a true upper bound on the turn - it prices one model round trip,
+* at the uncached input rate, on the primary model - so it still under-counts a
+* multi-round tool loop, a cache-write turn, or a fallback hop onto pricier pricing.
+*
+* @param reasonsWithinOutputBudget - reasonsWithinOutputBudget(modelInfo); passed as
+*   a boolean because common cannot import llm-adapters.
+*/
+const reservationOutputTokens = (requestedMaxTokens, reasonsWithinOutputBudget = false) => Math.min(requestedMaxTokens, reasonsWithinOutputBudget ? PREFLIGHT_RESERVATION_REASONING_OUTPUT_TOKENS : PREFLIGHT_RESERVATION_OUTPUT_TOKENS);
 z.enum([
 	"openai",
 	"test",
@@ -3043,6 +3434,126 @@ z.enum([
 	"xai",
 	"gemini"
 ]);
+z$1.enum([
+	"inject",
+	"auto-fire",
+	"hidden"
+]);
+/**
+* Modes acceptable at AUTHORING time. 'hidden' is intentionally excluded until
+* the host has true hidden-send support - accepting it would persist a value
+* that silently behaves as 'auto-fire' (a surprising downgrade). It stays in
+* ExecutionModeSchema/the stored enum for forward-compat.
+*/
+const AuthorableExecutionModeSchema = z$1.enum(["inject", "auto-fire"]);
+/**
+* Tools a prompt may require - constrained to the host's closed tool set, MINUS
+* integration-gated tools that act on the caller's own credentials/account. A
+* shared system prompt must not be able to inject e.g. blog-publishing into a
+* non-author's session via requiredTools. (Per-user entitlement of the remaining
+* tools is still the chat pipeline's responsibility - see follow-up note in the
+* briefcase blueprint; this allowlist is the storage-layer floor.)
+*/
+const BRIEFCASE_DISALLOWED_TOOLS = [
+	"blog_publish",
+	"blog_edit",
+	"blog_draft"
+];
+const BriefcaseRequiredToolsSchema = z$1.array(b4mLLMTools.refine((t) => !BRIEFCASE_DISALLOWED_TOOLS.includes(t), "This tool is not permitted in a briefcase prompt")).max(16);
+z$1.string().regex(/^[a-f0-9]{24}$/i, "Invalid prompt id");
+/** Shared cap for every free-text prompt body a caller can supply. Exported so the
+* caller-prompt caps on the chat request, the invoke params and the CLI tool import it
+* rather than each restating the literal. */
+const PROMPT_TEXT_MAX = 16e3;
+const TAGS_MAX = 20;
+z$1.object({
+	type: z$1.string().min(1).max(100),
+	name: z$1.string().min(1).max(200),
+	description: z$1.string().max(500).optional(),
+	promptText: z$1.string().min(1).max(PROMPT_TEXT_MAX),
+	tags: z$1.array(z$1.string().min(1).max(50)).max(TAGS_MAX).optional(),
+	executionMode: AuthorableExecutionModeSchema.optional(),
+	requiredTools: BriefcaseRequiredToolsSchema.optional()
+}).partial();
+/**
+* One catalog sub-query. Exactly one selector is used, in precedence order:
+* `personal` (resolved to the caller server-side) > `tags` > `type`.
+*/
+const PromptBatchQuerySchema = z$1.object({
+	key: z$1.string().min(1).max(100),
+	tags: z$1.array(z$1.string().min(1).max(50)).max(TAGS_MAX).optional(),
+	type: z$1.string().max(100).optional(),
+	personal: z$1.boolean().optional()
+});
+z$1.object({ queries: z$1.array(PromptBatchQuerySchema).min(1).max(32).refine((qs) => new Set(qs.map((q) => q.key)).size === qs.length, { message: "Batch query keys must be unique" }) });
+z$1.object({
+	sessionId: z$1.string().nullish(),
+	message: z$1.string(),
+	organizationId: z$1.string().optional(),
+	model: z$1.string().optional(),
+	temperature: z$1.number().min(0).max(2).optional(),
+	max_tokens: z$1.number().positive().optional(),
+	maxTokens: z$1.number().positive().optional(),
+	maxOutputTokens: z$1.number().positive().optional(),
+	stream: z$1.boolean().prefault(false),
+	historyCount: z$1.number().positive().default(10),
+	fileIds: z$1.array(z$1.string()).prefault([]),
+	wait: z$1.boolean().prefault(false),
+	enableTools: z$1.boolean().prefault(false),
+	toolMode: z$1.enum(["fast", "smart"]).optional(),
+	tools: z$1.array(z$1.string()).optional().describe("Explicit tool ids to offer the model. A non-empty array enables tools on its own; no companion `toolMode` or `enableTools` is required. Merged with the auto-selected set under `toolMode: \"smart\"`, and ignored under `toolMode: \"fast\"`. This list ADDS to what is offered rather than restricting it - the server still offers tools of its own (for example knowledge retrieval when the session has reachable documents). Unrecognized ids are dropped rather than rejecting the request; the response reports the surviving set as `tools.effectiveTools` and the ids that are not tools in this deployment as `tools.unrecognizedTools`, since no endpoint enumerates the valid ids. `unrecognizedTools` is reported under every `toolMode` - it describes the ids, not what the mode did with them - so under `toolMode: \"fast\"` an id can be absent from `effectiveTools` (the mode discarded it) without being unrecognized. Both reported lists are deduplicated, and `unrecognizedTools` names at most the first 10 distinct ids."),
+	enableQuestMaster: z$1.boolean().optional(),
+	enableMementos: z$1.boolean().optional(),
+	enableAgents: z$1.boolean().optional(),
+	promptMode: z$1.enum([
+		"raw",
+		"grounded",
+		"surface"
+	]).optional(),
+	skip_auto_offers: z$1.boolean().optional().describe("Suppress tools the server would otherwise attach on its own for this session (the knowledge-base search offer, in-app view navigation, blog drafting/editing/publishing, and skill invocation). Tools you request explicitly are unaffected. One system-prompt block goes with them: withholding in-app view navigation also drops the view-registry block that exists only to describe it. No other prompt content changes. This does not switch off retrieval: a session with forced knowledge retrieval still retrieves, and documents already attached to the session are still placed in the prompt directly. Any promptMode suppresses these too, so false has no effect alongside one."),
+	includePromptDetails: z$1.boolean().optional(),
+	includeSystemPrompt: z$1.boolean().optional(),
+	systemPrompt: z$1.string().max(PROMPT_TEXT_MAX).optional().describe("System-prompt text for this request only, never persisted. Rendered as a defended block appended after every other system-prompt source, with prose instructing the model to defer to organization, session and data-lake guidance. Over the cap is a 422, never truncated.")
+});
+z$1.object({
+	id: z$1.string(),
+	status: z$1.string(),
+	message_received: z$1.boolean(),
+	timestamp: z$1.string(),
+	model: z$1.string(),
+	message: z$1.string().optional(),
+	tools: z$1.object({
+		toolMode: z$1.enum(["fast", "smart"]).optional(),
+		autoSelectedTools: z$1.array(z$1.string()).optional(),
+		effectiveTools: z$1.array(z$1.string()),
+		unrecognizedTools: z$1.array(z$1.string()).optional()
+	}).optional(),
+	tracking_info: z$1.object({
+		quest_id: z$1.string(),
+		check_status_url: z$1.string(),
+		poll_url: z$1.string().optional()
+	})
+});
+/**
+* Reusable JSON error envelope (plain; the OpenAPI layer annotates it).
+*
+* Must stay in sync with the published `ErrorResponse` component
+* (../openapi/schemas.ts) - `openapi/errorEnvelopeParity.test.ts` pins the two
+* together, and apps/client's errorHandler test uses this shape as the stand-in for
+* the component, which is generate-time only and cannot be imported at runtime.
+*/
+const ApiErrorSchema = z$1.object({
+	error: z$1.string(),
+	request_id: z$1.string().optional(),
+	/**
+	* Deprecated, sunset 2026-12-01. The `name` of whatever was thrown - our own error
+	* classes usually, a library/driver class name on an unhandled 500 - added to every
+	* body by apps/client's errorHandler. Documented here so the runtime and the spec
+	* agree while it is still served; do not build on it. See CONVENTIONS.md section 1.
+	*/
+	name: z$1.string().optional()
+});
+ApiErrorSchema.extend({ errorCode: z$1.literal("insufficient_credits").optional() });
 const supportedVoiceGenerationVendor = z.enum(["openai", "elevenlabs"]);
 const voiceOutputFormatSchema = z.enum([
 	"mp3",
@@ -3071,6 +3582,49 @@ z.object({
 	languageCode: ttsLanguageCodeSchema.optional(),
 	preview: z.boolean().optional()
 });
+/**
+* Why a browsable copy of generated audio was not kept. Saving is best-effort and
+* never fatal (the caller was already billed for the bytes it is being handed), so
+* this is reported alongside a successful response rather than as an error.
+*
+* Must stay in sync with `PersistGeneratedAudioResult` in
+* apps/client/server/utils/persistGeneratedAudio.ts, which derives its `reason`
+* from this schema.
+*/
+const audioSaveSkippedReasonSchema = z.enum([
+	"storage_limit",
+	"file_too_large",
+	"error"
+]);
+z.object({
+	/** Base64-encoded audio payload. */
+	audio: z.string(),
+	format: voiceOutputFormatSchema,
+	contentType: z.string(),
+	saved: z.boolean().optional(),
+	fabFileId: z.string().optional(),
+	fileUrl: z.string().optional(),
+	saveSkippedReason: audioSaveSkippedReasonSchema.optional(),
+	/** The provider that actually produced the audio, present only on a fallback. */
+	provider: supportedVoiceGenerationVendor.optional(),
+	/** The originally requested provider that could not serve the request. */
+	fallbackFrom: supportedVoiceGenerationVendor.optional()
+});
+ApiErrorSchema.extend({
+	provider: supportedVoiceGenerationVendor.optional(),
+	errorCode: z.enum([
+		"insufficient_credits",
+		"provider_not_configured",
+		"provider_rejected"
+	]).optional()
+});
+z.object({
+	error: z.string(),
+	provider: supportedVoiceGenerationVendor,
+	saved: z.literal(true).optional(),
+	fabFileId: z.string().optional(),
+	fileUrl: z.string().optional()
+});
 z.enum(["openai"]);
 /**
 * Supported sound-effects generation vendors. Currently only ElevenLabs.
@@ -3196,13 +3750,93 @@ const AGENT_EXECUTION_STATUSES = [
 	"failed",
 	"aborted"
 ];
+/**
+* Operator allow-list for the client-authored Mongo filter carried on a `subscribe_query` frame.
+*
+* The WS data-subscribe handler forwards that filter to `Model.find` and persists it on the
+* QuerySubscription the separate subscriber-fanout service replays, so an unconstrained
+* `$`-prefixed key lets any authenticated socket ask the database to run server-side JavaScript
+* (`$where`, `$expr` + `$function`) or an unbounded `$regex` - either of which pins a pooled
+* connection for as long as it runs.
+*
+* Live subscriptions only ever need equality, membership and range matching, so anything outside
+* this list is REFUSED rather than stripped: silently dropping an operator would quietly widen the
+* document set the caller ends up subscribed to.
+*
+* The scan is deliberately structural rather than a model of Mongo's grammar - it flags any
+* `$`-prefixed key anywhere in the tree that isn't allow-listed. It can therefore accept an
+* allow-listed operator in a position Mongo would treat as a literal sub-document field name, but
+* that is inert; what matters is that no disallowed operator can reach the driver.
+*/
+/** Combinators whose operands are themselves filters. */
+const SUBSCRIPTION_FILTER_LOGICAL_OPERATORS = [
+	"$and",
+	"$or",
+	"$nor",
+	"$not"
+];
+/** Value-level operators a subscription filter may use. */
+const SUBSCRIPTION_FILTER_VALUE_OPERATORS = [
+	"$eq",
+	"$ne",
+	"$gt",
+	"$gte",
+	"$lt",
+	"$lte",
+	"$in",
+	"$nin",
+	"$exists",
+	"$type",
+	"$size",
+	"$all",
+	"$elemMatch"
+];
+const ALLOWED_OPERATORS = /* @__PURE__ */ new Set([...SUBSCRIPTION_FILTER_LOGICAL_OPERATORS, ...SUBSCRIPTION_FILTER_VALUE_OPERATORS]);
+/**
+* Returns a dotted path for every part of `filter` a subscription may not send: a disallowed
+* `$`-prefixed key, a `RegExp` operand, or nesting past {@link SUBSCRIPTION_FILTER_MAX_DEPTH}.
+* An empty array means the filter is safe to forward to the database.
+*/
+function findDisallowedSubscriptionFilterKeys(filter) {
+	const violations = [];
+	const walk = (node, path, depth) => {
+		if (depth > 12) {
+			violations.push(`${path} (nested deeper than 12)`);
+			return;
+		}
+		if (node instanceof RegExp) {
+			violations.push(`${path} (regular expression)`);
+			return;
+		}
+		if (Array.isArray(node)) {
+			node.forEach((entry, i) => walk(entry, `${path}[${i}]`, depth + 1));
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		for (const [key, value] of Object.entries(node)) {
+			const childPath = path ? `${path}.${key}` : key;
+			if (key.startsWith("$") && !ALLOWED_OPERATORS.has(key)) {
+				violations.push(childPath);
+				continue;
+			}
+			walk(value, childPath, depth + 1);
+		}
+	};
+	walk(filter, "", 0);
+	return violations;
+}
 const DataSubscribeRequestAction = z$1.object({
 	action: z$1.literal("subscribe_query"),
 	accessToken: z$1.string().optional(),
 	subscriptionId: z$1.string(),
 	collectionName: z$1.string(),
-	query: z$1.looseObject({}),
-	fields: z$1.looseObject({}),
+	query: z$1.looseObject({}).superRefine((filter, ctx) => {
+		for (const key of findDisallowedSubscriptionFilterKeys(filter)) ctx.addIssue({
+			code: "custom",
+			message: `Disallowed subscription filter: ${key}`
+		});
+	}),
+	fields: z$1.record(z$1.string(), z$1.union([z$1.boolean(), z$1.number()])),
 	fetchInitialData: z$1.boolean().prefault(true).optional(),
 	clientId: z$1.string().optional()
 });
@@ -3289,6 +3923,17 @@ const DataSubscriptionUpdateAction = z$1.object({
 		id: z$1.string()
 	})
 });
+/**
+* Server -> Client: a `subscribe_query` frame was refused (the operator allow-list, `fields`
+* validation) or its initial fetch was aborted (`maxTimeMS`). Neither failure throws an
+* UnauthorizedError/JsonWebTokenError, so withWebSocketContext's status code never reaches the
+* client as a frame - this is the only signal the caller gets that the subscription never took.
+*/
+const DataSubscribeErrorAction = z$1.object({
+	action: z$1.literal("data_subscribe_error"),
+	subscriptionId: z$1.string(),
+	error: z$1.string()
+});
 const LLMStatusUpdateAction = z$1.object({
 	action: z$1.literal("llm_status_update"),
 	status: z$1.string().nullable(),
@@ -4521,6 +5166,7 @@ const OptiHashiRunUpdatedAction = z$1.object({
 });
 z$1.discriminatedUnion("action", [
 	DataSubscriptionUpdateAction,
+	DataSubscribeErrorAction,
 	InboxRefetchAction,
 	LLMStatusUpdateAction,
 	InvitesRefetchAction,
@@ -4579,50 +5225,125 @@ z$1.discriminatedUnion("action", [
 	ReconnectResultAction
 ]);
 z$1.object({
-	sessionId: z$1.string().nullish(),
-	message: z$1.string(),
-	organizationId: z$1.string().optional(),
+	session_id: z$1.string().min(1),
+	message: z$1.string().min(1),
+	/** Falls back to the deployment's default chat model when omitted. */
 	model: z$1.string().optional(),
-	temperature: z$1.number().min(0).max(2).optional(),
-	max_tokens: z$1.number().positive().optional(),
-	maxTokens: z$1.number().positive().optional(),
-	maxOutputTokens: z$1.number().positive().optional(),
-	stream: z$1.boolean().prefault(false),
-	historyCount: z$1.number().positive().default(10),
-	fileIds: z$1.array(z$1.string()).prefault([]),
-	wait: z$1.boolean().prefault(false),
-	enableTools: z$1.boolean().prefault(false),
-	toolMode: z$1.enum(["fast", "smart"]).optional(),
+	/**
+	* Run as a specific persisted agent. Omit to let the executor pick the profile for
+	* the session: a session on a dedicated surface gets that surface's own profile,
+	* otherwise a synthetic one built from admin orchestration defaults. Omitting this
+	* is what reproduces the product UI's Agent Mode toggle.
+	*/
+	agent_id: z$1.string().optional(),
+	/**
+	* Bill this run to an organization's credit pool. The caller must belong to it; a
+	* non-member gets 404. Omit to bill the caller personally.
+	*/
+	organization_id: z$1.string().optional(),
+	/**
+	* Tool-id allowlist for the run. Omit to use the resolved profile's own list.
+	*
+	* Doubles as pre-approval: REST runs have no interactive client to answer a
+	* permission prompt, so tools named here are treated as approved. A run that calls
+	* an approval-gated tool NOT named here fails with that tool named in `error`.
+	*/
 	tools: z$1.array(z$1.string()).optional(),
-	enableQuestMaster: z$1.boolean().optional(),
-	enableMementos: z$1.boolean().optional(),
-	enableAgents: z$1.boolean().optional(),
-	promptMode: z$1.enum([
-		"raw",
-		"grounded",
-		"surface"
-	]).optional(),
-	includePromptDetails: z$1.boolean().optional(),
-	includeSystemPrompt: z$1.boolean().optional()
+	/**
+	* Hard ceiling on ReAct iterations. Each one is a full LLM round-trip, so the cap is
+	* bounded at 100 regardless of what the profile would allow.
+	*/
+	max_iterations: z$1.number().int().positive().max(100).optional(),
+	temperature: z$1.number().min(0).max(2).optional(),
+	max_tokens: z$1.number().int().positive().optional(),
+	thinking: z$1.object({
+		enabled: z$1.boolean(),
+		/** Bounded at 32000: Anthropic rejects rather than clamps an oversized budget. */
+		budget_tokens: z$1.number().int().positive().max(32e3).optional()
+	}).optional(),
+	/** Per-message file attachments (fabFile ids), materialized into the first iteration. */
+	file_ids: z$1.array(z$1.string()).optional(),
+	/** Workbench-level file ids for the session, forwarded as a dispatch-time snapshot. */
+	session_file_ids: z$1.array(z$1.string()).optional(),
+	enable_mementos: z$1.boolean().optional(),
+	enable_lattice: z$1.boolean().optional(),
+	/**
+	* Opt out of the artifact-emission prompt and artifact persistence for this run.
+	*
+	* ANDed with the deployment's admin `EnableArtifacts` setting, so this can only ever
+	* withhold artifacts, never force them on. Omitting it means "no preference" and
+	* leaves the admin setting as the only gate; only an explicit `false` opts out.
+	* Inherited by any subagent this run dispatches, so a delegating agent cannot route
+	* around the opt-out.
+	*
+	* Worth setting on a REST run: the emission prompt costs roughly 2.8k tokens per
+	* iteration, and nothing on this transport renders an artifact back to a human.
+	*/
+	enable_artifacts: z$1.boolean().optional()
 });
 z$1.object({
 	id: z$1.string(),
-	status: z$1.string(),
-	message_received: z$1.boolean(),
-	timestamp: z$1.string(),
+	status: z$1.literal("pending"),
+	session_id: z$1.string(),
 	model: z$1.string(),
-	message: z$1.string().optional(),
+	timestamp: z$1.string(),
 	tracking_info: z$1.object({
-		quest_id: z$1.string(),
-		check_status_url: z$1.string(),
-		poll_url: z$1.string().optional()
+		execution_id: z$1.string(),
+		/**
+		* The chat-history Quest holding the prompt, which gains the reply when the run
+		* completes. Absent when that best-effort write failed; the run still proceeds.
+		*/
+		quest_id: z$1.string().optional(),
+		poll_url: z$1.string()
 	})
 });
-/** Reusable JSON error envelope (plain; the OpenAPI layer annotates it). */
-const ApiErrorSchema = z$1.object({
-	error: z$1.string(),
-	request_id: z$1.string().optional()
+/** One step of a published reasoning trace - a public projection of `IAgentStep`. */
+const AgentExecutionStepSchema = z$1.object({
+	type: z$1.enum([
+		"thought",
+		"action",
+		"observation",
+		"final_answer"
+	]),
+	content: z$1.string(),
+	/** 0-indexed iteration. Absent on traces checkpointed before the field existed. */
+	iteration: z$1.number().int().nonnegative().optional(),
+	/** Set on `action` steps: the tool the agent invoked. */
+	tool_name: z$1.string().optional()
 });
+z$1.object({
+	id: z$1.string(),
+	status: z$1.enum([
+		"pending",
+		"running",
+		"continuing",
+		"awaiting_permission",
+		"awaiting_subagent",
+		"awaiting_dag_children",
+		"paused",
+		"completed",
+		"failed",
+		"aborted"
+	]),
+	session_id: z$1.string().nullable(),
+	answer: z$1.string().nullable(),
+	/**
+	* Why the run ended without an answer. Set only on `failed`; null otherwise.
+	* Without this a caller polling a terminal run sees `failed` + a null answer and
+	* cannot tell an approval-gated tool from a model error from a timeout.
+	*
+	* Approval-gate failures name the offending tool, since that is what the caller acts
+	* on. Everything else is reduced to a coarse category (billing, rate limit, timeout,
+	* auth) or a generic message: the stored reason is a raw internal exception, and
+	* those carry infrastructure identifiers. Full detail stays in the server logs.
+	*/
+	error: z$1.string().nullable(),
+	steps: z$1.array(AgentExecutionStepSchema),
+	total_iterations: z$1.number().nullable(),
+	created_at: z$1.string(),
+	updated_at: z$1.string()
+});
+z$1.object({ id: z$1.string().min(1) });
 /**
 * Tool schema matching ICompletionOptionTools.toolSchema. The Zod surface only
 * covers wire-format fields (toolFn is server-side). Replaces the historical
@@ -4716,6 +5437,7 @@ const CompletionContentEventSchema = z$1.object({
 		"tool_use",
 		"best-effort"
 	]).optional(),
+	stopReason: z$1.string().optional(),
 	thinking: z$1.array(z$1.any()).optional()
 });
 const CompletionSseErrorEventSchema = z$1.object({
@@ -5294,7 +6016,7 @@ const BFL_SAFETY_TOLERANCE = {
 */
 const BFLSafetyToleranceSchema = z$1.number().min(BFL_SAFETY_TOLERANCE.MIN).max(BFL_SAFETY_TOLERANCE.LEGACY_INPUT_MAX).optional().prefault(BFL_SAFETY_TOLERANCE.DEFAULT).transform((value) => Math.min(value, BFL_SAFETY_TOLERANCE.MAX));
 /**
-* List of image models supported by BlackForest Labs
+* List of image models supported by Black Forest Labs
 */
 const BFL_IMAGE_MODELS = [
 	"flux-pro-1.1",
@@ -5595,6 +6317,32 @@ z$1.enum([
 	"complex"
 ]);
 z$1.preprocess((v) => Array.isArray(v) ? v.at(-1) : v, z$1.union([z$1.boolean(), z$1.string()])).prefault(false).transform((v) => ["true", "1"].includes(String(v).toLowerCase())).catch(false);
+const SessionTagSchema = z$1.object({
+	name: z$1.string(),
+	strength: z$1.number()
+});
+z$1.object({
+	name: z$1.string().min(1).optional(),
+	knowledgeIds: z$1.array(z$1.string()).optional(),
+	artifactIds: z$1.array(z$1.string()).optional(),
+	tags: z$1.array(SessionTagSchema).optional(),
+	lastUsedModel: z$1.string().min(1).nullish().describe("Pin a specific model id, or omit/send null to leave the current pin unchanged. Sending null does NOT clear it."),
+	forceKnowledgeRetrieval: z$1.boolean().optional(),
+	propagateToProjects: z$1.boolean().optional().describe("Defaults to true when omitted. When knowledgeIds grows, the newly-added file ids are also appended to every project that contains this session, granting every member of that project access to those files. This propagation is append-only and cannot be undone through the UI - pass false if newly-attached files should not be shared with the project.")
+});
+z$1.object({ id: z$1.string().min(1) });
+z$1.object({
+	id: z$1.string(),
+	name: z$1.string(),
+	userId: z$1.string(),
+	knowledgeIds: z$1.array(z$1.string()).optional(),
+	artifactIds: z$1.array(z$1.string()).optional(),
+	tags: z$1.array(SessionTagSchema).optional(),
+	forceKnowledgeRetrieval: z$1.boolean().optional(),
+	lastUsedModel: z$1.string().nullish(),
+	firstCreated: z$1.date(),
+	lastUpdated: z$1.date()
+});
 z$2.enum([
 	"",
 	"TFG",
@@ -5662,16 +6410,200 @@ z$2.object({
 	isOnline: z$2.boolean()
 });
 /**
-* Model-INDEPENDENT sanity ceiling for a configured passage target, in tokens. A passage larger
-* than a full typical embedding context window (~8K) defeats retrieval granularity - one vector
-* would average a whole document (see DEFAULT_PASSAGE_TOKEN_TARGET). This bounds the scoped
-* `DefaultChunkSize` setting (#1662) where the specific embedding model is NOT known (the resolver
-* clamp is pure); the EXACT per-model embedding-window cap is enforced downstream by the chunker
-* (`effectiveChunkTokenLimit` in fab-pipeline), which knows the model and reduces further if needed.
+* A chunk larger than this (in tokens) marks a file whose chunking predates the passage-target
+* fix: a whole-document / whole-section blob rather than a ~512-token passage. Used to detect the
+* files a lake "Rebuild passages" pass should re-chunk. Deliberately well above
+* DEFAULT_PASSAGE_TOKEN_TARGET (512) so a correctly-chunked passage never trips it, and below the
+* ~6.5K model-window packing the old chunker produced, so every legacy blob does.
+*/
+const OVERSIZED_PASSAGE_TOKEN_THRESHOLD = 1500;
+/**
+* Why a file's chunk/vector pipeline is STALLED, stored in `FabFile.chunkStallReason`.
+*
+*  - `vectorizePaused`: the data-lake convergence kill switch abandoned a vectorize (#1676). The
+*    file keeps its chunks but has no vectors, so it is unsearchable until re-indexed.
+*  - `rechunkPaused`: the OTHER half of the same switch dropped a re-chunk before it ran
+*    (#1676/#1681). The damage is worse - the producer resets a wave's chunk state BEFORE the
+*    messages are handled, so a file halted here has NO chunks at all.
+*  - `unchunkedPaused`: the same chunk half, on a file that never had passages to lose. The rescue
+*    sweep selects on `chunkCount: 0` and enqueues without resetting anything, so a file it routes
+*    into the halt branch arrives already empty. The halted STATE is identical to `rechunkPaused`
+*    and every reader keys on both (CHUNKLESS_STALL_REASONS) - the split exists so the owner is not
+*    told that passages were removed which never existed.
+*
+* None auto-resumes; each needs a reprocess or a lifted switch.
+*
+* Without a marker the state is misread by every surface at once, which is the failure the field
+* exists to prevent: `chunkCount: 0` with `error: null` reads as an image or a pending upload, so
+* health drops it from the denominator, convergence grades it `conformant` (its stale stamp still
+* matches), and search does not withhold it because it is not "in flight". The file's passages are
+* simply gone and nothing REPORTS it. The rescue sweep is the one exception and deliberately so: an
+* unmarked file matches its filter and gets re-chunked, which is repair rather than reporting. That
+* is why the sweep excludes a stalled file only while the switch is ON - see
+* buildFabFileChunkScanFilter.
+*
+* A dedicated field rather than prose in `FabFile.notes` (#2016): `notes` is the USER's note, and
+* while the markers lived there every writer of the field clobbered the others - a "Rebuild
+* passages" wave silently deleted whatever the owner had typed.
+*
+* Lives here rather than beside its writers (apps/client's chunk and vectorize handlers) because it
+* is a cross-layer contract: the queue handlers write it and b4m-core's evaluators
+* (constants/lakeHealth.ts, constants/lakeConvergence.ts, dataLakeService/retrievalUnavailable.ts)
+* read it to tell a permanently-stalled file from one still in flight. b4m-core cannot import from
+* apps/client, so a copy there would have to drift silently.
+*/
+const CHUNK_STALL_REASONS = [
+	"vectorizePaused",
+	"rechunkPaused",
+	"unchunkedPaused"
+];
+/**
+* Whether a file is stalled by the convergence kill switch, by any arm. THE predicate every
+* reader uses, so adding a stall reason reaches health, convergence and retrieval without separate
+* comparisons drifting apart. Also the in-memory mirror of a Mongo
+* `chunkStallReason: { $in: [...CHUNK_STALL_REASONS] }`.
+*/
+function isChunkStalled(reason) {
+	return CHUNK_STALL_REASONS.includes(reason);
+}
+/**
+* Which reasons leave the file with NO passages, as opposed to passages with no vectors. A `Record`
+* over every reason rather than a hand-written subset array: a new stall reason then cannot compile
+* until it is classified, where a member missing from a literal array would just make a health count
+* silently wrong.
+*/
+const STALL_LEAVES_NO_PASSAGES = {
+	vectorizePaused: false,
+	rechunkPaused: true,
+	unchunkedPaused: true
+};
+CHUNK_STALL_REASONS.filter((reason) => STALL_LEAVES_NO_PASSAGES[reason]);
+/**
+* Owner-facing prose for a stall reason, and the ONLY place it is worded.
+*
+* `vectorizePaused` and `rechunkPaused` are the exact strings those markers used while they lived in
+* `notes`, which is also what the #2016 migration matches on to derive the field for existing rows -
+* do not reword either without updating it. `unchunkedPaused` postdates that migration and was never
+* written to `notes`, so its wording is free to change: nothing matches on it.
 */
-const MAX_PASSAGE_TOKEN_TARGET = 8192;
+const CHUNK_STALL_NOTICES = {
+	vectorizePaused: "Indexing paused by the data-lake convergence kill switch - reprocess to complete.",
+	rechunkPaused: "Re-chunking paused by the data-lake convergence kill switch - its passages were removed and are rebuilt when convergence resumes.",
+	unchunkedPaused: "Chunking paused by the data-lake convergence kill switch - this file has no passages yet and they are built when convergence resumes."
+};
+CHUNK_STALL_NOTICES.vectorizePaused;
+CHUNK_STALL_NOTICES.rechunkPaused;
+/**
+* TRANSITIONAL, and the ONE stall predicate every RETRIEVAL path must use until #2016's migration
+* has run in every environment. Reads the new field, then falls back to the legacy prose that the
+* pre-migration rows still carry in `notes`.
+*
+* It exists for the FORWARD window only: `migratorInvocation` is a `dependsOn` of the web stack
+* only (infra/web.ts); the queue stack has none, so the executor can serve forced retrieval and
+* `knowledge_base_search` while rows still carry the marker in `notes` and no `chunkStallReason`. A
+* row stalled by the chunk arm then reads as a plain unindexed file: `isRetrievalExcluded` drops it
+* upstream of the withhold on a vectorizedOnly lake, and `partitionByIndexAvailability` calls it
+* servable everywhere else. The turn answers around a passage-less file and reports FULL coverage -
+* the silent degradation this whole path exists to prevent.
+*
+* A code ROLLBACK is the mirror image and this arm CANNOT cover it: the rows are already migrated
+* (`chunkStallReason` set, `notes` unset) and the code restored is pre-#2016, which does not contain
+* this function. Nothing reverts the data on its own either - `migratorInvocation` only ever runs
+* `up` and `migrate down` is a manual CLI step - so `migrate down` is a REQUIRED step of any
+* rollback past #2016, not an optional tidy-up. What this arm does buy is that `down()` is safe to
+* run FIRST: whichever stack is still new keeps honoring the prose it restores, so a staggered
+* rollback has no window where a restored marker is invisible. `down()` is a PARTIAL restore
+* though - it skips a row whose owner typed a note after `up()`, and that row grades as unstalled
+* on both stacks once the field is dropped. See its own comment.
+*
+* Deliberately NOT used by the grading/health/UI readers: they are gated behind the web stack, and
+* a legacy row there renders the notice line AND the identical text as the owner's note.
+*
+* Mirrored in Mongo by `buildFabFileSearchQuery`'s `vectorizedOnly` exemption. Delete the legacy arm
+* from both together, one release after the migration has landed everywhere.
+*
+* Pinned to the two reasons the migration backfilled rather than every notice: `unchunkedPaused`
+* postdates it, so no row carries its prose, and including it would read an owner who happens to type
+* that sentence into `notes` as stalled.
+*/
+const LEGACY_CHUNK_STALL_NOTES = [CHUNK_STALL_NOTICES.vectorizePaused, CHUNK_STALL_NOTICES.rechunkPaused];
+function isChunkStalledFile(file) {
+	return isChunkStalled(file.chunkStallReason) || LEGACY_CHUNK_STALL_NOTES.includes(file.notes ?? "");
+}
+/**
+* `FabFile.chunkRebuildRequestedAt`: stamped by `resetChunkStateByIds` in the SAME write that
+* clears a file's chunk rollups, so "this file's passages are being rebuilt" can never be lost the
+* way the pair of steps that creates the state can be. The reset and the queue send are two
+* operations - kill the producer between them, or lose the consumer's marker write, and the file
+* sits at `chunkCount: 0` with `error: null` and no stall reason, a shape indistinguishable from an
+* image or a still-uploading row. It then drops out of lake health's denominator, out of the
+* convergence plan and out of the retrieval withhold at the same moment: every rollup says its
+* passages are gone, and nothing reports it.
+*
+* Deliberately NOT the `rechunkPaused` stall reason pre-written by the producer, which is the obvious
+* fix and the wrong one: that marker means "halted, needs an administrator", so a file awaiting an
+* ORDINARY rebuild would read to every reader as permanently paused for the whole rebuild - search
+* would tell readers it does not return on its own, health would hard-fail P3, and "Rebuild
+* passages" would offer to repair a file that is already repairing. A flag that cries wolf on the
+* normal path is worse than the rare window it closes.
+*
+* So the two facts are distinct states, and the consumer UPGRADES one to the other: pending means
+* "in flight, returns on its own", the paused note means "halted, needs intervention". A LOST
+* upgrade therefore degrades to mislabelled-but-visible rather than invisible, which is the trade
+* this field exists to make - invisibility is the real harm, labelling is secondary.
+*
+* A dedicated field on purpose, and the precedent #2016 followed for the other two machine-written
+* facts: while they all shared `notes` every writer of that field clobbered the others, including
+* the user's own note.
+*
+* Cleared by `commitFabFileChunks` (the rebuild landed) and by the chunk handler's pause write (the
+* rebuild was halted instead). A file carrying `error` is settled regardless - see
+* `isMemberIndexingInFlight`, which is where the precedence between these three lives.
+*/
+function isChunkRebuildPending(requestedAt) {
+	return requestedAt !== null && requestedAt !== void 0 && requestedAt !== "";
+}
 /** Ceiling so "adjustable" cannot mean "unbounded" in either direction. */
 const LAKE_ACCESS_AUDIT_RETENTION_MAX_DAYS = 2555;
+/**
+* Lake CONFIG-change audit retention and value caps.
+*
+* Twin of `constants/lakeAccessAudit.ts` and here for the same reason: the values are needed by
+* both the admin-settings schema in this package and by the repository that applies them
+* (`packages/database`, which cannot import an app-server layer).
+*
+* DELIBERATELY NOT the same numbers as the read audit, and deliberately not the same lever. A
+* retrieval is frequent, low-value and cheap to lose; a config change is rare, high-value and
+* alters every future answer the lake gives, so the two want opposite retention. Folding config
+* changes into the read collection would force one of them onto the other's clock - either a
+* config change expiring on a read-volume schedule, or a high-volume collection's storage
+* multiplied to serve a low-volume need.
+*
+* Same one-way ratchet as the read side (#1658's levers rule): `resolveLakeConfigAuditRetentionDays`
+* can only raise a configured value to the floor, never lower it, so an org cannot configure its
+* own retention down to nothing and defeat the control. Platform-level, not per-org: the setting
+* carries no `scope.settableAt`, so #1660's resolver returns the platform value at every scope.
+*/
+/** 3 years: long enough to outlive a typical contract and audit cycle, on a collection whose
+* volume is a few rows per lake per year. Longer than the read audit's 450 days on purpose - the
+* rarer and more consequential the event, the longer it is worth keeping. */
+const LAKE_CONFIG_AUDIT_RETENTION_FLOOR_DAYS = 1095;
+/** A separate constant from the floor on purpose, even though they agree today - a future change
+* to one must not silently move the other. */
+const LAKE_CONFIG_AUDIT_RETENTION_DEFAULT_DAYS = 1095;
+/** Ceiling so "adjustable" cannot mean "unbounded" in either direction. */
+const LAKE_CONFIG_AUDIT_RETENTION_MAX_DAYS = 3650;
+/**
+* Forced-retrieval budget and relevance defaults, shared between the admin-settings schema in this
+* package and `ChatCompletionFeatures.ts` (which cannot import from `common`'s settings schema
+* without a dependency cycle, so the constants live here instead).
+*
+* All three are levers. The char budget is the measured binding constraint on how much of a corpus
+* reaches the model on every Data-Lake-mode turn; the two floors decide which passages are eligible
+* to spend it (see `forcedRetrievalRelativeFloorPct` and `forcedRetrievalMinSimilarityPct`).
+*/
+/** Total characters of retrieved chunk text injected into a forced-retrieval prompt. */
+const FORCED_RETRIEVAL_CHAR_BUDGET_DEFAULT = 12e3;
 let OpenAIEmbeddingModel = /* @__PURE__ */ function(OpenAIEmbeddingModel) {
 	OpenAIEmbeddingModel["TEXT_EMBEDDING_3_SMALL"] = "text-embedding-3-small";
 	OpenAIEmbeddingModel["TEXT_EMBEDDING_3_LARGE"] = "text-embedding-3-large";
@@ -5826,6 +6758,76 @@ const HELP_CENTER_PROMPT = `HELP CENTER: Bike4Mind has a built-in Help Center th
 */
 const ABSTENTION_PROMPT = `When a request is underspecified or your sources do not cover it, say so and name what is missing. "I do not have enough to answer that" is a correct, high-value answer. Never invent facts about the user, their business, or their data, and never state a specific customer, competitor, deal, or figure as fact - or cite a source for it - unless your sources support it, even when the question assumes it.`;
 /**
+* Default text for the web-search freshness nudge, and the `WebSearchFreshnessPrompt` admin
+* setting's default.
+*
+* Unlike ABSTENTION_PROMPT / ARTIFACT_EMISSION_PROMPT / HELP_CENTER_PROMPT, this setting
+* distinguishes an absent row from a cleared one. ChatCompletionProcess reads it 2-arg, so an
+* absent row still falls back to this constant as the setting's registered default, but a cleared
+* '' is returned verbatim and drops the section rather than reverting. The siblings are read 3-arg
+* and collapse both cases to the constant. That divergence is deliberate - this section has no
+* companion boolean, so clearing the field is the only off switch it has. Keep the setting's
+* description in sync with that if either changes.
+*
+* Names no tool but `web_search`: the section is gated on web_search being offered, and web_fetch
+* is an independent toggle that may well be off.
+*/
+const WEB_SEARCH_FRESHNESS_PROMPT = `# WEB SEARCH AND FRESHNESS
+
+Your training data has a cutoff. The current date is supplied to you in this conversation's system context - treat it as authoritative, and assume anything time-sensitive may have changed since your training.
+
+Call \`web_search\` BEFORE answering when the answer depends on a fact that changes over time: current prices or rates, product availability or roadmap status, funding, organizational or personnel changes, published benchmarks or performance figures, competitive positioning, or anything the user frames as "current", "latest", "now", or "as of today". When a stale answer would mislead, search instead of answering from memory. When a search surfaces a specific page that matters, or the user names one, read that page directly rather than answering from the snippet.
+
+You do not need to search for stable knowledge (definitions, mathematics, established theory), or for questions answerable purely from this conversation or from documents already retrieved for you.
+
+When you report a time-sensitive fact, state what it is as of - the date of the source you used - and say plainly when you could not verify something and are answering from training data instead. Never present an unverified recollection as a current fact.`;
+/**
+* Default text for the knowledge-base retrieval nudge, and the `KnowledgeBaseRetrievalPrompt`
+* admin setting's default.
+*
+* The gap this closes: the tool prompt has a when-to-use section for the clock, for web search,
+* for MCP and for agent delegation, and none for the user's own corpus. The
+* `search_knowledge_base` description is entirely HOW to search ("Make ONE good search per
+* distinct topic") and never WHEN, so on the optional path the model decides unaided - and over 30
+* days of production it reached for the corpus on 20.1% of the turns it was offered on.
+*
+* Read 2-arg by ChatCompletionProcess, exactly as WEB_SEARCH_FRESHNESS_PROMPT is and unlike the
+* 3-arg siblings: an absent row falls back to this constant as the registered default, but a
+* cleared '' is returned verbatim and drops the section instead of reverting. Deliberate - the
+* section has no companion boolean, so clearing the field is its only off switch, and that off
+* switch is what makes it A/B-able without a deploy. Keep the setting's description in sync.
+*
+* Names no tool but `search_knowledge_base`, for the same reason the web-search section names no
+* `web_fetch`: the companion `retrieve_knowledge_content` is paired in at build time but a session
+* denylist can still strip it (ChatCompletionProcess warns on exactly that case), and instructing
+* the model to call a tool it was not given makes it emit the call as leaked JSON text.
+*
+* The "do not search" paragraph is load-bearing, not padding. A when-to-retrieve nudge without a
+* don't-retrieve clause buys retrieval on turns that need none - the same failure mode global
+* forced retrieval already shows on out-of-corpus questions, reached by a different route. Three of
+* its clauses are load-bearing for a specific co-resident path, not general hedging:
+* - "from an attached document" - a small attached corpus is INLINED rather than deferred to
+*   retrieval (`shouldDeferCorpusToRetrieval`), and forced retrieval deliberately steps aside on
+*   an attached-files turn (`forcedRetrievalAbstention` emits nothing there). Without this clause
+*   the section tells the model to go searching for content already sitting in its context.
+* - "already been searched on this turn" - on a forced turn that found nothing,
+*   `forcedRetrievalNoContextPrompt` instructs the model to say the library does not cover the
+*   question. A nudge to search then invites a second identical query - a billed query embedding,
+*   and a chance to talk itself out of a correct abstention.
+* - the opening scope, "unless its content has been placed in this conversation" - the reason the
+*   first paragraph does not simply claim the documents are invisible, which is false whenever a
+*   corpus was inlined.
+*/
+const KNOWLEDGE_BASE_RETRIEVAL_PROMPT = `# KNOWLEDGE BASE
+
+\`search_knowledge_base\` searches a library of documents the user has made available to you - their own uploads, and any shared or organization library they can reach. You cannot see what a document holds unless its content has been placed in this conversation or you search for it; file names and tags are labels, not content.
+
+Call \`search_knowledge_base\` BEFORE answering when that library would settle the question: anything about their organization, projects, customers, products, processes or people; a term, name, acronym or identifier that is not general public knowledge; a policy, decision, figure or date specific to them; or a question that assumes context this conversation never gave you. If you are about to answer in general terms a question the user means specifically, search first. A general-knowledge answer that sounds right is the failure this library exists to prevent.
+
+Do not search when the answer is already in front of you or out of scope: general knowledge (definitions, mathematics, established theory, public facts); anything answerable from this conversation, from an attached document, or from content already retrieved for you this turn; or a request to transform, summarize or reformat text the user has just supplied. If the library has already been searched on this turn, do not search it again for the same question - a repeat spends a round trip to return the same passages.
+
+When a search does not turn up what was asked for, say so plainly rather than filling the gap from training data, and never imply an answer came from the user's documents when it did not.`;
+/**
 * Default text for the formatting system message. Runtime fallback used by
 * `includeHardcodedSystemMessage` (b4m-core/utils/src/llm/utils.ts) when the `FormatPromptTemplate`
 * admin setting is blank; that setting's own default is intentionally '' - keep this the sole home.
@@ -5858,6 +6860,8 @@ z$1.enum([
 	"ArtifactEmissionPrompt",
 	"HelpCenterPrompt",
 	"AbstentionPrompt",
+	"WebSearchFreshnessPrompt",
+	"KnowledgeBaseRetrievalPrompt",
 	"UseFormatPrompt",
 	"EnableQuestMaster",
 	"EnableQuestMasterDefault",
@@ -5876,12 +6880,16 @@ z$1.enum([
 	"EnableLattice",
 	"EnableLatticeDefault",
 	"EnableDataLakes",
-	"EnableDataLakesDefault",
 	"EnableDataLakeSlackAdd",
 	"EnableDataLakeGroundingMode",
 	"EnableLakeMemory",
 	"EnableDataLakeVectorSearch",
+	"EnableRetrievalSupersessionCollapse",
 	"PauseLakeConvergence",
+	"LakeConvergenceBulkChangeSharePct",
+	"EnforceLakeReadGrants",
+	"EnableDataLakeDrivePoll",
+	"EnforceLakeAdmission",
 	"EnableBriefcase",
 	"EnableBriefcaseDefault",
 	"EnableImageTemplates",
@@ -5907,6 +6915,7 @@ z$1.enum([
 	"ReferralCreditsAmount",
 	"registrationLink",
 	"FeedbackReceiveEmail",
+	"FeedbackReceiveEmailNonProd",
 	"FeedbackKyle",
 	"EnableFeedBackToEmail",
 	"EnableFeedBackToSlack",
@@ -5972,15 +6981,26 @@ z$1.enum([
 	"defaultEmbeddingModel",
 	"dataLakeSearchMaxFiles",
 	"dataLakeSearchMaxChunks",
+	"forcedRetrievalCharBudget",
+	"lakeMemoryRecallK",
+	"kbSearchDefaultResults",
+	"kbSearchResultTokenBudget",
+	"kbSearchMinRelevancePct",
+	"forcedRetrievalRelativeFloorPct",
+	"forcedRetrievalMinSimilarityPct",
 	"dataLakeEmbeddingSpendEnabled",
 	"dataLakeEmbeddingBudgetPerRunUsd",
 	"dataLakeEmbeddingBudgetPerLakeUsd",
 	"dataLakeEmbeddingBudgetPerPeriodUsd",
 	"dataLakeEmbeddingBudgetPeriodHours",
 	"dataLakeEmbeddingMaxCallsPerMinute",
+	"dataLakeEmbeddingMaxTokensPerMinute",
 	"dataLakeVectorizeChunkBatchSize",
+	"dataLakeEmbeddingTierMultiplierIndividual",
+	"dataLakeEmbeddingTierMultiplierOrganization",
 	"LakeAccessAuditRetentionDays",
 	"LakeAccessQueryTextRetentionDays",
+	"LakeConfigAuditRetentionDays",
 	"MaxContentLength",
 	"enableAutoChunk",
 	"SlackDefaultWebhookUrl",
@@ -5988,6 +7008,7 @@ z$1.enum([
 	"SlackLiveopsWebhookUrl",
 	"SlackUserActivityWebhookUrl",
 	"SlackFeedbackWebhookUrl",
+	"SlackNonProdFeedbackWebhookUrl",
 	"SlackEmailAuditWebhookUrl",
 	"slackSigningSecret",
 	"slackBotToken",
@@ -6022,7 +7043,6 @@ z$1.enum([
 	"EnableBmPiDefault",
 	"EnableBmPiJira",
 	"EnableOptiHashi",
-	"EnableOptiHashiDefault",
 	"EnableComputeSubmission",
 	"EnableFamilyCompute",
 	"EnableHybridCompute",
@@ -6052,7 +7072,7 @@ z$1.enum([
 	"modelDiscoveryAutoRemap",
 	"prReportRepo",
 	"prReportIdentityMap",
-	"prReportSlackChannel",
+	"prReportWebhookUrl",
 	"prReportEgressAllowlist"
 ]);
 /**
@@ -6092,10 +7112,12 @@ const OrchestrationDefaultsSchema = z$1.object({
 		"mermaid_chart"
 	]),
 	/**
-	* Tool names explicitly forbidden. Enforced as a final subtraction in
-	* `pickEffectiveEnabledTools` - wins even over payload-pinned tools - so this
-	* is the defense-in-depth backstop for the case where an admin broadens
-	* `allowedTools` without realizing a parallel denylist is also needed.
+	* Tool names explicitly forbidden. Enforced in two places: as a final subtraction in
+	* `pickEffectiveEnabledTools` (wins even over payload-pinned tools), and - for the two
+	* delegation tools, which are injected as objects and never registered by name - at the
+	* dependency gate in agentExecutor (`delegationOffer` withholds `agentStore` /
+	* `dagDispatcher`). The name subtraction alone cannot reach those two; see
+	* agentExecutor.sessionToolPolicy.
 	*
 	* Seeded with every tool that mutates user data (the spec's
 	* "anything tagged `mutates_user_data`"): destructive/overwriting filesystem
@@ -6173,8 +7195,30 @@ const DATA_LAKE_SEARCH_MAX_CHUNKS_DEFAULT = 1e5;
 const DATA_LAKE_EMBEDDING_BUDGET_PER_LAKE_USD_MAX = 1e4;
 const DATA_LAKE_EMBEDDING_BUDGET_PER_PERIOD_USD_MAX = 5e3;
 const DATA_LAKE_EMBEDDING_MAX_CALLS_PER_MINUTE_MAX = 1e4;
+/**
+* The TOKEN half of the throughput cap, and the one that maps to what providers actually meter.
+* A call cap alone does not bound tokens: one call carries up to
+* DATA_LAKE_VECTORIZE_CHUNK_BATCH_SIZE_DEFAULT passages of DEFAULT_PASSAGE_TOKEN_TARGET tokens, so
+* 120 calls/min permits ~3.1M tokens/min - several times the smallest paid embeddings tier. The two
+* levers are complementary: calls/min bounds RPM, this bounds TPM, and a call must fit both.
+*
+* The default is deliberately LOW - it has to be safe on the smallest tier any deployment might
+* be on, including self-hosts nobody here can see. It is not a claim about what any particular
+* account can do, and reading it as one is the mistake to avoid: a provider tier is a property of
+* the provider organization, so it cannot be derived from this codebase at all.
+*
+* The real number is measurable per deployment: Admin -> Settings -> AI -> Data Lake Cost
+* Governance reads the configured provider's live ceiling (GET /api/admin/embedding-limits) and
+* shows it beside this lever, so an operator sets this from their own measured quota rather than
+* from a guess baked in here. Leave headroom below the measured ceiling for QUERY-side embedding,
+* which is exempt from this gate (see enforceEmbeddingSpendGate) and shares the same per-model
+* pool - a retrieval query must not queue behind a backfill.
+*/
+const DATA_LAKE_EMBEDDING_MAX_TOKENS_PER_MINUTE_DEFAULT = 6e5;
+const DATA_LAKE_EMBEDDING_MAX_TOKENS_PER_MINUTE_MAX = 5e7;
 function makeNumberSetting(config) {
 	let numberSchema = z$1.coerce.number();
+	if (config.int) numberSchema = numberSchema.int();
 	if (config.min !== void 0) numberSchema = numberSchema.min(config.min);
 	if (config.max !== void 0) numberSchema = numberSchema.max(config.max);
 	return {
@@ -6741,6 +7785,14 @@ const API_SERVICE_GROUPS = {
 			{
 				key: "AbstentionPrompt",
 				order: 11
+			},
+			{
+				key: "WebSearchFreshnessPrompt",
+				order: 12
+			},
+			{
+				key: "KnowledgeBaseRetrievalPrompt",
+				order: 13
 			}
 		]
 	},
@@ -6761,13 +7813,41 @@ const API_SERVICE_GROUPS = {
 			{
 				key: "dataLakeSearchMaxChunks",
 				order: 3
+			},
+			{
+				key: "forcedRetrievalCharBudget",
+				order: 4
+			},
+			{
+				key: "kbSearchDefaultResults",
+				order: 5
+			},
+			{
+				key: "kbSearchResultTokenBudget",
+				order: 6
+			},
+			{
+				key: "kbSearchMinRelevancePct",
+				order: 7
+			},
+			{
+				key: "lakeMemoryRecallK",
+				order: 8
+			},
+			{
+				key: "forcedRetrievalRelativeFloorPct",
+				order: 9
+			},
+			{
+				key: "forcedRetrievalMinSimilarityPct",
+				order: 10
 			}
 		]
 	},
 	DATA_LAKE_COST: {
 		id: "dataLakeCostGovernance",
 		name: "Data Lake Cost Governance",
-		description: "Spend levers for data-lake embedding work (ingestion, reprocessing, convergence). Budgets are USD; 0 means stop spending, not \"use the default\".",
+		description: "Spend levers for data-lake embedding work (ingestion, reprocessing, convergence). Budgets are USD; 0 means stop spending, not \"use the default\". The two tier multipliers scale the per-run and per-lake budgets by whether a lake is individual- or organization-owned.",
 		icon: "Savings",
 		settings: [
 			{
@@ -6795,8 +7875,20 @@ const API_SERVICE_GROUPS = {
 				order: 6
 			},
 			{
-				key: "dataLakeVectorizeChunkBatchSize",
+				key: "dataLakeEmbeddingMaxTokensPerMinute",
 				order: 7
+			},
+			{
+				key: "dataLakeVectorizeChunkBatchSize",
+				order: 8
+			},
+			{
+				key: "dataLakeEmbeddingTierMultiplierIndividual",
+				order: 9
+			},
+			{
+				key: "dataLakeEmbeddingTierMultiplierOrganization",
+				order: 10
 			}
 		]
 	},
@@ -7045,6 +8137,14 @@ const API_SERVICE_GROUPS = {
 				key: "SlackEmailAuditWebhookUrl",
 				order: 6.5
 			},
+			{
+				key: "SlackFeedbackWebhookUrl",
+				order: 6.75
+			},
+			{
+				key: "SlackNonProdFeedbackWebhookUrl",
+				order: 6.8
+			},
 			{
 				key: "FeedbackSendEmailUsername",
 				order: 7
@@ -7057,6 +8157,10 @@ const API_SERVICE_GROUPS = {
 				key: "FeedbackReceiveEmail",
 				order: 9
 			},
+			{
+				key: "FeedbackReceiveEmailNonProd",
+				order: 9.5
+			},
 			{
 				key: "liveFeedbackEmail",
 				order: 10
@@ -7181,10 +8285,6 @@ const API_SERVICE_GROUPS = {
 				key: "EnableOptiHashi",
 				order: 80
 			},
-			{
-				key: "EnableOptiHashiDefault",
-				order: 81
-			},
 			{
 				key: "EnableComputeSubmission",
 				order: 82
@@ -7572,16 +8672,23 @@ const API_SERVICE_GROUPS = {
 	},
 	DATA_LAKE_AUDIT: {
 		id: "dataLakeAuditService",
-		name: "Data Lake Access Audit",
-		description: "Retention for the lake access audit trail and its opt-in query-text log",
+		name: "Data Lake Audit",
+		description: "Retention for the lake audit trail: who READ a lake (plus the opt-in query-text log) and who CHANGED its configuration",
 		icon: "Security",
-		settings: [{
-			key: "LakeAccessAuditRetentionDays",
-			order: 1
-		}, {
-			key: "LakeAccessQueryTextRetentionDays",
-			order: 2
-		}]
+		settings: [
+			{
+				key: "LakeAccessAuditRetentionDays",
+				order: 1
+			},
+			{
+				key: "LakeAccessQueryTextRetentionDays",
+				order: 2
+			},
+			{
+				key: "LakeConfigAuditRetentionDays",
+				order: 3
+			}
+		]
 	}
 };
 const settingsMap = {
@@ -7673,21 +8780,11 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
 		order: 88
 	}),
-	EnableDataLakesDefault: makeBooleanSetting({
-		key: "EnableDataLakesDefault",
-		name: "Data Lakes: On by default for users",
-		defaultValue: false,
-		description: "When enabled, Data Lakes is active for users who have never explicitly toggled it.",
-		category: "Experimental",
-		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
-		order: 89,
-		dependsOn: "EnableDataLakes"
-	}),
 	EnableDataLakeSlackAdd: makeBooleanSetting({
 		key: "EnableDataLakeSlackAdd",
 		name: "Data Lakes: Slack \"@datalake add\" path",
-		defaultValue: false,
-		description: "Server-side gate for adding content to a Data Lake from Slack via \"@datalake add\". Off by default - the Slack command is intercepted deterministically but performs no ingest until this is turned on.",
+		defaultValue: true,
+		description: "Server-side gate for adding content to a Data Lake from Slack via \"@datalake add\". On by default. Turn OFF to make the Slack command inert - it is still intercepted deterministically, so the bot stays silent rather than falling through to the LLM.",
 		category: "Experimental",
 		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
 		order: 90,
@@ -7707,7 +8804,7 @@ const settingsMap = {
 		key: "EnableLakeMemory",
 		name: "Data Lakes: Lake memory profile (extraction)",
 		defaultValue: false,
-		description: "Server-side gate for the lake memory producer - LLM extraction of a data lake's documents into a durable memory profile on ingest. Off by default (measurement rollout); the consumer that injects the profile is inert until this is on and a lake has been extracted.",
+		description: "Master gate for lake memory, on all three sides: LLM extraction of a data lake's documents into a durable memory profile, recall of that profile into chats grounded in the lake, and whether the per-lake opt-in is offered at all. Off by default (measurement rollout). Turning it off stops recall immediately and stops new extractions from being queued or picked up, though a run already in flight finishes its slice (bounded by the handler timeout). It is NOT destructive - each lake keeps its own opt-in and its built profile, so flipping this back on resumes where it left off. Erasing a profile is a separate, explicit per-lake action.",
 		category: "Experimental",
 		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
 		order: 91,
@@ -7723,11 +8820,21 @@ const settingsMap = {
 		order: 92,
 		dependsOn: "EnableDataLakes"
 	}),
+	EnableRetrievalSupersessionCollapse: makeBooleanSetting({
+		key: "EnableRetrievalSupersessionCollapse",
+		name: "Data Lakes: Collapse superseded members before ranking",
+		defaultValue: false,
+		description: "When a lake holds two generations of the same document (a re-upload, a Drive sync, a migration), rank only the newest and report the suppression. Off by default: the weakest identity tier is a bare file name, so two genuinely different documents sharing a name in one lake would collapse to one - turn this on only after checking the reported collapse counts on real lakes. Suppression is recoverable either way; a collapsed member is still reachable by id or name through retrieve_knowledge_content.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 97,
+		dependsOn: "EnableDataLakes"
+	}),
 	PauseLakeConvergence: makeBooleanSetting({
 		key: "PauseLakeConvergence",
 		name: "Data Lakes: Pause background convergence work",
 		defaultValue: false,
-		description: "Kill switch for background data-lake ingestion work (convergence sweeps, rescue re-chunking) - NOT real-time user uploads, which are always honored. Off by default. Turn ON to halt in-flight background chunk/vectorize messages the next time the handler picks them up (a re-check inside the shared handler, so it takes effect on work already queued, not just the next scheduling pass). The platform value pauses every lake at once; a per-lake (or per-org / per-owner) override pauses a subset while the rest keep running. A platform-level flip applies immediately to lake-wide work and within ~5 min to per-lake-scoped work (settings cache).",
+		description: "Kill switch for background data-lake ingestion work (convergence sweeps, rescue re-chunking) - NOT real-time user uploads, which are always honored. Off by default. Turn ON to halt in-flight background chunk/vectorize messages the next time the handler picks them up (a re-check inside the shared handler, so it takes effect on work already queued, not just the next scheduling pass). The platform value pauses every lake at once; a per-lake (or per-org / per-owner) override pauses a subset while the rest keep running - including overriding a platform-wide pause back OFF for one lake. Every producer honors the override, the global chunk rescue sweep included: it resolves each candidate against the lake it belongs to (#2157), so a file in no lake at all follows the platform value, which is correct for it. A platform-level flip applies immediately to lake-wide work and within ~5 min to per-lake-scoped work (settings cache).",
 		category: "Experimental",
 		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
 		order: 93,
@@ -7738,6 +8845,57 @@ const settingsMap = {
 			"lake"
 		] }
 	}),
+	LakeConvergenceBulkChangeSharePct: makeNumberSetting({
+		key: "LakeConvergenceBulkChangeSharePct",
+		name: "Data Lakes: Convergence bulk-change confirmation threshold (%)",
+		defaultValue: 25,
+		min: 1,
+		max: 100,
+		description: "Share of a data lake, as a percentage of its gradable members, above which owner-triggered convergence (#1681) requires an explicit confirmation before it rewrites anything. A mass rewrite is the signature of a misconfigured chunk policy, and every individual change inside one looks locally reasonable, so the share is the only place the mistake is visible. The guard is suppressed on lakes with fewer gradable members than the plan needs for a percentage to mean anything. Lower it to make convergence ask more often; it never blocks a confirmed run.",
+		category: "AI",
+		order: 4,
+		dependsOn: "EnableDataLakes",
+		scope: { settableAt: [
+			"organization",
+			"owner",
+			"lake"
+		] }
+	}),
+	EnforceLakeReadGrants: makeBooleanSetting({
+		key: "EnforceLakeReadGrants",
+		name: "Data Lakes: Enforce read-time grant resolution",
+		defaultValue: true,
+		description: "Read-time grant resolution (#1673). ON is the shipped default: a persisted READER or ORG grant is resolved into the read decision, so a principal a lake was shared with can browse it, open it and ground on it. Resolution is purely ADDITIVE (legacy OR grant), so it takes no access away; this arm contains an ORG grant to the granting org, and expired rows never resolve. This is the standing KILL SWITCH for that arm, not a migration phase: turning it OFF returns to report-only, where the gate still resolves grants and logs where they WOULD change access ([lakeReadGrantCutover] lines) but the enforced decision falls back to the legacy owner/org/tag/entitlement/public rule - so those log lines are the diagnostic for a lake someone can no longer reach while the switch is off. Platform altitude on purpose: install-wide, not a per-lake lever. Tag and entitlement grants always resolve live and are never affected by this flag; only persisted reader/org rows are gated by it.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 94,
+		dependsOn: "EnableDataLakes"
+	}),
+	EnableDataLakeDrivePoll: makeBooleanSetting({
+		key: "EnableDataLakeDrivePoll",
+		name: "Data Lakes: Google Drive auto re-sync poll",
+		defaultValue: false,
+		description: "Server-side gate for the scheduled poll that keeps connected Google Drive folders in sync with their data lakes (adds/edits/removals). Off by default - a connected folder still syncs on demand via the Re-sync button; turn this on to also reconcile it automatically on a schedule.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 95,
+		dependsOn: "EnableDataLakes"
+	}),
+	EnforceLakeAdmission: makeBooleanSetting({
+		key: "EnforceLakeAdmission",
+		name: "Data Lakes: Enforce the admission contract",
+		defaultValue: false,
+		description: "Retrievability contract at admission (#1680). OFF by default = report-only: a file whose chunks cannot honor the chunk policy a lake REQUIRES is logged as quarantined ([admission] lines) but still joins the lake, exactly as today. ON refuses the membership write instead, so unretrievable content never becomes a member and no embedding spend is incurred for it; the caller gets an error naming the required and actual passage targets. Enforcement applies to NEW memberships only - files already in a lake are never evicted, and no query is ever blocked on lake health, which is advisory permanently. Turn this on only after the lake health report shows how many members would be refused. The lake rung is the one that matters (a lake enforces its own contract); the org and owner rungs enforce across every lake in that scope at once. A flip is not instantaneous: the settings cache is per-instance, so it applies immediately on the instance that served the change and within ~5 min (one cache TTL) everywhere else - an upload that still succeeds right after turning this on is stale cache, not a broken lever.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 96,
+		dependsOn: "EnableDataLakes",
+		scope: { settableAt: [
+			"organization",
+			"owner",
+			"lake"
+		] }
+	}),
 	EnableBriefcase: makeBooleanSetting({
 		key: "EnableBriefcase",
 		name: "Enable Briefcase",
@@ -7957,15 +9115,17 @@ const settingsMap = {
 	}),
 	DefaultChunkSize: makeNumberSetting({
 		key: "DefaultChunkSize",
+		userReadable: true,
 		name: "Default Chunk Size",
 		defaultValue: 512,
 		min: 64,
-		description: "Passage target in TOKENS for splitting large documents. The DEFAULT matches the chunker; a value stored here overrides it, and a stored value larger than the chunker default makes the UI reprocess path produce coarser chunks than /api/files/reprocess. Coarser chunks measurably worsen retrieval. Resolves at file-OWNER altitude: an org/individual owner may pin their own default above the platform value; a data lake does NOT override it (epic decision 7) - a lake declares the policy it REQUIRES and a file that cannot satisfy every lake it belongs to is reported as a conflict rather than silently re-chunked.",
+		max: OVERSIZED_PASSAGE_TOKEN_THRESHOLD,
+		description: "Passage target in TOKENS for splitting large documents. The DEFAULT matches the chunker; a value stored here overrides it, and a stored value larger than the chunker default makes the UI reprocess path produce coarser chunks than /api/files/reprocess. Coarser chunks measurably worsen retrieval, and values above the under-chunked detection threshold also stop \"Rebuild passages\" converging, so the accepted range is capped there. Resolves at file-OWNER altitude: an org/individual owner may pin their own default above the platform value; a data lake does NOT override it (epic decision 7) - a lake declares the policy it REQUIRES and a file that cannot satisfy every lake it belongs to is reported as a conflict rather than silently re-chunked.",
 		category: "AI",
 		order: 3,
 		scope: {
 			settableAt: ["organization", "owner"],
-			clamp: (value) => Math.min(Math.max(Math.floor(value), 64), MAX_PASSAGE_TOKEN_TARGET)
+			clamp: (value) => Math.min(Math.max(Math.floor(value), 64), OVERSIZED_PASSAGE_TOKEN_THRESHOLD)
 		}
 	}),
 	ModerationEnabled: makeBooleanSetting({
@@ -8014,6 +9174,22 @@ const settingsMap = {
 		category: "AI",
 		order: 11
 	}),
+	WebSearchFreshnessPrompt: makeStringSetting({
+		key: "WebSearchFreshnessPrompt",
+		name: "Web Search Freshness Prompt",
+		defaultValue: WEB_SEARCH_FRESHNESS_PROMPT,
+		description: "System prompt telling the model when to reach for web_search rather than answer from training data, and to state the as-of date of any time-sensitive fact. Injected only when the web_search tool is offered for the request - a model instructed to search without a search tool tends to claim it searched. Clearing this field turns the section OFF rather than restoring the built-in default, and it is the only off switch this section has; to get the stock wording back, paste it in. A change is not instantaneous: the settings cache is per-instance, so it applies immediately on the instance that served the change and within ~5 min (one cache TTL) everywhere else. After an upgrade, diff a saved copy against the built-in default: a saved copy pins the wording from whenever it was saved and will not pick up fixes made since.",
+		category: "AI",
+		order: 12
+	}),
+	KnowledgeBaseRetrievalPrompt: makeStringSetting({
+		key: "KnowledgeBaseRetrievalPrompt",
+		name: "Knowledge Base Retrieval Prompt",
+		defaultValue: KNOWLEDGE_BASE_RETRIEVAL_PROMPT,
+		description: "System prompt telling the model when to reach for search_knowledge_base rather than answer from training data, and when NOT to. Injected only when the search_knowledge_base tool is offered for the request - a model instructed to search a corpus it has no tool for tends to claim it searched. Clearing this field turns the section OFF rather than restoring the built-in default, and it is the only off switch this section has; to get the stock wording back, paste it in. A change is not instantaneous: the settings cache is per-instance, so it applies immediately on the instance that served the change and within ~5 min (one cache TTL) everywhere else. After an upgrade, diff a saved copy against the built-in default: a saved copy pins the wording from whenever it was saved and will not pick up fixes made since.",
+		category: "AI",
+		order: 13
+	}),
 	UseFormatPrompt: makeBooleanSetting({
 		key: "UseFormatPrompt",
 		name: "Use Format Prompt",
@@ -8032,6 +9208,7 @@ const settingsMap = {
 	}),
 	pricePerCredit: makeNumberSetting({
 		key: "pricePerCredit",
+		userReadable: true,
 		name: "Price Per Credit",
 		defaultValue: 50,
 		description: "The price per credit for purchasing credits.",
@@ -8109,7 +9286,8 @@ const settingsMap = {
 		name: "Referal Credits Amount",
 		defaultValue: 1e4,
 		description: "Credits to give to the referred user.",
-		category: "Referrals"
+		category: "Referrals",
+		userReadable: true
 	}),
 	EnableReferralToEmail: makeBooleanSetting({
 		key: "EnableReferralToEmail",
@@ -8136,6 +9314,15 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.FEEDBACK.id,
 		order: 9
 	}),
+	FeedbackReceiveEmailNonProd: makeStringSetting({
+		key: "FeedbackReceiveEmailNonProd",
+		name: "Non-Production Feedback Email",
+		defaultValue: "",
+		description: "Comma-separated recipient list for feedback submitted from every non-production stage (dev, staging, previews). Does not apply to a self-host install, which routes through FeedbackReceiveEmail like production. Leave empty to suppress non-production email entirely - it never falls back to the production recipient list.",
+		category: "Feedback",
+		group: API_SERVICE_GROUPS.FEEDBACK.id,
+		order: 9.5
+	}),
 	FeedbackKyle: makeStringSetting({
 		key: "FeedbackKyle",
 		name: "Kyle Feedback Email",
@@ -8210,7 +9397,17 @@ const settingsMap = {
 		description: "The webhook URL for sending feedback to the #bike4mind-feedback Slack channel.",
 		category: "Feedback",
 		group: API_SERVICE_GROUPS.FEEDBACK.id,
-		order: 7,
+		order: 6.75,
+		isSensitive: true
+	}),
+	SlackNonProdFeedbackWebhookUrl: makeStringSetting({
+		key: "SlackNonProdFeedbackWebhookUrl",
+		name: "Non-Production Feedback Channel Webhook URL",
+		defaultValue: "",
+		description: "Incoming-webhook URL that receives feedback submitted from every non-production stage (dev, staging, previews). Does not apply to a self-host install, which routes through SlackFeedbackWebhookUrl like production. Leave empty to suppress non-production feedback entirely - it never falls back to the production feedback channel.",
+		category: "Feedback",
+		group: API_SERVICE_GROUPS.FEEDBACK.id,
+		order: 6.8,
 		isSensitive: true
 	}),
 	SlackEmailAuditWebhookUrl: makeStringSetting({
@@ -8279,8 +9476,10 @@ const settingsMap = {
 	}),
 	MaxFileSize: makeNumberSetting({
 		key: "MaxFileSize",
+		userReadable: true,
 		name: "Max File Size",
 		defaultValue: 30,
+		min: 1,
 		description: "The maximum file size allowed for uploads in MB.",
 		category: "Knowledge",
 		group: API_SERVICE_GROUPS.KNOWLEDGE.id,
@@ -8387,6 +9586,7 @@ const settingsMap = {
 	}),
 	enforceCredits: makeBooleanSetting({
 		key: "enforceCredits",
+		userReadable: true,
 		name: "Enforce Credits",
 		defaultValue: process.env.B4M_SELF_HOST === "true" ? false : true,
 		description: "Whether to enforce credits for users",
@@ -8403,6 +9603,7 @@ const settingsMap = {
 	}),
 	enableTeamPlan: makeBooleanSetting({
 		key: "enableTeamPlan",
+		userReadable: true,
 		name: "Enable Team Plan",
 		defaultValue: false,
 		description: "Whether to enable team plans",
@@ -8508,7 +9709,8 @@ const settingsMap = {
 		description: "The global system prompt files to be used for AI model configuration.",
 		category: "AI",
 		group: API_SERVICE_GROUPS.OPENAI.id,
-		order: 8
+		order: 8,
+		userReadable: true
 	}),
 	OpenWeatherKey: makeStringSetting({
 		key: "OpenWeatherKey",
@@ -8662,6 +9864,7 @@ const settingsMap = {
 	}),
 	MaxContentLength: makeNumberSetting({
 		key: "MaxContentLength",
+		userReadable: true,
 		name: "Max Content Length",
 		defaultValue: 5e4,
 		description: "The maximum character length for file content displayed in workbench (truncated if larger).",
@@ -8817,57 +10020,136 @@ const settingsMap = {
 	}),
 	bflApiKey: makeStringSetting({
 		key: "bflApiKey",
-		name: "BlackForest Labs API Key",
+		name: "Black Forest Labs API Key",
 		defaultValue: "",
-		description: "The API Key for BlackForest Labs image generation service.",
+		description: "The API Key for Black Forest Labs image generation service.",
 		isSensitive: true,
 		category: "AI",
 		group: API_SERVICE_GROUPS.IMAGE_GENERATION.id,
 		order: 1
 	}),
-	defaultEmbeddingModel: makeStringSetting({
-		key: "defaultEmbeddingModel",
-		name: "Default Embedding Model",
-		defaultValue: defaultEmbeddingModelForEnv(),
-		description: "The default embedding model to use",
+	defaultEmbeddingModel: makeStringSetting({
+		key: "defaultEmbeddingModel",
+		userReadable: true,
+		name: "Default Embedding Model",
+		defaultValue: defaultEmbeddingModelForEnv(),
+		description: "The default embedding model to use",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		options: [
+			...Object.values(OpenAIEmbeddingModel),
+			...Object.values(VoyageAIEmbeddingModel),
+			...Object.values(BedrockEmbeddingModel),
+			...process.env.B4M_SELF_HOST === "true" ? Object.values(OllamaEmbeddingModel) : []
+		]
+	}),
+	dataLakeSearchMaxFiles: makeNumberSetting({
+		key: "dataLakeSearchMaxFiles",
+		name: "Data Lake Search Max Files",
+		defaultValue: DATA_LAKE_SEARCH_MAX_FILES_DEFAULT,
+		min: 1,
+		description: "Most files one data-lake semantic search will scope. Beyond this the search reports itself as truncated rather than silently ignoring the rest. Raising it well past a few thousand also deepens the paging offset, so prefer reporting truncation over a very large value.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 2,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
+	dataLakeSearchMaxChunks: makeNumberSetting({
+		key: "dataLakeSearchMaxChunks",
+		name: "Data Lake Search Max Chunks",
+		defaultValue: DATA_LAKE_SEARCH_MAX_CHUNKS_DEFAULT,
+		min: 1,
+		description: "Most chunk vectors one data-lake semantic search will score. Raising it trades query latency for coverage; lowering it makes truncation more likely (and reported).",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 3,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
+	forcedRetrievalCharBudget: makeNumberSetting({
+		key: "forcedRetrievalCharBudget",
+		name: "Forced Retrieval Char Budget",
+		defaultValue: FORCED_RETRIEVAL_CHAR_BUDGET_DEFAULT,
+		min: 1e3,
+		max: 1e5,
+		description: "Total characters of retrieved chunk text injected into a Data-Lake-mode turn. Measured saturating on every turn against a 47-document lake, so this is the binding constraint on how much of a corpus reaches the model - not the relevance floor. Raising it admits more passages at the cost of prompt tokens and latency on every Data-Lake turn; it is NOT automatically better, since more context can dilute ranking. Overridable per organization and per owner, the same altitude as the two relevance floors resolved alongside it on the same turn.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 4,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
+	kbSearchDefaultResults: makeNumberSetting({
+		key: "kbSearchDefaultResults",
+		name: "Knowledge Base Search Default Results",
+		defaultValue: 5,
+		min: 1,
+		max: 10,
+		description: "Passages the search_knowledge_base tool returns when a model call omits max_results, which is most calls. This is the exact bound while kbSearchResultTokenBudget is unset (0). Once a token budget is set, it takes over as the primary bound for search results (this setting's own value is then unused there, though it still governs the keyword-search fallback, and the count served if token pricing itself fails). Does NOT raise the tool's hard ceiling of 10 passages per call - a model that reads max_results up to 10 from its own tool schema won't ask for more than that regardless of this setting. A change is not instantaneous: the settings cache is per-instance, so it applies immediately on the instance that served the change and within ~5 min (one cache TTL) everywhere else.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 5,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
+	kbSearchResultTokenBudget: makeNumberSetting({
+		key: "kbSearchResultTokenBudget",
+		name: "Knowledge Base Search Result Token Budget",
+		defaultValue: 0,
+		min: 0,
+		max: 2e4,
+		description: "Approximate tokens of served passage TEXT (post-trim, post-clip - what the model actually receives, not the raw stored chunk) the search_knowledge_base tool may return in one call. Counted with a fixed tokenizer as a proxy, not billed against any specific model. Replaces a passage count as the primary bound once set, since it is invariant to chunk size - a lake chunked smaller no longer silently returns less material for the same setting. 0 (default) disables it: search_knowledge_base then serves exactly kbSearchDefaultResults passages, unchanged from before this setting existed. The FIRST matching passage is always returned even if it alone exceeds the budget - a search that found something never returns nothing. A change is not instantaneous: the settings cache is per-instance, so it applies immediately on the instance that served the change and within ~5 min (one cache TTL) everywhere else.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 6,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
+	kbSearchMinRelevancePct: makeNumberSetting({
+		key: "kbSearchMinRelevancePct",
+		name: "Knowledge Base Search Minimum Relevance (%)",
+		defaultValue: 0,
+		min: 0,
+		max: 100,
+		description: "Minimum cosine relevance, as a percent, a passage must clear to be returned by search_knowledge_base. 0 (default) matches current behavior (no relevance floor beyond a non-negative cosine score). Raising it lets breadth adapt per query - a narrow question can return fewer, more relevant passages instead of always padding out to the configured count. Cosine similarity is not comparable across embedding models: a floor tuned for one model can filter out an entire alternate model, when a lake mixes embedding models, more aggressively than intended. Start low and raise gradually while watching the tool's own retrieval-skipped notices. A change is not instantaneous: the settings cache is per-instance, so it applies immediately on the instance that served the change and within ~5 min (one cache TTL) everywhere else.",
 		category: "AI",
 		group: API_SERVICE_GROUPS.EMBEDDING.id,
-		options: [
-			...Object.values(OpenAIEmbeddingModel),
-			...Object.values(VoyageAIEmbeddingModel),
-			...Object.values(BedrockEmbeddingModel),
-			...process.env.B4M_SELF_HOST === "true" ? Object.values(OllamaEmbeddingModel) : []
-		]
+		order: 7,
+		scope: { settableAt: ["organization", "owner"] }
 	}),
-	dataLakeSearchMaxFiles: makeNumberSetting({
-		key: "dataLakeSearchMaxFiles",
-		name: "Data Lake Search Max Files",
-		defaultValue: DATA_LAKE_SEARCH_MAX_FILES_DEFAULT,
+	lakeMemoryRecallK: makeNumberSetting({
+		key: "lakeMemoryRecallK",
+		name: "Lake Memory Belief Budget",
+		defaultValue: 24,
 		min: 1,
-		description: "Most files one data-lake semantic search will scope. Beyond this the search reports itself as truncated rather than silently ignoring the rest. Raising it well past a few thousand also deepens the paging offset, so prefer reporting truncation over a very large value.",
+		max: 200,
+		int: true,
+		description: "Most beliefs the lake memory hot-card injects on a Data-Lake-mode turn, shared across every lake in scope. Recall still applies its cosine floor and the source-reachability gate first, so raising this does not admit low-quality beliefs - it raises the ceiling on how many QUALIFYING beliefs can actually be used, which was pinned at 8 (inherited from personal-memento recall) on no evidence beyond that inheritance. The sibling lever on the same turn is Forced Retrieval Char Budget, which governs raw chunk text rather than extracted beliefs. Platform-only for now, unlike that sibling: this read goes through plain getSettingsValue, which ignores settableAt, so a scope block here would be silently inert - every override written against it would resolve to nothing. Pointing the read at the scoped resolver is the prerequisite, not extra metadata.",
 		category: "AI",
 		group: API_SERVICE_GROUPS.EMBEDDING.id,
-		order: 2,
-		scope: { settableAt: [
-			"organization",
-			"owner",
-			"lake"
-		] }
+		order: 8
 	}),
-	dataLakeSearchMaxChunks: makeNumberSetting({
-		key: "dataLakeSearchMaxChunks",
-		name: "Data Lake Search Max Chunks",
-		defaultValue: DATA_LAKE_SEARCH_MAX_CHUNKS_DEFAULT,
+	forcedRetrievalRelativeFloorPct: makeNumberSetting({
+		key: "forcedRetrievalRelativeFloorPct",
+		name: "Forced Retrieval Relative Floor (%)",
+		defaultValue: 85,
+		min: 0,
+		max: 100,
+		int: true,
+		description: "How close to the best-scoring passage of the SAME turn a chunk must score to be injected on a Data-Lake-mode turn, as a percent of that top score. This is the floor that ranks; the absolute floor below only rejects. Unlike an absolute cosine line, it moves with the turn, so it keeps working when a corpus or an embedding model puts the whole score band somewhere else. Raising it injects fewer, more sharply-ranked passages and leaves char budget unspent; lowering it admits more of the tail. 0 disables the relative floor and leaves the absolute one as the only gate (the pre-#2497 behavior). The default is behavior-preserving rather than tuned: it admits everything the absolute floor admitted on the measured band, so it changes nothing until raised. Tune it AFTER an embedding-model change, never before - a migration shifts the band any value fitted to today would have been chosen against.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 9,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
+	forcedRetrievalMinSimilarityPct: makeNumberSetting({
+		key: "forcedRetrievalMinSimilarityPct",
+		name: "Forced Retrieval Absolute Floor (%)",
+		defaultValue: 75,
 		min: 1,
-		description: "Most chunk vectors one data-lake semantic search will score. Raising it trades query latency for coverage; lowering it makes truncation more likely (and reported).",
+		max: 100,
+		int: true,
+		description: "Absolute minimum cosine similarity, as a percent, a chunk must clear to be injected on a Data-Lake-mode turn. This is a sanity floor for genuinely unrelated content, NOT the ranking gate - the relative floor above does the ranking. Measured over 166 injected chunks on a production lake the 75 default never once bound (the whole band sat between 80 and 91), so it currently reads like a quality gate while providing no protection. Lowering it toward 30-40 is the intended companion to raising the relative floor: it lets the relative rule govern a corpus whose band sits low, which a 75 line would otherwise reject wholesale. Cosine similarity is not comparable across embedding models, so a value tuned for one model does not transfer to another.",
 		category: "AI",
 		group: API_SERVICE_GROUPS.EMBEDDING.id,
-		order: 3,
-		scope: { settableAt: [
-			"organization",
-			"owner",
-			"lake"
-		] }
+		order: 10,
+		scope: { settableAt: ["organization", "owner"] }
 	}),
 	LakeAccessAuditRetentionDays: makeNumberSetting({
 		key: "LakeAccessAuditRetentionDays",
@@ -8875,7 +10157,7 @@ const settingsMap = {
 		defaultValue: 450,
 		min: 450,
 		max: LAKE_ACCESS_AUDIT_RETENTION_MAX_DAYS,
-		description: "How long a lake access audit event (who read a lake, and when) is retained, in days. Has a floor of 450 days (12 months live plus a Type II observation tail) - this is a platform-wide value, not per-organization, until a scoped settings resolver exists.",
+		description: "How long a lake access audit event (who read a lake, and when) is retained, in days. Has a floor of 450 days (12 months live plus a Type II observation tail) - this is a platform-wide value, not per-organization, until a scoped settings resolver exists. Applies only to events written after a change: expiresAt is computed once at write time and is immutable, so raising or lowering this value never affects rows already recorded.",
 		category: "SecOps",
 		group: API_SERVICE_GROUPS.DATA_LAKE_AUDIT.id,
 		order: 1
@@ -8886,13 +10168,25 @@ const settingsMap = {
 		defaultValue: 30,
 		min: 1,
 		max: 90,
-		description: "How long the opt-in query-text log (the natural-language question behind a lake retrieval) is retained, in days. Always resolved shorter than the audit event retention itself, regardless of this value, since the query text is more sensitive than the event metadata.",
+		description: "How long the opt-in query-text log (the natural-language question behind a lake retrieval) is retained, in days. Always resolved shorter than the audit event retention itself, regardless of this value, since the query text is more sensitive than the event metadata. Applies only to events written after a change - already-recorded rows keep the expiry computed at write time and are not retroactively shortened or extended.",
 		category: "SecOps",
 		group: API_SERVICE_GROUPS.DATA_LAKE_AUDIT.id,
 		order: 2
 	}),
+	LakeConfigAuditRetentionDays: makeNumberSetting({
+		key: "LakeConfigAuditRetentionDays",
+		name: "Lake Config Change Audit Retention (days)",
+		defaultValue: LAKE_CONFIG_AUDIT_RETENTION_DEFAULT_DAYS,
+		min: LAKE_CONFIG_AUDIT_RETENTION_FLOOR_DAYS,
+		max: LAKE_CONFIG_AUDIT_RETENTION_MAX_DAYS,
+		description: "How long a lake CONFIG-change event (who changed a lake, what they changed, and which manage rung authorized it) is retained, in days. Floored at 1095 days - deliberately longer than the access-audit retention above, because a config change is rare and alters every future answer the lake gives, where a read is one turn. Platform-wide, not per-organization, until a scoped settings resolver exists.",
+		category: "SecOps",
+		group: API_SERVICE_GROUPS.DATA_LAKE_AUDIT.id,
+		order: 3
+	}),
 	dataLakeEmbeddingSpendEnabled: makeBooleanSetting({
 		key: "dataLakeEmbeddingSpendEnabled",
+		userReadable: true,
 		name: "Data Lake Embedding Spend Enabled",
 		defaultValue: true,
 		description: "Master switch for data-lake embedding spend (ingestion, reprocessing, convergence). Off halts all provider embedding calls on those paths; cached embeddings still apply.",
@@ -8902,6 +10196,7 @@ const settingsMap = {
 	}),
 	dataLakeEmbeddingBudgetPerRunUsd: makeNumberSetting({
 		key: "dataLakeEmbeddingBudgetPerRunUsd",
+		userReadable: true,
 		name: "Embedding Budget Per Run (USD)",
 		defaultValue: 5,
 		min: 0,
@@ -8955,6 +10250,17 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
 		order: 6
 	}),
+	dataLakeEmbeddingMaxTokensPerMinute: makeNumberSetting({
+		key: "dataLakeEmbeddingMaxTokensPerMinute",
+		name: "Embedding Max Tokens Per Minute",
+		defaultValue: DATA_LAKE_EMBEDDING_MAX_TOKENS_PER_MINUTE_DEFAULT,
+		min: 0,
+		max: DATA_LAKE_EMBEDDING_MAX_TOKENS_PER_MINUTE_MAX,
+		description: "Most provider embedding TOKENS per minute across all data-lake work, which is the quantity providers actually meter. The calls-per-minute lever alone does not bound this: one call carries a whole batch of passages. Set it from your provider dashboard TPM, leaving headroom for query-side embedding (exempt, so a search never queues behind a backfill). 0 stops all calls.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 7
+	}),
 	dataLakeVectorizeChunkBatchSize: makeNumberSetting({
 		key: "dataLakeVectorizeChunkBatchSize",
 		name: "Vectorize Chunk Batch Size",
@@ -8964,7 +10270,29 @@ const settingsMap = {
 		description: "How many chunks the chunk handler packs into one vectorize-queue message. Smaller batches smooth the fan-out; not a spend value, so min 1.",
 		category: "AI",
 		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
-		order: 7
+		order: 8
+	}),
+	dataLakeEmbeddingTierMultiplierIndividual: makeNumberSetting({
+		key: "dataLakeEmbeddingTierMultiplierIndividual",
+		name: "Cost Tier Multiplier - Individual-Owned Lakes",
+		defaultValue: 1,
+		min: 0,
+		max: 100,
+		description: "Scales the per-run and per-lake embedding budgets for lakes owned by an individual user. 1 means those lakes get exactly the configured budgets; 0 stops them spending at all. The effective budget is still capped by the same hard rail as the untiered value.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 9
+	}),
+	dataLakeEmbeddingTierMultiplierOrganization: makeNumberSetting({
+		key: "dataLakeEmbeddingTierMultiplierOrganization",
+		name: "Cost Tier Multiplier - Organization-Owned Lakes",
+		defaultValue: 5,
+		min: 0,
+		max: 100,
+		description: "Scales the per-run and per-lake embedding budgets for lakes owned by an organization, which serve a whole team rather than one person. 0 stops org-owned lakes spending at all. The effective budget is still capped by the same hard rail as the untiered value.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.DATA_LAKE_COST.id,
+		order: 10
 	}),
 	slackSigningSecret: makeStringSetting({
 		key: "slackSigningSecret",
@@ -9066,6 +10394,7 @@ const settingsMap = {
 	}),
 	enableVoiceSession: makeBooleanSetting({
 		key: "enableVoiceSession",
+		userReadable: true,
 		name: "Enable Voice Session",
 		defaultValue: false,
 		description: "Whether to enable the voice session.",
@@ -9075,6 +10404,7 @@ const settingsMap = {
 	}),
 	voiceV2Enabled: makeBooleanSetting({
 		key: "voiceV2Enabled",
+		userReadable: true,
 		name: "Enable Voice v2 (Model-Agnostic)",
 		defaultValue: false,
 		description: "Gate for the Voice v2 feature (ElevenLabs Conversational AI + any B4M reasoning model). When disabled, /api/voice/v2/sessions returns 403.",
@@ -9094,6 +10424,7 @@ const settingsMap = {
 	}),
 	voiceSessionAiVoice: makeStringSetting({
 		key: "voiceSessionAiVoice",
+		userReadable: true,
 		name: "Default Assistant Voice",
 		defaultValue: "alloy",
 		description: "The default voice for the assistant in the voice session.",
@@ -9395,16 +10726,6 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
 		order: 80
 	}),
-	EnableOptiHashiDefault: makeBooleanSetting({
-		key: "EnableOptiHashiDefault",
-		name: "OptiHashi: On by default for users",
-		defaultValue: false,
-		description: "When enabled, OptiHashi is active for users who have never explicitly toggled it.",
-		category: "Experimental",
-		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
-		order: 81,
-		dependsOn: "EnableOptiHashi"
-	}),
 	EnableLibreOncology: makeBooleanSetting({
 		key: "EnableLibreOncology",
 		name: "Enable LibreOncology",
@@ -9605,6 +10926,7 @@ const settingsMap = {
 	}),
 	orchestrationDefaults: makeObjectSetting({
 		key: "orchestrationDefaults",
+		userReadable: true,
 		name: "Agent Orchestration Defaults",
 		defaultValue: OrchestrationDefaultsSchema.parse({}),
 		description: "Default ReAct profile for agentless executions (#8922). Drives allowed/denied tools, iteration ceilings, default thoroughness, and fallback models when the agent_executor is invoked without a persisted IAgent (e.g. the upcoming Agent-mode toggle).",
@@ -9691,19 +11013,20 @@ const settingsMap = {
 		category: "Admin",
 		order: 142
 	}),
-	prReportSlackChannel: makeStringSetting({
-		key: "prReportSlackChannel",
-		name: "PR Report Slack Channel",
+	prReportWebhookUrl: makeStringSetting({
+		key: "prReportWebhookUrl",
+		name: "PR Report Slack Webhook URL",
 		defaultValue: "",
-		description: "Slack channel ID the PR status digest posts to. The bot token itself is resolved from the credential store, never from admin settings.",
+		isSensitive: true,
+		description: "Slack Incoming Webhook URL the PR status digest posts to (https://hooks.slack.com/services/...). It already encodes its channel and workspace, so no bot token or channel ID is needed to send. Bearer-equivalent: anyone holding it can post to the channel, so it is stored encrypted and never returned to the browser.",
 		category: "Slack",
 		order: 143
 	}),
 	prReportEgressAllowlist: makeObjectSetting({
 		key: "prReportEgressAllowlist",
 		name: "PR Report Egress Allowlist",
-		defaultValue: { hosts: ["slack.com", "www.slack.com"] },
-		description: "Hosts the PR digest may post to. FAILS CLOSED: an empty list rejects every send rather than degrading to allow-any, because the post body carries PR titles, author logins and the staffing implied by the role rosters. Validated against the Slack API origin, so the default lists slack.com; self-hosted (non-Slack) origins are not yet supported.",
+		defaultValue: { hosts: ["hooks.slack.com"] },
+		description: "Hosts the PR digest may post to, checked against the webhook URL its own hostname. FAILS CLOSED: an empty list rejects every send rather than degrading to allow-any, because the post body carries PR titles, author logins and the staffing implied by the role rosters. Slack incoming webhooks live at hooks.slack.com, so that is the default.",
 		category: "Slack",
 		order: 144,
 		schema: z$1.object({ hosts: z$1.array(z$1.string()).default([]) })
@@ -9783,7 +11106,8 @@ const SystemPromptDetailSchema = z$1.object({
 		"user",
 		"project",
 		"session",
-		"org"
+		"org",
+		"caller"
 	]),
 	/** e.g., "date_context", "tool_guidance" */
 	name: z$1.string(),
@@ -10095,6 +11419,7 @@ const PromptMetaTokenUsageSchema = z$1.object({
 	actualOutputTokens: z$1.number().optional(),
 	actualTotalTokens: z$1.number().optional(),
 	cacheReadInputTokens: z$1.number().optional(),
+	cacheCreationInputTokens: z$1.number().optional(),
 	settledBasis: z$1.enum(["provider", "local"]).optional(),
 	estimatedCost: z$1.number().optional(),
 	creditsUsed: z$1.number().optional()
@@ -10176,6 +11501,7 @@ const PromptMetaContextSchema = z$1.object({
 	}).optional(),
 	lakeMemory: z$1.object({
 		beliefCount: z$1.number(),
+		beliefBudget: z$1.number().optional(),
 		dataLakeTags: z$1.array(z$1.string())
 	}).optional(),
 	contextWindowUsage: z$1.object({
@@ -10220,7 +11546,15 @@ const PromptMetaPerformanceSchema = z$1.object({
 	totalResponseTime: z$1.number().optional(),
 	contextRetrievalTime: z$1.number().optional(),
 	modelInferenceTime: z$1.number().optional(),
+	/**
+	* Time to First Visible Token: elapsed ms until the first chunk the user can actually
+	* see. Left unset when a turn streamed nothing visible (thinking-only, or a turn that
+	* errored before answering), so absence reads as "never rendered" rather than as fast.
+	* Pair with firstChunkTime to tell a slow model from a long hidden-reasoning window.
+	*/
 	firstTokenTime: z$1.number().optional(),
+	/** Elapsed ms until the first chunk of any kind, including a hidden thinking block. */
+	firstChunkTime: z$1.number().optional(),
 	clientFirstTokenTime: z$1.number().optional(),
 	streamingPerformance: z$1.object({
 		chunkCount: z$1.number().optional(),
@@ -10294,10 +11628,348 @@ const CitableSourceSchema = z$1.object({
 		fullContext: z$1.string().optional()
 	}).optional()
 });
+/**
+* Per-turn retrieval outcome (#1867): whether retrieval was attempted this turn and what happened,
+* independent of whether the model then cited anything. Exists specifically to make the zero case
+* distinguishable from "never asked" - `context.lakeMemory` and `citables` both go silent on a
+* zero-result retrieval, so a turn that legitimately found nothing is indistinguishable from one
+* where retrieval never ran at all.
+*
+* Holds NO chunk/document identifiers, and no DOCUMENT count. A document count already exists and
+* is more precise: `citables.filter(c => c.type === 'document')` is deduped by id/url/title in
+* `applyQuestStatusChanges`, while this shape cannot dedupe (no identifiers to dedupe by) and
+* would have to sum - producing a second, disagreeing number for the same question.
+*
+* `injected` below is NOT that number and does not reopen it: it counts PASSAGES and characters,
+* neither of which `citables` can express - one document contributes many passages, and a turn
+* that injected nothing emits no citable to count at all. Similarity scores otherwise live on
+* `LakeAccessEvent`; the single `injected.topScore` is here because that row is written only on a
+* turn that grounded, so it cannot carry the near-miss score of a turn that grounded on nothing.
+*
+* CAUTION, not a guarantee: the absence of chunk/document identifiers is what keeps this shape
+* OUT of `promptMetaRedaction.ts`'s scope (that helper is a functionCalls-only denylist and would
+* not catch a nested nonidentifier field like `dataLakeTags` regardless). It does NOT mean this
+* field never needs redaction consideration - `dataLakeTags` (which lakes were involved) already
+* reaches non-owner viewers the same way `lakeMemory.dataLakeTags` does (session shares, feedback
+* egress, admin logs, session clone - see redactedFeedback.ts, admin/model-logs.ts, clone.ts, none
+* of which touch this field). That exposure is not new in the general case, but it IS new
+* specifically on a zero-recall turn: `lakeMemory` was never written there before this field
+* existed, so a turn that previously carried no lake-identity signal at all now carries one.
+*
+* `attempted`/`outcome` on their own would still be ambiguous about WHICH lakes were searched on a
+* zero-recall turn (dataLakeTags otherwise lives only inside `lakeMemory`, written after the
+* zero-belief return), so this stamps the resolved tags at write time rather than making a reader
+* fall back to the session's current (possibly since-changed) `retrievalTags`.
+*
+* Absent-or-fully-present, matching `lakeMemory` above - see the Mongoose-side subSchema comment
+* in QuestModel.ts for why partial-write and default-array shapes are unsafe here.
+*
+* WIDER THAN ITS NAME SUGGESTS as of `mode` (#1394). The field is no longer written only when
+* retrieval ran: it is now seeded on every turn that could have retrieved (forced retrieval
+* enabled, or the knowledge tool offered), so `attempted: false` is a recorded fact rather than
+* an absence to be inferred. Presence therefore means "this turn was in a position to retrieve",
+* and turns with no knowledge in scope still carry no field at all. The distinction matters to a
+* rollup: absence is now ambiguous between "not a retrieval turn" and "written before this
+* existed", which is why `mode` documents its own date-bounding requirement.
+*/
+const RetrievalSummarySchema = z$1.object({
+	/** True once a retrieval-capable surface actually ran (not merely offered) this turn. */
+	attempted: z$1.boolean(),
+	/**
+	* Present if and only if `attempted` is true - an outcome describes a run, and a turn that
+	* never ran retrieval has none. A reader testing for a specific value is unaffected (absence
+	* is not any of them); a reader switching exhaustively must handle undefined.
+	*
+	* 'ok' - ran, whether or not anything came back (the zero case is a legitimate 'ok').
+	* 'no_lakes' - ran but the user had no entitled/selected lake in scope.
+	* 'not_indexed' - ran to completion having compared nothing: the corpus in scope carries no
+	*   usable vector (never indexed, or embedded with a foreign model), so no passage was ever
+	*   scored against the query. Distinct from 'ok' because the library was not searched at all,
+	*   and reporting that as a topical zero ("your documents do not cover this") is exactly the
+	*   confident-wrong-answer this field exists to catch. Distinct from 'failed' because nothing
+	*   broke: the remedy is re-vectorizing, which the corpus owner can do themselves, and a retry
+	*   never helps.
+	*   COVERAGE: recorded by forced retrieval (KnowledgeRetrievalFeature's `scoredCount === 0`
+	*   exit) and by knowledgeBaseSearch, whose semantic arms carry the same verdict through to the
+	*   keyword arm's write - the two agree on "not one passage was compared against the query",
+	*   not on any withholding flag, so a relevance floor that emptied a real search and a partial
+	*   withholding alongside a real search both stay 'ok' on both surfaces.
+	*   knowledgeBaseRetrieve cannot reach this state: it fetches named files rather than ranking
+	*   against a query embedding, so it has no comparison to come up empty.
+	* 'failed' - recall did not complete: it threw, OR the retrieval repository is not wired on
+	*   this host (the guards in ChatCompletionFeatures / knowledgeBaseSearch / knowledgeBaseRetrieve
+	*   record it without anything throwing). What separates it from 'not_indexed' is the remedy,
+	*   not the tempo: fix the outage or the host wiring, never re-index content. An unwired host
+	*   reports continuously too, so "chronic" alone does not pick out 'not_indexed'.
+	*   NOT this: a model-supplied argument that is not a well-formed id. knowledgeBaseRetrieve
+	*   shape-checks `file_id` and answers a malformed one as a single-file miss ('ok'), because the
+	*   remedy is for the model to search for the right id - there is nothing for an operator to
+	*   fix. It is logged rather than counted here, so the rate stays observable without this field
+	*   reporting an outage that is not happening.
+	* On multiple retrieval calls within one turn, merge priority is failed > not_indexed > ok >
+	* no_lakes (see retrievalSummaryMerge.ts's mergeRetrievalSummary): a single failure is never
+	* masked by a later success or abstain, an unsearchable corpus outranks a legitimate zero so a
+	* success on another surface cannot erase it, and a real success is never masked by another
+	* surface's "no lakes in scope" abstain in the same turn.
+	*/
+	outcome: z$1.enum([
+		"ok",
+		"no_lakes",
+		"not_indexed",
+		"failed"
+	]).optional(),
+	/**
+	* Whether forced retrieval was ENABLED for this turn, independent of whether it then ran.
+	*
+	* This is what makes the optional path measurable. `attempted` says retrieval happened;
+	* without `mode` there is no way to ask the complementary question - of the turns where the
+	* model was merely OFFERED the knowledge tools, how often did it choose to retrieve - because
+	* a forced turn and an optional turn both land as `attempted: true`.
+	*
+	* Optional on the schema, and absence NEVER means 'optional' - it means unclassified. Two
+	* sources, one historical and one ongoing: turns recorded before this field landed, and
+	* agent-mode runs, which write a retrieval summary through `persistRunAsQuest` but never pass
+	* the seed site at the `offeredTools` write in ChatCompletionProcess. So date-bounding a rollup
+	* removes the first source but not the second; count the unclassified bucket rather than
+	* assuming it empties.
+	*/
+	mode: z$1.enum(["forced", "optional"]).optional(),
+	/**
+	* Whether the knowledge-base when-to-retrieve guidance section actually shipped in this turn's
+	* tool prompt. Written only on turns that were OFFERED the knowledge tool, so absence means
+	* "not an offered turn" or "recorded before this field landed" - it never means "cleared".
+	*
+	* `false` is the load-bearing value here, not filler. Clearing the KnowledgeBaseRetrievalPrompt
+	* setting is the section's only off switch, so a turn recording `false` is the CONTROL arm of
+	* the A/B this field exists to make readable. Anything merging or folding this must preserve an
+	* explicit `false` rather than collapse it into absent - see mergeRetrievalSummary, which uses
+	* `??` and deliberately not `||` for that reason.
+	*
+	* MUST STAY IN SYNC with TWO gates, not one. ToolBuilder.buildToolPrompt emits the section iff
+	* the tool is offered AND the guidance string is non-empty; filterByPromptMode then drops the
+	* whole `toolPrompt` source, which no promptMode admits, so an offered tool is not sufficient.
+	* The ChatCompletionProcess seed site conjoins all three, and hands the first two to
+	* buildToolPrompt as the same consts, so the flag and the actual emission cannot drift.
+	*/
+	knowledgeBaseGuidanceInjected: z$1.boolean().optional(),
+	/**
+	* Why the forced arm did not run on a turn that had it enabled. Only ever set with
+	* `mode: 'forced'`, and only for the deliberate suppressions in
+	* ChatCompletionFeatures.getContextMessages - a forced turn that ran and failed reports that
+	* through `outcome`, not here.
+	*
+	* These turns are the reason this field exists: forced retrieval is configured, a rule
+	* suppresses it, and the model falls back to the offered tool. That is exactly the population
+	* the per-turn routing question is about, and before this it was indistinguishable from a turn
+	* where forced retrieval was never configured at all.
+	*/
+	forcedSkipReason: z$1.enum(["attached_files", "personal_corpus"]).optional(),
+	/** Which retrieval-capable surface(s) ran this turn, e.g. 'lake-memory', 'knowledgeBaseSearch'. */
+	surfaces: z$1.array(z$1.string()),
+	/** Lakes resolved at the moment retrieval ran, stamped point-in-time (not read live from the session). */
+	dataLakeTags: z$1.array(z$1.string()),
+	/**
+	* Ids of the lakes whose `systemPrompt` was injected this turn (getAccessibleDataLakePrompts),
+	* across every injection site (forced retrieval and the model-driven knowledge tools). NOT the
+	* prompt text itself - that already reaches the model in the completion, and copying it here
+	* widens exposure for nothing. Absent means no injection site ran; present-and-empty means one
+	* ran but nothing qualified (untrusted, or an empty systemPrompt).
+	*/
+	injectedLakePromptIds: z$1.array(z$1.string()).optional(),
+	/** mementoCount/mementoIds precedent: mirrors injectedLakePromptIds.length. */
+	injectedLakePromptCount: z$1.number().optional(),
+	/**
+	* How much retrieved content actually reached the model this turn: `chunks` passages totalling
+	* `chars` characters of retrieved CONTENT (headings and framing excluded, so the number means
+	* the same thing on every surface), plus `topScore`, the best similarity among the compared
+	* passages the reporting surface can SEE - which is not the same population on every surface.
+	* Forced retrieval scores every chunk itself and so reports true near-misses; knowledgeBaseSearch's
+	* semantic arm only ever sees `minScore` survivors, and reports no `topScore` at all on a starve,
+	* so a sub-floor near-miss there is invisible rather than recorded.
+	*
+	* PRESENCE CONTRACT: present if and only if at least one surface COMPLETED a search this turn.
+	* `chunks: 0` is a RECORDED STARVE - the library was searched and nothing was injected, which is
+	* the case this field exists to make visible: without it, a forced-retrieval turn that injected
+	* nothing is byte-identical to one that injected its whole character budget (both `outcome:
+	* 'ok'`). Absence means the volume is UNKNOWN, which is what a turn carries when no surface
+	* completed a search: retrieval was never attempted, nothing was in scope to search
+	* ('no_lakes'), or the one surface that ran broke mid-flight, where a zero would be a lie.
+	* A surface that completed but CANNOT know the turn's passage volume also stays silent rather
+	* than claiming a zero - knowledgeBaseSearch's keyword arm on a hit is the case: it injects
+	* file metadata and hands the model retrieve_knowledge_content, which injects the text and
+	* reports no volume, so its zero would survive the merge as a starve that did not happen.
+	*
+	* KNOWN HOLE in that rule, while retrieve_knowledge_content stays uninstrumented: a recorded zero
+	* is not PROOF of a starve. Forced retrieval and the knowledge tools are not mutually exclusive
+	* (ChatCompletionProcess seeds on `forcedRetrievalEnabled || knowledgeToolOffered`), so the forced
+	* arm can complete empty, write its honest zero, and the model can then ground the same turn
+	* through retrieve_knowledge_content, which contributes no volume to oppose it. The zero is
+	* per-surface-truthful and turn-level-misleading. Any rollup counting starves should treat a zero
+	* as "nothing was injected by a surface that reports volume" and, until that tool reports its own,
+	* cross-check `functionCalls` before calling the turn ungrounded.
+	*
+	* Per SURFACE, not per turn: a surface that breaks contributes nothing while a surface that
+	* completed alongside it still reports its own volume, so a turn CAN read 'failed' next to a
+	* recorded zero. That pairing means "one surface broke, and everything that did finish injected
+	* nothing" - which is exactly what a reader needs, and strictly more than the outcome alone.
+	*
+	* SUMMED across surfaces, so this field and `outcome` can legitimately disagree in tone on a
+	* multi-surface turn: forced retrieval grounding on 12 passages while knowledgeBaseSearch throws
+	* gives `outcome: 'failed'` alongside `chunks: 12`. That is correct - `outcome` is worst-of,
+	* `injected` is sum-of-completions.
+	*
+	* `topScore` is optional because only cosine-similarity surfaces have one to report. Lake
+	* memory's belief `relevance` is a different scale and forced retrieval's pre-scan value is a
+	* -1 sentinel; neither is ever written here, because a `max` across mixed scales, or against a
+	* sentinel, is a number that reads as a similarity and is not one.
+	*
+	* Date-bound any rollup, the same caveat `mode` documents on itself: turns recorded before this
+	* landed carry no volume, and no backfill is possible - the volume of a past turn is gone.
+	*
+	* `preRelativeFloorCandidates` and `postRelativeFloorCandidates` are the ONE pair here that is
+	* not "what reached the model": `ranked.length` and `scored.length` in KnowledgeRetrievalFeature
+	* - the candidates left after the absolute similarity floor, and after the relative floor
+	* trims them. `chunks` is what survived the char budget on top of that, so the three
+	* numbers bracket two independent trimmers:
+	*
+	*   pre -> [relative floor] -> post -> [char budget] -> chunks
+	*
+	* They exist so a low `chunks` is diagnosable - a small corpus and a floor that trimmed a large
+	* pool end in the same `chunks`. `pre - post` is the floor's own effect and nothing else;
+	* `pre - chunks` is NOT, because the budget trims the same walk. Both optional: only forced
+	* retrieval computes a ranked pool, a surface without one (lake memory, the knowledge tools)
+	* never writes either, and absence must not read as zero candidates. SUMMED like `chunks`, with
+	* the same absent-is-not-zero handling as `topScore`.
+	*
+	* COMPARE THE PAIR ONLY TO ITSELF, never to `chunks`, unless `surfaces` is forced retrieval
+	* alone. `chunks` and `chars` sum across ALL surfaces while this pair is forced-only, so a mixed
+	* turn can store `chunks` above `pre` - inverting the relationship the pair exposes. Lake memory
+	* is the common case, not the exotic one: it is enabled inside the same forced-retrieval gate,
+	* so on a lake-memory lake it writes on nearly every forced turn. Its chunks can be backed out
+	* via `context.lakeMemory.beliefCount` (approximately - that count is pre-sanitization); its
+	* CHARS land only inside the shared sum, with no per-surface field to subtract them back out, so
+	* `chars` cannot be decontaminated at all. `pre - post` needs neither, which is the point of
+	* storing both.
+	*
+	* BOTH SATURATE, so `pre` counts what the SCAN REACHED, not what the corpus holds: `pool` is
+	* truncated in-scan at FORCED_RETRIEVAL_MAX_SCORED_CHUNKS (256), over a scan itself bounded by
+	* FORCED_RETRIEVAL_MAX_SCANNED_CHUNKS (4000) across FORCED_RETRIEVAL_MAX_CANDIDATE_FILES (100).
+	* 2000 qualifying chunks and 300 both record 256; above the cap a rollup is a plateau.
+	*/
+	injected: z$1.object({
+		chunks: z$1.number(),
+		chars: z$1.number(),
+		topScore: z$1.number().optional(),
+		preRelativeFloorCandidates: z$1.number().optional(),
+		postRelativeFloorCandidates: z$1.number().optional()
+	}).optional(),
+	/**
+	* Could the corpus in scope have answered this turn, whether or not the model went looking?
+	*
+	* The denominator the optional-path retrieval rate has always been missing (#1394). A rate of
+	* "the model retrieved on 20% of offered turns" cannot say whether the other 80% were misses or
+	* turns with nothing to find, and the two argue for opposite things: the first for routing work,
+	* the second for leaving the optional path alone. Crossing this field with the rate separates
+	* them.
+	*
+	* THE ONLY FIELD IN THIS BLOCK NOT WRITTEN BY THE TURN. Every sibling is stamped point-in-time
+	* while the turn runs; this one is written afterwards by an offline replay
+	* (packages/scripts/retrieval/answerability-replay.ts) that re-scores the recorded prompt against
+	* the corpus. That is deliberate - the population it exists to measure is the turns where
+	* retrieval did NOT run, so computing it live would mean adding a full brute-force chunk scan
+	* (ChatCompletionFeatures' forced path, which has no ANN index) to exactly the turns that pay
+	* nothing for retrieval today. The measurement is not worth that latency on live traffic.
+	*
+	* BEING A RECONSTRUCTION, IT CARRIES TWO DRIFTS THE OTHER FIELDS DO NOT:
+	* 1. Corpus CONTENT moves. A document added or reindexed between the turn and the replay is
+	*    scored as though it had been there. `probedAt` discloses the gap; a replay run long after
+	*    the window is weak evidence, not strong.
+	* 2. Corpus SCOPE is inferred, not recorded. The seed writes `dataLakeTags: []` on a turn where
+	*    retrieval never ran (ChatCompletionProcess), so the replay reconstructs scope from the
+	*    session's lakes as they stand at replay time. A session whose lake selection changed is
+	*    replayed against a corpus the turn never had, and NOTHING here flags that. Recording real
+	*    scope at seed time would fix it for future turns and is not done yet.
+	* 3. The QUESTION can move out from under it. The probe is keyed to the quest, not to the
+	*    prompt text it scored, so a turn whose prompt is later rewritten in place keeps a probe
+	*    describing the question it used to ask. mergeRetrievalSummary preserves the probe across
+	*    a runtime write deliberately - dropping it would erase the backfill - so nothing
+	*    invalidates a stale one. Re-run the replay with --force over a window whose turns were
+	*    edited.
+	*
+	* RAW SCORE, NOT A VERDICT, so the cutoff lives in the reader. summarizeOptionalPathRetrieval
+	* applies it at fold time, which lets the same replay be re-thresholded without re-running -
+	* the point of storing the number, given the two live floors disagree by construction (forced
+	* retrieval's absolute default is 0.75, the knowledge tool's is 0).
+	*
+	* `topScore` is the same raw cosine scale as `injected.topScore` and comparable to it. It is NOT
+	* comparable to lake memory's belief relevance, for the reason `injected` documents at length.
+	*
+	* `scanTruncated` inherits forced retrieval's saturation: the replay bounds its scan the same
+	* way, so a low `topScore` on a truncated scan is not proof the corpus lacked an answer - it is
+	* proof the part that was scanned did. Treat those turns as unknown rather than as negatives.
+	*
+	* Absence means NOT PROBED - never "not answerable". Every turn predating the replay, and every
+	* turn the replay skipped or failed on, is absent, so a fold must keep it as its own arm rather
+	* than letting it fall in with the negatives.
+	*/
+	answerability: z$1.object({
+		/** Best cosine the replay found across the reconstructed corpus. */
+		topScore: z$1.number(),
+		/** Chunks at or above `floor`. Separates "one lucky match" from "a rich seam". */
+		candidatesAboveFloor: z$1.number(),
+		/** The absolute floor the replay counted `candidatesAboveFloor` against, as a fraction. */
+		floor: z$1.number(),
+		/** The scan hit its chunk ceiling, so `topScore` is a floor on the true best, not the best. */
+		scanTruncated: z$1.boolean(),
+		/** When the replay ran, NOT when the turn ran - the disclosure for content drift above. */
+		probedAt: JsonSafeDate
+	}).optional(),
+	/**
+	* Which of this turn's injected lake prompt ids were BOTH in the session's pre-authorized (manage-
+	* but-not-member admission) set AND injected on this turn - see unionPreauthorizedLakeAccess and
+	* pages/api/sessions/create.ts. A subset of injectedLakePromptIds, never a superset. Narrows the
+	* session's static `preauthorizedLakeIds` (what was ADMITTED) to what a given turn actually used.
+	*
+	* MEMBERSHIP, NOT CAUSATION. An admitted lake the caller could already reach - its creator, or a
+	* member of its org - injects through the ordinary trust arm and is listed here all the same, so a
+	* non-empty value does not prove the admission is what made the injection possible. Absent means no
+	* admitted id was among this turn's injections, including every turn on a session with none.
+	*/
+	preauthorizedLakeIdsUsed: z$1.array(z$1.string()).optional()
+});
+/**
+* Why a grounded turn's library scan stopped short of the whole library.
+*
+* Written ONLY on a partially-covered turn (reportCoverage returns early otherwise), so presence
+* means "partial" and `partial` is always true - the flag is explicit anyway because a reader
+* checking `retrievalCoverage.partial` should not have to know that absence is the other half of
+* the contract.
+*
+* Single producer (ChatCompletionFeatures.reportCoverage), which is why - unlike `warnings`,
+* `citables` and `retrieval` - this field needs no merge case in applyQuestStatusChanges: a
+* later tool-arm write that omits it is preserved by the one-level spread.
+*
+* `reasons` is the same diagnostic prose the warnings entry interpolates. It is shown to the
+* reader behind a disclosure rather than in the banner body, because only some reasons are
+* actionable (a document mid-reindex returns on its own; a per-turn chunk budget does not).
+*/
+const RetrievalCoverageSchema = z$1.object({
+	/** Always true - see the presence contract above. */
+	partial: z$1.boolean(),
+	/** One entry per distinct cause, e.g. a candidate cap, a scan budget, an embedding mismatch. */
+	reasons: z$1.array(z$1.string())
+});
 z$1.object({
 	model: PromptMetaModelSchema.optional(),
 	tokenUsage: PromptMetaTokenUsageSchema.optional(),
 	context: PromptMetaContextSchema.optional(),
+	/** Per-turn retrieval outcome - see RetrievalSummarySchema. Top-level (not under `context`)
+	* deliberately: applyQuestStatusChanges does a one-level spread merge, so a field nested under
+	* `context` would be replaced wholesale by any tool-arm write instead of merging. */
+	retrieval: RetrievalSummarySchema.optional(),
+	/** Partial-grounding-coverage detail - see RetrievalCoverageSchema. Top-level for the same
+	* one-level-spread-merge reason as `retrieval` above. */
+	retrievalCoverage: RetrievalCoverageSchema.optional(),
 	functionCalls: z$1.array(PromptMetaFunctionCallSchema).optional(),
 	/**
 	* Names of the tools actually offered to the model this turn - the output of `buildTools`
@@ -10945,7 +12617,16 @@ const INVISIBLE_INK = /\u115F|\u1160|\u17B4|\u17B5|\u2800|\u3164|\uFFA0/g;
 const hasBlankTagPrefixSegment = (prefix) => {
 	return (prefix.endsWith(":") ? prefix.slice(0, -1) : prefix).split(":").some((part) => !/[\p{L}\p{N}\p{P}\p{S}\p{M}]/u.test(part.replace(INVISIBLE_INK, "")));
 };
-[...(() => {
+const DATA_LAKE_SLUG_REGEX = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+const DATA_LAKES = [{
+	id: "opti-knowledge",
+	slug: "opti-knowledge",
+	name: "Optimization Knowledge Base",
+	requiredUserTag: "Opti",
+	requiredEntitlement: "optihashi:pro",
+	fileTagPrefix: "opti:",
+	datalakeTag: "datalake:opti-knowledge"
+}, ...(() => {
 	const raw = process.env.NEXT_PUBLIC_PREMIUM_DATA_LAKES;
 	if (!raw) return [];
 	try {
@@ -10955,6 +12636,7 @@ const hasBlankTagPrefixSegment = (prefix) => {
 		return [];
 	}
 })()];
+new Set(DATA_LAKES.map((l) => l.id));
 /**
 * Canonical normalization for entitlement keys + `requiredEntitlement` values - the ONE
 * rule, applied at write time (create/update/stamp) and at match time. Mirrors the
@@ -10962,11 +12644,10 @@ const hasBlankTagPrefixSegment = (prefix) => {
 * casing matches the lowercase keys the resolver produces.
 */
 const normalizeEntitlementKey = (key) => key.trim().toLowerCase();
-const slugRegex = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 const sha256Regex = /^[a-f0-9]{64}$/;
 z.object({
 	name: z.string().min(1).max(200),
-	slug: z.string().min(2).max(60).regex(slugRegex, "Slug must be lowercase alphanumeric with hyphens (e.g. \"my-data-lake\")"),
+	slug: z.string().min(2).max(60).regex(DATA_LAKE_SLUG_REGEX, "Slug must be lowercase alphanumeric with hyphens (e.g. \"my-data-lake\")"),
 	description: z.string().max(2e3).optional(),
 	fileTagPrefix: z.string().trim().min(2).max(30).refine((s) => s.endsWith(":"), "Tag prefix must end with \":\" (e.g. \"acme:\")").refine((s) => !hasBlankTagPrefixSegment(s), "Tag prefix segments must be non-empty (e.g. \"acme:\" or \"acme:legal:\")").refine((s) => !isReservedTagPrefix(s), `Tag prefix cannot use the reserved "${DATALAKE_TAG_PREFIX}" namespace`),
 	requiredUserTag: z.string().min(1).max(100).optional(),
@@ -10982,7 +12663,13 @@ z.object({
 	requiredUserTag: z.union([z.literal(""), z.string().min(1).max(100)]).optional(),
 	requiredEntitlement: z.union([z.literal(""), z.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")")]).optional(),
 	auditQueryTextEnabled: z.boolean().optional(),
-	requiredPassageTokenTarget: z.number().int().min(64).max(MAX_PASSAGE_TOKEN_TARGET).nullable().optional()
+	lakeMemoryEnabled: z.boolean().optional(),
+	requiredPassageTokenTarget: z.number().int().min(64).max(OVERSIZED_PASSAGE_TOKEN_THRESHOLD).nullable().optional()
+});
+z.object({
+	groundingMode: z.enum(DATA_LAKE_GROUNDING_MODES).optional(),
+	preferredSystemPromptId: z.union([z.literal(""), z.string().min(1).max(200)]).optional(),
+	systemPrompt: z.string().optional()
 });
 z.object({
 	organizationId: z.string().optional(),
@@ -11051,6 +12738,7 @@ tags: z.array(TaxonomyTagInput).max(100) });
 z.object({ 
 /** User description of the data (helps the AI) */
 context: z.string().max(2e3).optional() });
+z.object({ tags: z.array(z.string().min(1).max(130).regex(/^[^\r\n]*$/)).max(100) });
 z.object({ hashes: z.array(z.string().regex(sha256Regex)).min(1).max(500) });
 const SyncDeltaFileEntry = z.object({
 	relativePath: z.string(),
@@ -11082,55 +12770,6 @@ z.object({
 		skip: z.array(z.string())
 	})
 });
-z$1.enum([
-	"inject",
-	"auto-fire",
-	"hidden"
-]);
-/**
-* Modes acceptable at AUTHORING time. 'hidden' is intentionally excluded until
-* the host has true hidden-send support - accepting it would persist a value
-* that silently behaves as 'auto-fire' (a surprising downgrade). It stays in
-* ExecutionModeSchema/the stored enum for forward-compat.
-*/
-const AuthorableExecutionModeSchema = z$1.enum(["inject", "auto-fire"]);
-/**
-* Tools a prompt may require - constrained to the host's closed tool set, MINUS
-* integration-gated tools that act on the caller's own credentials/account. A
-* shared system prompt must not be able to inject e.g. blog-publishing into a
-* non-author's session via requiredTools. (Per-user entitlement of the remaining
-* tools is still the chat pipeline's responsibility - see follow-up note in the
-* briefcase blueprint; this allowlist is the storage-layer floor.)
-*/
-const BRIEFCASE_DISALLOWED_TOOLS = [
-	"blog_publish",
-	"blog_edit",
-	"blog_draft"
-];
-const BriefcaseRequiredToolsSchema = z$1.array(b4mLLMTools.refine((t) => !BRIEFCASE_DISALLOWED_TOOLS.includes(t), "This tool is not permitted in a briefcase prompt")).max(16);
-z$1.string().regex(/^[a-f0-9]{24}$/i, "Invalid prompt id");
-const PROMPT_TEXT_MAX = 16e3;
-const TAGS_MAX = 20;
-z$1.object({
-	type: z$1.string().min(1).max(100),
-	name: z$1.string().min(1).max(200),
-	description: z$1.string().max(500).optional(),
-	promptText: z$1.string().min(1).max(PROMPT_TEXT_MAX),
-	tags: z$1.array(z$1.string().min(1).max(50)).max(TAGS_MAX).optional(),
-	executionMode: AuthorableExecutionModeSchema.optional(),
-	requiredTools: BriefcaseRequiredToolsSchema.optional()
-}).partial();
-/**
-* One catalog sub-query. Exactly one selector is used, in precedence order:
-* `personal` (resolved to the caller server-side) > `tags` > `type`.
-*/
-const PromptBatchQuerySchema = z$1.object({
-	key: z$1.string().min(1).max(100),
-	tags: z$1.array(z$1.string().min(1).max(50)).max(TAGS_MAX).optional(),
-	type: z$1.string().max(100).optional(),
-	personal: z$1.boolean().optional()
-});
-z$1.object({ queries: z$1.array(PromptBatchQuerySchema).min(1).max(32).refine((qs) => new Set(qs.map((q) => q.key)).size === qs.length, { message: "Batch query keys must be unique" }) });
 z$1.string().regex(/^[a-f0-9]{24}$/i, "Invalid template id");
 /**
 * The bound model. Reuses the legacy-remap preprocess so a template saved under
@@ -11169,6 +12808,45 @@ z$1.object({
 }).omit({ model: true }).partial();
 z$1.union([ToolExecutionResponseSchema, ApiErrorSchema]);
 /**
+* Response details shared by the endpoints that return generated audio as raw
+* bytes (music, sound effects). Not a contract - just the pieces both of their
+* contracts declare, kept in one place so the published media types and headers
+* cannot describe one endpoint and not the other.
+*/
+/**
+* Every Content-Type the ElevenLabs generators map an `output_format` token to
+* (`contentTypeForFormat` in ElevenLabsMusicGenerator / ElevenLabsSoundGenerator).
+* The first entry is the default (mp3); the rest are declared as alternates.
+* Must stay in sync with those two mappings.
+*/
+const GENERATED_AUDIO_CONTENT_TYPES = [
+	"audio/mpeg",
+	"audio/opus",
+	"audio/L16",
+	"audio/basic",
+	"application/octet-stream"
+];
+/**
+* Where the browsable copy of the generated audio ended up. These are the ONLY
+* channel for that information on these endpoints: the body is raw audio, so a
+* caller that wants the saved file has nowhere else to read it from.
+*/
+const GENERATED_AUDIO_SAVE_HEADERS = {
+	"X-B4M-Audio-Saved": "Whether a browsable copy was saved to the file browser (\"true\"/\"false\").",
+	"X-B4M-Audio-Fab-File-Id": "Id of the saved file. Present only when the copy was saved.",
+	"X-B4M-Audio-File-Name": "File name of the saved copy. Present only when the copy was saved.",
+	"X-B4M-Audio-File-Url": "Signed URL for the saved copy, minted at creation. Use this rather than re-resolving the file via GET /api/files/{id}, which fails closed until the async moderation scan completes."
+};
+/** The 200 response body of a raw-audio endpoint: default media type plus alternates. */
+const generatedAudioBody = () => ({
+	contentType: GENERATED_AUDIO_CONTENT_TYPES[0],
+	alsoReturns: GENERATED_AUDIO_CONTENT_TYPES.slice(1).map((contentType) => ({ contentType })),
+	headers: GENERATED_AUDIO_SAVE_HEADERS
+});
+({ ...generatedAudioBody() });
+({ ...generatedAudioBody() });
+z$1.enum(["user", "convergence"]).optional().catch(void 0), z$1.string().optional();
+/**
 * Blessed, self-hosted artifact library script paths (root-relative).
 *
 * Single source of truth shared across the artifact pipeline:
@@ -11272,6 +12950,10 @@ OpenAIImageGenerationInput.extend({
 	aspect_ratio: z$1.string().optional(),
 	fabFileIds: z$1.array(z$1.string()).prefault([]),
 	tools: z$1.array(z$1.union([b4mLLMTools, z$1.string()])).optional(),
+	safety_tolerance: BFLSafetyToleranceSchema,
+	prompt_upsampling: z$1.boolean().optional(),
+	seed: z$1.number().nullable().optional(),
+	output_format: z$1.enum(["jpeg", "png"]).nullable().optional(),
 	/** Resolved by the API route's prompt resolver. Defaults to 'fresh' for first-turn or sessions with no prior image. */
 	intent: PromptIntentSchema.optional(),
 	promptEnhancement: z$1.object({
@@ -11390,6 +13072,31 @@ z$1.object({
 		"grounded",
 		"surface"
 	]).optional(),
+	/**
+	* Suppress OUR server-side auto-offers without entering a promptMode. Exists because promptMode
+	* was the only switch for the offer and it also strips every authored prompt, so no caller could
+	* have an arm that went unoffered AND kept the abstention licence.
+	*
+	* Gates the three auto-add sites (the knowledge offer in resolveEnabledTools, the navigate_view
+	* auto-add, the blog/skill gate), unioned with `Boolean(promptMode)` by
+	* resolveSkipAutoOffers. A force-on, not an override: `false` under a promptMode still suppresses.
+	* Withholding navigate_view also drops the viewRegistry system block, which only describes it.
+	*
+	* Withholds the OFFER, not knowledge: `session.forceKnowledgeRetrieval` is untouched, and an
+	* already-attached corpus is inlined rather than deferred to the tool. An arm that must see no
+	* knowledge at all also needs a session with no attachments and forced retrieval off.
+	*/
+	skipAutoOffers: z$1.boolean().optional(),
+	/**
+	* Caller-supplied system-prompt text. Rendered as a defended, deference-postured block
+	* appended last in the system-prompt stack. Reached by both POST /api/chat and /api/ai/llm.
+	*
+	* This cap is the universal backstop, not a duplicate of a route check: the parse that opens
+	* invoke() runs outside any try and before a quest row is written, so it holds for every caller
+	* including ones that pass through no route schema. Do not drop it on the assumption that
+	* whoever called validated first.
+	*/
+	systemPrompt: z$1.string().max(PROMPT_TEXT_MAX).optional(),
 	/** Whether Mementos is enabled */
 	enableMementos: z$1.boolean().optional(),
 	/** Whether Artifacts is enabled */
@@ -11465,6 +13172,12 @@ z$1.object({
 	}).optional()
 });
 const MCP_PROVIDER_METADATA = {
+	notion: { defaultToolDescriptions: {
+		notion_search: "Search for pages and databases in the connected Notion workspace by text query. Returns matching page titles, IDs, and URLs.",
+		notion_create_page: "Create a new page in the connected Notion workspace. Requires write access to be enabled. The page is created under the configured root page or a specified parent.",
+		notion_read_page: "Read the content of a Notion page by its ID. Returns the child blocks (text, headings, lists, etc.) and a plain-text summary. Results are paginated; pass start_cursor with the returned next_cursor when has_more is true.",
+		notion_append_blocks: "Append content blocks (paragraphs, headings, lists, code, etc.) to an existing Notion page or block. Requires write access."
+	} },
 	atlassian: { defaultToolDescriptions: {
 		confluence_get_page: "Retrieve a Confluence page by ID or search by title within a space. Include page metadata and optional content.",
 		confluence_create_page: "Create a new Confluence page. Automatically uses your personal space when spaceId is omitted - no need to call confluence_get_current_user first.",
@@ -11910,6 +13623,7 @@ z$1.object({
 	reason: ReportReasonSchema,
 	details: z$1.string().max(2e3).optional()
 });
+const PublishTagsSchema = z$1.array(z$1.string().max(60)).max(20);
 z$1.object({
 	/** Short opaque id for short URLs (`/p/r/{publicId}`, `/p/f/{publicId}`) and lookups. */
 	publicId: z$1.string(),
@@ -11918,6 +13632,11 @@ z$1.object({
 	slug: SlugSchema,
 	title: z$1.string().min(1).max(200),
 	description: z$1.string().max(1e3).optional(),
+	/** Freeform owner-supplied labels, normalized by normalizePublishTags. Shares a vocabulary
+	*  with AppFile tags (see GET /api/publish/tags) so one label means one thing across the app,
+	*  but stored per artifact rather than in a central tag table - there is no tag entity to keep
+	*  in sync, and a tag nobody uses simply stops appearing. */
+	tags: PublishTagsSchema.prefault([]),
 	visibility: VisibilitySchema.prefault("private"),
 	/** Group id a viewer must belong to when gated cross-scope. */
 	gatedToGroupId: z$1.string().optional(),
@@ -12003,6 +13722,9 @@ z$1.object({
 	title: z$1.string().min(1).max(200),
 	description: z$1.string().max(1e3).optional(),
 	visibility: VisibilitySchema.optional(),
+	/** Optional at publish time so a client that already knows its labels - the CLI publish
+	*  skill - can set them in the same call instead of a follow-up PATCH. */
+	tags: PublishTagsSchema.optional(),
 	gatedToGroupId: z$1.string().optional(),
 	/** Who may annotate the published artifact. Defaults to `none` (read-only). */
 	commentPolicy: CommentPolicySchema.optional(),
@@ -12243,6 +13965,32 @@ function isModelAccessible(model, userTags, isAdmin = false, entitlementKeys = [
 	const normalizedAllowedEntitlements = (model.allowedEntitlements ?? []).map(normalizeEntitlementKey);
 	return normalizedKeys.some((key) => normalizedAllowedEntitlements.includes(key));
 }
+[...OPENAI_IMAGE_MODELS, ...GEMINI_IMAGE_MODELS];
+/** Generation was cut off against the output-token ceiling. */
+const TRUNCATED_FINISH_REASON = "max_tokens";
+/**
+* We aborted the stream ourselves because it degenerated into repetition
+* (`DEGENERATE_STREAM_STOP_REASON` in `@bike4mind/llm-adapters`). Distinct from
+* `max_tokens` because the useful advice differs: telling a user to continue is actively
+* wrong here, since resuming from a degenerated tail tends to reproduce the loop.
+*/
+const DEGENERATE_FINISH_REASON = "degenerate_repetition";
+/**
+* Every reason meaning "this reply stopped early". Membership rather than equality with a
+* single literal, so a newly-added early-stop reason surfaces a notice automatically.
+*/
+const EARLY_STOP_FINISH_REASONS = /* @__PURE__ */ new Set([TRUNCATED_FINISH_REASON, DEGENERATE_FINISH_REASON]);
+/**
+* Whether a reply stopped early, given the reason reported for it.
+*
+* An ABSENT reason is NOT an early stop. Plenty of paths never report one (a backend whose
+* complete() leaves it unset, an older server, a non-terminal chunk), and treating silence
+* as truncation would cry wolf on every one of them. Only a reason we recognize as an
+* early stop counts - an unrecognized value is left alone rather than guessed at.
+*/
+function isEarlyStop(stopReason) {
+	return !!stopReason && EARLY_STOP_FINISH_REASONS.has(stopReason);
+}
 /**
 * Trigger-word validation, shared between client form and server agent
 * endpoints so the validation rules can't drift.
@@ -12322,7 +14070,7 @@ Array.from(new Set([
 		id: "opti.root",
 		section: "opti",
 		label: "OptiHashi Home",
-		description: "The OptiHashi Optimizer landing page showing all 8 pattern family cards",
+		description: "The OptiHashi Optimizer landing page showing the pattern family cards",
 		navigationType: "route",
 		target: "/opti",
 		keywords: [
@@ -12852,9 +14600,9 @@ Array.from(new Set([
 		requiresAdmin: true
 	},
 	{
-		id: "admin.feedbacks",
+		id: "admin.feedback",
 		section: "admin",
-		label: "Feedbacks",
+		label: "Feedback",
 		description: "View and manage user feedback, bug reports, and feature requests",
 		navigationType: "tab",
 		target: "2",
@@ -13223,6 +14971,66 @@ Array.from(new Set([
 	const [, top] = v.target.split("/");
 	return `/${top}`;
 })));
+function getHeader(headers, name) {
+	if (!headers || typeof headers !== "object") return null;
+	if (typeof headers.get === "function") {
+		const value = headers.get(name);
+		return typeof value === "string" ? value : null;
+	}
+	const value = headers[name] ?? headers[name.toLowerCase()];
+	return typeof value === "string" ? value : null;
+}
+function parseCount(value) {
+	if (value === null) return null;
+	const trimmed = value.trim();
+	if (!trimmed) return null;
+	const parsed = Number(trimmed);
+	return Number.isFinite(parsed) ? parsed : null;
+}
+const UNIT_MS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4,
+	h: 36e5
+};
+const DURATION_PART = /(\d+(?:\.\d+)?)(ms|h|m|s)/g;
+/**
+* Parse a Go-style duration ("6ms", "0s", "1m30s", "1h2m3s") to milliseconds.
+*
+* Exported for its own tests: it is the part of this module that can be wrong in a way the
+* numbers still look plausible.
+*/
+function parseDurationMs(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	if (!trimmed) return null;
+	DURATION_PART.lastIndex = 0;
+	let total = 0;
+	let matched = 0;
+	let consumed = 0;
+	for (const part of trimmed.matchAll(DURATION_PART)) {
+		total += Number(part[1]) * UNIT_MS[part[2]];
+		consumed += part[0].length;
+		matched += 1;
+	}
+	if (matched === 0 || consumed !== trimmed.length) return null;
+	return total;
+}
+/** Read both rate-limit dimensions off a provider response. */
+function parseEmbeddingRateLimitHeaders(headers) {
+	return {
+		limitTokens: parseCount(getHeader(headers, "x-ratelimit-limit-tokens")),
+		limitRequests: parseCount(getHeader(headers, "x-ratelimit-limit-requests")),
+		remainingTokens: parseCount(getHeader(headers, "x-ratelimit-remaining-tokens")),
+		remainingRequests: parseCount(getHeader(headers, "x-ratelimit-remaining-requests")),
+		resetTokensMs: parseDurationMs(getHeader(headers, "x-ratelimit-reset-tokens")),
+		resetRequestsMs: parseDurationMs(getHeader(headers, "x-ratelimit-reset-requests"))
+	};
+}
+/** True when the provider reported at least one usable ceiling. */
+function hasUsableLimits(snapshot) {
+	return snapshot.limitTokens !== null || snapshot.limitRequests !== null;
+}
 dayjs.extend(utc);
 dayjs.extend(timezone);
 dayjs.extend(relativeTime);
@@ -13291,16 +15099,34 @@ function isUserInitiatedAbort(error, userSignal) {
 	return isAbortError && !userSignal;
 }
 /**
-* Extract retry delay from error response (e.g., Retry-After header)
+* A Retry-After hint is only useful if it asks us to wait. `Retry-After: 0`, a negative value, or an
+* HTTP date that has already passed all carry no timing information - and every `withRetry` in this
+* repo treats a non-null hint as authoritative *over* its exponential backoff, so returning 0 does
+* not mean "wait a moment", it means "abandon the backoff entirely and retry immediately".
+*
+* That inverts the retry budget exactly when it matters: a server sends Retry-After when it is
+* already struggling, so honouring a zero turns the remaining attempts into an instant burst against
+* a service asking for room. Null instead, so the caller falls through to its own backoff.
+*
+* Exported because the rule, not the code, is the thing worth sharing: `Retry-After` is parsed in
+* more than one package (fab-pipeline's `getOpenSearchRetryAfterMs`), and a four-token predicate
+* copied around is a rule that drifts. Feed it a delay already converted to ms.
+*/
+function retryAfterHintOrNull(ms) {
+	return ms > 0 ? ms : null;
+}
+/**
+* Extract retry delay from error response (e.g., Retry-After header). Returns null when the header is
+* absent, unparseable, or does not ask us to wait - see retryAfterHintOrNull.
 */
 function getRetryAfterMs(error) {
 	if (!isAxiosError(error)) return null;
 	const retryAfter = error.response?.headers?.["retry-after"];
 	if (!retryAfter) return null;
 	const seconds = parseInt(retryAfter, 10);
-	if (!isNaN(seconds)) return seconds * 1e3;
+	if (!isNaN(seconds)) return retryAfterHintOrNull(seconds * 1e3);
 	const date = Date.parse(retryAfter);
-	if (!isNaN(date)) return Math.max(0, date - Date.now());
+	if (!isNaN(date)) return retryAfterHintOrNull(date - Date.now());
 	return null;
 }
 /**
@@ -13875,7 +15701,7 @@ const CliConfigSchema = z$1.object({
 	}).optional(),
 	mcpServers: McpServersSchema,
 	preferences: z$1.object({
-		maxTokens: z$1.number(),
+		maxTokens: z$1.number().optional(),
 		temperature: z$1.number(),
 		autoSave: z$1.boolean(),
 		autoCompact: z$1.boolean().optional().prefault(true),
@@ -13970,10 +15796,27 @@ const ProjectLocalConfigSchema = z$1.object({
 	sandbox: PartialSandboxConfigSchema
 });
 /**
+* The output budget every pre-migration config was born with, back when
+* `preferences.maxTokens` was required and DEFAULT_CONFIG supplied this value. It is
+* indistinguishable from a user who deliberately typed 4096, and the migration reverts
+* it either way - acceptable only because the cleanup runs ONCE (see CONFIG_SCHEMA_VERSION):
+* a user who wanted 4096 sets it again and keeps it, while an install that never chose it
+* stops being capped by it. A value-keyed rule with no marker would instead make 4096
+* permanently unrepresentable, even though the /config select still offers it.
+*/
+const LEGACY_PINNED_MAX_TOKENS = 4096;
+/**
+* Schema version of the on-disk config, and the marker that makes the migrations in
+* `load()` one-time. A file stamped with anything else gets the upgrade pass and is
+* rewritten at the current version; a file already at it is left alone. Bump this when
+* adding a migration, and gate the new step on the version it needs to run from.
+*/
+const CONFIG_SCHEMA_VERSION = "0.2.0";
+/**
 * Default configuration
 */
 const DEFAULT_CONFIG = {
-	version: "0.1.0",
+	version: CONFIG_SCHEMA_VERSION,
 	userId: v4(),
 	defaultModel: ChatModels.CLAUDE_4_5_SONNET,
 	toolApiKeys: {
@@ -13982,7 +15825,6 @@ const DEFAULT_CONFIG = {
 	},
 	mcpServers: [],
 	preferences: {
-		maxTokens: 4096,
 		temperature: .7,
 		autoSave: true,
 		autoCompact: true,
@@ -14262,6 +16104,13 @@ var ConfigStore = class {
 					if (oldApiConfig.environment === "custom" && oldApiConfig.customUrl) rawConfig.apiConfig = { customUrl: oldApiConfig.customUrl };
 					else rawConfig.apiConfig = {};
 				}
+				if (rawConfig.version !== CONFIG_SCHEMA_VERSION) {
+					if (rawConfig.preferences?.maxTokens === LEGACY_PINNED_MAX_TOKENS) delete rawConfig.preferences.maxTokens;
+					rawConfig.version = CONFIG_SCHEMA_VERSION;
+					try {
+						await promises.writeFile(this.configPath, JSON.stringify(rawConfig, null, 2), "utf-8");
+					} catch {}
+				}
 				const validated = CliConfigSchema.parse(rawConfig);
 				const normalizedMcpServers = normalizeMcpServers(validated.mcpServers);
 				globalConfig = {
@@ -14692,4 +16541,4 @@ var ConfigStore = class {
 	}
 };
 //#endregion
-export { WORK_ITEM_STATUSES as $, HttpStatus as A, usdToCredits as At, REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS as B, DEFAULT_MUSIC_MODEL_ID as C, mapMimeTypeToArtifactType as Ct, FORMAT_PROMPT_TEMPLATE as D, settingsMap as Dt, FIXED_TEMPERATURE_MODELS as E, secureParameters as Et, NO_TEMPERATURE_MODELS as F, isNearLimit as Ft, SupportedFabFileMimeTypes as G, REFUSAL_FALLBACK_MODELS as H, NotFoundError as I, parseRateLimitHeaders as It, UnauthorizedError as J, TTS_MAX_INPUT_CHARS as K, OllamaEmbeddingModel as L, InternalServerError as M, withRetry as Mt, MODEL_INFO_FIELD_GROUP_OF as N, buildRateLimitLogEntry as Nt, ForbiddenError as O, toModelInfo as Ot, ModelBackend as P, extractSnippetMeta as Pt, VoyageAIEmbeddingModel as Q, OpenAIEmbeddingModel as R, CorruptedFileError as S, isZodError as St, FIELD_GROUP_OF as T, resolveHistoryFetchLimit as Tt, RESPONSES_API_TOOL_MODELS as U, REASONING_SUPPORTED_MODELS as V, SpeechToTextModels as W, VIDEO_SIZE_CONSTRAINTS as X, UnprocessableEntityError as Y, VideoModels as Z, BadRequestError as _, isRenderableModelType as _t, getCreditsUrl as a, getQuestErrorCode as at, CREDIT_DEDUCT_TRANSACTION_TYPES as b, isUnlimitedHistory as bt, requireApiUrl as c, isFieldGroup as ct, AGENT_QUEST_MANIFEST as d, isImageAttachment as dt, applyModelPriceCatalog as et, AGENT_QUEST_MCP_URI as f, isImageServeable as ft, BFL_SAFETY_TOLERANCE as g, isPlaceholderApiKey as gt, BEDROCK_NO_PROMPT_CACHING_MODELS as h, isModelDeprecated as ht, LOCAL_DEV_URL as i, getMcpProviderMetadata as it, ImageModels as j, usdToCreditsStochastic as jt, HTTPError as k, toModelRecord as kt, resolveApiEndpoint as l, isGPTImage2Model as lt, ApiKeyType as m, isModelAccessible as mt, logger as n, dayjsConfig_default as nt, getEnvironmentName as o, getRetryAfterMs as ot, ARTIFACT_ATTRS_PATTERN as p, isMediaModelType as pt, TooManyRequestsError as q, ApiEndpointUnconfiguredError as r, defaultEmbeddingModelForEnv as rt, parseApiUrl as s, isAudioMimeType as st, ConfigStore as t, calculateRetryDelay as tt, AGENT_QUEST_ID as u, isGPTImageModel as ut, BedrockEmbeddingModel as v, isRetryableError as vt, DEFAULT_UNKNOWN_CONTEXT_WINDOW as w, obfuscateApiKey as wt, ChatModels as x, isUserInitiatedAbort as xt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as y, isSupportedFabFileMimeType as yt, PermissionDeniedError as z };
+export { SupportedFabFileMimeTypes as $, buildRateLimitLogEntry as $t, HTTPError as A, isRenderableModelType as At, OPENAI_GPT_IMAGE_1_IMAGE_SIZES as B, resolveHistoryFetchLimit as Bt, DEFAULT_MUSIC_MODEL_ID as C, isGeminiModelId as Ct, FIXED_TEMPERATURE_MODELS as D, isModelAccessible as Dt, FIELD_GROUP_OF as E, isMediaModelType as Et, MODEL_INFO_FIELD_GROUP_OF as F, isZodError as Ft, PermissionDeniedError as G, usdToCredits as Gt, OllamaEmbeddingModel as H, settingsMap as Ht, McpServerName as I, mapMimeTypeToArtifactType as It, REFUSAL_FALLBACK_MODELS as J, ACTOR_COLOR_SLOTS as Jt, REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS as K, usdToCreditsStochastic as Kt, ModelBackend as L, obfuscateApiKey as Lt, IMAGE_SIZE_CONSTRAINTS as M, isSupportedFabFileMimeType as Mt, ImageModels as N, isUnlimitedHistory as Nt, FORMAT_PROMPT_TEMPLATE as O, isModelDeprecated as Ot, InternalServerError as P, isUserInitiatedAbort as Pt, SpeechToTextModels as Q, selfClaimedActorKindSchema as Qt, NO_TEMPERATURE_MODELS as R, parseEmbeddingRateLimitHeaders as Rt, CorruptedFileError as S, isGPTImageModel as St, DEGENERATE_FINISH_REASON as T, isImageServeable as Tt, OpenAIEmbeddingModel as U, toModelInfo as Ut, OPENAI_GPT_IMAGE_2_IMAGE_SIZES as V, secureParameters as Vt, PROMPT_TEXT_MAX as W, toModelRecord as Wt, REVIEW_GATE_STATUS_VALUES as X, actorKindMarker as Xt, RESPONSES_API_TOOL_MODELS as Y, actorColorIndex as Yt, SUBQUEST_STATUS_VALUES as Z, actorKindSchema as Zt, BadRequestError as _, isChunkRebuildPending as _t, getCreditsUrl as a, VideoModels as at, CREDIT_DEDUCT_TRANSACTION_TYPES as b, isFieldGroup as bt, requireApiUrl as c, applyModelPriceCatalog as ct, AGENT_QUEST_MANIFEST as d, defaultEmbeddingModelForEnv as dt, extractSnippetMeta as en, TTS_MAX_INPUT_CHARS as et, AGENT_QUEST_MCP_URI as f, getMcpProviderMetadata as ft, BFL_SAFETY_TOLERANCE as g, isAudioMimeType as gt, BEDROCK_NO_PROMPT_CACHING_MODELS as h, hasUsableLimits as ht, LOCAL_DEV_URL as i, VIDEO_SIZE_CONSTRAINTS as it, HttpStatus as j, isRetryableError as jt, ForbiddenError as k, isPlaceholderApiKey as kt, resolveApiEndpoint as l, calculateRetryDelay as lt, ApiKeyType as m, getRetryAfterMs as mt, logger as n, parseRateLimitHeaders as nn, UnauthorizedError as nt, getEnvironmentName as o, VoyageAIEmbeddingModel as ot, ARTIFACT_ATTRS_PATTERN as p, getQuestErrorCode as pt, REASONING_SUPPORTED_MODELS as q, withRetry as qt, ApiEndpointUnconfiguredError as r, UnprocessableEntityError as rt, parseApiUrl as s, WORK_ITEM_STATUSES as st, ConfigStore as t, isNearLimit as tn, TooManyRequestsError as tt, AGENT_QUEST_ID as u, dayjsConfig_default as ut, BedrockEmbeddingModel as v, isChunkStalledFile as vt, DEFAULT_UNKNOWN_CONTEXT_WINDOW as w, isImageAttachment as wt, ChatModels as x, isGPTImage2Model as xt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as y, isEarlyStop as yt, NotFoundError as z, reservationOutputTokens as zt };