@bike4mind/cli 0.21.0 → 0.22.0

package/dist/{ApiClient-Ut1MXtOs.mjs → ApiClient-XdY9O3nz.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { n as logger, t as ConfigStore } from "./ConfigStore-CoY0l0gr.mjs";
-import { t as version } from "./package-CfIETbXd.mjs";
+import { n as logger, t as ConfigStore } from "./ConfigStore-8_0WsN5r.mjs";
+import { t as version } from "./package-OZdXqn0e.mjs";
 import axios, { isAxiosError } from "axios";
 //#region src/auth/OAuthClient.ts
 /**

package/dist/{ConfigStore-CoY0l0gr.mjs → ConfigStore-8_0WsN5r.mjs}

@@ -416,6 +416,7 @@ let ApiKeyType = /* @__PURE__ */ function(ApiKeyType) {
 	ApiKeyType["ollama"] = "ollama";
 	ApiKeyType["xai"] = "xai";
 	ApiKeyType["kimi"] = "kimi";
+	ApiKeyType["deepseek"] = "deepseek";
 	ApiKeyType["voyageai"] = "voyageai";
 	return ApiKeyType;
 }({});
@@ -489,6 +490,16 @@ const FallbackInfoSchema = z$1.object({
 	primaryModelName: z$1.string(),
 	fallbackModel: z$1.string(),
 	fallbackModelName: z$1.string(),
+	/**
+	* Backend of each side, so the badge can name the provider path without
+	* inferring it from the id - a bare `deepseek-*` slug is the direct API on a
+	* hosted deployment and an Ollama pull on a self-hosted one. Optional and
+	* loosely typed: these payloads are persisted in browser storage, so a record
+	* written by an older build has neither field and an unknown backend name from
+	* a newer one must not fail the parse.
+	*/
+	primaryModelBackend: z$1.string().optional(),
+	fallbackModelBackend: z$1.string().optional(),
 	timestamp: z$1.number()
 });
 const ArtifactMetadataSchema = z$1.object({
@@ -895,6 +906,7 @@ let ModelBackend = /* @__PURE__ */ function(ModelBackend) {
 	ModelBackend["BFL"] = "bfl";
 	ModelBackend["XAI"] = "xai";
 	ModelBackend["Kimi"] = "kimi";
+	ModelBackend["DeepSeek"] = "deepseek";
 	ModelBackend["VoyageAI"] = "voyageai";
 	ModelBackend["AWS"] = "aws";
 	ModelBackend["LocalImage"] = "local-image";
@@ -1093,6 +1105,7 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 	ChatModels["KIMI_K2_5"] = "kimi-k2.5";
 	ChatModels["KIMI_K2_5_BEDROCK"] = "moonshotai.kimi-k2.5";
 	ChatModels["KIMI_K2_THINKING_BEDROCK"] = "moonshot.kimi-k2-thinking";
+	ChatModels["DEEPSEEK_FLASH"] = "deepseek-flash";
 	return ChatModels;
 }({});
 const CHAT_MODELS = Object.values(ChatModels);
@@ -1227,7 +1240,8 @@ const NO_TEMPERATURE_MODELS = /* @__PURE__ */ new Set([
 	"kimi-k2.7-code",
 	"kimi-k2.7-code-highspeed",
 	"kimi-k2.6",
-	"kimi-k2.5"
+	"kimi-k2.5",
+	"deepseek-flash"
 ]);
 /**
 * Models whose safety classifiers can decline a request with `stop_reason: 'refusal'`
@@ -1716,6 +1730,7 @@ const ADAPTER_FAMILIES = [
 	"gemini",
 	"xai",
 	"kimi",
+	"deepseek",
 	"ollama",
 	"bfl",
 	"local-image",
@@ -1966,6 +1981,7 @@ const MODEL_INFO_FIELD_GROUP_OF = {
 	supportsImageVariation: "modalities",
 	supportsSafetyTolerance: "modalities",
 	deprecationDate: "lifecycle",
+	replacedBy: "lifecycle",
 	adapterFamily: "dispatch",
 	dispatchProfile: "dispatch",
 	description: "presentation",
@@ -2089,6 +2105,8 @@ z$1.object({
 	}).optional(),
 	/** Optional: a state row written before Phase 4 has none, and must keep parsing. */
 	suggestion: ModelLifecycleSuggestion.optional(),
+	/** Dispatch probes spent on this model, so one that always fails stops taking a budget slot. */
+	probeAttempts: z$1.number().int().nonnegative().optional(),
 	createdAt: z$1.date(),
 	updatedAt: z$1.date()
 });
@@ -3130,6 +3148,7 @@ function toModelInfo(record) {
 		disabled,
 		disabledReason: record.disabledReason ?? record.autoDisabledReason ?? (retired ? "retired by the provider" : void 0),
 		deprecationDate: record.lifecycle?.deprecationDate,
+		replacedBy: record.lifecycle?.replacedBy,
 		trainingCutoff: record.trainingCutoff,
 		releaseDate: record.releaseDate,
 		logoFile: record.logoFile,
@@ -3162,6 +3181,7 @@ const VENDOR_BY_BACKEND = {
 	["gemini"]: "google",
 	["xai"]: "xai",
 	["kimi"]: "moonshotai",
+	["deepseek"]: "deepseek",
 	["bfl"]: "black-forest-labs",
 	["aws"]: "amazon",
 	["voyageai"]: "voyageai",
@@ -3230,10 +3250,13 @@ function toModelRecord(info) {
 		supportsTools: info.supportsTools,
 		supportsImageVariation: info.supportsImageVariation,
 		supportsSafetyTolerance: info.supportsSafetyTolerance,
-		lifecycle: info.deprecationDate ? {
-			status: "deprecated",
-			deprecationDate: info.deprecationDate
-		} : { status: "active" },
+		lifecycle: {
+			...info.deprecationDate ? {
+				status: "deprecated",
+				deprecationDate: info.deprecationDate
+			} : { status: "active" },
+			...info.replacedBy ? { replacedBy: info.replacedBy } : {}
+		},
 		description: info.description,
 		logoFile: info.logoFile,
 		rank: info.rank,
@@ -4016,6 +4039,7 @@ const QuestExportProgressAction = z$1.object({
 	downloadUrl: z$1.string().optional(),
 	filename: z$1.string().optional(),
 	errorMessage: z$1.string().optional(),
+	droppedQuestCount: z$1.number().optional(),
 	clientId: z$1.string().optional()
 });
 const SpiderProgressUpdateAction = z$1.object({
@@ -6634,12 +6658,23 @@ let OllamaEmbeddingModel = /* @__PURE__ */ function(OllamaEmbeddingModel) {
 	return OllamaEmbeddingModel;
 }({});
 /**
-* The default embedding model for the current deployment. On self-host with a local Ollama
-* server and no cloud embedding key, this is a local embedder, so RAG / knowledge search work
-* out of the box with no AWS/OpenAI/Voyage credential; otherwise it is the cloud default. Read
-* by the `defaultEmbeddingModel` admin-setting default and by the query-embedding fallback, so
-* an operator who never opens admin settings still gets a working, keyless embedder instead of
-* an unconfigured cloud model that fails with an opaque "security token" error.
+* The default embedding model this deployment advertises - the `defaultEmbeddingModel` admin-setting
+* default and the query-embedding fallback, so an operator who never opens admin settings still gets
+* a sensible model rather than an unconfigured one.
+*
+* Deliberately answers from the ENVIRONMENT only, and deliberately does NOT try to answer "can this
+* deployment actually reach that model". It cannot: on a hosted stage an SST secret arrives as a
+* linked Resource, never as process.env (see apps/client/server/modelDiscovery/adapters.ts), so an
+* absent OPENAI_API_KEY here means "unknown", not "no key" - it is absent on production too. This
+* function is also bundled into the browser via settingsMap, where every env read is undefined, so
+* any answer it gives must be one that is safe as a stage-neutral constant.
+*
+* Reachability is therefore decided where the resolved credentials are actually in hand, by
+* `resolveEmbeddingWithKeylessFallback` (fab-pipeline) - that is what lets a keyless cloud stage
+* embed on Bedrock without changing what any other stage advertises.
+*
+* The one arm that IS env-decidable: a self-host running Ollama has its base URL in real process.env
+* on both server and (absent) client, and no cloud credential can arrive by any other route.
 */
 function defaultEmbeddingModelForEnv() {
 	const selfHost = process.env.B4M_SELF_HOST === "true";
@@ -6648,6 +6683,45 @@ function defaultEmbeddingModelForEnv() {
 	if (selfHost && hasOllama && !hasCloudEmbeddingKey) return "qwen3-embedding:0.6b";
 	return "text-embedding-ada-002";
 }
+/**
+* True when this deployment can embed with no provider API key at all: a cloud stage reaches
+* Bedrock through its task/execution role's AWS credentials.
+*
+* Requires POSITIVE evidence of an execution role rather than merely "not self-host". A plain
+* `next dev` session and a CI job both leave B4M_SELF_HOST unset while holding no AWS credentials
+* at all, so an absence test would send them to the Bedrock SDK for an opaque `CredentialsProvider
+* Error` in place of the actionable OPENAI_KEY_MISSING_MESSAGE naming the key to set - the same
+* actionable-to-opaque trade this fallback exists to avoid, just in a different keyless place.
+*
+* BOTH runtimes must be covered, and they carry different markers. The Lambdas (vectorize
+* subscriber, the crons, the Next API routes) get AWS_LAMBDA_FUNCTION_NAME; ChatCompletion is a
+* Fargate service (infra/chatCompletion.ts) and gets the ECS task-role URI instead. Since
+* knowledgeBaseSearch runs inside that container, keying on the Lambda marker alone would leave
+* chat knowledge-base search failing on exactly the keyless stages this fallback is for.
+*
+* SST_RESOURCE_App is the third arm and the one this repo can prove: SST sets it on anything it
+* links, Lambda and Service alike (infra/chatCompletion.ts:129 and infra/agentExecutor.ts:54 both
+* note that linking alone exposes SST_RESOURCE_*). It covers the Fargate task whether or not the
+* ECS credential URI is present, and it is absent from a plain `next dev` and from CI, which is
+* the case that matters. `sst dev` does set it - correctly, since that session runs against real
+* AWS credentials.
+*
+* Self-host is excluded outright because it has no such role - its keyless path is the local
+* Ollama embedder (`isLocalEmbedderAvailable` in toolAvailability.ts), not Bedrock.
+*
+* Answers "is Bedrock reachable here", NOT "should we use it" - a keyed stage is keyless-capable
+* too, so this must only ever be asked ALONGSIDE a resolved credential table that came back empty.
+* `resolveEmbeddingWithKeylessFallback` is where the two questions are paired for callers free to
+* choose the model, and is what such a caller should use instead of asking this directly. The
+* direct callers are the ones that additionally need the answer BEFORE resolving, to decide
+* policy: toolAvailability reports whether embedding-backed tools are usable at all, and
+* data-lakes/semantic-search decides whether a substitution is permitted for this request before
+* it knows whether one is needed. Both still pair it with the table.
+*/
+function hasKeylessCloudEmbedder() {
+	if (process.env.B4M_SELF_HOST === "true") return false;
+	return !!(process.env.AWS_LAMBDA_FUNCTION_NAME || process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI || process.env.SST_RESOURCE_App);
+}
 z$1.union([
 	z$1.enum(OpenAIEmbeddingModel),
 	z$1.enum(VoyageAIEmbeddingModel),
@@ -6655,6 +6729,18 @@ z$1.union([
 	z$1.enum(OllamaEmbeddingModel)
 ]);
 /**
+* The measured per-space floors, rendered for an admin-facing description (e.g. "75 for
+* text-embedding-ada-002, 35 for text-embedding-3-small").
+*
+* Rendered rather than written out in prose because these numbers are expected to move - 35 is
+* provisional until it is re-derived against a production lake - and a description that restates
+* the table is a wrong number shown to operators the moment it drifts, with nothing failing.
+*/
+const forcedRetrievalFloorsBySpaceSummary = Object.entries({
+	["text-embedding-ada-002"]: 75,
+	["text-embedding-3-small"]: 35
+}).map(([space, pct]) => `${pct} for ${space}`).join(", ");
+/**
 * Default text for the artifact-emission system prompt. Single source of truth used BOTH as the
 * `ArtifactEmissionPrompt` admin setting's default AND as the runtime fallback in
 * ChatCompletionProcess - so an unset/empty/cleared DB value reverts to this and never bricks
@@ -6847,6 +6933,7 @@ z$1.enum([
 	"geminiDemoKey",
 	"xaiApiKey",
 	"moonshotApiKey",
+	"deepseekApiKey",
 	"voyageApiKey",
 	"FirecrawlApiKey",
 	"FirecrawlApiUrl",
@@ -6981,6 +7068,7 @@ z$1.enum([
 	"defaultEmbeddingModel",
 	"dataLakeSearchMaxFiles",
 	"dataLakeSearchMaxChunks",
+	"dataLakeSearchMaxChunksPerFile",
 	"forcedRetrievalCharBudget",
 	"lakeMemoryRecallK",
 	"kbSearchDefaultResults",
@@ -7070,6 +7158,7 @@ z$1.enum([
 	"modelDiscoveryAllowEgress",
 	"modelDiscoveryPriceBandPct",
 	"modelDiscoveryAutoRemap",
+	"modelDiscoveryProbeNewModels",
 	"prReportRepo",
 	"prReportIdentityMap",
 	"prReportWebhookUrl",
@@ -7841,6 +7930,10 @@ const API_SERVICE_GROUPS = {
 			{
 				key: "forcedRetrievalMinSimilarityPct",
 				order: 10
+			},
+			{
+				key: "dataLakeSearchMaxChunksPerFile",
+				order: 11
 			}
 		]
 	},
@@ -7948,6 +8041,16 @@ const API_SERVICE_GROUPS = {
 			order: 1
 		}]
 	},
+	DEEPSEEK: {
+		id: "deepseekAPIService",
+		name: "DeepSeek Service",
+		description: "DeepSeek API integration settings",
+		icon: "AutoAwesome",
+		settings: [{
+			key: "deepseekApiKey",
+			order: 1
+		}]
+	},
 	ANTHROPIC: {
 		id: "anthropicAPIService",
 		name: "Anthropic Service",
@@ -8647,6 +8750,10 @@ const API_SERVICE_GROUPS = {
 			{
 				key: "modelDiscoveryAutoRemap",
 				order: 6
+			},
+			{
+				key: "modelDiscoveryProbeNewModels",
+				order: 7
 			}
 		]
 	},
@@ -8732,6 +8839,16 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.MOONSHOT.id,
 		order: 1
 	}),
+	deepseekApiKey: makeStringSetting({
+		key: "deepseekApiKey",
+		name: "DeepSeek API Key",
+		defaultValue: "",
+		description: "The global API Key for DeepSeek.",
+		isSensitive: true,
+		category: "AI",
+		group: API_SERVICE_GROUPS.DEEPSEEK.id,
+		order: 1
+	}),
 	voyageApiKey: makeStringSetting({
 		key: "voyageApiKey",
 		name: "Voyage API Key",
@@ -10033,7 +10150,7 @@ const settingsMap = {
 		userReadable: true,
 		name: "Default Embedding Model",
 		defaultValue: defaultEmbeddingModelForEnv(),
-		description: "The default embedding model to use",
+		description: "The default embedding model to use. Changing it changes the SCALE of every similarity score in the system, so relevance floors do not carry across: a floor tuned for one model can sit above the entire range of another and reject everything. The server handles this for you on the floors it ships, applying the value measured for whichever model your documents are actually embedded with - but if you have set Forced Retrieval Absolute Floor by hand, re-measure it after changing this. Existing documents keep their old vectors and are only comparable to a query embedded the same way, so a change here needs a re-embed to take full effect; until then each set of documents is searched with the model it was indexed under.",
 		category: "AI",
 		group: API_SERVICE_GROUPS.EMBEDDING.id,
 		options: [
@@ -10065,6 +10182,17 @@ const settingsMap = {
 		order: 3,
 		scope: { settableAt: ["organization", "owner"] }
 	}),
+	dataLakeSearchMaxChunksPerFile: makeNumberSetting({
+		key: "dataLakeSearchMaxChunksPerFile",
+		name: "Data Lake Search Max Chunks Per Document",
+		defaultValue: 0,
+		min: 0,
+		description: "Most chunks from any ONE source document a data-lake semantic search may return in its top-K. A diversity guard for CONTESTED slots: where several documents answer the question, it stops the best-scoring one from taking slots the others could have filled. It is NOT a fix for severe crowding - the cap redistributes only among the candidates retrieval already returned, so a document that supplies enough of the top-scoring chunks to fill that pool on its own is one the cap cannot change at all. On a corpus of book-length documents, expect enabling this to change little beyond widening the vector-search request. 0 (default) disables the cap, byte-identical to behavior before this setting existed. The cap never SHRINKS a result set - once the spread-out picks are in, any slots still open are backfilled with the highest-scoring chunks the cap held back, so a lake whose only match is one document still returns a full top-K. A value at or above the result count is also a no-op, since nothing can ever be held back. Below it, each retrieval stream's candidate pool is widened to a fixed multiple of the result count so the cap has a spread to choose from. The scanned corpus itself does not grow (that is bounded separately), but the vector-search backends are asked for that many more matches, and a larger in-memory ranking pool costs some CPU. 2-3 is the useful range; 1 serves one passage per document, which suits a corpus of many short documents and starves a question whose answer spans one long one. The chat knowledge-base path ranks more passages than it serves, so it applies the cap a second time at the count it actually serves - otherwise the spread-out picks, which are by definition the lowest-scoring ones admitted, would land in the passages that path discards.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 11,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
 	forcedRetrievalCharBudget: makeNumberSetting({
 		key: "forcedRetrievalCharBudget",
 		name: "Forced Retrieval Char Budget",
@@ -10145,7 +10273,7 @@ const settingsMap = {
 		min: 1,
 		max: 100,
 		int: true,
-		description: "Absolute minimum cosine similarity, as a percent, a chunk must clear to be injected on a Data-Lake-mode turn. This is a sanity floor for genuinely unrelated content, NOT the ranking gate - the relative floor above does the ranking. Measured over 166 injected chunks on a production lake the 75 default never once bound (the whole band sat between 80 and 91), so it currently reads like a quality gate while providing no protection. Lowering it toward 30-40 is the intended companion to raising the relative floor: it lets the relative rule govern a corpus whose band sits low, which a 75 line would otherwise reject wholesale. Cosine similarity is not comparable across embedding models, so a value tuned for one model does not transfer to another.",
+		description: `Absolute minimum cosine similarity, as a percent, a chunk must clear to be injected on a Data-Lake-mode turn. This is a sanity floor for genuinely unrelated content, NOT the ranking gate - the relative floor above does the ranking. LEAVE IT AT 75 UNLESS YOU HAVE MEASURED YOUR OWN CORPUS: a raw cosine means nothing outside the embedding model it was fitted to, so while this reads 75 the server ignores it and applies the floor measured for whichever model your documents are actually embedded with (${forcedRetrievalFloorsBySpaceSummary}, and no absolute floor at all for a model nobody has measured - the relative floor still applies). Set any other value and the server uses exactly that, in every space, which is yours to get right: 75 against text-embedding-3-small sits above that band entirely and returns nothing on every query. Where this floor lands inside your band decides a lot - on one measured corpus 74 / 75 / 76 swung recall 91% / 65% / 40% - and the same 75 that is a cliff on one lake rejects nothing at all on another. Re-measure after changing the embedding model; the sweep tool is packages/scripts/retrieval/forcedFloorSweep.ts.`,
 		category: "AI",
 		group: API_SERVICE_GROUPS.EMBEDDING.id,
 		order: 10,
@@ -10997,6 +11125,15 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.MODEL_DISCOVERY.id,
 		order: 6
 	}),
+	modelDiscoveryProbeNewModels: makeBooleanSetting({
+		key: "modelDiscoveryProbeNewModels",
+		name: "Probe New Models for Dispatch",
+		defaultValue: true,
+		description: "Lets a write-mode run spend a forced one-tool call on a newly discovered OpenAI model to verify which token parameter and tool transport it takes, and turn its tools on. Off leaves every new OpenAI model with tools withheld until an operator writes the dispatch profile by hand.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.MODEL_DISCOVERY.id,
+		order: 7
+	}),
 	prReportRepo: makeStringSetting({
 		key: "prReportRepo",
 		name: "PR Report Repository",
@@ -11089,7 +11226,8 @@ const ModelTelemetrySchema = z$1.object({
 		"google",
 		"xai",
 		"ollama",
-		"moonshot"
+		"moonshot",
+		"deepseek"
 	]),
 	fallbackUsed: z$1.boolean(),
 	fallbackReason: z$1.string().optional(),
@@ -11769,6 +11907,31 @@ const RetrievalSummarySchema = z$1.object({
 	/** Lakes resolved at the moment retrieval ran, stamped point-in-time (not read live from the session). */
 	dataLakeTags: z$1.array(z$1.string()),
 	/**
+	* The lake scope the turn's retrieval surfaces WOULD have searched, resolved at the seed site
+	* whether or not any of them ran: the caller's accessible lakes narrowed to the session
+	* (narrowLakeAccessToSession), or empty where the corpus is personal and the lake arms are
+	* suppressed. `dataLakeTags` is the other half of the pair and answers a different question -
+	* which lakes retrieval ACTUALLY used - so on a turn where retrieval never ran that one is empty
+	* while this one still names whatever was in scope.
+	*
+	* EXISTS FOR THE OFFLINE REPLAY. `answerability` is reconstructed after the fact, and without a
+	* recorded scope the replay had to rebuild one from the session's `retrievalTags` as they stand
+	* at replay time - a session whose lake selection had since changed was replayed against a
+	* corpus its turn never had, with nothing to flag it. Recording it here removes that drift for
+	* every turn seeded after this landed; `probedAt` still discloses the content drift, which no
+	* amount of recording can fix.
+	*
+	* Absence means NOT RECORDED (a turn predating this, or one whose `retrieval` was written only
+	* by a surface rather than by the seed) - never "no lakes in scope", which is present-and-empty.
+	* The replay must keep those apart: probing an unrecorded turn would mean inventing a scope,
+	* which is the approximation this field exists to end.
+	*
+	* Only the seed writes it, so mergeRetrievalSummary carries it first-writer-wins rather than
+	* unioning: a later surface write asserting a narrower scope must not be able to widen the
+	* recorded one, and a union across the two would mean neither.
+	*/
+	lakeScope: z$1.array(z$1.string()).optional(),
+	/**
 	* Ids of the lakes whose `systemPrompt` was injected this turn (getAccessibleDataLakePrompts),
 	* across every injection site (forced retrieval and the model-driven knowledge tools). NOT the
 	* prompt text itself - that already reaches the model in the completion, and copying it here
@@ -11880,15 +12043,15 @@ const RetrievalSummarySchema = z$1.object({
 	* (ChatCompletionFeatures' forced path, which has no ANN index) to exactly the turns that pay
 	* nothing for retrieval today. The measurement is not worth that latency on live traffic.
 	*
-	* BEING A RECONSTRUCTION, IT CARRIES TWO DRIFTS THE OTHER FIELDS DO NOT:
+	* BEING A RECONSTRUCTION, IT CARRIES DRIFTS THE OTHER FIELDS DO NOT:
 	* 1. Corpus CONTENT moves. A document added or reindexed between the turn and the replay is
 	*    scored as though it had been there. `probedAt` discloses the gap; a replay run long after
 	*    the window is weak evidence, not strong.
-	* 2. Corpus SCOPE is inferred, not recorded. The seed writes `dataLakeTags: []` on a turn where
-	*    retrieval never ran (ChatCompletionProcess), so the replay reconstructs scope from the
-	*    session's lakes as they stand at replay time. A session whose lake selection changed is
-	*    replayed against a corpus the turn never had, and NOTHING here flags that. Recording real
-	*    scope at seed time would fix it for future turns and is not done yet.
+	* 2. Corpus SCOPE no longer drifts: the seed records the turn's resolved scope in `lakeScope`
+	*    and the replay probes that, so a session whose lake selection has since changed is still
+	*    scored against the lakes its turn actually had. The cost is coverage rather than accuracy -
+	*    a turn with no recorded scope is skipped instead of approximated, so every turn predating
+	*    the field is outside the measurement.
 	* 3. The QUESTION can move out from under it. The probe is keyed to the quest, not to the
 	*    prompt text it scored, so a turn whose prompt is later rewritten in place keeps a probe
 	*    describing the question it used to ask. mergeRetrievalSummary preserves the probe across
@@ -11935,7 +12098,32 @@ const RetrievalSummarySchema = z$1.object({
 	* non-empty value does not prove the admission is what made the injection possible. Absent means no
 	* admitted id was among this turn's injections, including every turn on a session with none.
 	*/
-	preauthorizedLakeIdsUsed: z$1.array(z$1.string()).optional()
+	preauthorizedLakeIdsUsed: z$1.array(z$1.string()).optional(),
+	/**
+	* Which of this turn's injected lake prompt ids the caller holds an owner/curator GRANT on - the
+	* per-arm sibling of `preauthorizedLakeIdsUsed`, and the reason both exist: `injectedLakePromptIds`
+	* records THAT a lake's systemPrompt entered the turn, these two record WHICH ARM admitted it.
+	* A subset of injectedLakePromptIds, never a superset. Derived at both injection sites via
+	* grantedLakeIdsUsedFor.
+	*
+	* THE ARM WORTH NAMING SEPARATELY: the grant arm (#2495) is the only one that can cross an org
+	* boundary - `grantLakeAccess` can hand a CURATOR grant to an arbitrary cross-tenant user, and
+	* that grant carries injection trust. The creator and org arms cannot reach past one org, and a
+	* reader grant is excluded permanently, so a lake listed here is the case an operator auditing
+	* cross-tenant prompt influence is actually looking for.
+	*
+	* MEMBERSHIP, NOT CAUSATION, the same caveat the field above carries: a granted lake its holder
+	* could already reach (they created it, or they are in its org) injects through the ordinary
+	* trust arm and is listed here anyway, so a non-empty value does not prove the grant is what
+	* made the injection possible. The two fields OVERLAP for that reason - a lake can appear in
+	* both - so they are not a partition of injectedLakePromptIds and must not be counted as one.
+	*
+	* Absent means no injected id was grant-reached, including every turn where the grant read
+	* FAILED (it is fail-quiet by design - telemetry must not drop the injection it records), so
+	* absence is weaker evidence than presence. Date-bound any rollup: turns predating this field
+	* carry nothing, and no backfill is possible - a past turn's grant rows have moved on.
+	*/
+	grantedLakeIdsUsed: z$1.array(z$1.string()).optional()
 });
 /**
 * Why a grounded turn's library scan stopped short of the whole library.
@@ -16541,4 +16729,4 @@ var ConfigStore = class {
 	}
 };
 //#endregion
-export { SupportedFabFileMimeTypes as $, buildRateLimitLogEntry as $t, HTTPError as A, isRenderableModelType as At, OPENAI_GPT_IMAGE_1_IMAGE_SIZES as B, resolveHistoryFetchLimit as Bt, DEFAULT_MUSIC_MODEL_ID as C, isGeminiModelId as Ct, FIXED_TEMPERATURE_MODELS as D, isModelAccessible as Dt, FIELD_GROUP_OF as E, isMediaModelType as Et, MODEL_INFO_FIELD_GROUP_OF as F, isZodError as Ft, PermissionDeniedError as G, usdToCredits as Gt, OllamaEmbeddingModel as H, settingsMap as Ht, McpServerName as I, mapMimeTypeToArtifactType as It, REFUSAL_FALLBACK_MODELS as J, ACTOR_COLOR_SLOTS as Jt, REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS as K, usdToCreditsStochastic as Kt, ModelBackend as L, obfuscateApiKey as Lt, IMAGE_SIZE_CONSTRAINTS as M, isSupportedFabFileMimeType as Mt, ImageModels as N, isUnlimitedHistory as Nt, FORMAT_PROMPT_TEMPLATE as O, isModelDeprecated as Ot, InternalServerError as P, isUserInitiatedAbort as Pt, SpeechToTextModels as Q, selfClaimedActorKindSchema as Qt, NO_TEMPERATURE_MODELS as R, parseEmbeddingRateLimitHeaders as Rt, CorruptedFileError as S, isGPTImageModel as St, DEGENERATE_FINISH_REASON as T, isImageServeable as Tt, OpenAIEmbeddingModel as U, toModelInfo as Ut, OPENAI_GPT_IMAGE_2_IMAGE_SIZES as V, secureParameters as Vt, PROMPT_TEXT_MAX as W, toModelRecord as Wt, REVIEW_GATE_STATUS_VALUES as X, actorKindMarker as Xt, RESPONSES_API_TOOL_MODELS as Y, actorColorIndex as Yt, SUBQUEST_STATUS_VALUES as Z, actorKindSchema as Zt, BadRequestError as _, isChunkRebuildPending as _t, getCreditsUrl as a, VideoModels as at, CREDIT_DEDUCT_TRANSACTION_TYPES as b, isFieldGroup as bt, requireApiUrl as c, applyModelPriceCatalog as ct, AGENT_QUEST_MANIFEST as d, defaultEmbeddingModelForEnv as dt, extractSnippetMeta as en, TTS_MAX_INPUT_CHARS as et, AGENT_QUEST_MCP_URI as f, getMcpProviderMetadata as ft, BFL_SAFETY_TOLERANCE as g, isAudioMimeType as gt, BEDROCK_NO_PROMPT_CACHING_MODELS as h, hasUsableLimits as ht, LOCAL_DEV_URL as i, VIDEO_SIZE_CONSTRAINTS as it, HttpStatus as j, isRetryableError as jt, ForbiddenError as k, isPlaceholderApiKey as kt, resolveApiEndpoint as l, calculateRetryDelay as lt, ApiKeyType as m, getRetryAfterMs as mt, logger as n, parseRateLimitHeaders as nn, UnauthorizedError as nt, getEnvironmentName as o, VoyageAIEmbeddingModel as ot, ARTIFACT_ATTRS_PATTERN as p, getQuestErrorCode as pt, REASONING_SUPPORTED_MODELS as q, withRetry as qt, ApiEndpointUnconfiguredError as r, UnprocessableEntityError as rt, parseApiUrl as s, WORK_ITEM_STATUSES as st, ConfigStore as t, isNearLimit as tn, TooManyRequestsError as tt, AGENT_QUEST_ID as u, dayjsConfig_default as ut, BedrockEmbeddingModel as v, isChunkStalledFile as vt, DEFAULT_UNKNOWN_CONTEXT_WINDOW as w, isImageAttachment as wt, ChatModels as x, isGPTImage2Model as xt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as y, isEarlyStop as yt, NotFoundError as z, reservationOutputTokens as zt };
+export { SupportedFabFileMimeTypes as $, selfClaimedActorKindSchema as $t, HTTPError as A, isPlaceholderApiKey as At, OPENAI_GPT_IMAGE_1_IMAGE_SIZES as B, reservationOutputTokens as Bt, DEFAULT_MUSIC_MODEL_ID as C, isGPTImageModel as Ct, FIXED_TEMPERATURE_MODELS as D, isMediaModelType as Dt, FIELD_GROUP_OF as E, isImageServeable as Et, MODEL_INFO_FIELD_GROUP_OF as F, isUserInitiatedAbort as Ft, PermissionDeniedError as G, toModelRecord as Gt, OllamaEmbeddingModel as H, secureParameters as Ht, McpServerName as I, isZodError as It, REFUSAL_FALLBACK_MODELS as J, withRetry as Jt, REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS as K, usdToCredits as Kt, ModelBackend as L, mapMimeTypeToArtifactType as Lt, IMAGE_SIZE_CONSTRAINTS as M, isRetryableError as Mt, ImageModels as N, isSupportedFabFileMimeType as Nt, FORMAT_PROMPT_TEMPLATE as O, isModelAccessible as Ot, InternalServerError as P, isUnlimitedHistory as Pt, SpeechToTextModels as Q, actorKindSchema as Qt, NO_TEMPERATURE_MODELS as R, obfuscateApiKey as Rt, CorruptedFileError as S, isGPTImage2Model as St, DEGENERATE_FINISH_REASON as T, isImageAttachment as Tt, OpenAIEmbeddingModel as U, settingsMap as Ut, OPENAI_GPT_IMAGE_2_IMAGE_SIZES as V, resolveHistoryFetchLimit as Vt, PROMPT_TEXT_MAX as W, toModelInfo as Wt, REVIEW_GATE_STATUS_VALUES as X, actorColorIndex as Xt, RESPONSES_API_TOOL_MODELS as Y, ACTOR_COLOR_SLOTS as Yt, SUBQUEST_STATUS_VALUES as Z, actorKindMarker as Zt, BadRequestError as _, isAudioMimeType as _t, getCreditsUrl as a, VideoModels as at, CREDIT_DEDUCT_TRANSACTION_TYPES as b, isEarlyStop as bt, requireApiUrl as c, applyModelPriceCatalog as ct, AGENT_QUEST_MANIFEST as d, defaultEmbeddingModelForEnv as dt, buildRateLimitLogEntry as en, TTS_MAX_INPUT_CHARS as et, AGENT_QUEST_MCP_URI as f, getMcpProviderMetadata as ft, BFL_SAFETY_TOLERANCE as g, hasUsableLimits as gt, BEDROCK_NO_PROMPT_CACHING_MODELS as h, hasKeylessCloudEmbedder as ht, LOCAL_DEV_URL as i, VIDEO_SIZE_CONSTRAINTS as it, HttpStatus as j, isRenderableModelType as jt, ForbiddenError as k, isModelDeprecated as kt, resolveApiEndpoint as l, calculateRetryDelay as lt, ApiKeyType as m, getRetryAfterMs as mt, logger as n, isNearLimit as nn, UnauthorizedError as nt, getEnvironmentName as o, VoyageAIEmbeddingModel as ot, ARTIFACT_ATTRS_PATTERN as p, getQuestErrorCode as pt, REASONING_SUPPORTED_MODELS as q, usdToCreditsStochastic as qt, ApiEndpointUnconfiguredError as r, parseRateLimitHeaders as rn, UnprocessableEntityError as rt, parseApiUrl as s, WORK_ITEM_STATUSES as st, ConfigStore as t, extractSnippetMeta as tn, TooManyRequestsError as tt, AGENT_QUEST_ID as u, dayjsConfig_default as ut, BedrockEmbeddingModel as v, isChunkRebuildPending as vt, DEFAULT_UNKNOWN_CONTEXT_WINDOW as w, isGeminiModelId as wt, ChatModels as x, isFieldGroup as xt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as y, isChunkStalledFile as yt, NotFoundError as z, parseEmbeddingRateLimitHeaders as zt };

package/dist/{buildAgent-jZhBReAr.mjs → buildAgent-CvPRH2n-.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { F as loadContextFiles, J as setWebSocketToolExecutor, L as generateCliTools, M as ReActAgent, X as buildSystemPrompt, Y as getPlanModeFilePath, a as McpManager, i as AgentStore, l as OllamaBackend, n as BackgroundAgentManager, o as createSseBackend, r as SubagentOrchestrator, s as ServerLlmBackend, t as AgentHistoryStore } from "./AgentHistoryStore-ucv6xXVT.mjs";
-import { n as logger } from "./ConfigStore-CoY0l0gr.mjs";
+import { F as loadContextFiles, J as setWebSocketToolExecutor, L as generateCliTools, M as ReActAgent, X as buildSystemPrompt, Y as getPlanModeFilePath, a as McpManager, i as AgentStore, l as OllamaBackend, n as BackgroundAgentManager, o as createSseBackend, r as SubagentOrchestrator, s as ServerLlmBackend, t as AgentHistoryStore } from "./AgentHistoryStore-7zQUOxkA.mjs";
+import { n as logger } from "./ConfigStore-8_0WsN5r.mjs";
 import { z as z$1 } from "zod";
 import WebSocket from "ws";
 //#region src/llm/NotifyingLlmBackend.ts

package/dist/commands/acpCommand.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as RemoteSkillSource, A as FallbackLlmBackend, C as createWriteTodosTool, D as createResumeAgentTool, E as createCoordinateTaskTool, I as PermissionManager, J as setWebSocketToolExecutor, O as createBackgroundAgentTools, Q as isReadOnlyTool, S as createTodoStore, et as CustomCommandStore, k as createAgentDelegateTool, nt as SessionStore, tt as CheckpointStore, w as createSkillTool, x as createFindDefinitionTool, y as createGetFileStructureTool } from "../AgentHistoryStore-ucv6xXVT.mjs";
-import { c as requireApiUrl, n as logger, t as ConfigStore } from "../ConfigStore-CoY0l0gr.mjs";
-import { t as ApiClient } from "../ApiClient-Ut1MXtOs.mjs";
-import { a as createToolSearchTool, i as buildLlmBackend, n as buildSupportingStores, o as deferredToolRegistry, r as buildSandbox, s as NotifyingLlmBackend, t as buildAgent } from "../buildAgent-jZhBReAr.mjs";
+import { $ as RemoteSkillSource, A as FallbackLlmBackend, C as createWriteTodosTool, D as createResumeAgentTool, E as createCoordinateTaskTool, I as PermissionManager, J as setWebSocketToolExecutor, O as createBackgroundAgentTools, Q as isReadOnlyTool, S as createTodoStore, et as CustomCommandStore, k as createAgentDelegateTool, nt as SessionStore, tt as CheckpointStore, w as createSkillTool, x as createFindDefinitionTool, y as createGetFileStructureTool } from "../AgentHistoryStore-7zQUOxkA.mjs";
+import { c as requireApiUrl, n as logger, t as ConfigStore } from "../ConfigStore-8_0WsN5r.mjs";
+import { t as ApiClient } from "../ApiClient-XdY9O3nz.mjs";
+import { a as createToolSearchTool, i as buildLlmBackend, n as buildSupportingStores, o as deferredToolRegistry, r as buildSandbox, s as NotifyingLlmBackend, t as buildAgent } from "../buildAgent-CvPRH2n-.mjs";
 import { randomUUID } from "crypto";
 import { existsSync, realpathSync, statSync } from "fs";
 import { isAbsolute } from "path";

package/dist/commands/apiCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { l as resolveApiEndpoint, s as parseApiUrl, t as ConfigStore } from "../ConfigStore-CoY0l0gr.mjs";
+import { l as resolveApiEndpoint, s as parseApiUrl, t as ConfigStore } from "../ConfigStore-8_0WsN5r.mjs";
 //#region src/commands/apiCommand.ts
 /**
 * External API config command (--api-url / --reset-api)

package/dist/commands/doctorCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-CfIETbXd.mjs";
+import { t as version } from "../package-OZdXqn0e.mjs";
 import { a as fetchLatestVersion, c as isNpmPrefixWritable, i as compareSemver } from "../updateChecker-CQW8bxo6.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync } from "child_process";

package/dist/commands/envCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-CoY0l0gr.mjs";
+import { t as ConfigStore } from "../ConfigStore-8_0WsN5r.mjs";
 //#region src/commands/envCommand.ts
 /**
 * Environment switching for the `--dev` / `--prod` launch flags.

package/dist/commands/headlessCommand.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as RemoteSkillSource, A as FallbackLlmBackend, B as classifyCommandRisk, C as createWriteTodosTool, D as createResumeAgentTool, E as createCoordinateTaskTool, F as loadContextFiles, I as PermissionManager, J as setWebSocketToolExecutor, L as generateCliTools, M as ReActAgent, O as createBackgroundAgentTools, Q as isReadOnlyTool, S as createTodoStore, X as buildSystemPrompt, a as McpManager, b as createWorkItemTools, et as CustomCommandStore, i as AgentStore, k as createAgentDelegateTool, n as BackgroundAgentManager, nt as SessionStore, o as createSseBackend, r as SubagentOrchestrator, t as AgentHistoryStore, tt as CheckpointStore, w as createSkillTool, x as createFindDefinitionTool, y as createGetFileStructureTool, z as SHELL_LIKE_TOOL_COMMAND_FIELDS } from "../AgentHistoryStore-ucv6xXVT.mjs";
-import { c as requireApiUrl, n as logger, t as ConfigStore } from "../ConfigStore-CoY0l0gr.mjs";
-import { t as ApiClient } from "../ApiClient-Ut1MXtOs.mjs";
+import { $ as RemoteSkillSource, A as FallbackLlmBackend, B as classifyCommandRisk, C as createWriteTodosTool, D as createResumeAgentTool, E as createCoordinateTaskTool, F as loadContextFiles, I as PermissionManager, J as setWebSocketToolExecutor, L as generateCliTools, M as ReActAgent, O as createBackgroundAgentTools, Q as isReadOnlyTool, S as createTodoStore, X as buildSystemPrompt, a as McpManager, b as createWorkItemTools, et as CustomCommandStore, i as AgentStore, k as createAgentDelegateTool, n as BackgroundAgentManager, nt as SessionStore, o as createSseBackend, r as SubagentOrchestrator, t as AgentHistoryStore, tt as CheckpointStore, w as createSkillTool, x as createFindDefinitionTool, y as createGetFileStructureTool, z as SHELL_LIKE_TOOL_COMMAND_FIELDS } from "../AgentHistoryStore-7zQUOxkA.mjs";
+import { c as requireApiUrl, n as logger, t as ConfigStore } from "../ConfigStore-8_0WsN5r.mjs";
+import { t as ApiClient } from "../ApiClient-XdY9O3nz.mjs";
 import { t as DEFAULT_SANDBOX_CONFIG } from "../types-LyRNHOiS.mjs";
 import { r as reconstructTurnBlocks, t as WorkItemsClient } from "../WorkItemsClient-Cow6nXx7.mjs";
 import { t as createSandboxRuntime } from "../SandboxRuntimeAdapter-ChGlxSGQ.mjs";

package/dist/commands/mcpCommand.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as ConfigStore } from "../ConfigStore-CoY0l0gr.mjs";
-import { t as version } from "../package-CfIETbXd.mjs";
+import { t as ConfigStore } from "../ConfigStore-8_0WsN5r.mjs";
+import { t as version } from "../package-OZdXqn0e.mjs";
 //#region src/commands/mcpCommand.ts
 /**
 * External MCP commands (b4m mcp list, b4m mcp add, etc.)
@@ -70,7 +70,7 @@ async function handleMcpCommand(subcommand, argv) {
 			await handleDisable(config, argv.name, configStore);
 			break;
 		case "serve": {
-			const { handleMcpServeCommand } = await import("../serve-C9UDR5px.mjs");
+			const { handleMcpServeCommand } = await import("../serve-CEqSZwl6.mjs");
 			await handleMcpServeCommand({
 				http: Boolean(argv.http),
 				port: typeof argv.port === "number" ? argv.port : void 0,

package/dist/commands/pluginCommand.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { n as getDefaultPluginsDir, r as isFeatureEnabled, t as PluginStore } from "../PluginStore-DwvOJ-G3.mjs";
-import { t as ConfigStore } from "../ConfigStore-CoY0l0gr.mjs";
+import { t as ConfigStore } from "../ConfigStore-8_0WsN5r.mjs";
 import { execFileSync } from "child_process";
 import { promises } from "fs";
 import path from "path";

package/dist/commands/updateCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-CfIETbXd.mjs";
+import { t as version } from "../package-OZdXqn0e.mjs";
 import { c as isNpmPrefixWritable, l as setAutoUpdatePreference, n as REEXEC_GUARD_ENV, o as forceCheckForUpdate, r as checkForUpdate, s as getAutoUpdatePreference, t as INSTALL_CMD, u as shouldAttemptAutoUpdate } from "../updateChecker-CQW8bxo6.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync, spawnSync } from "child_process";

package/dist/index.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { $ as RemoteSkillSource, A as FallbackLlmBackend, C as createWriteTodosTool, D as createResumeAgentTool, E as createCoordinateTaskTool, G as DEFAULT_THOROUGHNESS, H as DEFAULT_AGENT_MODEL, I as PermissionManager, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, N as findIterationBoundary, O as createBackgroundAgentTools, P as extractCompactInstructions, Q as isReadOnlyTool, R as getProcessHooks, S as createTodoStore, T as parseAgentConfig, U as DEFAULT_MAX_ITERATIONS, V as ALWAYS_DENIED_FOR_AGENTS, W as DEFAULT_RETRY_CONFIG, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionStore, at as searchCommands, b as createWorkItemTools, c as isTransientNetworkError, ct as searchFiles, d as createReviewGateTool, et as CustomCommandStore, f as formatReviewGatesOutput, ft as MAX_PASTE_SIZE, g as createDecisionLogTool, h as formatBlockersOutput, it as processFileReferences, j as substituteArguments, k as createAgentDelegateTool, lt as warmFileCache, m as createBlockerTools, nt as SessionStore, ot as mergeCommands, p as createBlockerStore, q as registerFeatureModuleTools, rt as hasFileReferences, st as formatFileSize, tt as CheckpointStore, u as createReviewGateStore, ut as COMPACTION_SUMMARY_MARKER, v as formatDecisionsOutput, w as createSkillTool, x as createFindDefinitionTool, y as createGetFileStructureTool } from "./AgentHistoryStore-ucv6xXVT.mjs";
+import { $ as RemoteSkillSource, A as FallbackLlmBackend, C as createWriteTodosTool, D as createResumeAgentTool, E as createCoordinateTaskTool, G as DEFAULT_THOROUGHNESS, H as DEFAULT_AGENT_MODEL, I as PermissionManager, J as setWebSocketToolExecutor, K as clearFeatureModuleTools, N as findIterationBoundary, O as createBackgroundAgentTools, P as extractCompactInstructions, Q as isReadOnlyTool, R as getProcessHooks, S as createTodoStore, T as parseAgentConfig, U as DEFAULT_MAX_ITERATIONS, V as ALWAYS_DENIED_FOR_AGENTS, W as DEFAULT_RETRY_CONFIG, X as buildSystemPrompt, Y as getPlanModeFilePath, Z as buildSkillsPromptSection, _ as createDecisionStore, at as searchCommands, b as createWorkItemTools, c as isTransientNetworkError, ct as searchFiles, d as createReviewGateTool, et as CustomCommandStore, f as formatReviewGatesOutput, ft as MAX_PASTE_SIZE, g as createDecisionLogTool, h as formatBlockersOutput, it as processFileReferences, j as substituteArguments, k as createAgentDelegateTool, lt as warmFileCache, m as createBlockerTools, nt as SessionStore, ot as mergeCommands, p as createBlockerStore, q as registerFeatureModuleTools, rt as hasFileReferences, st as formatFileSize, tt as CheckpointStore, u as createReviewGateStore, ut as COMPACTION_SUMMARY_MARKER, v as formatDecisionsOutput, w as createSkillTool, x as createFindDefinitionTool, y as createGetFileStructureTool } from "./AgentHistoryStore-7zQUOxkA.mjs";
 import { a as selectLiveSubagentTokens, i as selectLiveSubagentCredits, n as selectActiveBackgroundShells, o as useCliStore, r as selectCompletedBackgroundShells, t as selectActiveBackgroundAgents } from "./store-CvjTpQPs.mjs";
 import { r as isFeatureEnabled, t as PluginStore } from "./PluginStore-DwvOJ-G3.mjs";
-import { Jt as ACTOR_COLOR_SLOTS, Qt as selfClaimedActorKindSchema, X as REVIEW_GATE_STATUS_VALUES, Xt as actorKindMarker, Yt as actorColorIndex, Z as SUBQUEST_STATUS_VALUES, Zt as actorKindSchema, a as getCreditsUrl, b as CREDIT_DEDUCT_TRANSACTION_TYPES, c as requireApiUrl, i as LOCAL_DEV_URL, l as resolveApiEndpoint, n as logger, o as getEnvironmentName, r as ApiEndpointUnconfiguredError, s as parseApiUrl, t as ConfigStore, x as ChatModels, yt as isEarlyStop } from "./ConfigStore-CoY0l0gr.mjs";
+import { $t as selfClaimedActorKindSchema, Qt as actorKindSchema, X as REVIEW_GATE_STATUS_VALUES, Xt as actorColorIndex, Yt as ACTOR_COLOR_SLOTS, Z as SUBQUEST_STATUS_VALUES, Zt as actorKindMarker, a as getCreditsUrl, b as CREDIT_DEDUCT_TRANSACTION_TYPES, bt as isEarlyStop, c as requireApiUrl, i as LOCAL_DEV_URL, l as resolveApiEndpoint, n as logger, o as getEnvironmentName, r as ApiEndpointUnconfiguredError, s as parseApiUrl, t as ConfigStore, x as ChatModels } from "./ConfigStore-8_0WsN5r.mjs";
 import { t as getShellSessionManager } from "./ShellSessionManager-6o8KZzl1-vrbPAUTq.mjs";
-import { n as OAuthClient, t as ApiClient } from "./ApiClient-Ut1MXtOs.mjs";
+import { n as OAuthClient, t as ApiClient } from "./ApiClient-XdY9O3nz.mjs";
 import { i as getTokenCounter, n as ConversationContext, r as reconstructTurnBlocks, t as WorkItemsClient } from "./WorkItemsClient-Cow6nXx7.mjs";
-import { a as createToolSearchTool, i as buildLlmBackend, n as buildSupportingStores, o as deferredToolRegistry, r as buildSandbox, s as NotifyingLlmBackend, t as buildAgent } from "./buildAgent-jZhBReAr.mjs";
-import { t as version } from "./package-CfIETbXd.mjs";
+import { a as createToolSearchTool, i as buildLlmBackend, n as buildSupportingStores, o as deferredToolRegistry, r as buildSandbox, s as NotifyingLlmBackend, t as buildAgent } from "./buildAgent-CvPRH2n-.mjs";
+import { t as version } from "./package-OZdXqn0e.mjs";
 import { r as checkForUpdate } from "./updateChecker-CQW8bxo6.mjs";
 import React, { useCallback, useEffect, useMemo, useReducer, useRef, useState, useSyncExternalStore } from "react";
 import { Box, Static, Text, render, useApp, useInput, usePaste, useStdout } from "ink";

package/dist/{package-CfIETbXd.mjs → package-OZdXqn0e.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 //#region package.json
-var version = "0.21.0";
+var version = "0.22.0";
 //#endregion
 export { version as t };

package/dist/{serve-C9UDR5px.mjs → serve-CEqSZwl6.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { W as PROMPT_TEXT_MAX, c as requireApiUrl, d as AGENT_QUEST_MANIFEST, f as AGENT_QUEST_MCP_URI, n as logger, s as parseApiUrl, t as ConfigStore, u as AGENT_QUEST_ID } from "./ConfigStore-CoY0l0gr.mjs";
-import { t as ApiClient } from "./ApiClient-Ut1MXtOs.mjs";
+import { W as PROMPT_TEXT_MAX, c as requireApiUrl, d as AGENT_QUEST_MANIFEST, f as AGENT_QUEST_MCP_URI, n as logger, s as parseApiUrl, t as ConfigStore, u as AGENT_QUEST_ID } from "./ConfigStore-8_0WsN5r.mjs";
+import { t as ApiClient } from "./ApiClient-XdY9O3nz.mjs";
 import { z as z$1 } from "zod";
 import { isAxiosError } from "axios";
 import { Writable } from "node:stream";