@bike4mind/cli 1.0.0 → 1.1.0

package/dist/{ConfigStore-DHNgFdOu.mjs → ConfigStore-DdHHCH2t.mjs}

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
-import { t as DEFAULT_SANDBOX_CONFIG } from "./types-LyRNHOiS.mjs";
+import { t as DEFAULT_SANDBOX_CONFIG } from "./types-F61_hxmG.mjs";
 import "crypto";
 import { existsSync, promises } from "fs";
 import os, { homedir } from "os";
 import path from "path";
 import { v4 } from "uuid";
+import * as path$1 from "node:path";
+import * as fs$2 from "node:fs";
 import * as z$2 from "zod";
 import z, { ZodError, z as z$1 } from "zod";
 import dayjs from "dayjs";
@@ -13,25 +15,65 @@ import utc from "dayjs/plugin/utc.js";
 import relativeTime from "dayjs/plugin/relativeTime.js";
 import localizedFormat from "dayjs/plugin/localizedFormat.js";
 import { isAxiosError } from "axios";
+import { homedir as homedir$1 } from "node:os";
 import fs$1 from "fs/promises";
 process.env.APP_NAME;
 process.env.WEBSITE_URL;
+const SNIPPET_META_OPEN = "<!--snippet-meta";
+const SNIPPET_META_CLOSE = "-->";
+/** Index of the first non-whitespace character at or after `from`. */
+const skipSpaceForward = (text, from) => {
+	let i = from;
+	while (i < text.length && /\s/.test(text[i])) i++;
+	return i;
+};
+/** Index just past the last non-whitespace character before `before`. */
+const skipSpaceBackward = (text, before) => {
+	let i = before;
+	while (i > 0 && /\s/.test(text[i - 1])) i--;
+	return i;
+};
+/**
+* Split a prompt into its `<!--snippet-meta {...}-->` sections and the text around them.
+*
+* Scanned with indexOf rather than a regex. The regex this replaces backtracked
+* super-linearly on a marker whose JSON never closed, which invited a parse cap - but a
+* cap could not be applied safely here: the section pattern was terminated by
+* `(?=<!--snippet-meta|$)`, so capping moved `$` and changed section SHAPE, not just
+* length. Past the cap a snippet re-emitted as a `text` section, and callers that skip
+* snippets when collecting URLs to fetch (utils/src/llm/utils.ts) would start fetching
+* them. A linear scan needs no cap, so the shape is the same at every input length.
+*/
 const extractSnippetMeta = (content) => {
-	const snippetRegex = /<!--snippet-meta\s*(\{[\s\S]*?\})\s*-->[\n\s]*([\s\S]*?)(?=<!--snippet-meta|$)/g;
 	const sections = [];
-	let lastIndex = 0;
-	let match;
-	while ((match = snippetRegex.exec(content)) !== null) {
-		if (match.index > lastIndex) {
-			const textBefore = content.slice(lastIndex, match.index).trim();
-			if (textBefore) sections.push({
-				type: "text",
-				content: textBefore
-			});
+	let cursor = 0;
+	let search = 0;
+	while (search < content.length) {
+		const open = content.indexOf(SNIPPET_META_OPEN, search);
+		if (open === -1) break;
+		const metaStart = skipSpaceForward(content, open + 16);
+		if (content[metaStart] !== "{") {
+			search = open + 16;
+			continue;
+		}
+		let close = content.indexOf(SNIPPET_META_CLOSE, metaStart);
+		while (close !== -1) {
+			const metaEnd = skipSpaceBackward(content, close);
+			if (metaEnd > metaStart && content[metaEnd - 1] === "}") break;
+			close = content.indexOf(SNIPPET_META_CLOSE, close + 3);
 		}
+		if (close === -1) break;
+		const bodyStart = close + 3;
+		const nextMarker = content.indexOf(SNIPPET_META_OPEN, bodyStart);
+		const bodyEnd = nextMarker === -1 ? content.length : nextMarker;
+		const textBefore = content.slice(cursor, open).trim();
+		if (textBefore) sections.push({
+			type: "text",
+			content: textBefore
+		});
 		try {
-			const meta = JSON.parse(match[1]);
-			const snippetContent = match[2].trim();
+			const meta = JSON.parse(content.slice(metaStart, skipSpaceBackward(content, close)));
+			const snippetContent = content.slice(bodyStart, bodyEnd).trim();
 			if (meta && snippetContent) sections.push({
 				type: "snippet",
 				meta,
@@ -40,15 +82,14 @@ const extractSnippetMeta = (content) => {
 		} catch (e) {
 			console.error("Error parsing snippet meta:", e);
 		}
-		lastIndex = match.index + match[0].length;
-	}
-	if (lastIndex < content.length) {
-		const remainingText = content.slice(lastIndex).trim();
-		if (remainingText) sections.push({
-			type: "text",
-			content: remainingText
-		});
+		cursor = bodyEnd;
+		search = bodyEnd;
 	}
+	const remainingText = content.slice(cursor).trim();
+	if (remainingText) sections.push({
+		type: "text",
+		content: remainingText
+	});
 	return { sections };
 };
 function getHeader$1(headers, name) {
@@ -858,6 +899,19 @@ let KnowledgeType = /* @__PURE__ */ function(KnowledgeType) {
 * fails the build.
 */
 const QUEST_ERROR_CODES = ["insufficient_credits", "spend_cap_exceeded"];
+/**
+* Single source of truth for `IChatHistoryItem.type` / quest `type`. Restated by hand in
+* `schemas/actions.ts`, `schemas/chat.ts`, and `notebookExportService/types.ts` before this
+* const existed, which is exactly how `voice_transcript` went missing from the export contract
+* once already - derive from this tuple instead of retyping the union.
+*/
+const CHAT_HISTORY_ITEM_TYPES = [
+	"message",
+	"oob",
+	"error",
+	"system",
+	"voice_transcript"
+];
 z$1.union([
 	z$1.literal("string"),
 	z$1.literal("number"),
@@ -982,6 +1036,12 @@ const IMAGE_SIZE_CONSTRAINTS = {
 			"2160x3840"
 		],
 		defaultSize: "1024x1024",
+		/**
+		* Accepted by the API, and what generate sends when no size is asked for, but it is not a
+		* resolution - so it is deliberately out of `sizes`, the preset list the size picker renders.
+		* The one spelling: schemas/openai.ts and utils/imageSizes.ts both read it from here.
+		*/
+		autoSize: "auto",
 		/** Constraints for custom/flexible sizes */
 		constraints: {
 			maxEdge: 3840,
@@ -990,6 +1050,29 @@ const IMAGE_SIZE_CONSTRAINTS = {
 			edgeMultiple: 16,
 			maxAspectRatio: 3
 		}
+	},
+	/** Also the only sizes the variation endpoint accepts - variations are dall-e-2 only. */
+	DALL_E_2: {
+		sizes: [
+			"256x256",
+			"512x512",
+			"1024x1024"
+		],
+		defaultSize: "1024x1024"
+	},
+	/**
+	* dall-e-3 is no longer in ImageModels, but the generate path still accepts its sizes
+	* for callers holding a persisted one. Listed separately to record what each tier really
+	* accepts; isSupportedImageSize currently measures both against the union of the two
+	* (OPENAI_LEGACY_IMAGE_SIZES), so the split is documentation rather than enforcement.
+	*/
+	DALL_E_3: {
+		sizes: [
+			"1024x1024",
+			"1792x1024",
+			"1024x1792"
+		],
+		defaultSize: "1024x1024"
 	}
 };
 /**
@@ -1650,7 +1733,8 @@ z$1.object({
 		"ok",
 		"error",
 		"timeout",
-		"refusal"
+		"refusal",
+		"degenerate"
 	]).default("ok"),
 	latencyMs: z$1.number().optional(),
 	/** Originating surface (web/cli/api/agent/system); unset => unclassified. */
@@ -1975,6 +2059,7 @@ const MODEL_INFO_FIELD_GROUP_OF = {
 	backend: "identity",
 	contextWindow: "limits",
 	max_tokens: "limits",
+	maxOutputTokensDerived: "limits",
 	can_think: "reasoning",
 	thinkingStyle: "reasoning",
 	can_stream: "modalities",
@@ -2247,6 +2332,16 @@ const DiscoveryPriceSkip = z$1.object({
 	modelId: z$1.string().min(1),
 	reason: z$1.string()
 });
+/**
+* A configured source the run never attempted, and why. Produced by
+* `skipReasonFor` in runModelDiscovery (services/modelDiscoveryService); the
+* reason stays a plain string rather than that module's SourceSkipReason union
+* so a new reason needs no schema or UI change.
+*/
+const DiscoverySkippedSource = z$1.object({
+	name: z$1.string().min(1),
+	reason: z$1.string()
+});
 const DiscoveryLifecycleTransition = z$1.object({
 	modelId: z$1.string().min(1),
 	/** Absent when no row in force carried a lifecycle for this model. */
@@ -2303,6 +2398,8 @@ z$1.object({
 	*/
 	mode: z$1.enum(DISCOVERY_RUN_MODES).optional(),
 	sources: z$1.array(DiscoverySourceReport).optional(),
+	/** Configured sources this run never attempted; disjoint from `sources`. */
+	skippedSources: z$1.array(DiscoverySkippedSource).optional(),
 	joinCoverage: z$1.array(DiscoveryJoinCoverage).optional(),
 	/** Ids no aggregator matched: a work item, not a log line. */
 	unmatchedIds: z$1.array(z$1.string()).optional(),
@@ -2419,6 +2516,59 @@ let McpServerName = /* @__PURE__ */ function(McpServerName) {
 	McpServerName["Notion"] = "notion";
 	return McpServerName;
 }({});
+const ROLLUP_DAY_MS = 864e5;
+/**
+* Reads a rollup bound as a UTC instant. The schema below accepts an offset-less value (what a
+* date picker emits), and a bare `new Date` would read that in the host's local zone - so the
+* same query would cover a different window depending on where it ran.
+*/
+function parseFeedbackRollupBound(value) {
+	return new Date(/([Zz]|[+-]\d{2}:?\d{2})$/.test(value) ? value : `${value}Z`);
+}
+z$1.object({
+	from: z$1.iso.datetime({
+		offset: true,
+		local: true
+	}),
+	to: z$1.iso.datetime({
+		offset: true,
+		local: true
+	})
+}).refine((query) => parseFeedbackRollupBound(query.from) < parseFeedbackRollupBound(query.to), {
+	message: "from must be strictly before to",
+	path: ["from"]
+}).refine((query) => parseFeedbackRollupBound(query.to).getTime() - parseFeedbackRollupBound(query.from).getTime() < 366 * ROLLUP_DAY_MS, {
+	message: `window must not exceed 366 days`,
+	path: ["to"]
+});
+const feedbackCountBucketSchema = z$1.object({
+	key: z$1.string(),
+	count: z$1.number()
+});
+const orgFeedbackSummaryCountsSchema = z$1.object({
+	totals: z$1.object({ count: z$1.number() }),
+	byDay: z$1.array(z$1.object({
+		day: z$1.string(),
+		count: z$1.number()
+	})),
+	bySubject: z$1.array(feedbackCountBucketSchema),
+	byType: z$1.array(feedbackCountBucketSchema),
+	byStatus: z$1.array(feedbackCountBucketSchema),
+	byTag: z$1.array(feedbackCountBucketSchema),
+	byTagTruncated: z$1.boolean().optional()
+});
+z$1.object({
+	summaryJobId: z$1.string(),
+	organizationId: z$1.string(),
+	range: z$1.object({
+		from: z$1.string(),
+		to: z$1.string()
+	}),
+	generatedAt: z$1.string(),
+	model: z$1.string(),
+	summary: z$1.string(),
+	counts: orgFeedbackSummaryCountsSchema
+});
 /**
 * Check if a value is a placeholder (not configured or SST default).
 * Uses case-insensitive comparison and trims whitespace to prevent bypass attempts.
@@ -2467,10 +2617,16 @@ function isPlaceholderApiKey(value) {
 /**
 * Lake lifecycle. Stable states (draft/active/archived/deleted) plus transitional
 * states (archiving/unarchiving/restoring/deleting/purging) that exist to drive UI and make a crashed
-* mid-operation observable. draft -> active is one-way. It happens implicitly once the lake
-* holds its first member file (see `activateIfDraft` below), and unconditionally when an
-* archived or deleted lake is restored, which is how an empty lake can end up active.
+* mid-operation observable.
 *
+* draft <-> active is a DELIBERATE, two-way move: `promoteDataLake` publishes a draft (the only
+* door onto `activateIfDraft` below) and `demoteDataLake` reverses it. Neither fires as a side
+* effect of adding content - a draft lake that fills up with files stays a draft, excluded from
+* grounding, until an owner or admin explicitly promotes it. Restoring an archived or
+* deleted lake still lands unconditionally on `active`, which is how an empty lake can end up
+* active without ever passing through an explicit promote.
+*
+
 * `purging` is the one transitional state that is NOT recoverable by retrying the same action:
 * it is claimed the moment a phase-2 hard delete is ACCEPTED (#1744), before the background
 * sweep runs, so that `listDeletedDataLakes` stops offering Restore on a lake whose
@@ -2582,6 +2738,7 @@ const LAKE_CONFIG_FIELD_AUDIT = {
 	totalChunkedChars: "excluded",
 	embeddingSpendMicroUsd: "excluded",
 	lastSyncAt: "excluded",
+	lastHealthCheckedAt: "excluded",
 	filesDeletedAt: "excluded",
 	filesArchivedAt: "excluded",
 	lakeMemoryExtractionAt: "excluded",
@@ -2960,6 +3117,26 @@ function isSupportedFabFileMimeType(mimeType) {
 	return !!mimeType && SUPPORTED_FAB_FILE_MIME_TYPES.has(mimeType);
 }
 /**
+* Known MIME types emitted by the generated-audio endpoints (TTS + sound
+* effects). Deliberately SEPARATE from SupportedFabFileMimeTypes: that set is
+* the ingest pipeline's chunk+vectorize allowlist, and audio is intentionally
+* NOT vectorizable and NOT attachable to a chat completion (no model accepts
+* audio input). Kept only for extension mapping / documentation; the runtime
+* guard below matches any `audio/*` so unusual provider subtypes are still
+* treated as audio (i.e. still excluded from every LLM path).
+*/
+let AudioMimeType = /* @__PURE__ */ function(AudioMimeType) {
+	AudioMimeType["MP3"] = "audio/mpeg";
+	AudioMimeType["WAV"] = "audio/wav";
+	AudioMimeType["OPUS"] = "audio/opus";
+	AudioMimeType["AAC"] = "audio/aac";
+	AudioMimeType["FLAC"] = "audio/flac";
+	AudioMimeType["PCM"] = "audio/pcm";
+	AudioMimeType["OGG"] = "audio/ogg";
+	AudioMimeType["WEBM"] = "audio/webm";
+	return AudioMimeType;
+}({});
+/**
 * Is this an audio MIME type? Matches any `audio/*` (not just the known set)
 * so the LLM-exclusion and vectorization-skip guards fail safe for any audio
 * subtype a provider might emit.
@@ -3117,6 +3294,18 @@ const isRenderableModelType = (type) => MODEL_INFO_TYPES.includes(type);
 */
 const isMediaModelType = (type) => type === "image" || type === "video";
 /**
+* The modalities promptMeta.model.type is allowed to record. Deliberately NARROWER than
+* MODEL_INFO_TYPES: 'speech-to-text' is served by its own transcription route, never by a
+* completion, so recording it would put a value in the field that no reader narrows on.
+* PromptMetaModelSchema.type (schemas/promptMeta) builds its z.enum from this const, and
+* QuestModelType (apps/client admin reporting) is an alias of the type - one source, three uses.
+*/
+const PROMPT_META_MODEL_TYPES = [
+	"text",
+	"image",
+	"video"
+];
+/**
 * The record -> ModelInfo adapter: one place where every ModelInfo field a
 * catalog record does not carry gets its default. Each default degrades to the
 * visible, recoverable behavior rather than the silent or expensive one.
@@ -3135,6 +3324,7 @@ function toModelInfo(record) {
 		backend: record.backend,
 		contextWindow: record.contextWindow,
 		max_tokens: record.maxOutputTokens ?? Math.min(record.contextWindow, 4096),
+		...record.maxOutputTokens === void 0 ? { maxOutputTokensDerived: true } : {},
 		pricing: {},
 		can_stream: record.canStream,
 		can_think: record.reasoning?.supported ?? false,
@@ -3240,7 +3430,7 @@ function toModelRecord(info) {
 		type: info.type,
 		name: info.name,
 		contextWindow: info.contextWindow,
-		maxOutputTokens: info.max_tokens,
+		maxOutputTokens: info.maxOutputTokensDerived === true ? void 0 : info.max_tokens,
 		canStream: info.can_stream,
 		reasoning: info.can_think === void 0 && info.thinkingStyle === void 0 ? void 0 : {
 			supported: info.can_think === true,
@@ -3535,7 +3725,7 @@ z$1.object({
 		"grounded",
 		"surface"
 	]).optional(),
-	skip_auto_offers: z$1.boolean().optional().describe("Suppress tools the server would otherwise attach on its own for this session (the knowledge-base search offer, in-app view navigation, blog drafting/editing/publishing, and skill invocation). Tools you request explicitly are unaffected. One system-prompt block goes with them: withholding in-app view navigation also drops the view-registry block that exists only to describe it. No other prompt content changes. This does not switch off retrieval: a session with forced knowledge retrieval still retrieves, and documents already attached to the session are still placed in the prompt directly. Any promptMode suppresses these too, so false has no effect alongside one."),
+	skip_auto_offers: z$1.boolean().optional().describe("Suppress tools the server would otherwise attach on its own for this session (the knowledge-base search offer, in-app view navigation, blog drafting/editing/publishing, skill invocation, and every tool from a connected MCP server). Native tools you request explicitly in `tools` are unaffected, but an MCP server tool cannot be named through this field, so with this flag set a caller with an MCP server connected sees none of its tools regardless of `tools`. One system-prompt block goes with them: withholding in-app view navigation also drops the view-registry block that exists only to describe it. No other prompt content changes. This does not switch off retrieval: a session with forced knowledge retrieval still retrieves, and documents already attached to the session are still placed in the prompt directly. Any promptMode suppresses these too, so false has no effect alongside one."),
 	includePromptDetails: z$1.boolean().optional(),
 	includeSystemPrompt: z$1.boolean().optional(),
 	systemPrompt: z$1.string().max(PROMPT_TEXT_MAX).optional().describe("System-prompt text for this request only, never persisted. Rendered as a defended block appended after every other system-prompt source, with prose instructing the model to defer to organization, session and data-lake guidance. Over the cap is a 422, never truncated.")
@@ -3547,6 +3737,8 @@ z$1.object({
 	timestamp: z$1.string(),
 	model: z$1.string(),
 	message: z$1.string().optional(),
+	type: z$1.enum(CHAT_HISTORY_ITEM_TYPES).optional(),
+	errorCode: z$1.enum(QUEST_ERROR_CODES).optional(),
 	tools: z$1.object({
 		toolMode: z$1.enum(["fast", "smart"]).optional(),
 		autoSelectedTools: z$1.array(z$1.string()).optional(),
@@ -3559,6 +3751,18 @@ z$1.object({
 		poll_url: z$1.string().optional()
 	})
 });
+z$1.object({
+	id: z$1.string(),
+	status: z$1.enum([
+		"stopped",
+		"running",
+		"done"
+	]).optional(),
+	type: z$1.enum(CHAT_HISTORY_ITEM_TYPES).optional(),
+	errorCode: z$1.enum(QUEST_ERROR_CODES).optional(),
+	reply: z$1.string().nullable().optional(),
+	replies: z$1.array(z$1.string()).optional()
+});
 /**
 * Reusable JSON error envelope (plain; the OpenAPI layer annotates it).
 *
@@ -3776,6 +3980,33 @@ const AGENT_EXECUTION_STATUSES = [
 	"aborted"
 ];
 /**
+* Why a session summarization happened, stamped on `ISession.summaryTrigger`. Single source for
+* the four places that each used to spell this list out: the Session zod schema
+* (schemas/actions.ts), the entity type (types/entities/SessionTypes.ts), the Mongoose path
+* (packages/database SessionModel) and the session.summarize event payload (apps/client
+* server/utils/eventBus.ts). They drifted - the Mongoose enum said 'milestone'/'growth' for two
+* values nothing produces - and a drift there is invisible at runtime, because BaseModel's
+* findOneAndUpdate writes without runValidators.
+*
+* 'throttling' is the one member no stored document can carry: shouldSummarizeSession
+* (b4m-core/services ChatCompletionFeatures) returns it as the reason it declined to summarize,
+* so it never reaches a write. It stays in the union because that return value is typed as
+* `ISessionDocument['summaryTrigger']`.
+*
+* 'manual' means someone asked for one notebook's summary. The admin sweep (apps/client
+* server/events/spider.ts) summarizes every un-summarized notebook of the admin who ran it in one
+* billed pass, so it stamps 'spider' instead: without that, one deliberate click and a whole sweep
+* are indistinguishable when someone investigates unexpected summarization spend.
+*/
+const SESSION_SUMMARY_TRIGGERS = [
+	"manual",
+	"project",
+	"earlyMilestone",
+	"contentGrowth",
+	"throttling",
+	"spider"
+];
+/**
 * Operator allow-list for the client-authored Mongo filter carried on a `subscribe_query` frame.
 *
 * The WS data-subscribe handler forwards that filter to `Model.find` and persists it on the
@@ -4044,6 +4275,19 @@ const QuestExportProgressAction = z$1.object({
 	droppedQuestCount: z$1.number().optional(),
 	clientId: z$1.string().optional()
 });
+const OrgFeedbackSummaryProgressAction = z$1.object({
+	action: z$1.literal("org_feedback_summary_progress"),
+	summaryJobId: z$1.string(),
+	organizationId: z$1.string(),
+	status: z$1.enum([
+		"processing",
+		"completed",
+		"failed"
+	]),
+	progress: z$1.number(),
+	errorMessage: z$1.string().optional(),
+	clientId: z$1.string().optional()
+});
 const SpiderProgressUpdateAction = z$1.object({
 	action: z$1.literal("spider_progress"),
 	spiderJobId: z$1.string(),
@@ -4128,13 +4372,7 @@ const StreamedChatCompletionAction = z$1.object({
 		replies: z$1.array(z$1.string()).optional(),
 		images: z$1.array(z$1.string()).optional(),
 		videos: z$1.array(z$1.string()).optional(),
-		type: z$1.enum([
-			"message",
-			"oob",
-			"error",
-			"system",
-			"voice_transcript"
-		]),
+		type: z$1.enum(CHAT_HISTORY_ITEM_TYPES),
 		status: z$1.enum([
 			"stopped",
 			"running",
@@ -4935,18 +5173,13 @@ const SessionCreatedAction = shareableDocumentSchema.extend({
 	claudeConversationId: z$1.string().optional(),
 	summary: z$1.string().optional(),
 	summaryAt: z$1.date().optional(),
-	summaryTrigger: z$1.enum([
-		"manual",
-		"project",
-		"earlyMilestone",
-		"contentGrowth",
-		"throttling"
-	]).optional(),
+	summaryTrigger: z$1.enum(SESSION_SUMMARY_TRIGGERS).optional(),
 	deletedAt: z$1.date().optional(),
 	tags: z$1.array(z$1.object({
 		name: z$1.string(),
 		strength: z$1.number()
 	})).optional(),
+	taggedAt: z$1.date().optional(),
 	clonedSourceId: z$1.string().nullable().optional(),
 	forkedSourceId: z$1.string().nullable().optional(),
 	isAutoNamed: z$1.boolean().optional(),
@@ -5208,6 +5441,7 @@ z$1.discriminatedUnion("action", [
 	ResearchTaskStatusUpdateAction,
 	NotebookCurationProgressUpdateAction,
 	QuestExportProgressAction,
+	OrgFeedbackSummaryProgressAction,
 	SpiderProgressUpdateAction,
 	SpiderCompleteAction,
 	SpiderErrorAction,
@@ -5466,11 +5700,27 @@ const CompletionContentEventSchema = z$1.object({
 	stopReason: z$1.string().optional(),
 	thinking: z$1.array(z$1.any()).optional()
 });
+/**
+* The in-band terminal failure frame. Because this endpoint flushes SSE headers
+* before it authenticates or prices anything, EVERY failure past the malformed-body
+* check arrives here under a 200 - there is no pre-stream 422 on this surface the
+* way there is on /api/chat and /api/embed/chat.
+*
+* `code` is the machine-readable classifier, drawn from QUEST_ERROR_CODES (itself a
+* narrowing of the platform-wide API_ERROR_CODES, so it cannot drift from the codes
+* the JSON surfaces use). It is what makes mid-generation credit exhaustion
+* detectable: the `message` is prose and callers must never match on it. Absent for
+* unclassified failures, so treat it as optional.
+*
+* The field is `code` rather than the conventions' `errorCode` because this frame
+* shipped that way and is a published wire shape; the vocabulary is what had to be
+* shared, not the key.
+*/
 const CompletionSseErrorEventSchema = z$1.object({
 	type: z$1.literal("error"),
 	message: z$1.string(),
 	requestId: z$1.string().optional(),
-	code: z$1.string().optional()
+	code: z$1.enum(QUEST_ERROR_CODES).optional()
 });
 z$1.union([
 	CompletionMetaEventSchema,
@@ -6156,21 +6406,9 @@ const ALL_IMAGE_MODELS = [
 	...XAI_IMAGE_MODELS,
 	...GEMINI_IMAGE_MODELS
 ];
-const OPENAI_GPT_IMAGE_1_IMAGE_SIZES = [
-	"1024x1024",
-	"1024x1536",
-	"1536x1024"
-];
-const OPENAI_GPT_IMAGE_2_IMAGE_SIZES = [
-	"1024x1024",
-	"1536x1024",
-	"1024x1536",
-	"2048x2048",
-	"2048x1152",
-	"3840x2160",
-	"2160x3840",
-	"auto"
-];
+const OPENAI_GPT_IMAGE_1_IMAGE_SIZES = IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_1.sizes;
+/** The UI presets plus the tier's non-resolution `autoSize`, which the picker cannot render. */
+const OPENAI_GPT_IMAGE_2_IMAGE_SIZES = [...IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.sizes, IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.autoSize];
 const BFL_IMAGE_SIZES = ["1024x768"];
 const OPENAI_IMAGE_SIZES = [...OPENAI_GPT_IMAGE_1_IMAGE_SIZES];
 const ALL_IMAGE_SIZES = [
@@ -6180,16 +6418,41 @@ const ALL_IMAGE_SIZES = [
 ];
 z$1.enum(OPENAI_IMAGE_SIZES);
 const ImageSizeSchema = z$1.union([z$1.enum(ALL_IMAGE_SIZES), z$1.string().regex(/^\d+x\d+$/, { error: "Size must be in format 'widthxheight'" })]);
-const OpenAIImageQualitySchema = z$1.enum([
+const OPENAI_IMAGE_QUALITIES = [
 	"standard",
 	"hd",
 	"low",
 	"medium",
 	"high",
 	"auto"
-]);
+];
+const OpenAIImageQualitySchema = z$1.enum(OPENAI_IMAGE_QUALITIES);
+OPENAI_IMAGE_QUALITIES.filter((quality) => quality !== "auto");
 const OpenAIImageStyleSchema = z$1.enum(["vivid", "natural"]);
 /**
+* Alpha handling for gpt-image renders. `transparent` only yields real alpha when the
+* output format also carries an alpha channel (png or webp) - OpenAI rejects it alongside
+* jpeg. Ignored by every other provider (see OpenAIImageService.generate).
+*/
+const OpenAIImageBackgroundSchema = z$1.enum([
+	"transparent",
+	"opaque",
+	"auto"
+]);
+/** Container for a generated image. `webp` is gpt-image only; BFL and Gemini take png/jpeg. */
+const ImageOutputFormatSchema = z$1.enum([
+	"png",
+	"jpeg",
+	"webp"
+]);
+/**
+* Degrade a shared output-format setting to what BFL and Gemini accept, so selecting
+* webp for gpt-image cannot fail an unrelated render after a model switch.
+*/
+function toNonWebpOutputFormat(format) {
+	return format === "webp" ? "png" : format;
+}
+/**
 * Maps legacy/removed image model IDs to their current replacements.
 * Prevents Zod validation failures when clients send stale persisted model names.
 *
@@ -6232,6 +6495,7 @@ const OpenAIImageGenerationInput = z$1.object({
 	response_format: z$1.enum(["b64_json", "url"]).optional(),
 	size: ImageSizeSchema.nullable().optional(),
 	style: OpenAIImageStyleSchema.optional(),
+	background: OpenAIImageBackgroundSchema.nullable().optional(),
 	width: z$1.number().optional(),
 	height: z$1.number().optional(),
 	aspect_ratio: z$1.string().optional()
@@ -6354,6 +6618,7 @@ z$1.object({
 	tags: z$1.array(SessionTagSchema).optional(),
 	lastUsedModel: z$1.string().min(1).nullish().describe("Pin a specific model id, or omit/send null to leave the current pin unchanged. Sending null does NOT clear it."),
 	forceKnowledgeRetrieval: z$1.boolean().optional(),
+	lakeScope: z$1.array(z$1.string()).nullable().optional().describe("The data lakes this session grounds on, as lake tags (the `datalakeTag` of each lake from GET /api/data-lakes). Send a list to ground only on those lakes, `[]` to ground on no lake at all, or `null` to clear the choice so retrieval falls back to every lake you can reach. Omit to leave the current choice unchanged. Tags naming a lake you cannot reach are ignored at retrieval time rather than rejected here. Narrowing the scope does not by itself turn retrieval on: pair it with `forceKnowledgeRetrieval: true` for a session that is not already grounded. Conversely `[]` leaves a grounded session nothing to retrieve from, so its forced retrieval is skipped rather than run against every lake."),
 	propagateToProjects: z$1.boolean().optional().describe("Defaults to true when omitted. When knowledgeIds grows, the newly-added file ids are also appended to every project that contains this session, granting every member of that project access to those files. This propagation is append-only and cannot be undone through the UI - pass false if newly-attached files should not be shared with the project.")
 });
 z$1.object({ id: z$1.string().min(1) });
@@ -6365,6 +6630,8 @@ z$1.object({
 	artifactIds: z$1.array(z$1.string()).optional(),
 	tags: z$1.array(SessionTagSchema).optional(),
 	forceKnowledgeRetrieval: z$1.boolean().optional(),
+	retrievalTags: z$1.array(z$1.string()).optional(),
+	lakeScopeExplicit: z$1.boolean().optional().describe("True when `retrievalTags` is a deliberate choice, so an empty list means \"no lake\" rather than \"any\"."),
 	lastUsedModel: z$1.string().nullish(),
 	firstCreated: z$1.date(),
 	lastUpdated: z$1.date()
@@ -6683,7 +6950,7 @@ function defaultEmbeddingModelForEnv() {
 	const hasOllama = !!process.env.OLLAMA_BASE_URL?.trim();
 	const hasCloudEmbeddingKey = !isPlaceholderApiKey(process.env.OPENAI_API_KEY) || !isPlaceholderApiKey(process.env.VOYAGE_API_KEY);
 	if (selfHost && hasOllama && !hasCloudEmbeddingKey) return "qwen3-embedding:0.6b";
-	return "text-embedding-ada-002";
+	return "text-embedding-3-small";
 }
 /**
 * True when this deployment can embed with no provider API key at all: a cloud stage reaches
@@ -6732,15 +6999,15 @@ z$1.union([
 ]);
 /**
 * The measured per-space floors, rendered for an admin-facing description (e.g. "75 for
-* text-embedding-ada-002, 35 for text-embedding-3-small").
+* text-embedding-ada-002, 58 for text-embedding-3-small").
 *
-* Rendered rather than written out in prose because these numbers are expected to move - 35 is
-* provisional until it is re-derived against a production lake - and a description that restates
-* the table is a wrong number shown to operators the moment it drifts, with nothing failing.
+* Rendered rather than written out in prose because these numbers move as each space is re-measured
+* against a production lake, and a description that restates the table is a wrong number shown to
+* operators the moment it drifts, with nothing failing.
 */
 const forcedRetrievalFloorsBySpaceSummary = Object.entries({
 	["text-embedding-ada-002"]: 75,
-	["text-embedding-3-small"]: 35
+	["text-embedding-3-small"]: 58
 }).map(([space, pct]) => `${pct} for ${space}`).join(", ");
 /**
 * Default text for the artifact-emission system prompt. Single source of truth used BOTH as the
@@ -7078,6 +7345,7 @@ z$1.enum([
 	"kbSearchMinRelevancePct",
 	"forcedRetrievalRelativeFloorPct",
 	"forcedRetrievalMinSimilarityPct",
+	"forcedRetrievalSpreadFloorPct",
 	"dataLakeEmbeddingSpendEnabled",
 	"dataLakeEmbeddingBudgetPerRunUsd",
 	"dataLakeEmbeddingBudgetPerLakeUsd",
@@ -7315,7 +7583,7 @@ function makeNumberSetting(config) {
 	return {
 		...config,
 		type: "number",
-		schema: numberSchema.prefault(config.defaultValue ?? 0)
+		schema: z$1.preprocess((val) => val === null || typeof val === "string" && val.trim() === "" ? void 0 : val, numberSchema.prefault(config.defaultValue ?? 0))
 	};
 }
 function makeBooleanSetting(config) {
@@ -7392,6 +7660,17 @@ const RapidReplySettingsSchema = z$1.object({
 		lastUpdated: /* @__PURE__ */ new Date()
 	})
 });
+/**
+* Canonical repository and branch the What's New generator reads from.
+*
+* Every default in the What's New path (zod schema, settings registry, server
+* config service, cron/backfill fallbacks, admin form seed) must resolve here.
+* A stale slug is invisible in production: GitHubService.listMergedPullRequests
+* returns [] for a repository outside the connection allowlist, so generation
+* records "no PRs today" instead of an error and the surface silently goes dark.
+*/
+const WHATS_NEW_DEFAULT_REPOSITORY = "Bike4Mind/bike4mind";
+const WHATS_NEW_DEFAULT_TARGET_BRANCH = "prod";
 const L = {
 	temperature: {
 		min: 0,
@@ -7495,8 +7774,8 @@ const WhatsNewConfigSchema = z$1.object({
 	maxCommitMessageLength: z$1.number().min(L.maxCommitMessageLength.min).max(L.maxCommitMessageLength.max).default(L.maxCommitMessageLength.default),
 	maxPRBodyLength: z$1.number().min(L.maxPRBodyLength.min).max(L.maxPRBodyLength.max).default(L.maxPRBodyLength.default),
 	maxChangelogLength: z$1.number().min(L.maxChangelogLength.min).max(L.maxChangelogLength.max).default(L.maxChangelogLength.default),
-	repository: z$1.string().regex(/^[\w.-]+\/[\w.-]+$/, "Must be in owner/repo format (e.g., MyOrg/my-repo)").default("MillionOnMars/lumina5"),
-	targetBranch: z$1.string().regex(/^[\w./-]+$/, "Must be a valid branch name").default("prod"),
+	repository: z$1.string().regex(/^[\w.-]+\/[\w.-]+$/, "Must be in owner/repo format (e.g., MyOrg/my-repo)").default(WHATS_NEW_DEFAULT_REPOSITORY),
+	targetBranch: z$1.string().regex(/^[\w./-]+$/, "Must be a valid branch name").default(WHATS_NEW_DEFAULT_TARGET_BRANCH),
 	promptTemplate: z$1.string().min(L.promptTemplate.min, `Prompt template must be at least ${L.promptTemplate.min} characters`).max(L.promptTemplate.max, `Prompt template cannot exceed ${L.promptTemplate.max.toLocaleString()} characters`).trim().optional()
 });
 const WhatsNewSyncConfigSchema = z$1.object({
@@ -7934,8 +8213,12 @@ const API_SERVICE_GROUPS = {
 				order: 10
 			},
 			{
-				key: "dataLakeSearchMaxChunksPerFile",
+				key: "forcedRetrievalSpreadFloorPct",
 				order: 11
+			},
+			{
+				key: "dataLakeSearchMaxChunksPerFile",
+				order: 12
 			}
 		]
 	},
@@ -10192,7 +10475,7 @@ const settingsMap = {
 		description: "Most chunks from any ONE source document a data-lake semantic search may return in its top-K. A diversity guard for CONTESTED slots: where several documents answer the question, it stops the best-scoring one from taking slots the others could have filled. It is NOT a fix for severe crowding - the cap redistributes only among the candidates retrieval already returned, so a document that supplies enough of the top-scoring chunks to fill that pool on its own is one the cap cannot change at all. On a corpus of book-length documents, expect enabling this to change little beyond widening the vector-search request. 0 (default) disables the cap, byte-identical to behavior before this setting existed. The cap never SHRINKS a result set - once the spread-out picks are in, any slots still open are backfilled with the highest-scoring chunks the cap held back, so a lake whose only match is one document still returns a full top-K. A value at or above the result count is also a no-op, since nothing can ever be held back. Below it, each retrieval stream's candidate pool is widened to a fixed multiple of the result count so the cap has a spread to choose from. The scanned corpus itself does not grow (that is bounded separately), but the vector-search backends are asked for that many more matches, and a larger in-memory ranking pool costs some CPU. 2-3 is the useful range; 1 serves one passage per document, which suits a corpus of many short documents and starves a question whose answer spans one long one. The chat knowledge-base path ranks more passages than it serves, so it applies the cap a second time at the count it actually serves - otherwise the spread-out picks, which are by definition the lowest-scoring ones admitted, would land in the passages that path discards.",
 		category: "AI",
 		group: API_SERVICE_GROUPS.EMBEDDING.id,
-		order: 11,
+		order: 12,
 		scope: { settableAt: ["organization", "owner"] }
 	}),
 	forcedRetrievalCharBudget: makeNumberSetting({
@@ -10275,12 +10558,25 @@ const settingsMap = {
 		min: 1,
 		max: 100,
 		int: true,
-		description: `Absolute minimum cosine similarity, as a percent, a chunk must clear to be injected on a Data-Lake-mode turn. This is a sanity floor for genuinely unrelated content, NOT the ranking gate - the relative floor above does the ranking. LEAVE IT AT 75 UNLESS YOU HAVE MEASURED YOUR OWN CORPUS: a raw cosine means nothing outside the embedding model it was fitted to, so while this reads 75 the server ignores it and applies the floor measured for whichever model your documents are actually embedded with (${forcedRetrievalFloorsBySpaceSummary}, and no absolute floor at all for a model nobody has measured - the relative floor still applies). Set any other value and the server uses exactly that, in every space, which is yours to get right: 75 against text-embedding-3-small sits above that band entirely and returns nothing on every query. Where this floor lands inside your band decides a lot - on one measured corpus 74 / 75 / 76 swung recall 91% / 65% / 40% - and the same 75 that is a cliff on one lake rejects nothing at all on another. Re-measure after changing the embedding model; the sweep tool is packages/scripts/retrieval/forcedFloorSweep.ts.`,
+		description: `Absolute minimum cosine similarity, as a percent, a chunk must clear to be injected on a Data-Lake-mode turn. This is a sanity floor for genuinely unrelated content, NOT the ranking gate - the relative floor above does the ranking. LEAVE IT AT 75 UNLESS YOU HAVE MEASURED YOUR OWN CORPUS: a raw cosine means nothing outside the embedding model it was fitted to, so while this reads 75 the server ignores it and applies the floor measured for whichever model your documents are actually embedded with (${forcedRetrievalFloorsBySpaceSummary}, and no absolute floor at all for a model nobody has measured - the relative floor still applies). Set any other value and the server uses exactly that, in every space, which is yours to get right: 75 against text-embedding-3-small sits above that band entirely and returns nothing on every query. Where this floor lands inside your band decides a lot - on one measured corpus 74 / 75 / 76 swung recall 91% / 65% / 40% - and the same 75 that is a cliff on one lake rejects nothing at all on another. Re-measure after changing the embedding model.`,
 		category: "AI",
 		group: API_SERVICE_GROUPS.EMBEDDING.id,
 		order: 10,
 		scope: { settableAt: ["organization", "owner"] }
 	}),
+	forcedRetrievalSpreadFloorPct: makeNumberSetting({
+		key: "forcedRetrievalSpreadFloorPct",
+		name: "Forced Retrieval Spread Floor (%)",
+		defaultValue: 0,
+		min: 0,
+		max: 100,
+		int: true,
+		description: "How far below the best-scoring passage of the SAME turn a chunk may score and still be injected, as a percent of the gap between that best score and a typical one (this turn's median). 0 (the default) disables it. This is the only one of the three floors whose cut depends on the QUESTION rather than on where the score band sits: a question one document answers sharply leaves its answer far above the median and admits few passages, while a broad question leaves many passages bunched near the top and admits many. The other two floors cannot tell those turns apart, which is why retrieved volume otherwise tracks the character budget instead of the question. Because it is measured in units of the band rather than against a fixed cosine, the same value means the same thing in every embedding space and does not need re-tuning when the embedding model changes. Lower is stricter (10 keeps only passages within a tenth of the way down to the median); 100 cuts at the median itself. It can never empty a turn - the best passage always clears its own cutoff. Ships off because no magnitude has been measured yet; measure one offline before turning it on.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 11,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
 	LakeAccessAuditRetentionDays: makeNumberSetting({
 		key: "LakeAccessAuditRetentionDays",
 		name: "Lake Access Audit Retention (days)",
@@ -10708,8 +11004,8 @@ const settingsMap = {
 			maxCommitMessageLength: 200,
 			maxPRBodyLength: 500,
 			maxChangelogLength: 1e3,
-			repository: "MillionOnMars/lumina5",
-			targetBranch: "main"
+			repository: WHATS_NEW_DEFAULT_REPOSITORY,
+			targetBranch: WHATS_NEW_DEFAULT_TARGET_BRANCH
 		},
 		description: "Configuration for automated What's New modal generation, including LLM model selection, prompt parameters, validation rules, and content sanitization limits.",
 		category: "Admin",
@@ -11281,7 +11577,14 @@ const TokensBySourceSchema = z$1.object({
 	fabFiles: z$1.number(),
 	urlContent: z$1.number(),
 	toolSchemas: z$1.number(),
-	userPrompt: z$1.number()
+	userPrompt: z$1.number(),
+	/**
+	* Lake-sourced content injected this turn (forced retrieval + the lake-memory hot card), split out
+	* of `systemPrompts`. Optional and absent means UNKNOWN, never zero - telemetry captured before
+	* this bucket existed has no value to report and must not be read as "no lake content". Mirrors
+	* PromptMetaTokensBySourceSchema in promptMeta.ts.
+	*/
+	lakeRetrieval: z$1.number().optional()
 });
 z$1.object({
 	/** gen_ai.usage.input_tokens */
@@ -11528,6 +11831,7 @@ const PromptMetaModelParametersSchema = z$1.object({
 	prompt_upsampling: z$1.boolean().optional(),
 	seed: z$1.number().optional(),
 	output_format: z$1.string().optional(),
+	background: z$1.string().optional(),
 	response_format: z$1.string().optional(),
 	seconds: z$1.number().optional(),
 	model: z$1.string().optional()
@@ -11535,11 +11839,7 @@ const PromptMetaModelParametersSchema = z$1.object({
 const PromptMetaModelSchema = z$1.object({
 	name: z$1.string(),
 	parameters: PromptMetaModelParametersSchema.optional(),
-	type: z$1.enum([
-		"text",
-		"image",
-		"video"
-	]).optional(),
+	type: z$1.enum(PROMPT_META_MODEL_TYPES).optional(),
 	backend: z$1.string().optional(),
 	contextWindow: z$1.number().optional(),
 	maxTokens: z$1.number().optional(),
@@ -11593,7 +11893,16 @@ const PromptMetaTokensBySourceSchema = z$1.object({
 	fabFiles: z$1.number(),
 	urlContent: z$1.number(),
 	toolSchemas: z$1.number(),
-	userPrompt: z$1.number()
+	userPrompt: z$1.number(),
+	/**
+	* Lake-sourced content injected this turn - forced retrieval (`knowledge_retrieval`) plus the
+	* lake-memory hot card (`lake_memory`) - moved out of the `systemPrompts` residual so the
+	* breakdown can price the lake separately. Optional, and absent means UNKNOWN, never zero: turns
+	* recorded before this field existed carry no value and none can be backfilled, because the only
+	* evidence was the residual this split had not yet made. Same absent-is-unknown rule as
+	* `retrieval.injected` below.
+	*/
+	lakeRetrieval: z$1.number().optional()
 });
 const PromptMetaContextSchema = z$1.object({
 	attachedFiles: z$1.array(PromptMetaAttachedFileSchema).optional(),
@@ -11903,12 +12212,28 @@ const RetrievalSummarySchema = z$1.object({
 	* the per-turn routing question is about, and before this it was indistinguishable from a turn
 	* where forced retrieval was never configured at all.
 	*/
-	forcedSkipReason: z$1.enum(["attached_files", "personal_corpus"]).optional(),
+	forcedSkipReason: z$1.enum([
+		"attached_files",
+		"personal_corpus",
+		"no_lake_scope"
+	]).optional(),
 	/** Which retrieval-capable surface(s) ran this turn, e.g. 'lake-memory', 'knowledgeBaseSearch'. */
 	surfaces: z$1.array(z$1.string()),
 	/** Lakes resolved at the moment retrieval ran, stamped point-in-time (not read live from the session). */
 	dataLakeTags: z$1.array(z$1.string()),
 	/**
+	* The subset of `dataLakeTags` that actually put files into the ranked scope. `dataLakeTags`
+	* alone says which lakes were REQUESTED, which read as "searched" while a lake could contribute
+	* nothing - the retrieval budget used to be spent in file order and starved whichever lake
+	* sorted last.
+	*
+	* Optional because attribution is best-effort: a file matched by a lake's prefix/membership arm
+	* can carry no reversible `datalake:` tag (see attributeAccessedLakes), and the producer omits
+	* this rather than reporting an inconclusive scope as "no lake contributed". Absent means
+	* unknown, NOT none.
+	*/
+	dataLakeTagsWithCandidates: z$1.array(z$1.string()).optional(),
+	/**
 	* The lake scope the turn's retrieval surfaces WOULD have searched, resolved at the seed site
 	* whether or not any of them ran: the caller's accessible lakes narrowed to the session
 	* (narrowLakeAccessToSession), or empty where the corpus is personal and the lake arms are
@@ -11995,16 +12320,25 @@ const RetrievalSummarySchema = z$1.object({
 	* not "what reached the model": `ranked.length` and `scored.length` in KnowledgeRetrievalFeature
 	* - the candidates left after the absolute similarity floor, and after the relative floor
 	* trims them. `chunks` is what survived the char budget on top of that, so the three
-	* numbers bracket two independent trimmers:
+	* numbers bracket three independent trimmers:
 	*
-	*   pre -> [relative floor] -> post -> [char budget] -> chunks
+	*   pre -> [relative floor] -> post -> [spread floor] -> postSpread -> [char budget] -> chunks
 	*
 	* They exist so a low `chunks` is diagnosable - a small corpus and a floor that trimmed a large
-	* pool end in the same `chunks`. `pre - post` is the floor's own effect and nothing else;
+	* pool end in the same `chunks`. `pre - post` is the relative floor's own effect and nothing
+	* else, and `post - postSpread` the spread floor's;
 	* `pre - chunks` is NOT, because the budget trims the same walk. Both optional: only forced
 	* retrieval computes a ranked pool, a surface without one (lake memory, the knowledge tools)
-	* never writes either, and absence must not read as zero candidates. SUMMED like `chunks`, with
-	* the same absent-is-not-zero handling as `topScore`.
+	* never writes any of them, and absence must not read as zero candidates. SUMMED like `chunks`,
+	* with the same absent-is-not-zero handling as `topScore`.
+	*
+	* `backgroundScore` is the median of every score the turn compared, and `postSpreadFloorCandidates`
+	* what is left once the spread floor cuts against it. Recorded even while that floor is OFF (its
+	* shipped default), in which case `postSpread` equals `post` and the pair degenerates to a
+	* diagnostic: `topScore - backgroundScore` is the turn's signal spread, and the distribution of
+	* that quantity over production traffic is what a value for `forcedRetrievalSpreadFloorPct` has to
+	* be chosen from. NOT comparable across embedding spaces as an absolute number, for the same
+	* reason `topScore` is not; the RATIO of the two floors' cuts is.
 	*
 	* COMPARE THE PAIR ONLY TO ITSELF, never to `chunks`, unless `surfaces` is forced retrieval
 	* alone. `chunks` and `chars` sum across ALL surfaces while this pair is forced-only, so a mixed
@@ -12026,7 +12360,9 @@ const RetrievalSummarySchema = z$1.object({
 		chars: z$1.number(),
 		topScore: z$1.number().optional(),
 		preRelativeFloorCandidates: z$1.number().optional(),
-		postRelativeFloorCandidates: z$1.number().optional()
+		postRelativeFloorCandidates: z$1.number().optional(),
+		postSpreadFloorCandidates: z$1.number().optional(),
+		backgroundScore: z$1.number().optional()
 	}).optional(),
 	/**
 	* Could the corpus in scope have answered this turn, whether or not the model went looking?
@@ -12264,9 +12600,18 @@ z$1.object({
 	schemaVersion: z$1.number().int().positive(),
 	/** Product identifier: 'vibeswire', 'bike4mind', 'stocksandvibes', 'k2kanji', etc. */
 	productId: z$1.string().min(1).max(64),
-	/** Product's internal user ID */
+	/**
+	* Product's internal user ID, or OVERWATCH_ANONYMOUS_USER_ID when the event has no
+	* identified user. See the session and identity conventions below.
+	*/
 	userId: z$1.string().min(1).max(256),
-	/** Session identifier for retention/funnel analysis */
+	/**
+	* Visit identifier. Overwatch counts distinct values of this per product as the first
+	* stage of its acquisition funnel, so one value per visit is what makes that count a
+	* count of visits. An emitter that cannot tell which visit a request belongs to sends
+	* OVERWATCH_UNKNOWN_SESSION_ID rather than a value of its own invention - see the
+	* conventions below.
+	*/
 	sessionId: z$1.string().min(1).max(256),
 	/** Event type: 'session_start', 'signup', 'feature_used', etc. */
 	event: z$1.string().min(1).max(128),
@@ -12283,6 +12628,153 @@ z$1.object({
 		z$1.boolean()
 	])).refine((v) => JSON.stringify(v).length <= 1024, "metadata must be ≤ 1KB serialized").optional()
 });
+/**
+* Public wire schema for `GET /api/v1/me` - the caller's own identity and
+* commercial state, and nothing else.
+*
+* Deliberately narrower than the user document `/api/identify` returns: no email,
+* no tags, no internal flags. Everything here answers one of three questions a
+* downstream app has to ask before it spends - who is this, what have they paid
+* for, can they afford the next call.
+*
+* Public-API rules apply: snake_case wire fields, no `.catch()`, no top-level
+* `.transform()`.
+*/
+/**
+* Rung on the B4M plan ladder the caller currently sits on.
+*
+* `free` means no active subscription. `other` is still a paying customer: either
+* an active plan that is not on the ladder (`SubscriptionPlanDetail.tier` is
+* optional - a standalone product omits it so it stays out of the cross-plan
+* change flow), or one whose Stripe price the deployment can no longer name, as
+* happens to a subscriber grandfathered on a superseded price. `subscription` is
+* `null` in that second case.
+*
+* Gate on `tier !== 'free'` for "is this caller paying" and on `subscription.
+* price_id` for "which product" - NOT on `basic`/`pro`, whose ordinals come from
+* the internal change-flow ladder and do not track a plan's marketing name (the
+* Professional plan occupies the `basic` rung today).
+*/
+const ME_TIERS = [
+	"free",
+	"basic",
+	"pro",
+	"other"
+];
+/** The caller's active subscription, or `null` when they have none the deployment can name. */
+const MeSubscriptionSchema = z$1.object({
+	plan_name: z$1.string(),
+	price_id: z$1.string(),
+	interval: z$1.enum(["monthly", "yearly"]),
+	/** ISO 8601. When the current billing period ends - not a cancellation date. */
+	current_period_ends_at: z$1.string()
+});
+z$1.object({
+	/** Stable B4M user id. Safe to key an integrator's own records on. */
+	id: z$1.string(),
+	/** Display name. Never the email address. */
+	name: z$1.string(),
+	tier: z$1.enum(ME_TIERS),
+	subscription: MeSubscriptionSchema.nullable(),
+	credits: z$1.object({ 
+	/**
+	* Spendable credits on the caller's PERSONAL ledger. Organization pools are not
+	* included - a call billed to an organization draws on a balance this number
+	* does not describe.
+	*/
+balance: z$1.number() }),
+	/** Entitlement keys the caller currently holds, e.g. `base`. */
+	entitlements: z$1.array(z$1.string())
+});
+/**
+* Every tool name in `b4mLLMTools`. Exhaustive by annotation - do not widen the type.
+*/
+const CORE_TOOL_SIDE_EFFECTS = {
+	dice_roll: "none",
+	weather_info: "none",
+	web_search: "none",
+	web_fetch: "none",
+	wolfram_alpha: "none",
+	deep_research: "none",
+	math_evaluate: "none",
+	current_datetime: "none",
+	prompt_enhancement: "none",
+	wikipedia_on_this_day: "none",
+	moon_phase: "none",
+	sunrise_sunset: "none",
+	iss_tracker: "none",
+	planet_visibility: "none",
+	search_knowledge_base: "none",
+	retrieve_knowledge_content: "none",
+	count_knowledge_base: "none",
+	describe_knowledge_base: "none",
+	chess_engine: "none",
+	fmp_financial_data: "none",
+	bob_panel_read: "none",
+	skill: "none",
+	recharts: "local",
+	mermaid_chart: "local",
+	navigate_view: "local",
+	generate_jupyter_notebook: "local",
+	optihashi_schedule: "local",
+	optihashi_formulate: "local",
+	optihashi_edit_problem: "local",
+	image_generation: "external",
+	edit_image: "external",
+	music_generation: "external",
+	audio_generation: "external",
+	excel_generation: "external",
+	edit_file: "external",
+	blog_publish: "external",
+	blog_edit: "external",
+	blog_draft: "external",
+	delegate_to_agent: "external"
+};
+/**
+* Tool names that reach the pipeline from outside `b4mLLMTools` - the CLI tool set, the
+* Slack tool set, and premium-overlay tools supplied at runtime via the `externalTools`
+* merge. No enum to key off, so these get no compile-time exhaustiveness; an unlisted name
+* falls through to the gated default, which is the correct failure direction.
+*/
+const EXTERNAL_REGISTRY_SIDE_EFFECTS = {
+	file_read: "none",
+	glob_files: "none",
+	grep_search: "none",
+	recent_changes: "none",
+	check_shell_output: "none",
+	list_background_shells: "none",
+	lattice_query: "none",
+	lattice_explain: "none",
+	ask_user_question: "local",
+	create_file: "external",
+	edit_local_file: "external",
+	delete_file: "external",
+	bash_execute: "external",
+	write_shell_stdin: "external",
+	kill_background_shell: "external",
+	lattice_create_model: "external",
+	lattice_add_entity: "external",
+	lattice_set_value: "external",
+	lattice_create_rule: "external",
+	slackbot_help: "none",
+	list_curated_files: "none",
+	notebook_status: "none",
+	share_curated_file: "external",
+	notebook_new: "external",
+	confirm_pending_action: "external",
+	cancel_pending_action: "external",
+	mission_status: "none",
+	optihashi_decompose: "local",
+	optihashi_solve: "local",
+	send_slack_message: "external",
+	coordinate_task: "external",
+	code_execute: "external",
+	video_generation: "external"
+};
+({
+	...CORE_TOOL_SIDE_EFFECTS,
+	...EXTERNAL_REGISTRY_SIDE_EFFECTS
+});
 const InternalTeamMemberSchema = z$1.object({
 	name: z$1.string().min(1, "Name is required"),
 	phone: z$1.string().min(1, "Phone is required"),
@@ -12835,12 +13327,13 @@ new Set(DATA_LAKES.map((l) => l.id));
 */
 const normalizeEntitlementKey = (key) => key.trim().toLowerCase();
 const sha256Regex = /^[a-f0-9]{64}$/;
+const requiredUserTagValue = z.string().trim().min(1).max(100).refine((s) => !/[,;]/.test(s), "User tag must be a single tag with no commas or semicolons (e.g. \"vip\" or \"Sales Team\")");
 z.object({
 	name: z.string().min(1).max(200),
 	slug: z.string().min(2).max(60).regex(DATA_LAKE_SLUG_REGEX, "Slug must be lowercase alphanumeric with hyphens (e.g. \"my-data-lake\")"),
 	description: z.string().max(2e3).optional(),
 	fileTagPrefix: z.string().trim().min(2).max(30).refine((s) => s.endsWith(":"), "Tag prefix must end with \":\" (e.g. \"acme:\")").refine((s) => !hasBlankTagPrefixSegment(s), "Tag prefix segments must be non-empty (e.g. \"acme:\" or \"acme:legal:\")").refine((s) => !isReservedTagPrefix(s), `Tag prefix cannot use the reserved "${DATALAKE_TAG_PREFIX}" namespace`),
-	requiredUserTag: z.string().min(1).max(100).optional(),
+	requiredUserTag: requiredUserTagValue.optional(),
 	requiredEntitlement: z.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")").optional(),
 	organizationId: z.string().optional()
 });
@@ -12850,7 +13343,7 @@ z.object({
 	systemPrompt: z.string().optional(),
 	preferredSystemPromptId: z.union([z.literal(""), z.string().min(1).max(200)]).optional(),
 	groundingMode: z.enum(DATA_LAKE_GROUNDING_MODES).optional(),
-	requiredUserTag: z.union([z.literal(""), z.string().min(1).max(100)]).optional(),
+	requiredUserTag: z.union([z.literal(""), requiredUserTagValue]).optional(),
 	requiredEntitlement: z.union([z.literal(""), z.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")")]).optional(),
 	auditQueryTextEnabled: z.boolean().optional(),
 	lakeMemoryEnabled: z.boolean().optional(),
@@ -13096,6 +13589,51 @@ const OPTIONAL_DEP_BLESSED_SCRIPT_PATHS = Object.values({
 	}
 }).map((d) => d.path);
 [...REACT_BLESSED_SCRIPT_PATHS, ...OPTIONAL_DEP_BLESSED_SCRIPT_PATHS];
+function isGPTImageModel(model) {
+	if (!model) return false;
+	return OPENAI_IMAGE_MODELS.includes(model) || model.startsWith("gpt-image-");
+}
+/**
+* Flux Ultra is the only BFL generation model driven by `aspect_ratio`; the Pro family takes
+* discrete `width`/`height` and ignores aspect_ratio outright. Must stay in sync with the branch
+* in `BFLImageService.generate`, which is what actually builds the request body.
+*/
+function isBflUltraImageModel(model) {
+	return model === "flux-pro-1.1-ultra";
+}
+/** Returns true specifically for gpt-image-2 (including versioned snapshots like gpt-image-2-2026-04-21). */
+function isGPTImage2Model(model) {
+	if (!model) return false;
+	return model === "gpt-image-2" || model.startsWith("gpt-image-2");
+}
+/**
+* Whether a user can access a model. Access is any-of (mirrors the Q3b data-lake
+* rule, `getAccessibleDataLakes`): a non-admin reaches the model via
+* `allowedUserTags ∩ userTags` OR `allowedEntitlements ∩ entitlementKeys`.
+*
+* `entitlementKeys` is optional - when omitted/empty the entitlement branch is
+* inert, so a model with no `allowedEntitlements` behaves exactly as before
+* (tag-only). This lets a tag-less subscriber reach an entitlement-gated model
+* while leaving every existing tag-gated model unchanged (zero regression).
+*
+* Pure + zero-dependency (only types + the shared key normalizer), so it lives
+* in `@bike4mind/common` as the SINGLE source of truth - imported by the core
+* `@bike4mind/utils` re-export (server/services) AND the client
+* `useAccessibleModels` hook, which previously kept a hand-rolled twin "to avoid
+* AWS SDK imports". Common is browser-safe, so there is no longer any reason to
+* duplicate the logic.
+*/
+function isModelAccessible(model, userTags, isAdmin = false, entitlementKeys = []) {
+	if (!model.enabled) return false;
+	if (isAdmin) return true;
+	const normalizedUserTags = userTags.map((tag) => tag.toLowerCase());
+	const normalizedAllowedTags = (model.allowedUserTags ?? []).map((tag) => tag.toLowerCase());
+	if (normalizedUserTags.some((tag) => normalizedAllowedTags.includes(tag))) return true;
+	const normalizedKeys = entitlementKeys.map(normalizeEntitlementKey);
+	const normalizedAllowedEntitlements = (model.allowedEntitlements ?? []).map(normalizeEntitlementKey);
+	return normalizedKeys.some((key) => normalizedAllowedEntitlements.includes(key));
+}
+[...OPENAI_IMAGE_MODELS, ...GEMINI_IMAGE_MODELS];
 const DashboardParamsSchema = z$1.object({
 	dashboardDataSources: z$1.array(z$1.object({
 		sourceName: z$1.string(),
@@ -13139,11 +13677,21 @@ OpenAIImageGenerationInput.extend({
 	height: z$1.number().optional(),
 	aspect_ratio: z$1.string().optional(),
 	fabFileIds: z$1.array(z$1.string()).prefault([]),
+	/**
+	* Extra gpt-image "style anchor" images, as fabFile ids. They ride alongside the primary
+	* input image (the first image-type entry in `fabFileIds`) rather than replacing it, and
+	* OpenAI receives them in this order - which matters, because a mask always applies to the
+	* first image in the array. fabFile ids rather than URLs so the existing access +
+	* moderation gates (findAccessibleInIds, isImageServeable) still apply. Ignored by every
+	* non-gpt-image provider. Repeated ids collapse to one anchor. See MAX_REFERENCE_IMAGES for
+	* why the cap is 4 and not OpenAI's 16.
+	*/
+	referenceImageFabFileIds: z$1.array(z$1.string()).max(4).optional(),
 	tools: z$1.array(z$1.union([b4mLLMTools, z$1.string()])).optional(),
 	safety_tolerance: BFLSafetyToleranceSchema,
 	prompt_upsampling: z$1.boolean().optional(),
 	seed: z$1.number().nullable().optional(),
-	output_format: z$1.enum(["jpeg", "png"]).nullable().optional(),
+	output_format: ImageOutputFormatSchema.nullable().optional(),
 	/** Resolved by the API route's prompt resolver. Defaults to 'fresh' for first-turn or sessions with no prior image. */
 	intent: PromptIntentSchema.optional(),
 	promptEnhancement: z$1.object({
@@ -13161,7 +13709,7 @@ OpenAIImageGenerationInput.extend({
 const GenerateImageToolCallSchema = OpenAIImageGenerationInput.extend({
 	safety_tolerance: z$1.number().optional(),
 	prompt_upsampling: z$1.boolean().optional(),
-	output_format: z$1.enum(["jpeg", "png"]).nullable().optional(),
+	output_format: ImageOutputFormatSchema.nullable().optional(),
 	seed: z$1.number().nullable().optional(),
 	editModel: z$1.string().optional()
 }).omit({ prompt: true });
@@ -13198,7 +13746,18 @@ OpenAIImageGenerationInput.extend({
 	organizationId: z$1.string().nullable().optional(),
 	aspect_ratio: z$1.string().optional(),
 	fabFileIds: z$1.array(z$1.string()).prefault([]),
-	image: z$1.string()
+	/**
+	* Extra gpt-image "style anchor" images, as fabFile ids. On this endpoint `fabFileIds` is
+	* the inpainting mask, not an image input, so references need their own field: they are
+	* appended after `image` (the edit source), and OpenAI applies the mask to the first entry
+	* of that array - i.e. always to `image`, never to a reference. fabFile ids rather than URLs
+	* so the existing access + moderation gates (findAccessibleInIds, isImageServeable) still
+	* apply. Ignored by BFL and Gemini. Repeated ids collapse to one anchor. See
+	* MAX_REFERENCE_IMAGES for why the cap is 4, not 16.
+	*/
+	referenceImageFabFileIds: z$1.array(z$1.string()).max(4).optional(),
+	image: z$1.string(),
+	output_format: ImageOutputFormatSchema.nullable().optional()
 });
 const isUnlimitedHistory = (historyCount) => historyCount === -1;
 /**
@@ -13232,6 +13791,13 @@ z$1.object({
 	message: z$1.string(),
 	messageFileIds: z$1.array(z$1.string()).prefault([]),
 	questId: z$1.string().optional(),
+	/**
+	* Correct-and-retry: the quest whose answer the user says was wrong. Produces a NEW quest
+	* carrying the user's correction, rather than overwriting the flagged one the way `questId`
+	* (retry) does - the original answer has to survive for the evaluation-pair export to read it.
+	* Validated server-side against the resolved session before it is persisted.
+	*/
+	correctsQuestId: z$1.string().optional(),
 	/** Extra context messages to include in the conversation from external sources */
 	extraContextMessages: z$1.array(z$1.object({
 		role: z$1.enum([
@@ -13267,11 +13833,19 @@ z$1.object({
 	* was the only switch for the offer and it also strips every authored prompt, so no caller could
 	* have an arm that went unoffered AND kept the abstention licence.
 	*
-	* Gates the three auto-add sites (the knowledge offer in resolveEnabledTools, the navigate_view
+	* Gates the auto-add sites (the knowledge offer in resolveEnabledTools, the navigate_view
 	* auto-add, the blog/skill gate), unioned with `Boolean(promptMode)` by
 	* resolveSkipAutoOffers. A force-on, not an override: `false` under a promptMode still suppresses.
 	* Withholding navigate_view also drops the viewRegistry system block, which only describes it.
 	*
+	* `buildSharedTools`' `offerOnlyNamedTools` (see sharedToolBuilder.ts) reads the same union for
+	* the same reason: MCP tools merged past the `enabledTools` filter are withheld too, since the
+	* caller never named them either. Unlike the auto-add sites, this one can still be reached per
+	* tool - a caller with `session.enabledTools` (not the public `tools` field, which
+	* `filterKnownTools` strips non-native ids from before this flag is even consulted) can name one
+	* MCP tool by its namespaced `server__tool` id and keep it while every unnamed sibling is
+	* withheld.
+	*
 	* Withholds the OFFER, not knowledge: `session.forceKnowledgeRetrieval` is untouched, and an
 	* already-attached corpus is inlined rather than deferred to the tool. An arm that must see no
 	* knowledge at all also needs a session with no attachments and forced retrieval off.
@@ -14132,43 +14706,158 @@ const countCodePoints = (text) => {
 	for (const _ch of text) count++;
 	return count;
 };
-function isGPTImageModel(model) {
-	if (!model) return false;
-	return OPENAI_IMAGE_MODELS.includes(model) || model.startsWith("gpt-image-");
+/**
+* Default character budget for a super-linear parse pass. A starting point only -
+* see the sizing rule below; any call site in front of a measured parser should pass
+* an explicit `max` derived from that parser's own curve.
+*/
+const DEFAULT_PARSE_CAP = 1e5;
+/**
+* Bound the length of input a super-linear parser will scan.
+*
+* A regex that backtracks polynomially (or worse) turns an unbounded input length
+* into unbounded CPU on a shared process - the algorithmic-DoS shape. Refusing to
+* scan more than `max` characters converts that into a fixed worst case regardless
+* of how pathological the input is.
+*
+* Truncation (never throwing) is deliberate: these caps sit in front of best-effort
+* cleaners and content detectors where an over-cap input should degrade quietly,
+* not crash the pipeline.
+*
+* PREFER LINEARIZING THE PARSER. A cap is the fallback, not the first move. The email
+* cleaners in services/lib/turndown.ts and the snippet-meta extractor in common/utils.ts
+* both started here and both ended up as single-pass scans instead, because a cap that
+* was small enough to bound their cost was also small enough to stop them working on
+* real content. When the parser is linear, the cap can go.
+*
+* SIZING RULE - if you do cap, pick `max` from the parser's measured cost AT the cap,
+* not from the headroom above real input. For an O(n^2)/O(n^3) inner loop, "far above
+* anything legitimate" is not a bound: the email cleaners were cubic, so a 512k cap
+* still ran for minutes. Measure the worst-case shape at the cap you intend to ship and
+* make sure the number of milliseconds is one you can defend.
+*
+* Four further traps this helper cannot solve for you:
+* - A per-item cap is not a total bound when the item count is also attacker-chosen
+*   (a .pptx picks its own slide count). Carry a running budget across the loop.
+* - Cap what is SCANNED, not what is returned. Where the result is rendered or
+*   stored, re-append `input.slice(max)` unchanged: truncating the value silently
+*   drops content, and a cut inside an element can strand its closing tag. Splicing
+*   the original halves back together also avoids leaving a lone surrogate, since
+*   `slice` cuts by UTF-16 code unit.
+* - Splicing the tail back is not enough when the cap changes the SHAPE of the parse
+*   rather than only its length - a pattern terminated by `$`, say, whose sections then
+*   end early and get classified differently. Check what an over-cap input parses INTO,
+*   not just that its characters survive.
+* - Cap in front of a best-effort cleaner or detector, where degrading quietly is
+*   acceptable. Do not cap in front of a parser whose output drives execution (a
+*   tool-call parser): silently parsing a prefix there means running a subset of what
+*   was asked. If such a parser caps internally, its callers must pass it text already
+*   scoped to the construct being parsed.
+*
+* @returns the input unchanged when within budget, otherwise its first `max` chars.
+*/
+function capForParse(input, max = DEFAULT_PARSE_CAP) {
+	if (!Number.isFinite(max) || max < 0) throw new RangeError(`capForParse: max must be a non-negative finite number, got ${max}`);
+	return input.length <= max ? input : input.slice(0, max);
 }
-/** Returns true specifically for gpt-image-2 (including versioned snapshots like gpt-image-2-2026-04-21). */
-function isGPTImage2Model(model) {
-	if (!model) return false;
-	return model === "gpt-image-2" || model.startsWith("gpt-image-2");
+/**
+* Exactly 'WIDTHxHEIGHT' - nothing else, no surrounding whitespace and no third segment.
+* Anchored on purpose: this module is the single source of the size rule, so a value that
+* only looks like a resolution ('1024x1024x1024') must not be measured as one.
+*/
+const SIZE_PATTERN = /^(\d+)x(\d+)$/;
+/**
+* Splits a 'WIDTHxHEIGHT' string into numeric edges, or null when it is not a pair
+* of positive numbers. Lets callers tell a resolution that breaks a rule apart from
+* a value that expresses no resolution at all ('auto', 'wide', undefined).
+*/
+function parseSizeEdges(size) {
+	if (typeof size !== "string") return null;
+	const match = SIZE_PATTERN.exec(size);
+	if (!match) return null;
+	const width = Number(match[1]);
+	const height = Number(match[2]);
+	if (!width || !height) return null;
+	return {
+		width,
+		height
+	};
 }
 /**
-* Whether a user can access a model. Access is any-of (mirrors the Q3b data-lake
-* rule, `getAccessibleDataLakes`): a non-admin reaches the model via
-* `allowedUserTags ∩ userTags` OR `allowedEntitlements ∩ entitlementKeys`.
+* True when a custom gpt-image-2 resolution meets OpenAI's documented limits.
+* gpt-image-2 accepts any resolution satisfying these, not only the presets in
+* IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.sizes, so a flat preset check would reject
+* valid custom sizes.
+*/
+function satisfiesGptImage2Constraints({ width, height }) {
+	const { maxEdge, minTotalPixels, maxTotalPixels, edgeMultiple, maxAspectRatio } = IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.constraints;
+	const longEdge = Math.max(width, height);
+	const shortEdge = Math.min(width, height);
+	const totalPixels = width * height;
+	return longEdge <= maxEdge && width % edgeMultiple === 0 && height % edgeMultiple === 0 && longEdge / shortEdge <= maxAspectRatio && totalPixels >= minTotalPixels && totalPixels <= maxTotalPixels;
+}
+/**
+* Sizes the legacy (pre-GPT-Image) OpenAI generate endpoint accepts. The two tiers
+* overlap on 1024x1024; the repeated entry is harmless because this list is only ever
+* tested for membership.
+*/
+const OPENAI_LEGACY_IMAGE_SIZES = [...IMAGE_SIZE_CONSTRAINTS.DALL_E_2.sizes, ...IMAGE_SIZE_CONSTRAINTS.DALL_E_3.sizes];
+/**
+* True when `size` may be sent to OpenAI for `model`. This is the single source of the
+* OpenAI image size rule - generate, edit, the variation endpoint, the cost estimate and
+* the settings UI all resolve through it, so a tier changing its accepted sizes is a
+* one-line edit to IMAGE_SIZE_CONSTRAINTS rather than a hunt through retyped lists.
 *
-* `entitlementKeys` is optional - when omitted/empty the entitlement branch is
-* inert, so a model with no `allowedEntitlements` behaves exactly as before
-* (tag-only). This lets a tag-less subscriber reach an entitlement-gated model
-* while leaving every existing tag-gated model unchanged (zero regression).
+* gpt-image-2 takes 'auto', its presets, or any custom WIDTHxHEIGHT meeting
+* satisfiesGptImage2Constraints. The gpt-image-1 family is limited to its three fixed
+* sizes. Anything else is treated as legacy dall-e.
 *
-* Pure + zero-dependency (only types + the shared key normalizer), so it lives
-* in `@bike4mind/common` as the SINGLE source of truth - imported by the core
-* `@bike4mind/utils` re-export (server/services) AND the client
-* `useAccessibleModels` hook, which previously kept a hand-rolled twin "to avoid
-* AWS SDK imports". Common is browser-safe, so there is no longer any reason to
-* duplicate the logic.
+* OpenAI image models only: BFL, Gemini and xAI sizes are validated by their own adapters,
+* and passing one of those models here would measure it against the wrong list.
 */
-function isModelAccessible(model, userTags, isAdmin = false, entitlementKeys = []) {
-	if (!model.enabled) return false;
-	if (isAdmin) return true;
-	const normalizedUserTags = userTags.map((tag) => tag.toLowerCase());
-	const normalizedAllowedTags = (model.allowedUserTags ?? []).map((tag) => tag.toLowerCase());
-	if (normalizedUserTags.some((tag) => normalizedAllowedTags.includes(tag))) return true;
-	const normalizedKeys = entitlementKeys.map(normalizeEntitlementKey);
-	const normalizedAllowedEntitlements = (model.allowedEntitlements ?? []).map(normalizeEntitlementKey);
-	return normalizedKeys.some((key) => normalizedAllowedEntitlements.includes(key));
+function isSupportedImageSize(model, size) {
+	if (typeof size !== "string") return false;
+	if (isGPTImage2Model(model)) {
+		if (size === IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.autoSize || IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.sizes.includes(size)) return true;
+		const edges = parseSizeEdges(size);
+		return edges !== null && satisfiesGptImage2Constraints(edges);
+	}
+	if (isGPTImageModel(model)) return IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_1.sizes.includes(size);
+	return OPENAI_LEGACY_IMAGE_SIZES.includes(size);
+}
+/**
+* The size to fall back to when a requested size is unsupported for `model`. Every tier
+* defaults to 1024x1024 today; the indirection keeps that a per-tier decision.
+*/
+function fallbackImageSize(model) {
+	if (isGPTImage2Model(model)) return IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.defaultSize;
+	if (isGPTImageModel(model)) return IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_1.defaultSize;
+	return IMAGE_SIZE_CONSTRAINTS.DALL_E_2.defaultSize;
+}
+/**
+* The size the generate endpoint should send for a GPT-Image `model`, given what the
+* caller asked for. Returns the input unchanged when nothing needs correcting, so a
+* caller can compare the two to decide whether to warn.
+*
+* Absent: gpt-image-2 gets 'auto' - it is the only tier that can pick its own - and the
+* gpt-image-1 family gets its fixed default.
+*
+* Present but unsupported: replaced by the tier fallback, with one deliberate exception.
+* A gpt-image-2 value that names no resolution at all ('wide') is forwarded untouched:
+* gpt-image-2 sizing is open-ended, so an unrecognized token is left for OpenAI to
+* interpret rather than second-guessed here. The gpt-image-1 family has fixed sizes and
+* no such pass-through.
+*
+* GPT-Image tiers only - the legacy dall-e path has its own absent-size handling and
+* should gate on isSupportedImageSize directly.
+*/
+function resolveGptImageGenerateSize(model, size) {
+	const isGptImage2 = isGPTImage2Model(model);
+	if (!size) return isGptImage2 ? IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.autoSize : fallbackImageSize(model);
+	if (isSupportedImageSize(model, size)) return size;
+	if (isGptImage2 && parseSizeEdges(size) === null) return size;
+	return fallbackImageSize(model);
 }
-[...OPENAI_IMAGE_MODELS, ...GEMINI_IMAGE_MODELS];
 /** Generation was cut off against the output-token ceiling. */
 const TRUNCATED_FINISH_REASON = "max_tokens";
 /**
@@ -14195,6 +14884,43 @@ function isEarlyStop(stopReason) {
 	return !!stopReason && EARLY_STOP_FINISH_REASONS.has(stopReason);
 }
 /**
+* promptMeta.functionCalls fields that must never reach a viewer who only holds a
+* "read this conversation" grant - a session share, a live subscription, a bug-report
+* egress to a third party (Slack/email), or a session clone made by a share holder
+* (b4m-core/services/src/sessionService/clone.ts, which copies quest.promptMeta wholesale
+* onto a session the sharee then OWNS - a share/subscribe grant must not become a durable
+* unredacted copy just because the copy has a new owner).
+*
+* `returnValue` is the verbatim output of a tool call the OWNER's turn made - up to 8000 chars
+* per call (see recordToolResult.ts) - and a tool can read the owner's private corpus, files, or
+* connected integrations. A share/subscribe grant authorizes reading the conversation the owner
+* had, not re-reading whatever the owner's tools touched on the owner's behalf. `error` is
+* currently unwritten but carries the same class of content on the failure path, so it is
+* redacted alongside it.
+*
+* This list is the single source of truth: add a field here and every response boundary that
+* routes through {@link redactFunctionCallsForViewer} inherits the redaction - PROVIDED the field
+* is a top-level, directly-owned-content field like these two. The redaction itself is a shallow
+* `delete` per field (see below), so a future owner-only value nested inside another field (e.g. a
+* private blob inside `parameters`) would NOT be caught by adding its name here; that shape needs
+* its own per-field handling, not just a new entry in this array.
+*
+* Adjacent unredacted shape, not yet a leak: `promptMeta.executionTracking.steps[].result`/
+* `.error` (PromptMetaZodSchema) are the same class of owner-only content but nothing writes them
+* today, so there is nothing to redact yet. A future writer landing there bypasses this list
+* entirely unless it is added here too.
+*/
+const OWNER_ONLY_FUNCTION_CALL_FIELDS = ["returnValue", "error"];
+/**
+* Verbatim retrieved passage text on a citation chip (#3038). Owner-only for exactly the reason
+* `returnValue` is: it is a slice of a document the OWNER's retrieval read on the owner's behalf,
+* and a share/subscribe/clone grant authorizes reading the conversation, not re-reading the
+* owner's corpus through it. The sibling `chunkId` is deliberately kept - an opaque id is not
+* content, and `citables[].id` (the file id) is already unredacted beside it.
+*/
+const OWNER_ONLY_CITABLE_METADATA_FIELDS = ["fullContext"];
+[...OWNER_ONLY_FUNCTION_CALL_FIELDS.map((field) => `promptMeta.functionCalls.${field}`), ...OWNER_ONLY_CITABLE_METADATA_FIELDS.map((field) => `promptMeta.citables.metadata.${field}`)];
+/**
 * Trigger-word validation, shared between client form and server agent
 * endpoints so the validation rules can't drift.
 *
@@ -14268,6 +14994,7 @@ function isImageServeable(f) {
 function isImageAttachment(mimeType) {
 	return typeof mimeType === "string" && mimeType.toLowerCase().startsWith("image/");
 }
+IMAGE_SIZE_CONSTRAINTS.BFL.minWidth, IMAGE_SIZE_CONSTRAINTS.BFL.maxWidth;
 Array.from(new Set([
 	{
 		id: "opti.root",
@@ -15406,6 +16133,42 @@ async function withRetry(fn, options = {}) {
 		}
 	}
 }
+function readZipEntryBounded(entry, maxBytes) {
+	return new Promise((resolve, reject) => {
+		const stream = entry.internalStream("nodebuffer");
+		let parts = [];
+		let byteLength = 0;
+		let settled = false;
+		stream.on("data", (chunk) => {
+			if (settled) return;
+			byteLength += chunk.length;
+			if (byteLength > maxBytes) {
+				settled = true;
+				stream.pause();
+				parts = [];
+				resolve({
+					ok: false,
+					reason: "too-large"
+				});
+				return;
+			}
+			parts.push(chunk);
+		}).on("error", (error) => {
+			if (settled) return;
+			settled = true;
+			parts = [];
+			reject(error);
+		}).on("end", () => {
+			if (settled) return;
+			settled = true;
+			resolve({
+				ok: true,
+				text: Buffer.concat(parts).toString("utf8"),
+				byteLength
+			});
+		}).resume();
+	});
+}
 //#endregion
 //#region src/utils/apiUrl.ts
 /**
@@ -15526,6 +16289,212 @@ function getEnvironmentName(configApiConfig) {
 	if (/^https?:\/\/(localhost|127\.0\.0\.1)(:|\/|$)/i.test(endpoint.url)) return "Local Dev";
 	return "Self-Hosted";
 }
+//#endregion
+//#region src/config/toolSafety.ts
+/**
+* Tool safety categories determine when permission is required
+*/
+const ToolCategorySchema = z$1.enum([
+	"auto_approve",
+	"prompt_always",
+	"prompt_default"
+]);
+z$1.object({
+	categories: z$1.record(z$1.string(), ToolCategorySchema),
+	trustedTools: z$1.array(z$1.string())
+});
+/**
+* Default tool categories
+*
+* Categories:
+* - auto_approve: Safe tools that don't need permission (math, search, datetime)
+* - prompt_always: Dangerous tools that ALWAYS need permission, cannot be trusted (file edits, shell commands)
+* - prompt_default: Tools that prompt by default but users can trust them (file reads, searches)
+*/
+const DEFAULT_TOOL_CATEGORIES = {
+	math_evaluate: "auto_approve",
+	current_datetime: "auto_approve",
+	dice_roll: "auto_approve",
+	prompt_enhancement: "auto_approve",
+	find_definition: "auto_approve",
+	ask_user_question: "auto_approve",
+	weather_info: "prompt_default",
+	edit_file: "prompt_always",
+	edit_local_file: "prompt_always",
+	create_file: "prompt_always",
+	delete_file: "prompt_always",
+	shell_execute: "prompt_always",
+	bash_execute: "prompt_always",
+	write_shell_stdin: "prompt_always",
+	kill_background_shell: "prompt_always",
+	git_commit: "prompt_always",
+	git_push: "prompt_always",
+	skill: "prompt_always",
+	web_search: "prompt_default",
+	check_shell_output: "prompt_default",
+	list_background_shells: "prompt_default",
+	web_fetch: "prompt_default",
+	deep_research: "prompt_default",
+	file_read: "prompt_default",
+	grep_search: "prompt_default",
+	glob_files: "prompt_default",
+	get_file_tree: "prompt_default",
+	get_file_structure: "prompt_default",
+	git_status: "prompt_default",
+	git_diff: "prompt_default",
+	git_log: "prompt_default",
+	git_branch: "prompt_default"
+};
+/**
+* Get the category for a tool
+* Returns 'prompt_default' if tool is not in the default categories
+*/
+function getToolCategory(toolName, customCategories) {
+	if (toolName.startsWith("agent_hook:") || toolName.startsWith("skill_hook:")) return "prompt_always";
+	if (customCategories && toolName in customCategories) return customCategories[toolName];
+	if (toolName in DEFAULT_TOOL_CATEGORIES) return DEFAULT_TOOL_CATEGORIES[toolName];
+	if (toolName.startsWith("mcp__")) return "prompt_always";
+	return "prompt_default";
+}
+/**
+* Check if a tool can be trusted (not prompt_always)
+*/
+function canTrustTool(toolName, customCategories) {
+	return getToolCategory(toolName, customCategories) !== "prompt_always";
+}
+/**
+* Check if a tool is read-only (safe for parallel execution).
+* Write tools (prompt_always category) must always be sequential.
+*
+* @param toolName - Name of the tool to check
+* @param customCategories - Optional custom category overrides
+* @returns true if the tool is read-only, false if it's a write tool
+*/
+function isReadOnlyTool(toolName, customCategories) {
+	return getToolCategory(toolName, customCategories) !== "prompt_always";
+}
+const PROJECT_CONTEXT_FILES = [
+	"CLAUDE.local.md",
+	"CLAUDE.md",
+	"AGENTS.md",
+	"AI.local.md",
+	"AI.md",
+	"INSTRUCTIONS.md"
+];
+const GLOBAL_CONTEXT_FILES = ["AI.local.md", "AI.md"];
+/**
+* Format file size for display
+*/
+function formatFileSize(bytes) {
+	if (bytes < 1024) return `${bytes}B`;
+	if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)}KB`;
+	return `${(bytes / 1048576).toFixed(1)}MB`;
+}
+/**
+* Try to read a context file from a directory
+*
+* Security: Only reads regular files (not directories or symlinks) within the specified directory.
+* Files must be under 100KB to prevent abuse. Symlinks are rejected to prevent reading
+* files outside the intended directory.
+*
+* @param dir - The directory to read from (must be a controlled location)
+* @param filename - The filename to read (must not contain path separators)
+* @param source - Whether this is a 'global' or 'project' context file
+* @returns The file result, an error object, or null if file doesn't exist
+*/
+function tryReadContextFile(dir, filename, source) {
+	const filePath = path$1.join(dir, filename);
+	try {
+		const stats = fs$2.lstatSync(filePath);
+		if (stats.isDirectory()) return null;
+		if (stats.isSymbolicLink()) return { error: `${source === "global" ? "Global" : "Project"} ${filename} is a symlink (not allowed for security)` };
+		if (stats.size > 102400) return { error: `${source === "global" ? "Global" : "Project"} ${filename} exceeds 100KB limit (${formatFileSize(stats.size)})` };
+		return {
+			filename,
+			content: fs$2.readFileSync(filePath, "utf-8"),
+			source,
+			path: filePath
+		};
+	} catch (err) {
+		if (err.code === "ENOENT") return null;
+		if (err.code === "EACCES") return { error: `Cannot read ${source} ${filename}: permission denied` };
+		return { error: `Cannot read ${source} ${filename}: ${err instanceof Error ? err.message : "Unknown error"}` };
+	}
+}
+/**
+* Find the first context file in a directory from a list of candidates
+*/
+function findContextFile(dir, candidates, source) {
+	for (const filename of candidates) {
+		const result = tryReadContextFile(dir, filename, source);
+		if (result === null) continue;
+		if ("error" in result) return {
+			result: null,
+			error: result.error
+		};
+		return {
+			result,
+			error: null
+		};
+	}
+	return {
+		result: null,
+		error: null
+	};
+}
+/**
+* Merge global and project context into a single string
+*/
+function mergeContextContent(global, project) {
+	if (global && project) return `${global.content}\n\n---\n\n${project.content}`;
+	if (global) return global.content;
+	if (project) return project.content;
+	return "";
+}
+/**
+* Load context files from global and project directories
+*
+* Global files are loaded from ~/.bike4mind/
+* Project files are loaded from `projectDir`. When it is null the project layer
+* is SKIPPED entirely (not defaulted to cwd) - the folder-trust gate passes null
+* for an untrusted project so its repo context file is never loaded.
+*
+* Returns the first matching file from each layer based on priority order
+*/
+async function loadContextFiles(projectDir) {
+	const errors = [];
+	const globalDir = path$1.join(homedir$1(), ".bike4mind");
+	const [globalResult, projectResult] = await Promise.all([Promise.resolve(findContextFile(globalDir, GLOBAL_CONTEXT_FILES, "global")), Promise.resolve(projectDir ? findContextFile(projectDir, PROJECT_CONTEXT_FILES, "project") : {
+		result: null,
+		error: null
+	})]);
+	if (globalResult.error) errors.push(globalResult.error);
+	if (projectResult.error) errors.push(projectResult.error);
+	const mergedContent = mergeContextContent(globalResult.result, projectResult.result);
+	return {
+		globalContext: globalResult.result,
+		projectContext: projectResult.result,
+		mergedContent,
+		errors
+	};
+}
+/**
+* Extract "# Compact Instructions" or "## Compact Instructions" section from CLAUDE.md content
+*
+* This section provides project-specific instructions for how conversations should be
+* summarized when compacting context.
+*
+* @param contextContent - The merged context content from CLAUDE.md files
+* @returns The extracted instructions content, or undefined if not found
+*/
+function extractCompactInstructions(contextContent) {
+	const match = contextContent.match(/^#{1,2}\s*Compact\s*Instructions\s*$/im);
+	if (!match || match.index === void 0) return;
+	const startIndex = match.index + match[0].length;
+	const remainingContent = contextContent.slice(startIndex);
+	const endIndex = remainingContent.match(/^#{1,2}\s+\S/m)?.index ?? remainingContent.length;
+	return remainingContent.slice(0, endIndex).trim() || void 0;
+}
 const logger = class Logger {
 	static {
 		this.instance = null;
@@ -15943,6 +16912,7 @@ const CliConfigSchema = z$1.object({
 		hearth: z$1.boolean().optional()
 	}).catchall(z$1.boolean())).optional().prefault({}),
 	trustedTools: z$1.array(z$1.string()).optional().prefault([]),
+	trustedProjects: z$1.array(z$1.string()).optional().prefault([]),
 	sandbox: SandboxConfigSchema.optional(),
 	additionalDirectories: z$1.array(z$1.string()).optional().prefault([]),
 	fallbackModels: z$1.array(z$1.string()).optional()
@@ -16051,6 +17021,7 @@ const DEFAULT_CONFIG = {
 		config: {}
 	},
 	trustedTools: [],
+	trustedProjects: [],
 	additionalDirectories: []
 };
 /**
@@ -16071,6 +17042,19 @@ function findProjectConfigDir(startDir = process.cwd()) {
 	return process.cwd();
 }
 /**
+* Canonicalize a path via realpath, returning null if it doesn't exist or can't
+* be resolved. Used so a symlinked or relative project root is compared against
+* the trust set by its real location, and a resolve failure fails safe
+* (untrusted) rather than crashing the launch.
+*/
+async function safeRealpath(p) {
+	try {
+		return await promises.realpath(p);
+	} catch {
+		return null;
+	}
+}
+/**
 * Load project config from .bike4mind/config.json
 * Returns null if file doesn't exist (this is normal - config.json is optional)
 */
@@ -16178,32 +17162,89 @@ function mergeMcpServers(...serverArrays) {
 	for (const servers of serverArrays) if (servers) for (const server of servers) serverMap.set(server.name, server);
 	return Array.from(serverMap.values());
 }
+/** Sandbox modes ordered from weakest to strongest posture. */
+const SANDBOX_MODE_RANK = {
+	disabled: 0,
+	"auto-allow": 1,
+	permissions: 2
+};
+function intersectStrings(a, b) {
+	const set = new Set(a);
+	return b.filter((x) => set.has(x));
+}
+function unionStrings(a, b) {
+	return Array.from(/* @__PURE__ */ new Set([...a, ...b]));
+}
+/** True when `target` is `root` itself or nested under it (no `..` escape). */
+function isWithin(root, target) {
+	const rel = path.relative(root, target);
+	return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+}
 /**
-* Deep-merge sandbox configs. Later values override earlier ones.
-* Arrays (allowedReadPaths, deniedPaths, excludedCommands) are replaced, not concatenated.
+* Merge a repo-sourced sandbox override onto the user's base posture so it can
+* only ever TIGHTEN it, never loosen it. A repo layer may enable the sandbox,
+* raise the mode (disabled < auto-allow < permissions) but never select
+* auto-allow itself, add denied paths, narrow read paths / domains / excluded
+* commands, turn the network filter on, and force allowUnsandboxedCommands off.
+* Every loosening value is ignored with a warning. `platform` is ignored.
 */
-function mergeSandboxConfig(base, override) {
-	const resolved = base ?? DEFAULT_SANDBOX_CONFIG;
-	if (!override) return resolved;
-	return {
-		enabled: override.enabled ?? resolved.enabled,
-		mode: override.mode ?? resolved.mode,
-		filesystem: {
-			...resolved.filesystem,
-			...override.filesystem ?? {}
-		},
-		network: {
-			...resolved.network,
-			...override.network ?? {}
-		},
-		excludedCommands: override.excludedCommands ?? resolved.excludedCommands,
-		allowUnsandboxedCommands: override.allowUnsandboxedCommands ?? resolved.allowUnsandboxedCommands,
-		platform: override.platform ?? resolved.platform
+function tightenSandbox(base, repo) {
+	const b = base ?? DEFAULT_SANDBOX_CONFIG;
+	if (!repo) return b;
+	const warn = (what) => logger.warn(`Ignoring repo sandbox override that would loosen posture: ${what}`);
+	const result = {
+		...b,
+		filesystem: { ...b.filesystem },
+		network: { ...b.network }
 	};
+	if (repo.enabled === true) result.enabled = true;
+	else if (repo.enabled === false && b.enabled) warn("sandbox.enabled=false");
+	if (repo.mode !== void 0) if (repo.mode === "auto-allow") warn("sandbox.mode=auto-allow");
+	else if (SANDBOX_MODE_RANK[repo.mode] >= SANDBOX_MODE_RANK[b.mode]) result.mode = repo.mode;
+	else warn(`sandbox.mode=${repo.mode} weaker than ${b.mode}`);
+	if (repo.filesystem) {
+		const fsr = repo.filesystem;
+		if (fsr.deniedPaths) result.filesystem.deniedPaths = unionStrings(result.filesystem.deniedPaths, fsr.deniedPaths);
+		if (fsr.allowedReadPaths) result.filesystem.allowedReadPaths = intersectStrings(result.filesystem.allowedReadPaths, fsr.allowedReadPaths);
+		if (fsr.writeOnlyToWorkingDir === true) result.filesystem.writeOnlyToWorkingDir = true;
+		else if (fsr.writeOnlyToWorkingDir === false && b.filesystem.writeOnlyToWorkingDir) warn("filesystem.writeOnlyToWorkingDir=false");
+	}
+	if (repo.network) {
+		const nr = repo.network;
+		if (nr.enabled === true) result.network.enabled = true;
+		else if (nr.enabled === false && b.network.enabled) warn("network.enabled=false");
+		if (nr.allowedDomains) result.network.allowedDomains = intersectStrings(result.network.allowedDomains, nr.allowedDomains);
+	}
+	if (repo.excludedCommands) result.excludedCommands = intersectStrings(result.excludedCommands, repo.excludedCommands);
+	if (repo.allowUnsandboxedCommands === false) result.allowUnsandboxedCommands = false;
+	else if (repo.allowUnsandboxedCommands === true && !b.allowUnsandboxedCommands) warn("allowUnsandboxedCommands=true");
+	if (result.enabled && result.mode === "disabled") result.mode = "permissions";
+	if (!result.enabled) result.mode = "disabled";
+	return result;
 }
 /**
-* Merge configs with priority: global -> project -> local
-* Each layer overrides the previous one
+* Fold repo-sourced MCP servers under the global set so a repo entry can never
+* REPLACE a same-named global server. Global definitions always win; repo
+* entries only fill names global does not already use. Later repo layers win
+* over earlier ones for names global does not define.
+*/
+function mergeMcpServersGlobalWins(global, ...repoLayers) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const layer of repoLayers) {
+		if (!layer) continue;
+		for (const server of layer) byName.set(server.name, server);
+	}
+	if (global) for (const server of global) byName.set(server.name, server);
+	return Array.from(byName.values());
+}
+/**
+* Merge configs with priority: global -> project -> local, with the invariant
+* that repo layers may only TIGHTEN the user's global security posture, never
+* loosen it. Sandbox goes through `tightenSandbox`; the repo `trustedTools`
+* union is filtered to tools that can actually be trusted and aren't globally
+* disabled; and any tool a repo tries to re-enable while it is disabled is
+* dropped. `mcpServers` is NOT merged here - callers fold repo servers in via
+* `mergeMcpServersGlobalWins` where all repo layers are visible together.
 */
 function mergeConfigs(global, project, local) {
 	const merged = { ...global };
@@ -16222,8 +17263,7 @@ function mergeConfigs(global, project, local) {
 				...project.tools.config
 			}
 		};
-		if (project.mcpServers) merged.mcpServers = mergeMcpServers(merged.mcpServers, project.mcpServers);
-		if (project.sandbox) merged.sandbox = mergeSandboxConfig(merged.sandbox, project.sandbox);
+		if (project.sandbox) merged.sandbox = tightenSandbox(merged.sandbox, project.sandbox);
 	}
 	if (local) {
 		if (local.trustedTools) {
@@ -16238,9 +17278,15 @@ function mergeConfigs(global, project, local) {
 			...merged.preferences,
 			...local.preferences
 		};
-		if (local.mcpServers) merged.mcpServers = mergeMcpServers(merged.mcpServers, local.mcpServers);
-		if (local.sandbox) merged.sandbox = mergeSandboxConfig(merged.sandbox, local.sandbox);
+		if (local.sandbox) merged.sandbox = tightenSandbox(merged.sandbox, local.sandbox);
 	}
+	const disabledSet = new Set(merged.tools.disabled);
+	merged.tools = {
+		...merged.tools,
+		enabled: merged.tools.enabled.filter((t) => !disabledSet.has(t))
+	};
+	const globalTrusted = new Set(global.trustedTools || []);
+	merged.trustedTools = (merged.trustedTools || []).filter((t) => globalTrusted.has(t) || canTrustTool(t) && !disabledSet.has(t));
 	return merged;
 }
 /**
@@ -16270,6 +17316,12 @@ var ConfigStore = class {
 	constructor(configPath) {
 		this.config = null;
 		this.projectConfigDir = null;
+		this.globalConfig = null;
+		this.projectRealPath = null;
+		this.projectTrusted = false;
+		this.rawProjectConfig = null;
+		this.rawProjectLocalConfig = null;
+		this.rawMcpJsonServers = null;
 		this.configPath = configPath || path.join(homedir(), ".bike4mind", "config.json");
 	}
 	/**
@@ -16336,35 +17388,33 @@ var ConfigStore = class {
 					trustedTools: validated.trustedTools || []
 				};
 			} catch (error) {
-				if (error.code === "ENOENT") globalConfig = { ...DEFAULT_CONFIG };
+				if (error.code === "ENOENT") globalConfig = structuredClone(DEFAULT_CONFIG);
 				else if (error instanceof z$1.ZodError) {
 					console.error("Global config validation error:", error.issues);
 					console.error("Using default configuration");
-					globalConfig = { ...DEFAULT_CONFIG };
+					globalConfig = structuredClone(DEFAULT_CONFIG);
 				} else throw error;
 			}
-			let projectConfig = null;
-			let projectLocalConfig = null;
-			let mcpJsonServers = null;
+			this.globalConfig = globalConfig;
+			this.projectConfigDir = null;
+			this.projectRealPath = null;
+			this.projectTrusted = false;
+			this.rawProjectConfig = null;
+			this.rawProjectLocalConfig = null;
+			this.rawMcpJsonServers = null;
 			if (process.env.B4M_NO_PROJECT_CONFIG !== "1") {
 				this.projectConfigDir = findProjectConfigDir();
 				if (this.projectConfigDir) {
-					projectConfig = await loadProjectConfig(this.projectConfigDir);
-					projectLocalConfig = await loadProjectLocalConfig(this.projectConfigDir);
-					mcpJsonServers = await loadMcpJsonConfig(this.projectConfigDir);
-					if (projectConfig) logger.debug(`📁 Project config loaded from: ${this.projectConfigDir}/.bike4mind/`);
-					if (mcpJsonServers && mcpJsonServers.length > 0) logger.debug(`📁 Project MCP config loaded from: ${this.projectConfigDir}/.mcp.json`);
+					this.projectRealPath = await safeRealpath(this.projectConfigDir) ?? this.projectConfigDir;
+					this.projectTrusted = (globalConfig.trustedProjects || []).includes(this.projectRealPath);
+					if (this.projectTrusted) {
+						const loaded = await this.loadProjectLayers();
+						if (loaded.hasConfig) logger.debug(`📁 Project config loaded from: ${this.projectConfigDir}/.bike4mind/`);
+						if (loaded.mcpCount > 0) logger.debug(`📁 Project MCP config loaded from: ${this.projectConfigDir}/.mcp.json`);
+					}
 				}
-			} else this.projectConfigDir = null;
-			const mergedConfig = mergeConfigs(globalConfig, projectConfig, projectLocalConfig);
-			if (mcpJsonServers && mcpJsonServers.length > 0) mergedConfig.mcpServers = mergeMcpServers(mcpJsonServers, mergedConfig.mcpServers);
-			const mcpConfigFile = process.env.B4M_MCP_CONFIG_FILE;
-			if (mcpConfigFile) {
-				const injected = await loadMcpConfigFile(mcpConfigFile);
-				if (process.env.B4M_STRICT_MCP_CONFIG === "1") mergedConfig.mcpServers = injected ?? [];
-				else if (injected) mergedConfig.mcpServers = mergeMcpServers(mergedConfig.mcpServers, injected);
 			}
-			this.config = mergedConfig;
+			this.config = await this.computeMerged();
 			return this.config;
 		} catch (error) {
 			if (error.code === "ENOENT") return this.reset();
@@ -16378,6 +17428,116 @@ var ConfigStore = class {
 		}
 	}
 	/**
+	* Load the raw repo config layers for the current project root. Called only
+	* for a trusted root; stores them on `this` so trust changes can re-merge
+	* without re-reading the global config file.
+	*/
+	async loadProjectLayers() {
+		if (!this.projectConfigDir) return {
+			hasConfig: false,
+			mcpCount: 0
+		};
+		this.rawProjectConfig = await loadProjectConfig(this.projectConfigDir);
+		this.rawProjectLocalConfig = await loadProjectLocalConfig(this.projectConfigDir);
+		this.rawMcpJsonServers = await loadMcpJsonConfig(this.projectConfigDir);
+		return {
+			hasConfig: !!this.rawProjectConfig,
+			mcpCount: this.rawMcpJsonServers?.length ?? 0
+		};
+	}
+	/**
+	* Build the merged effective config from the global layer plus the raw repo
+	* layers - but only when the project is trusted, so an untrusted root
+	* contributes nothing. Repo MCP servers are folded in global-wins (a repo
+	* name can never replace a global server); an explicit `--mcp-config` is host-
+	* injected (not repo-sourced) and keeps its override-by-name / strict scope.
+	*/
+	async computeMerged() {
+		const global = this.globalConfig;
+		const project = this.projectTrusted ? this.rawProjectConfig : null;
+		const local = this.projectTrusted ? this.rawProjectLocalConfig : null;
+		const mcpJson = this.projectTrusted ? this.rawMcpJsonServers : null;
+		const merged = mergeConfigs(global, project, local);
+		merged.mcpServers = mergeMcpServersGlobalWins(global.mcpServers, mcpJson, project?.mcpServers, local?.mcpServers);
+		const mcpConfigFile = process.env.B4M_MCP_CONFIG_FILE;
+		if (mcpConfigFile) {
+			const injected = await loadMcpConfigFile(mcpConfigFile);
+			if (process.env.B4M_STRICT_MCP_CONFIG === "1") merged.mcpServers = injected ?? [];
+			else if (injected) merged.mcpServers = mergeMcpServers(merged.mcpServers, injected);
+		}
+		return merged;
+	}
+	/** Whether the current project root is trusted (folder-trust gate). */
+	isProjectTrusted() {
+		return this.projectTrusted;
+	}
+	/** Canonicalized project root discovered this session, or null. */
+	getProjectRealPath() {
+		return this.projectRealPath;
+	}
+	/** The realpath'd roots the user has explicitly trusted. */
+	getTrustedProjects() {
+		return this.globalConfig?.trustedProjects ? [...this.globalConfig.trustedProjects] : [];
+	}
+	/**
+	* Whether the current project root ships any repo-committed b4m files that the
+	* trust gate governs. Used to decide whether the startup trust prompt is even
+	* worth showing (nothing to gate = no prompt).
+	*/
+	projectHasB4mFiles() {
+		const root = this.projectConfigDir;
+		if (!root) return false;
+		return [
+			[".bike4mind", "config.json"],
+			[".bike4mind", "local.json"],
+			[".bike4mind", "agents"],
+			[".bike4mind", "commands"],
+			[".mcp.json"],
+			[".claude", "agents"],
+			[".claude", "skills"],
+			[".claude", "commands"],
+			...PROJECT_CONTEXT_FILES.map((name) => [name])
+		].some((parts) => existsSync(path.join(root, ...parts)));
+	}
+	/**
+	* Trust a project root (default: the current one). Persists the realpath'd
+	* root to the global `trustedProjects` and, when it's the current root, loads
+	* its repo layers and re-merges so they take effect for this session.
+	*/
+	async trustProject(root) {
+		await this.load();
+		const target = root ? await safeRealpath(root) : this.projectRealPath;
+		if (!target) return false;
+		const g = this.globalConfig;
+		if (!g.trustedProjects) g.trustedProjects = [];
+		if (!g.trustedProjects.includes(target)) g.trustedProjects.push(target);
+		if (target === this.projectRealPath && this.projectConfigDir && process.env.B4M_NO_PROJECT_CONFIG !== "1") {
+			this.projectTrusted = true;
+			await this.loadProjectLayers();
+		}
+		await this.save();
+		return true;
+	}
+	/**
+	* Revoke trust for a project root (default: the current one). Next launch
+	* re-prompts and repo layers stay inert until re-trusted. Revoking the current
+	* root drops its raw layers so nothing repo-sourced survives in this session.
+	*/
+	async untrustProject(root) {
+		await this.load();
+		const target = root ? await safeRealpath(root) : this.projectRealPath;
+		if (!target) return;
+		const g = this.globalConfig;
+		g.trustedProjects = (g.trustedProjects || []).filter((p) => p !== target);
+		if (target === this.projectRealPath) {
+			this.projectTrusted = false;
+			this.rawProjectConfig = null;
+			this.rawProjectLocalConfig = null;
+			this.rawMcpJsonServers = null;
+		}
+		await this.save();
+	}
+	/**
 	* Read the features map straight from the global config file, bypassing the
 	* in-memory cache. save() merges over this so concurrent writers (the
 	* interactive session vs `b4m plugin add`) don't clobber each other's keys.
@@ -16412,47 +17572,52 @@ var ConfigStore = class {
 	/**
 	* Save configuration to disk
 	*/
-	async save(config) {
+	async save(config, opts) {
 		await this.init();
+		if (!this.globalConfig) await this.load();
+		const global = this.globalConfig;
 		if (config) {
-			const existingConfig = await this.load();
-			this.config = {
-				...existingConfig,
-				...config,
-				auth: config.auth !== void 0 ? config.auth : existingConfig.auth,
+			const { mcpServers, trustedTools, additionalDirectories, trustedProjects, tools, sandbox, ...rest } = config;
+			this.globalConfig = {
+				...global,
+				...rest,
+				auth: "auth" in config ? config.auth : global.auth,
 				preferences: {
-					...existingConfig.preferences,
+					...global.preferences,
 					...config.preferences || {}
 				},
-				tools: {
-					...existingConfig.tools,
-					...config.tools || {}
-				},
 				toolApiKeys: {
-					...existingConfig.toolApiKeys,
+					...global.toolApiKeys,
 					...config.toolApiKeys || {}
 				},
-				features: this.mergeFeatures(await this.readDiskFeatures(), existingConfig.features, config.features ?? existingConfig.features)
+				features: opts?.clearFeatures ? {} : this.mergeFeatures(await this.readDiskFeatures(), global.features, config.features ?? global.features)
 			};
-		}
-		if (!this.config) throw new Error("No configuration to save");
+		} else this.globalConfig = {
+			...global,
+			features: opts?.clearFeatures ? {} : await this.readDiskFeatures()
+		};
 		try {
-			await promises.writeFile(this.configPath, JSON.stringify(this.config, null, 2), "utf-8");
+			await promises.writeFile(this.configPath, JSON.stringify(this.globalConfig, null, 2), "utf-8");
 			await promises.chmod(this.configPath, 384);
 		} catch (error) {
 			console.error("Failed to save config:", error);
 			throw error;
 		}
+		this.config = await this.computeMerged();
 	}
 	/**
 	* Reset configuration to defaults
 	*/
 	async reset() {
-		this.config = {
-			...DEFAULT_CONFIG,
+		this.globalConfig = {
+			...structuredClone(DEFAULT_CONFIG),
 			userId: v4()
 		};
-		await this.save();
+		this.projectTrusted = false;
+		this.rawProjectConfig = null;
+		this.rawProjectLocalConfig = null;
+		this.rawMcpJsonServers = null;
+		await this.save(void 0, { clearFeatures: true });
 		return this.config;
 	}
 	/**
@@ -16468,56 +17633,71 @@ var ConfigStore = class {
 		await this.save(updates);
 	}
 	/**
+	* Persist a sandbox config to the GLOBAL layer (the `/sandbox` handlers' path).
+	* Sandbox is excluded from the generic `save()` allowlist so it flows only
+	* through here - a merged-config save() can never launder a repo-tightened
+	* sandbox into the user's global default.
+	*/
+	async saveSandboxConfig(sandbox) {
+		await this.load();
+		this.globalConfig.sandbox = sandbox;
+		await this.save();
+	}
+	/**
 	* Add MCP server configuration
 	*/
 	async addMcpServer(server) {
-		const config = await this.load();
-		config.mcpServers = config.mcpServers.filter((s) => s.name !== server.name);
-		config.mcpServers.push(server);
-		await this.save(config);
+		await this.load();
+		const g = this.globalConfig;
+		g.mcpServers = g.mcpServers.filter((s) => s.name !== server.name);
+		g.mcpServers.push(server);
+		await this.save();
 	}
 	/**
 	* Remove MCP server configuration
 	*/
 	async removeMcpServer(name) {
-		const config = await this.load();
-		config.mcpServers = config.mcpServers.filter((s) => s.name !== name);
-		await this.save(config);
+		await this.load();
+		const g = this.globalConfig;
+		g.mcpServers = g.mcpServers.filter((s) => s.name !== name);
+		await this.save();
 	}
 	/**
 	* Enable/disable MCP server
 	*/
 	async toggleMcpServer(name, enabled) {
-		const config = await this.load();
-		const server = config.mcpServers.find((s) => s.name === name);
+		await this.load();
+		const server = this.globalConfig.mcpServers.find((s) => s.name === name);
 		if (server) {
 			server.enabled = enabled;
-			await this.save(config);
+			await this.save();
 		}
 	}
 	/**
 	* Add a tool to trusted tools list
 	*/
 	async trustTool(toolName) {
-		const config = await this.load();
-		if (!config.trustedTools) config.trustedTools = [];
-		if (!config.trustedTools.includes(toolName)) {
-			config.trustedTools.push(toolName);
-			await this.save(config);
+		await this.load();
+		const g = this.globalConfig;
+		if (!g.trustedTools) g.trustedTools = [];
+		if (!g.trustedTools.includes(toolName)) {
+			g.trustedTools.push(toolName);
+			await this.save();
 		}
 	}
 	/**
 	* Remove a tool from trusted tools list
 	*/
 	async untrustTool(toolName) {
-		const config = await this.load();
-		if (config.trustedTools) {
-			config.trustedTools = config.trustedTools.filter((t) => t !== toolName);
-			await this.save(config);
+		await this.load();
+		const g = this.globalConfig;
+		if (g.trustedTools) {
+			g.trustedTools = g.trustedTools.filter((t) => t !== toolName);
+			await this.save();
 		}
 	}
 	/**
-	* Get list of trusted tools
+	* Get list of trusted tools (merged effective view)
 	*/
 	async getTrustedTools() {
 		return (await this.load()).trustedTools || [];
@@ -16526,9 +17706,9 @@ var ConfigStore = class {
 	* Clear all trusted tools
 	*/
 	async clearTrustedTools() {
-		const config = await this.load();
-		config.trustedTools = [];
-		await this.save(config);
+		await this.load();
+		this.globalConfig.trustedTools = [];
+		await this.save();
 	}
 	/**
 	* Get authentication tokens
@@ -16540,17 +17720,17 @@ var ConfigStore = class {
 	* Set authentication tokens
 	*/
 	async setAuthTokens(tokens) {
-		const config = await this.load();
-		config.auth = tokens;
-		await this.save(config);
+		await this.load();
+		this.globalConfig.auth = tokens;
+		await this.save();
 	}
 	/**
 	* Clear authentication tokens (logout)
 	*/
 	async clearAuthTokens() {
-		const config = await this.load();
-		config.auth = void 0;
-		await this.save(config);
+		await this.load();
+		this.globalConfig.auth = void 0;
+		await this.save();
 	}
 	/**
 	* Check if user is authenticated
@@ -16571,10 +17751,9 @@ var ConfigStore = class {
 	* Pass null to reset to the build-time default service.
 	*/
 	async setCustomApiUrl(url) {
-		const config = await this.load();
-		if (url === null) config.apiConfig = void 0;
-		else config.apiConfig = { customUrl: url };
-		await this.save(config);
+		await this.load();
+		this.globalConfig.apiConfig = url === null ? void 0 : { customUrl: url };
+		await this.save();
 	}
 	/**
 	* Switch the active API environment, caching auth tokens per-environment so
@@ -16591,8 +17770,9 @@ var ConfigStore = class {
 	* preserve the previous `auth` and defeat the per-env swap.
 	*/
 	async switchApiEnvironment(target) {
-		const config = await this.load();
-		const prevKey = normalizeEnvKey(config.apiConfig?.customUrl || getDefaultApiUrl());
+		await this.load();
+		const g = this.globalConfig;
+		const prevKey = normalizeEnvKey(g.apiConfig?.customUrl || getDefaultApiUrl());
 		let newUrl;
 		let newApiConfig;
 		if (target === "prod") {
@@ -16611,16 +17791,15 @@ var ConfigStore = class {
 			url: newUrl,
 			envName,
 			changed: false,
-			authenticated: hasValidAuth(config.auth)
+			authenticated: hasValidAuth(g.auth)
 		};
-		const authByEnv = { ...config.authByEnv || {} };
-		if (config.auth) authByEnv[prevKey] = config.auth;
+		const authByEnv = { ...g.authByEnv || {} };
+		if (g.auth) authByEnv[prevKey] = g.auth;
 		else delete authByEnv[prevKey];
 		const restored = authByEnv[newKey];
-		config.apiConfig = newApiConfig;
-		config.authByEnv = authByEnv;
-		config.auth = restored;
-		config.features = await this.readDiskFeatures();
+		g.apiConfig = newApiConfig;
+		g.authByEnv = authByEnv;
+		g.auth = restored;
 		await this.save();
 		return {
 			url: newUrl,
@@ -16708,40 +17887,48 @@ var ConfigStore = class {
 	* Persists to global config
 	*/
 	async addDirectory(dirPath) {
-		const config = await this.load();
-		if (!config.additionalDirectories) config.additionalDirectories = [];
+		await this.load();
+		const g = this.globalConfig;
+		if (!g.additionalDirectories) g.additionalDirectories = [];
 		const resolvedPath = path.resolve(dirPath);
-		if (!config.additionalDirectories.includes(resolvedPath)) {
-			config.additionalDirectories.push(resolvedPath);
-			await this.save(config);
+		if (!g.additionalDirectories.includes(resolvedPath)) {
+			g.additionalDirectories.push(resolvedPath);
+			await this.save();
 		}
 	}
 	/**
 	* Remove a directory from the allowed directories list
 	*/
 	async removeDirectory(dirPath) {
-		const config = await this.load();
-		if (config.additionalDirectories) {
+		await this.load();
+		const g = this.globalConfig;
+		if (g.additionalDirectories) {
 			const resolvedPath = path.resolve(dirPath);
-			config.additionalDirectories = config.additionalDirectories.filter((d) => path.resolve(d) !== resolvedPath);
-			await this.save(config);
+			g.additionalDirectories = g.additionalDirectories.filter((d) => path.resolve(d) !== resolvedPath);
+			await this.save();
 		}
 	}
 	/**
-	* Get all additional directories (merged from global + project configs)
-	* Returns resolved absolute paths
+	* Get all additional directories (global config + trusted-project config).
+	* Returns resolved absolute paths. Project-declared directories are included
+	* ONLY when the project is trusted, and each must resolve inside the project
+	* root (a repo cannot widen file access beyond its own tree).
 	*/
 	async getAdditionalDirectories() {
-		const config = await this.load();
+		await this.load();
+		const g = this.globalConfig;
 		const dirs = /* @__PURE__ */ new Set();
-		if (config.additionalDirectories) for (const dir of config.additionalDirectories) dirs.add(path.resolve(dir));
-		const projectConfig = await this.loadRawProjectConfig();
-		if (projectConfig?.additionalDirectories) {
-			const projectRoot = this.projectConfigDir || process.cwd();
-			for (const dir of projectConfig.additionalDirectories) dirs.add(path.resolve(projectRoot, dir));
+		if (g.additionalDirectories) for (const dir of g.additionalDirectories) dirs.add(path.resolve(dir));
+		if (this.projectTrusted && this.rawProjectConfig?.additionalDirectories) {
+			const projectRoot = this.projectRealPath || this.projectConfigDir;
+			if (projectRoot) for (const dir of this.rawProjectConfig.additionalDirectories) {
+				const real = await safeRealpath(path.resolve(projectRoot, dir));
+				if (real && isWithin(projectRoot, real)) dirs.add(real);
+				else logger.warn(`Ignoring project additionalDirectory outside project root: ${dir}`);
+			}
 		}
 		return Array.from(dirs);
 	}
 };
 //#endregion
-export { SupportedFabFileMimeTypes as $, actorKindSchema as $t, HTTPError as A, isModelDeprecated as At, OPENAI_GPT_IMAGE_1_IMAGE_SIZES as B, parseEmbeddingRateLimitHeaders as Bt, DEFAULT_MUSIC_MODEL_ID as C, isGPTImage2Model as Ct, FIXED_TEMPERATURE_MODELS as D, isImageServeable as Dt, FIELD_GROUP_OF as E, isImageAttachment as Et, MODEL_INFO_FIELD_GROUP_OF as F, isUnlimitedHistory as Ft, PermissionDeniedError as G, toModelInfo as Gt, OllamaEmbeddingModel as H, resolveHistoryFetchLimit as Ht, McpServerName as I, isUserInitiatedAbort as It, REFUSAL_FALLBACK_MODELS as J, usdToCreditsStochastic as Jt, REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS as K, toModelRecord as Kt, ModelBackend as L, isZodError as Lt, IMAGE_SIZE_CONSTRAINTS as M, isRenderableModelType as Mt, ImageModels as N, isRetryableError as Nt, FORMAT_PROMPT_TEMPLATE as O, isMediaModelType as Ot, InternalServerError as P, isSupportedFabFileMimeType as Pt, SpeechToTextModels as Q, actorKindMarker as Qt, NO_TEMPERATURE_MODELS as R, mapMimeTypeToArtifactType as Rt, CorruptedFileError as S, isFieldGroup as St, DEGENERATE_FINISH_REASON as T, isGeminiModelId as Tt, OpenAIEmbeddingModel as U, secureParameters as Ut, OPENAI_GPT_IMAGE_2_IMAGE_SIZES as V, reservationOutputTokens as Vt, PROMPT_TEXT_MAX as W, settingsMap as Wt, REVIEW_GATE_STATUS_VALUES as X, ACTOR_COLOR_SLOTS as Xt, RESPONSES_API_TOOL_MODELS as Y, withRetry as Yt, SUBQUEST_STATUS_VALUES as Z, actorColorIndex as Zt, BadRequestError as _, hasUsableLimits as _t, getCreditsUrl as a, VideoModels as at, CREDIT_DEDUCT_TRANSACTION_TYPES as b, isChunkStalledFile as bt, requireApiUrl as c, applyModelPriceCatalog as ct, AGENT_QUEST_MANIFEST as d, dayjsConfig_default as dt, selfClaimedActorKindSchema as en, TTS_MAX_INPUT_CHARS as et, AGENT_QUEST_MCP_URI as f, defaultEmbeddingModelForEnv as ft, BFL_SAFETY_TOLERANCE as g, hasKeylessCloudEmbedder as gt, BEDROCK_NO_PROMPT_CACHING_MODELS as h, getRetryAfterMs as ht, LOCAL_DEV_URL as i, parseRateLimitHeaders as in, VIDEO_SIZE_CONSTRAINTS as it, HttpStatus as j, isPlaceholderApiKey as jt, ForbiddenError as k, isModelAccessible as kt, resolveApiEndpoint as l, calculateRetryDelay as lt, ApiKeyType as m, getQuestErrorCode as mt, logger as n, extractSnippetMeta as nn, UnauthorizedError as nt, getEnvironmentName as o, VoyageAIEmbeddingModel as ot, ARTIFACT_ATTRS_PATTERN as p, getMcpProviderMetadata as pt, REASONING_SUPPORTED_MODELS as q, usdToCredits as qt, ApiEndpointUnconfiguredError as r, isNearLimit as rn, UnprocessableEntityError as rt, parseApiUrl as s, WORK_ITEM_STATUSES as st, ConfigStore as t, buildRateLimitLogEntry as tn, TooManyRequestsError as tt, AGENT_QUEST_ID as u, countCodePoints as ut, BedrockEmbeddingModel as v, isAudioMimeType as vt, DEFAULT_UNKNOWN_CONTEXT_WINDOW as w, isGPTImageModel as wt, ChatModels as x, isEarlyStop as xt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as y, isChunkRebuildPending as yt, NotFoundError as z, obfuscateApiKey as zt };
+export { RESPONSES_API_TOOL_MODELS as $, secureParameters as $t, DEFAULT_UNKNOWN_CONTEXT_WINDOW as A, isGPTImage2Model as At, InternalServerError as B, isRetryableError as Bt, BadRequestError as C, hasUsableLimits as Ct, ChatModels as D, isChunkStalledFile as Dt, CREDIT_DEDUCT_TRANSACTION_TYPES as E, isChunkRebuildPending as Et, ForbiddenError as F, isMediaModelType as Ft, NotFoundError as G, isZodError as Gt, McpServerName as H, isSupportedImageSize as Ht, HTTPError as I, isModelAccessible as It, PROMPT_TEXT_MAX as J, parseEmbeddingRateLimitHeaders as Jt, OllamaEmbeddingModel as K, mapMimeTypeToArtifactType as Kt, HttpStatus as L, isModelDeprecated as Lt, FIELD_GROUP_OF as M, isGeminiModelId as Mt, FIXED_TEMPERATURE_MODELS as N, isImageAttachment as Nt, CorruptedFileError as O, isEarlyStop as Ot, FORMAT_PROMPT_TEMPLATE as P, isImageServeable as Pt, REFUSAL_FALLBACK_MODELS as Q, resolveHistoryFetchLimit as Qt, IMAGE_SIZE_CONSTRAINTS as R, isPlaceholderApiKey as Rt, BFL_SAFETY_TOLERANCE as S, hasKeylessCloudEmbedder as St, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as T, isBflUltraImageModel as Tt, ModelBackend as U, isUnlimitedHistory as Ut, MODEL_INFO_FIELD_GROUP_OF as V, isSupportedFabFileMimeType as Vt, NO_TEMPERATURE_MODELS as W, isUserInitiatedAbort as Wt, REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS as X, reservationOutputTokens as Xt, PermissionDeniedError as Y, readZipEntryBounded as Yt, REASONING_SUPPORTED_MODELS as Z, resolveGptImageGenerateSize as Zt, AGENT_QUEST_MCP_URI as _, defaultEmbeddingModelForEnv as _t, canTrustTool as a, usdToCreditsStochastic as an, TooManyRequestsError as at, AudioMimeType as b, getQuestErrorCode as bt, ApiEndpointUnconfiguredError as c, actorColorIndex as cn, VIDEO_SIZE_CONSTRAINTS as ct, getEnvironmentName as d, selfClaimedActorKindSchema as dn, WORK_ITEM_STATUSES as dt, settingsMap as en, REVIEW_GATE_STATUS_VALUES as et, parseApiUrl as f, buildRateLimitLogEntry as fn, applyModelPriceCatalog as ft, AGENT_QUEST_MANIFEST as g, dayjsConfig_default as gt, AGENT_QUEST_ID as h, parseRateLimitHeaders as hn, countCodePoints as ht, loadContextFiles as i, usdToCredits as in, TTS_MAX_INPUT_CHARS as it, DEGENERATE_FINISH_REASON as j, isGPTImageModel as jt, DEFAULT_MUSIC_MODEL_ID as k, isFieldGroup as kt, LOCAL_DEV_URL as l, actorKindMarker as ln, VideoModels as lt, resolveApiEndpoint as m, isNearLimit as mn, capForParse as mt, logger as n, toModelRecord as nn, SpeechToTextModels as nt, getToolCategory as o, withRetry as on, UnauthorizedError as ot, requireApiUrl as p, extractSnippetMeta as pn, calculateRetryDelay as pt, OpenAIEmbeddingModel as q, obfuscateApiKey as qt, extractCompactInstructions as r, toNonWebpOutputFormat as rn, SupportedFabFileMimeTypes as rt, isReadOnlyTool as s, ACTOR_COLOR_SLOTS as sn, UnprocessableEntityError as st, ConfigStore as t, toModelInfo as tn, SUBQUEST_STATUS_VALUES as tt, getCreditsUrl as u, actorKindSchema as un, VoyageAIEmbeddingModel as ut, ARTIFACT_ATTRS_PATTERN as v, fallbackImageSize as vt, BedrockEmbeddingModel as w, isAudioMimeType as wt, BEDROCK_NO_PROMPT_CACHING_MODELS as x, getRetryAfterMs as xt, ApiKeyType as y, getMcpProviderMetadata as yt, ImageModels as z, isRenderableModelType as zt };