@bike4mind/cli 1.0.0 → 1.2.0

package/dist/{ConfigStore-DHNgFdOu.mjs → ConfigStore-qV7NrCgZ.mjs}

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
-import { t as DEFAULT_SANDBOX_CONFIG } from "./types-LyRNHOiS.mjs";
-import "crypto";
+import { t as DEFAULT_SANDBOX_CONFIG } from "./types-F61_hxmG.mjs";
+import { createHmac } from "crypto";
 import { existsSync, promises } from "fs";
 import os, { homedir } from "os";
 import path from "path";
 import { v4 } from "uuid";
+import * as path$1 from "node:path";
+import * as fs$1 from "node:fs";
 import * as z$2 from "zod";
 import z, { ZodError, z as z$1 } from "zod";
 import dayjs from "dayjs";
@@ -13,124 +15,10 @@ import utc from "dayjs/plugin/utc.js";
 import relativeTime from "dayjs/plugin/relativeTime.js";
 import localizedFormat from "dayjs/plugin/localizedFormat.js";
 import { isAxiosError } from "axios";
-import fs$1 from "fs/promises";
+import { homedir as homedir$1 } from "node:os";
+import fs from "fs/promises";
 process.env.APP_NAME;
 process.env.WEBSITE_URL;
-const extractSnippetMeta = (content) => {
-	const snippetRegex = /<!--snippet-meta\s*(\{[\s\S]*?\})\s*-->[\n\s]*([\s\S]*?)(?=<!--snippet-meta|$)/g;
-	const sections = [];
-	let lastIndex = 0;
-	let match;
-	while ((match = snippetRegex.exec(content)) !== null) {
-		if (match.index > lastIndex) {
-			const textBefore = content.slice(lastIndex, match.index).trim();
-			if (textBefore) sections.push({
-				type: "text",
-				content: textBefore
-			});
-		}
-		try {
-			const meta = JSON.parse(match[1]);
-			const snippetContent = match[2].trim();
-			if (meta && snippetContent) sections.push({
-				type: "snippet",
-				meta,
-				content: snippetContent
-			});
-		} catch (e) {
-			console.error("Error parsing snippet meta:", e);
-		}
-		lastIndex = match.index + match[0].length;
-	}
-	if (lastIndex < content.length) {
-		const remainingText = content.slice(lastIndex).trim();
-		if (remainingText) sections.push({
-			type: "text",
-			content: remainingText
-		});
-	}
-	return { sections };
-};
-function getHeader$1(headers, name) {
-	if (!headers || typeof headers !== "object") return null;
-	if (typeof headers.get === "function") {
-		const val = headers.get(name);
-		return typeof val === "string" ? val : null;
-	}
-	const value = headers[name] ?? headers[name.toLowerCase()];
-	return typeof value === "string" ? value : null;
-}
-function parseNumber(value) {
-	if (value === null || value === void 0) return null;
-	const num = Number(value);
-	return Number.isFinite(num) ? num : null;
-}
-/**
-* Parse rate limit headers from an HTTP response.
-*
-* Reads standard headers:
-* - `X-RateLimit-Limit` - max requests per window
-* - `X-RateLimit-Remaining` - requests left
-* - `X-RateLimit-Reset` - Unix epoch seconds when the window resets
-* - `Retry-After` - seconds to wait (on 429 responses), or an HTTP-date
-*/
-function parseRateLimitHeaders(headers) {
-	const limitStr = getHeader$1(headers, "X-RateLimit-Limit") ?? getHeader$1(headers, "x-ratelimit-limit");
-	const remainingStr = getHeader$1(headers, "X-RateLimit-Remaining") ?? getHeader$1(headers, "x-ratelimit-remaining");
-	const resetStr = getHeader$1(headers, "X-RateLimit-Reset") ?? getHeader$1(headers, "x-ratelimit-reset");
-	const retryAfterStr = getHeader$1(headers, "Retry-After") ?? getHeader$1(headers, "retry-after");
-	const limit = parseNumber(limitStr);
-	const remaining = parseNumber(remainingStr);
-	let resetAt = null;
-	if (resetStr !== null) {
-		const resetNum = Number(resetStr);
-		if (Number.isFinite(resetNum)) resetAt = /* @__PURE__ */ new Date(resetNum * 1e3);
-		else {
-			const parsed = new Date(resetStr);
-			if (!isNaN(parsed.getTime())) resetAt = parsed;
-		}
-	}
-	let retryAfterMs = null;
-	if (retryAfterStr !== null) {
-		const retryNum = Number(retryAfterStr);
-		if (Number.isFinite(retryNum)) retryAfterMs = retryNum * 1e3;
-		else {
-			const parsed = new Date(retryAfterStr);
-			if (!isNaN(parsed.getTime())) retryAfterMs = Math.max(0, parsed.getTime() - Date.now());
-		}
-	}
-	let usagePercent = null;
-	if (limit !== null && limit > 0 && remaining !== null && remaining >= 0) usagePercent = Math.round((limit - remaining) / limit * 100);
-	return {
-		limit,
-		remaining,
-		resetAt,
-		retryAfterMs,
-		usagePercent
-	};
-}
-function isNearLimit(info, thresholdPercent = 80) {
-	if (info.usagePercent === null) return false;
-	return info.usagePercent >= thresholdPercent;
-}
-/**
-* Build a structured log object for rate limit events.
-* Used by all integration clients to emit consistent log lines.
-*/
-function buildRateLimitLogEntry(integration, endpoint, info, wasThrottled = false) {
-	return {
-		type: wasThrottled ? "RATE_LIMIT_ERROR" : "RATE_LIMIT",
-		integration,
-		endpoint,
-		limit: info.limit,
-		remaining: info.remaining,
-		resetAt: info.resetAt?.toISOString() ?? null,
-		retryAfterMs: info.retryAfterMs,
-		usagePercent: info.usagePercent,
-		wasThrottled,
-		timestamp: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
 //#endregion
 //#region ../../b4m-core/hearth/dist/index.mjs
 /**
@@ -278,23 +166,14 @@ z$1.object({
 });
 //#endregion
 //#region ../../b4m-core/common/dist/index.mjs
-let HttpStatus = /* @__PURE__ */ function(HttpStatus) {
-	HttpStatus[HttpStatus["Ok"] = 200] = "Ok";
-	HttpStatus[HttpStatus["Created"] = 201] = "Created";
-	HttpStatus[HttpStatus["BadRequest"] = 400] = "BadRequest";
-	HttpStatus[HttpStatus["Unauthorized"] = 401] = "Unauthorized";
-	HttpStatus[HttpStatus["Forbidden"] = 403] = "Forbidden";
-	HttpStatus[HttpStatus["NotFound"] = 404] = "NotFound";
-	HttpStatus[HttpStatus["Conflict"] = 409] = "Conflict";
-	HttpStatus[HttpStatus["UnprocessableEntity"] = 422] = "UnprocessableEntity";
-	HttpStatus[HttpStatus["TooManyRequests"] = 429] = "TooManyRequests";
-	HttpStatus[HttpStatus["InternalServerError"] = 500] = "InternalServerError";
-	HttpStatus[HttpStatus["BadGateway"] = 502] = "BadGateway";
-	return HttpStatus;
-}({});
 var HTTPError = class extends Error {
 	statusCode;
 	additionalInfo;
+	/**
+	* Set on a 5xx that reports a third party's failure the server handled correctly (a source site
+	* timing out), so `errorHandler` logs it at warn rather than paging as a server fault.
+	*/
+	expected;
 	constructor(statusCode, message, additionalInfo) {
 		super(message);
 		this.statusCode = statusCode;
@@ -326,47 +205,6 @@ var UnprocessableEntityError = class extends HTTPError {
 		this.name = "UnprocessableEntityError";
 	}
 };
-var BadRequestError = class extends HTTPError {
-	additionalInfo;
-	constructor(message, additionalInfo) {
-		super(400, message, additionalInfo);
-		this.additionalInfo = additionalInfo;
-		this.name = "BadRequestError";
-	}
-};
-var UnauthorizedError = class extends HTTPError {
-	additionalInfo;
-	constructor(message, additionalInfo) {
-		super(401, message, additionalInfo);
-		this.additionalInfo = additionalInfo;
-		this.name = "UnauthorizedError";
-	}
-};
-var ForbiddenError = class extends HTTPError {
-	additionalInfo;
-	constructor(message, additionalInfo) {
-		super(403, message, additionalInfo);
-		this.additionalInfo = additionalInfo;
-		this.name = "ForbiddenError";
-	}
-};
-var TooManyRequestsError = class extends HTTPError {
-	additionalInfo;
-	constructor(message, additionalInfo) {
-		super(429, message, additionalInfo);
-		this.additionalInfo = additionalInfo;
-		this.name = "TooManyRequestsError";
-	}
-};
-var CorruptedFileError = class extends HTTPError {
-	additionalInfo;
-	constructor(fileName, fileType, corruptionDetails, additionalInfo) {
-		const message = `File '${fileName}' (${fileType}) appears to be corrupted${corruptionDetails ? `: ${corruptionDetails}` : ""}. Please try uploading the file again.`;
-		super(422, message, additionalInfo);
-		this.additionalInfo = additionalInfo;
-		this.name = "CorruptedFileError";
-	}
-};
 function isZodError(err) {
 	return Boolean(err && (err instanceof ZodError || err.name === "ZodError"));
 }
@@ -759,19 +597,7 @@ z$1.object({
 	content: z$1.string(),
 	metadata: ArtifactMetadataSchema.optional()
 });
-/**
-* Regex sub-pattern (as a string) that matches the attribute portion of an
-* `<artifact ...>` opening tag. It handles:
-*  - newlines inside the attribute list (AI sometimes wraps long tags),
-*  - `>` characters inside double- or single-quoted attribute values.
-*
-* Exported as a string (not a compiled RegExp) so each consumer can
-* compose it into their own regex with the flags they need, avoiding
-* shared mutable `lastIndex` state.
-*
-* Usage: `new RegExp('<artifact\\s+(' + ARTIFACT_ATTRS_PATTERN + ')>...')`
-*/
-const ARTIFACT_ATTRS_PATTERN = String.raw`(?:[^>"']|"[^"]*"|'[^']*')*`;
+String.raw`(?:[^>"']|"[^"]*"|'[^']*')*`;
 const ClaudeArtifactMimeTypes = {
 	REACT: "application/vnd.ant.react",
 	HTML: "text/html",
@@ -785,45 +611,6 @@ const ClaudeArtifactMimeTypes = {
 	PYTHON: "application/vnd.ant.python",
 	BLOG_DRAFT: "application/vnd.b4m.blog-draft"
 };
-/**
-* Map a MIME type (or AI-provider artifact-type string) to an internal {@link ArtifactType}.
-*
-* Single source of truth - consumed by the artifact parsers (b4m-core/utils + client) and the
-* tool_result dedup in ChatCompletionProcess. Exact blessed-type matches first (case-insensitive,
-* since MIME types are), then language/format inference; returns null if unrecognized.
-*
-* This previously lived as three hand-maintained copies that drifted - e.g. the lattice
-* tool emits `application/vnd.b4m.lattice` but a copy matched `application/vnd.ant.lattice`,
-* letting lattice tool_result artifacts dodge the dedup set.
-*/
-function mapMimeTypeToArtifactType(mimeType) {
-	if (!mimeType) return null;
-	const normalized = mimeType.toLowerCase().trim();
-	switch (normalized) {
-		case ClaudeArtifactMimeTypes.REACT.toLowerCase(): return "react";
-		case ClaudeArtifactMimeTypes.HTML.toLowerCase(): return "html";
-		case ClaudeArtifactMimeTypes.SVG.toLowerCase(): return "svg";
-		case ClaudeArtifactMimeTypes.MERMAID.toLowerCase(): return "mermaid";
-		case ClaudeArtifactMimeTypes.RECHARTS.toLowerCase(): return "recharts";
-		case ClaudeArtifactMimeTypes.CHESS.toLowerCase(): return "chess";
-		case ClaudeArtifactMimeTypes.CODE.toLowerCase(): return "code";
-		case ClaudeArtifactMimeTypes.MARKDOWN.toLowerCase(): return "code";
-		case ClaudeArtifactMimeTypes.LATTICE.toLowerCase(): return "lattice";
-		case ClaudeArtifactMimeTypes.PYTHON.toLowerCase(): return "python";
-		case ClaudeArtifactMimeTypes.BLOG_DRAFT.toLowerCase(): return "blog-draft";
-	}
-	if (normalized.includes("jsx") || normalized.includes("react")) return "react";
-	if (normalized.includes("javascript") || normalized.includes("typescript")) return "code";
-	if (normalized.includes("python") || normalized === "text/x-python") return "python";
-	if (normalized.includes("java") || normalized.includes("c++") || normalized.includes("rust") || normalized.includes("go") || normalized.includes("ruby") || normalized.includes("php") || normalized.includes("swift") || normalized.includes("kotlin") || normalized.includes("csharp") || normalized.includes("c#")) return "code";
-	if (normalized.includes("html") || normalized.includes("xhtml")) return "html";
-	if (normalized.includes("svg")) return "svg";
-	if (normalized.includes("markdown") || normalized.includes("md")) return "code";
-	if (normalized.includes("mermaid")) return "mermaid";
-	if (normalized.includes("recharts") || normalized.includes("chart")) return "recharts";
-	if (normalized.includes("chess")) return "chess";
-	return null;
-}
 let KnowledgeType = /* @__PURE__ */ function(KnowledgeType) {
 	/**
 	* A knowledge that is from a URL.
@@ -858,6 +645,19 @@ let KnowledgeType = /* @__PURE__ */ function(KnowledgeType) {
 * fails the build.
 */
 const QUEST_ERROR_CODES = ["insufficient_credits", "spend_cap_exceeded"];
+/**
+* Single source of truth for `IChatHistoryItem.type` / quest `type`. Restated by hand in
+* `schemas/actions.ts`, `schemas/chat.ts`, and `notebookExportService/types.ts` before this
+* const existed, which is exactly how `voice_transcript` went missing from the export contract
+* once already - derive from this tuple instead of retyping the union.
+*/
+const CHAT_HISTORY_ITEM_TYPES = [
+	"message",
+	"oob",
+	"error",
+	"system",
+	"voice_transcript"
+];
 z$1.union([
 	z$1.literal("string"),
 	z$1.literal("number"),
@@ -982,6 +782,12 @@ const IMAGE_SIZE_CONSTRAINTS = {
 			"2160x3840"
 		],
 		defaultSize: "1024x1024",
+		/**
+		* Accepted by the API, and what generate sends when no size is asked for, but it is not a
+		* resolution - so it is deliberately out of `sizes`, the preset list the size picker renders.
+		* The one spelling: schemas/openai.ts and utils/imageSizes.ts both read it from here.
+		*/
+		autoSize: "auto",
 		/** Constraints for custom/flexible sizes */
 		constraints: {
 			maxEdge: 3840,
@@ -990,6 +796,28 @@ const IMAGE_SIZE_CONSTRAINTS = {
 			edgeMultiple: 16,
 			maxAspectRatio: 3
 		}
+	},
+	/** Also the only sizes the variation endpoint accepts - variations are dall-e-2 only. */
+	DALL_E_2: {
+		sizes: [
+			"256x256",
+			"512x512",
+			"1024x1024"
+		],
+		defaultSize: "1024x1024"
+	},
+	/**
+	* dall-e-3 is no longer in ImageModels, but the generate path still accepts its sizes
+	* for callers holding a persisted one. Reached by LEGACY_DALL_E_3_MODEL_ID rather than an
+	* enum member; isSupportedImageSize measures each dall-e tier against its own list.
+	*/
+	DALL_E_3: {
+		sizes: [
+			"1024x1024",
+			"1792x1024",
+			"1024x1792"
+		],
+		defaultSize: "1024x1024"
 	}
 };
 /**
@@ -1071,6 +899,7 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 	ChatModels["CLAUDE_4_8_OPUS"] = "claude-opus-4-8";
 	ChatModels["CLAUDE_FABLE_5"] = "claude-fable-5";
 	ChatModels["CLAUDE_5_OPUS"] = "claude-opus-5";
+	ChatModels["CLAUDE_5_5_OPUS"] = "claude-opus-5-5";
 	ChatModels["JURASSIC2_ULTRA"] = "ai21.j2-ultra-v1";
 	ChatModels["JURASSIC2_MID"] = "ai21.j2-mid-v1";
 	ChatModels["GEMINI_3_5_FLASH"] = "gemini-3.5-flash";
@@ -1112,12 +941,6 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 const CHAT_MODELS = Object.values(ChatModels);
 const supportedChatModels = z$1.enum(ChatModels);
 /**
-* Every `ChatModels` Gemini entry is named `gemini...` (see the GEMINI block above) - a prefix
-* check tracks that naming convention automatically as new Gemini models are added, unlike an
-* explicit id list that would need updating in lockstep and could silently miss one.
-*/
-const isGeminiModelId = (model) => model.startsWith("gemini");
-/**
 * Models that support the reasoning_effort parameter.
 * o1-preview and o1-mini do NOT support reasoning_effort.
 */
@@ -1138,137 +961,7 @@ const REASONING_SUPPORTED_MODELS = /* @__PURE__ */ new Set([
 	"gpt-5.6-luna",
 	"gpt-5.6-terra"
 ]);
-/**
-* GPT-5-family reasoning models whose tool calling breaks on
-* `/v1/chat/completions` when `reasoning_effort` is also sent. OpenAI requires
-* this combination to go through `/v1/responses` instead. The failure mode
-* differs by model:
-*   - GPT-5.4 (and -mini/-nano) hard-reject with a 400:
-*       "Function tools with reasoning_effort are not supported for <model> in
-*        /v1/chat/completions. Please use /v1/responses instead."
-*   - GPT-5 / -mini / -nano / 5.1 / 5.2 return 200 but silently degrade: the
-*     model *narrates* the tool call in its text ("Calling the tool now...")
-*     instead of emitting a real `tool_calls` entry, so no tool ever executes.
-*     This surfaced as the /opti optimizer's "Draft with AI" doing nothing on
-*     GPT-5: the same request on a model with `reasoning_effort`
-*     dropped (or on Claude) fires the tool correctly.
-*
-* We drop `reasoning_effort` when tools are sent for these models so tool
-* calling continues to work on `/v1/chat/completions`. Dropping it only forgoes
-* explicit effort control - the model still reasons at its default.
-*
-* NOTE: for the base GPT-5 narrator family (`RESPONSES_API_TOOL_MODELS`), the
-* adapter now routes tool turns to `/v1/responses` instead - where reasoning +
-* tools work together, so `reasoning_effort` is kept. This drop remains as
-* defense-in-depth for the (now-unreached) chat path and covers the GPT-5.4
-* family, which is NOT routed to Responses (its drop-path already works).
-*
-* O-series reasoning models (o1/o3/o4) are intentionally excluded: they call
-* tools correctly with `reasoning_effort` on `/v1/chat/completions`.
-*
-* Invariant: every member here MUST also be in `REASONING_SUPPORTED_MODELS`.
-* The gate in `openaiBackend.ts` short-circuits when a model doesn't support
-* reasoning at all, so adding a non-reasoning model here would make the gate
-* a no-op and silently leak `reasoning_effort` to the request.
-*/
-const REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS = /* @__PURE__ */ new Set([
-	"gpt-5",
-	"gpt-5-mini",
-	"gpt-5-nano",
-	"gpt-5.1",
-	"gpt-5.2",
-	"gpt-5.4",
-	"gpt-5.4-mini",
-	"gpt-5.4-nano",
-	"gpt-5.6-sol",
-	"gpt-5.6-luna",
-	"gpt-5.6-terra"
-]);
-/**
-* GPT-5 reasoning models that silently *narrate* tool calls on
-* `/v1/chat/completions` (return 200 with the call written as text instead of a
-* real `tool_calls` entry, so nothing executes). The adapter
-* routes these to OpenAI's `/v1/responses` API when function tools are present,
-* where reasoning + tools work together and `reasoning_effort` can be kept.
-*
-* Deliberately excludes the GPT-5.4 family: it *hard-errors* (400) on that
-* combination and is already handled by dropping `reasoning_effort` on the chat
-* path (see `REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS`), so it stays on
-* the working chat path to keep this routing's blast radius small. Also excludes
-* `*-chat-latest` (non-reasoning) and O-series (tools work there already).
-*
-* Invariant: every member MUST also be in `REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS`
-* so the chat path still drops `reasoning_effort` as a fallback if routing is bypassed.
-*/
-const RESPONSES_API_TOOL_MODELS = /* @__PURE__ */ new Set([
-	"gpt-5",
-	"gpt-5-mini",
-	"gpt-5-nano",
-	"gpt-5.1",
-	"gpt-5.2",
-	"gpt-5.6-sol",
-	"gpt-5.6-luna",
-	"gpt-5.6-terra"
-]);
-/**
-* Models that only support temperature=1 (no custom temperature).
-* Includes:
-*  - All reasoning models (OpenAI requires temp=1 when reasoning is active)
-*  - chat-latest variants that enforce this constraint
-*  - GPT-5.5, which rejects custom temperature even though it does not expose
-*    reasoning controls
-*/
-const FIXED_TEMPERATURE_MODELS = /* @__PURE__ */ new Set([
-	...Array.from(REASONING_SUPPORTED_MODELS),
-	"gpt-5.1-chat-latest",
-	"gpt-5.2-chat-latest",
-	"gpt-5.5"
-]);
-/**
-* Models that do not accept the temperature parameter at all.
-* The API will reject requests that include temperature for these models.
-*/
-const NO_TEMPERATURE_MODELS = /* @__PURE__ */ new Set([
-	"claude-opus-4-7",
-	"global.anthropic.claude-opus-4-7",
-	"claude-opus-4-8",
-	"global.anthropic.claude-opus-4-8",
-	"claude-sonnet-5",
-	"global.anthropic.claude-sonnet-5",
-	"claude-fable-5",
-	"claude-opus-5",
-	"kimi-k3",
-	"kimi-k2.7-code",
-	"kimi-k2.7-code-highspeed",
-	"kimi-k2.6",
-	"kimi-k2.5",
-	"deepseek-flash",
-	"deepseek-v4-pro"
-]);
-/**
-* Models whose safety classifiers can decline a request with `stop_reason: 'refusal'`
-* (HTTP 200, empty or partial content) - Claude Fable 5's GA classifiers target research
-* biology and most cybersecurity content and occasionally false-positive on benign adjacent
-* work. Per Anthropic's GA guidance a refusal from these is opt-in recoverable: rather than
-* surfacing a hard refusal, the backend throws so the completion loop's existing fallback
-* machinery continues the request on Opus 5 (whose classifiers intervene far less often).
-* A refusal from any *other* model is a genuine decline and surfaces unchanged. Keep in
-* sync with the `claude-fable-5` fallback preference chain in `adminSettings/fallback.ts`.
-*/
-const REFUSAL_FALLBACK_MODELS = /* @__PURE__ */ new Set(["claude-fable-5"]);
-/**
-* Bedrock-hosted Claude models that do NOT support prompt caching (`cache_control`).
-* Sending `cache_control` to these models triggers a Bedrock deserialization error:
-*   `tools.N.cache_control: Extra inputs are not permitted`
-*
-* AWS Bedrock added prompt caching for Claude 3.5 Haiku and Claude 3.7 Sonnet (and later);
-* the OG Claude 3 Haiku and the v1 Claude 3.5 Sonnet were not retrofitted.
-*
-* Keep this set narrow - default behavior is to apply caching when `cacheStrategy.enableCaching`
-* is true. Add a model here only when we have concrete evidence (a Bedrock validation error)
-* that it rejects `cache_control`.
-*/
-const BEDROCK_NO_PROMPT_CACHING_MODELS = /* @__PURE__ */ new Set(["anthropic.claude-3-haiku-20240307-v1:0", "anthropic.claude-3-5-sonnet-20240620-v1:0"]);
+[...Array.from(REASONING_SUPPORTED_MODELS)];
 /**
 * Speech to Text Models
 *
@@ -1314,13 +1007,6 @@ z$1.enum({
 	...SpeechToTextModels,
 	...VideoModels
 });
-/** Returns true if the model is deprecated on or before the provided date (default: now). */
-const isModelDeprecated = (model, now = /* @__PURE__ */ new Date()) => {
-	if (!model.deprecationDate) return false;
-	const todayYMD = new Date(now.toISOString().slice(0, 10));
-	const cutoff = /* @__PURE__ */ new Date(model.deprecationDate + "T00:00:00Z");
-	return todayYMD.getTime() >= cutoff.getTime();
-};
 /**
 * Valid status values for sub-quests.
 * Canonical vocabulary - the mongoose schema, zod schemas, and client all
@@ -1516,7 +1202,14 @@ const RealtimeVoiceUsageTransaction = BaseCreditTransaction.extend({
 });
 const ToolUsageTransaction = BaseCreditTransaction.extend({
 	type: z$1.literal("tool_usage"),
-	model: z$1.string(),
+	/**
+	* The model that actually incurred the tool cost (e.g. 'gpt-image-2'), NOT the chat
+	* model of the quest that ran the tool. The row is one aggregate over every charging
+	* tool call in the quest, so this is set only when exactly one model charged; a quest
+	* that charged on two or more models leaves it unset rather than naming one of them.
+	* Per-call attribution always lives on the `feature: 'tool'` UsageEventModel rows.
+	*/
+	model: z$1.string().optional(),
 	questId: z$1.string(),
 	sessionId: z$1.string()
 });
@@ -1602,8 +1295,8 @@ z$1.object({
 	ownerType: z$1.enum(CreditHolderType),
 	sessionId: z$1.string().optional(),
 	/**
-	* Data lake this call is 1:1 attributable to (ingestion embeds only - a query
-	* embedding can span multiple lakes and is never attributed here). Unset for
+	* Data lake this call is 1:1 attributable to (ingestion embeds and research-run judge calls -
+	* a query embedding can span multiple lakes and is never attributed here). Unset for
 	* every other feature/call.
 	*/
 	dataLakeId: z$1.string().optional(),
@@ -1650,7 +1343,8 @@ z$1.object({
 		"ok",
 		"error",
 		"timeout",
-		"refusal"
+		"refusal",
+		"degenerate"
 	]).default("ok"),
 	latencyMs: z$1.number().optional(),
 	/** Originating surface (web/cli/api/agent/system); unset => unclassified. */
@@ -1757,7 +1451,6 @@ const FIELD_GROUPS = [
 	"dispatch",
 	"availability"
 ];
-const isFieldGroup = (value) => FIELD_GROUPS.includes(value);
 /** YYYY-MM-DD, the format every date-ish ModelInfo field already uses. */
 const CALENDAR_DATE = z$1.string().regex(/^\d{4}-\d{2}-\d{2}$/, "expected a YYYY-MM-DD calendar date");
 const ReasoningWrite = z$1.strictObject({
@@ -1975,6 +1668,7 @@ const MODEL_INFO_FIELD_GROUP_OF = {
 	backend: "identity",
 	contextWindow: "limits",
 	max_tokens: "limits",
+	maxOutputTokensDerived: "limits",
 	can_think: "reasoning",
 	thinkingStyle: "reasoning",
 	can_stream: "modalities",
@@ -2247,6 +1941,16 @@ const DiscoveryPriceSkip = z$1.object({
 	modelId: z$1.string().min(1),
 	reason: z$1.string()
 });
+/**
+* A configured source the run never attempted, and why. Produced by
+* `skipReasonFor` in runModelDiscovery (services/modelDiscoveryService); the
+* reason stays a plain string rather than that module's SourceSkipReason union
+* so a new reason needs no schema or UI change.
+*/
+const DiscoverySkippedSource = z$1.object({
+	name: z$1.string().min(1),
+	reason: z$1.string()
+});
 const DiscoveryLifecycleTransition = z$1.object({
 	modelId: z$1.string().min(1),
 	/** Absent when no row in force carried a lifecycle for this model. */
@@ -2303,6 +2007,8 @@ z$1.object({
 	*/
 	mode: z$1.enum(DISCOVERY_RUN_MODES).optional(),
 	sources: z$1.array(DiscoverySourceReport).optional(),
+	/** Configured sources this run never attempted; disjoint from `sources`. */
+	skippedSources: z$1.array(DiscoverySkippedSource).optional(),
 	joinCoverage: z$1.array(DiscoveryJoinCoverage).optional(),
 	/** Ids no aggregator matched: a work item, not a log line. */
 	unmatchedIds: z$1.array(z$1.string()).optional(),
@@ -2419,6 +2125,59 @@ let McpServerName = /* @__PURE__ */ function(McpServerName) {
 	McpServerName["Notion"] = "notion";
 	return McpServerName;
 }({});
+const ROLLUP_DAY_MS = 864e5;
+/**
+* Reads a rollup bound as a UTC instant. The schema below accepts an offset-less value (what a
+* date picker emits), and a bare `new Date` would read that in the host's local zone - so the
+* same query would cover a different window depending on where it ran.
+*/
+function parseFeedbackRollupBound(value) {
+	return new Date(/([Zz]|[+-]\d{2}:?\d{2})$/.test(value) ? value : `${value}Z`);
+}
+z$1.object({
+	from: z$1.iso.datetime({
+		offset: true,
+		local: true
+	}),
+	to: z$1.iso.datetime({
+		offset: true,
+		local: true
+	})
+}).refine((query) => parseFeedbackRollupBound(query.from) < parseFeedbackRollupBound(query.to), {
+	message: "from must be strictly before to",
+	path: ["from"]
+}).refine((query) => parseFeedbackRollupBound(query.to).getTime() - parseFeedbackRollupBound(query.from).getTime() < 366 * ROLLUP_DAY_MS, {
+	message: `window must not exceed 366 days`,
+	path: ["to"]
+});
+const feedbackCountBucketSchema = z$1.object({
+	key: z$1.string(),
+	count: z$1.number()
+});
+const orgFeedbackSummaryCountsSchema = z$1.object({
+	totals: z$1.object({ count: z$1.number() }),
+	byDay: z$1.array(z$1.object({
+		day: z$1.string(),
+		count: z$1.number()
+	})),
+	bySubject: z$1.array(feedbackCountBucketSchema),
+	byType: z$1.array(feedbackCountBucketSchema),
+	byStatus: z$1.array(feedbackCountBucketSchema),
+	byTag: z$1.array(feedbackCountBucketSchema),
+	byTagTruncated: z$1.boolean().optional()
+});
+z$1.object({
+	summaryJobId: z$1.string(),
+	organizationId: z$1.string(),
+	range: z$1.object({
+		from: z$1.string(),
+		to: z$1.string()
+	}),
+	generatedAt: z$1.string(),
+	model: z$1.string(),
+	summary: z$1.string(),
+	counts: orgFeedbackSummaryCountsSchema
+});
 /**
 * Check if a value is a placeholder (not configured or SST default).
 * Uses case-insensitive comparison and trims whitespace to prevent bypass attempts.
@@ -2467,10 +2226,16 @@ function isPlaceholderApiKey(value) {
 /**
 * Lake lifecycle. Stable states (draft/active/archived/deleted) plus transitional
 * states (archiving/unarchiving/restoring/deleting/purging) that exist to drive UI and make a crashed
-* mid-operation observable. draft -> active is one-way. It happens implicitly once the lake
-* holds its first member file (see `activateIfDraft` below), and unconditionally when an
-* archived or deleted lake is restored, which is how an empty lake can end up active.
+* mid-operation observable.
 *
+* draft <-> active is a DELIBERATE, two-way move: `promoteDataLake` publishes a draft (the only
+* door onto `activateIfDraft` below) and `demoteDataLake` reverses it. Neither fires as a side
+* effect of adding content - a draft lake that fills up with files stays a draft, excluded from
+* grounding, until an owner or admin explicitly promotes it. Restoring an archived or
+* deleted lake still lands unconditionally on `active`, which is how an empty lake can end up
+* active without ever passing through an explicit promote.
+*
+
 * `purging` is the one transitional state that is NOT recoverable by retrying the same action:
 * it is claimed the moment a phase-2 hard delete is ACCEPTED (#1744), before the background
 * sweep runs, so that `listDeletedDataLakes` stops offering Restore on a lake whose
@@ -2500,6 +2265,7 @@ const DATA_LAKE_STABLE_STATUSES = [
 	"deleted"
 ];
 DATA_LAKE_STATUSES.filter((s) => !DATA_LAKE_STABLE_STATUSES.includes(s));
+const DATA_LAKE_ORIGINS = ["curated", "connector-fed"];
 z$1.object({
 	/**
 	* The granting lake's Mongo `_id`. ALWAYS a persisted DB lake: a hardcoded/fallback lake has no
@@ -2547,6 +2313,14 @@ z$1.object({
 	removedAt: z$1.date(),
 	expiresAt: z$1.date()
 });
+/** Mirrors the read model's vocabulary deliberately (aliased, not re-declared, so the two can
+* never drift) - an audit reader learns one principal shape for both halves of the trail. */
+const LAKE_CONFIG_CHANGE_PRINCIPAL_KINDS = [
+	"user",
+	"agent",
+	"apiKey",
+	"system"
+];
 /**
 * Every `IDataLake` field, classified as audited or not. A TOTAL map keyed by `keyof IDataLake`,
 * exactly like `LAKE_FIELD_VISIBILITY` in redactLakeForActor.ts and for the same reason: a list of
@@ -2575,6 +2349,7 @@ const LAKE_CONFIG_FIELD_AUDIT = {
 	auditQueryTextEnabled: "audited",
 	lakeMemoryEnabled: "audited",
 	status: "audited",
+	origin: "audited",
 	createdByUserId: "audited",
 	lastUpdatedByUserId: "excluded",
 	fileCount: "excluded",
@@ -2582,15 +2357,59 @@ const LAKE_CONFIG_FIELD_AUDIT = {
 	totalChunkedChars: "excluded",
 	embeddingSpendMicroUsd: "excluded",
 	lastSyncAt: "excluded",
+	lastHealthCheckedAt: "excluded",
+	lastInconsistencyScanAt: "excluded",
 	filesDeletedAt: "excluded",
 	filesArchivedAt: "excluded",
 	lakeMemoryExtractionAt: "excluded",
 	lakeMemoryCursor: "excluded",
 	lakeMemoryPurgedAt: "excluded",
 	inconsistencyReport: "excluded",
-	inconsistencyComputedAt: "excluded"
+	inconsistencyComputedAt: "excluded",
+	modelInconsistencyRunAt: "excluded"
 };
 [...Object.keys(LAKE_CONFIG_FIELD_AUDIT).filter((field) => LAKE_CONFIG_FIELD_AUDIT[field] === "audited")];
+z$1.object({
+	dataLakeId: z$1.string(),
+	/** Denormalized from the lake at offer time: a recipient route can filter by it without a join. */
+	organizationId: z$1.string().nullish(),
+	/** The actor who made the offer - always the eventual `grantedByUserId` of an accepted transfer. */
+	offeredByUserId: z$1.string(),
+	recipientUserId: z$1.string(),
+	status: z$1.enum([
+		"pending",
+		"accepted",
+		"declined",
+		"cancelled",
+		"expired"
+	]),
+	expiresAt: z$1.date(),
+	/** Set by the atomic `resolve` when the offer leaves `pending`; null while it is still open. */
+	resolvedAt: z$1.date().nullish(),
+	/**
+	* The lake's effective owner ids AT OFFER TIME. Accept re-resolves them and refuses if they moved,
+	* so an offer can never apply a transfer over another transfer (or a departure succession) that
+	* happened in between. Snapshotted rather than recomputed because "stale" is exactly the case
+	* where today's answer differs from the one the offer was made under.
+	*/
+	priorOwnerUserIds: z$1.array(z$1.string()),
+	offeredVia: z$1.enum([
+		"grant-owner",
+		"creator",
+		"platform-admin",
+		"org-admin"
+	]),
+	/**
+	* The principal to attribute the applied transfer to, resolved by the route at OFFER time (only a
+	* route can tell an API key from a session). Carried so the eventual audit row keeps naming the
+	* same principal the offer was made under, rather than whichever principal happens to accept.
+	*/
+	auditPrincipal: z$1.object({
+		principalKind: z$1.enum(LAKE_CONFIG_CHANGE_PRINCIPAL_KINDS),
+		principalId: z$1.string(),
+		onBehalfOfUserId: z$1.string().optional()
+	}).optional()
+});
 /**
 * SRE Agent Trio - Shared Types
 *
@@ -2942,32 +2761,7 @@ let SupportedFabFileMimeTypes = /* @__PURE__ */ function(SupportedFabFileMimeTyp
 	SupportedFabFileMimeTypes["CONF"] = "text/plain";
 	return SupportedFabFileMimeTypes;
 }({});
-/**
-* The canonical set of MIME types the ingest pipeline can actually chunk +
-* vectorize. Kept in lockstep with the `SmartChunker` switch in
-* `@bike4mind/fab-pipeline`.
-*/
-const SUPPORTED_FAB_FILE_MIME_TYPES = new Set(Object.values(SupportedFabFileMimeTypes));
-/**
-* Type guard: is a claimed MIME type one we actually support ingesting?
-*
-* Used to gate uploads so unsupported/binary files (e.g. `.exe`) are rejected
-* with a clear error instead of being stored and silently "vectorized" into 0
-* chunks. Node-free so it can run on both the client (upload UI) and server
-* (ingest endpoints).
-*/
-function isSupportedFabFileMimeType(mimeType) {
-	return !!mimeType && SUPPORTED_FAB_FILE_MIME_TYPES.has(mimeType);
-}
-/**
-* Is this an audio MIME type? Matches any `audio/*` (not just the known set)
-* so the LLM-exclusion and vectorization-skip guards fail safe for any audio
-* subtype a provider might emit.
-*/
-function isAudioMimeType(mimeType) {
-	if (!mimeType) return false;
-	return mimeType.split(";")[0].trim().toLowerCase().startsWith("audio/");
-}
+new Set(Object.values(SupportedFabFileMimeTypes));
 /** Reads back the classifier set by the tagged-error helpers above; `undefined` for untagged errors. */
 function getQuestErrorCode(error) {
 	const code = error?.additionalInfo?.errorCode;
@@ -3046,231 +2840,23 @@ const AGENT_QUEST_MANIFEST = {
 	}
 };
 /**
-* The catalog row in force for a model and unit at a given time: newest
-* effectiveFrom <= at AMONG ROWS OF THAT UNIT. Units are independent price
-* streams - a newer per_minute row must never shadow the in-force per_token
-* row (that would silently revert token billing to the adapter literal).
-* Rows are append-only, so this is the whole time-travel story (see
-* ModelPriceTypes).
-*/
-function resolveModelPriceRow(rows, modelId, unit, at) {
-	let inForce;
-	for (const row of rows) {
-		if (row.modelId !== modelId || row.unit !== unit) continue;
-		if (row.effectiveFrom.getTime() > at.getTime()) continue;
-		if (!inForce || row.effectiveFrom.getTime() > inForce.effectiveFrom.getTime()) inForce = row;
-	}
-	return inForce;
-}
-/**
-* Overlay catalog prices onto assembled ModelInfo. Only per_token rows apply
-* here (they feed getTextModelCost via ModelInfo.pricing); per_minute and
-* per_image rows are consumed by their own settlement paths. A model with no
-* per_token row in force keeps its adapter literal - the fallback that keeps
-* zero-config self-host deployments working.
-*/
-function applyModelPriceCatalog(models, rows, at = /* @__PURE__ */ new Date()) {
-	if (rows.length === 0) return models;
-	return models.map((model) => {
-		if (model.type !== "text") return model;
-		const row = resolveModelPriceRow(rows, model.id, "per_token", at);
-		if (!row) return model;
-		const pricing = {};
-		for (const [threshold, tier] of Object.entries(row.pricing)) pricing[Number(threshold)] = tier;
-		return {
-			...model,
-			pricing
-		};
-	});
-}
-/**
 * Input headroom the chat path holds back on top of a request's reserved output.
 * safeInputWindow (ChatCompletionProcess) subtracts it, so a text entry whose output
 * reserve leaves less than this has no room for a prompt at all.
 */
 const CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS = 1e3;
 /**
-* Fallback context window for a media row whose catalog value is not usable (a discovery feed's
-* literal 0, meaning "not applicable" rather than a real budget - see isMediaModelType). Shared by
-* effectiveContextWindow (@bike4mind/utils, server) and useTokenLimits (apps/client, browser) so
-* the two do not drift onto different placeholder numbers for the same "unknown" case.
-*/
-const DEFAULT_UNKNOWN_CONTEXT_WINDOW = 2e5;
-/**
-* The model types this build's ModelInfo consumers narrow on. ModelRecord.type is
-* wider (embedding / tts / realtime-voice), so the read path drops and counts any
-* record outside this set: an old build must degrade to "I do not see the new video
-* models", never to a runtime narrowing failure.
+* The modalities promptMeta.model.type is allowed to record. Deliberately NARROWER than
+* MODEL_INFO_TYPES: 'speech-to-text' is served by its own transcription route, never by a
+* completion, so recording it would put a value in the field that no reader narrows on.
+* PromptMetaModelSchema.type (schemas/promptMeta) builds its z.enum from this const, and
+* QuestModelType (apps/client admin reporting) is an alias of the type - one source, three uses.
 */
-const MODEL_INFO_TYPES = [
+const PROMPT_META_MODEL_TYPES = [
 	"text",
 	"image",
-	"speech-to-text",
 	"video"
 ];
-const isRenderableModelType = (type) => MODEL_INFO_TYPES.includes(type);
-/**
-* Whether a ModelInfo type returns media (image/video) rather than tokens. Shared by
-* safeInputWindow/effectiveContextWindow (@bike4mind/utils, server) and useTokenLimits
-* (apps/client, browser) so "what counts as media" cannot drift between the two halves of the
-* same guard - both need it, and common is the one package already safe to import from either.
-*/
-const isMediaModelType = (type) => type === "image" || type === "video";
-/**
-* The record -> ModelInfo adapter: one place where every ModelInfo field a
-* catalog record does not carry gets its default. Each default degrades to the
-* visible, recoverable behavior rather than the silent or expensive one.
-*
-* Pricing is never sourced here: applyModelPriceCatalog overlays the ModelPrice
-* rows afterwards, and an empty map trips the [UNPRICED_MODEL] alarm on first
-* billed use, which is the intended fail-loud path.
-*/
-function toModelInfo(record) {
-	const retired = record.lifecycle?.status === "retired";
-	const disabled = record.disabled === true || record.autoDisabled === true || retired;
-	return {
-		id: record.id,
-		type: record.type,
-		name: record.name,
-		backend: record.backend,
-		contextWindow: record.contextWindow,
-		max_tokens: record.maxOutputTokens ?? Math.min(record.contextWindow, 4096),
-		pricing: {},
-		can_stream: record.canStream,
-		can_think: record.reasoning?.supported ?? false,
-		thinkingStyle: toThinkingStyle(record),
-		adapterFamily: record.adapterFamily,
-		dispatchProfile: record.dispatchProfile,
-		supportsVision: record.supportsVision,
-		supportsTools: record.supportsTools,
-		supportsImageVariation: record.supportsImageVariation ?? false,
-		supportsSafetyTolerance: record.supportsSafetyTolerance,
-		freeToRun: record.freeToRun,
-		private: record.private ?? false,
-		disabled,
-		disabledReason: record.disabledReason ?? record.autoDisabledReason ?? (retired ? "retired by the provider" : void 0),
-		deprecationDate: record.lifecycle?.deprecationDate,
-		replacedBy: record.lifecycle?.replacedBy,
-		trainingCutoff: record.trainingCutoff,
-		releaseDate: record.releaseDate,
-		logoFile: record.logoFile,
-		rank: record.rank,
-		description: record.description,
-		isSlowModel: record.isSlowModel
-	};
-}
-/**
-* ModelInfo.thinkingStyle only describes the two Anthropic request shapes. Other
-* reasoning styles map to undefined rather than to a wrong shape; the backends
-* treat unset as their own default.
-*/
-function toThinkingStyle(record) {
-	switch (record.reasoning?.style) {
-		case "anthropic-adaptive": return "adaptive";
-		case "anthropic-legacy": return "legacy";
-		default: return;
-	}
-}
-function fromThinkingStyle(style) {
-	if (style === "adaptive") return "anthropic-adaptive";
-	if (style === "legacy") return "anthropic-legacy";
-}
-/** Who makes the model, when the id namespace says so: [region.]<vendor>.<model>. */
-const BEDROCK_REGION_PREFIX = /^(us|eu|apac|global)\./;
-const VENDOR_BY_BACKEND = {
-	["openai"]: "openai",
-	["anthropic"]: "anthropic",
-	["gemini"]: "google",
-	["xai"]: "xai",
-	["kimi"]: "moonshotai",
-	["deepseek"]: "deepseek",
-	["bfl"]: "black-forest-labs",
-	["aws"]: "amazon",
-	["voyageai"]: "voyageai",
-	["ollama"]: "ollama",
-	["local-image"]: "local",
-	["bedrock"]: "amazon"
-};
-/**
-* ModelInfo carries no vendor (that is one of the four disagreeing taxonomies
-* this catalog replaces), so the inverse adapter derives it: the backend answers
-* it for direct providers, and for Bedrock the id namespace does.
-*/
-/**
-* Bedrock id prefixes that name the same maker as a different string. AWS spells
-* Kimi K2.5 `moonshotai.` and K2 Thinking `moonshot.`, so the raw prefix would
-* file one vendor's two models under two vendors and split them in the admin
-* dashboard. Canonicalized to the spelling the direct backend and the models.dev
-* provider both use.
-*/
-const BEDROCK_VENDOR_ALIASES = { moonshot: "moonshotai" };
-function inferVendor(info) {
-	if (info.backend === "bedrock") {
-		const withoutRegion = String(info.id).replace(BEDROCK_REGION_PREFIX, "");
-		const dot = withoutRegion.indexOf(".");
-		if (dot > 0) {
-			const prefix = withoutRegion.slice(0, dot);
-			return BEDROCK_VENDOR_ALIASES[prefix] ?? prefix;
-		}
-	}
-	return VENDOR_BY_BACKEND[info.backend] ?? String(info.backend);
-}
-/**
-* ModelInfo -> ModelRecord, the inverse of toModelInfo. Two callers: the
-* fallback seed generator (adapter literals become seed rows) and the merge's
-* base tier (a seeded model becomes a record that a catalog row can then claim
-* groups of).
-*
-* `pricing` has no ModelInfo spelling here and is deliberately absent rather
-* than guessed: catalog rows never carry it. The dispatch group round-trips
-* (ModelInfo carries it since dispatch consumes it), but no feed may author it -
-* a wrong value there mis-routes a request, so it stays seed- or
-* operator-sourced, or comes from the seed-side DispatchResolver.
-*
-* Round-tripping normalizes the optional booleans toModelInfo defaults
-* (can_think, private, disabled, supportsImageVariation): undefined becomes an
-* explicit false. That is only observable for a model whose merged record a
-* catalog row actually owns a group of.
-*/
-function toModelRecord(info) {
-	return {
-		id: info.id,
-		vendor: inferVendor(info),
-		backend: info.backend,
-		type: info.type,
-		name: info.name,
-		contextWindow: info.contextWindow,
-		maxOutputTokens: info.max_tokens,
-		canStream: info.can_stream,
-		reasoning: info.can_think === void 0 && info.thinkingStyle === void 0 ? void 0 : {
-			supported: info.can_think === true,
-			style: fromThinkingStyle(info.thinkingStyle)
-		},
-		adapterFamily: info.adapterFamily,
-		dispatchProfile: info.dispatchProfile,
-		supportsVision: info.supportsVision,
-		supportsTools: info.supportsTools,
-		supportsImageVariation: info.supportsImageVariation,
-		supportsSafetyTolerance: info.supportsSafetyTolerance,
-		lifecycle: {
-			...info.deprecationDate ? {
-				status: "deprecated",
-				deprecationDate: info.deprecationDate
-			} : { status: "active" },
-			...info.replacedBy ? { replacedBy: info.replacedBy } : {}
-		},
-		description: info.description,
-		logoFile: info.logoFile,
-		rank: info.rank,
-		isSlowModel: info.isSlowModel,
-		trainingCutoff: info.trainingCutoff,
-		releaseDate: info.releaseDate,
-		private: info.private,
-		freeToRun: info.freeToRun,
-		disabled: info.disabled,
-		disabledReason: info.disabledReason
-	};
-}
 const DEFAULT_PRICE_MARGIN = 1.2;
 const DEFAULT_USD_TO_CREDITS_RATE = 6e-4;
 /**
@@ -3318,140 +2904,6 @@ const CREDITS_PER_USD_COST = (() => {
 	console.warn(`[pricing] Env-configured margin/rate derive ${derived} credits per USD cost; using defaults`);
 	return Math.round(DEFAULT_PRICE_MARGIN / DEFAULT_USD_TO_CREDITS_RATE);
 })();
-/**
-* Converts a USD cost to credits, including markup, rounding UP (minimum 1).
-*
-* Use for reservations, eligibility checks, estimates, and display - anywhere
-* a deterministic, conservative number is needed. Final settlement of variable
-* usage should use usdToCreditsStochastic so users pay the exact fraction in
-* expectation instead of the round-up.
-*
-* Examples (defaults):
-* $1 USD = 2000 credits (1.2x markup at $0.0006/credit)
-* $0.001 USD = 2 credits
-* $0.0001 USD = 1 credit (minimum)
-*
-* @param rate - Credits per $1, defaults to the platform-wide CREDITS_PER_USD_COST.
-*   Pass an override for a provider-specific admin-tunable rate (e.g. a
-*   billing-sensitive external compute path priced independently of the
-*   platform default).
-*/
-const usdToCredits = (usd, rate = CREDITS_PER_USD_COST) => {
-	return Math.max(1, Math.ceil(usd * rate));
-};
-/**
-* Uniform draw in [0, 1) from the platform CSPRNG. Billing draws MUST be
-* unpredictable: a caller who can foresee the stream could time requests to
-* land on the no-charge side of every draw. Node >= 19 and all browsers
-* expose globalThis.crypto; the Math.random fallback exists only so tests
-* and exotic runtimes do not crash, and it warns once.
-*/
-let warnedNonCryptoRng = false;
-const cryptoUniform = () => {
-	const cryptoObj = globalThis.crypto;
-	if (cryptoObj?.getRandomValues) {
-		const buf = /* @__PURE__ */ new Uint32Array(1);
-		cryptoObj.getRandomValues(buf);
-		return buf[0] / 4294967296;
-	}
-	if (!warnedNonCryptoRng) {
-		warnedNonCryptoRng = true;
-		console.warn("[pricing] globalThis.crypto unavailable; billing rounding falls back to Math.random");
-	}
-	return Math.random();
-};
-/**
-* Converts a USD cost to credits with markup using UNBIASED stochastic
-* rounding: the integer part is always charged, and the fractional part
-* charges one extra credit with probability equal to the fraction.
-* E[charge] equals the exact fractional cost at every call size - no
-* round-up overcharge, no 1-credit minimum, and no free-below-threshold
-* leak. Because draws are independent and priced at exact cost, no calling
-* pattern (splitting, retrying, aborting) changes expected cost.
-*
-* Server-side settlement only. Do NOT use for display, estimates, or
-* reservations (it is non-deterministic; use usdToCredits). Zero or
-* non-finite cost charges 0.
-*
-* @param usd - The raw provider cost in USD to convert
-* @param rng - Uniform [0,1) source, injectable for tests; defaults to CSPRNG
-* @param rate - Credits per $1, defaults to the platform-wide CREDITS_PER_USD_COST.
-*   Callers settling a provider-specific admin-tunable rate must pass the SAME
-*   rate value that was used at reservation time (snapshot it, don't re-read
-*   a live admin setting), or the settlement math mixes scales.
-*/
-const usdToCreditsStochastic = (usd, rng = cryptoUniform, rate = CREDITS_PER_USD_COST) => {
-	const raw = usd * rate;
-	if (!Number.isFinite(raw) || raw <= 0) return 0;
-	const base = Math.floor(raw);
-	const fraction = raw - base;
-	return base + (rng() < fraction ? 1 : 0);
-};
-/**
-* Output tokens the pre-flight credit hold prices when a request's max_tokens
-* ceiling exceeds it.
-*
-* max_tokens is a *ceiling*, not a prediction: adaptive reasoning models stop at
-* end_turn well short of it, so pricing the hold at the full window (128K on the
-* flagship models) reserved several thousand credits per turn regardless of answer
-* length. The excess was always refunded at settlement, but the hold IS the
-* insufficient-funds gate, so users whose balance sat between their real cost and
-* the worst case were falsely blocked.
-*
-* 16K covers the realistic long answer with headroom - the largest replies seen in
-* practice are HTML-artifact turns at roughly 10-11K output tokens (see
-* buildThinkingParams in llm-adapters/thinkingParams.ts, whose max_tokens floor was
-* sized off the same measurement).
-*
-* UNDER-RESERVATION IS ACCEPTED, NOT PREVENTED. A turn that emits more than this
-* settles as a shortfall debit at reconciliation, which is already a supported path
-* (provider-basis settlement could always exceed a hold priced on the local
-* estimate). The two sites clamp the shortfall differently: chat's
-* computeSettlementDelta (services/llm/ChatCompletionProcess.ts) floors the debit at
-* the balance snapshot taken at its OWN admission and reports the remainder as
-* writtenOffCredits; cliCompletions.ts does an unclamped $inc on success and only
-* logs an ALERT if it lands negative. Neither is a non-negativity guarantee: the
-* chat snapshot predates any sibling turn's spend (see that function's own "best
-* effort" note), and when the shortfall still fits the stale snapshot the debit
-* applies in full - writtenOffCredits 0, and no BILLING_SHORTFALL_CLAMP log - so a
-* concurrent holder can land negative there too. Either way the resulting balance
-* fails the *next* turn's own admission gate - but that bound is per turn, not per
-* holder: turns admitted concurrently are each checked against the balance at their
-* own admission and settle against a snapshot that predates their siblings' spend,
-* so a holder running turns in parallel can be shorted once per in-flight turn, not
-* once total.
-*/
-const PREFLIGHT_RESERVATION_OUTPUT_TOKENS = 16384;
-/**
-* Reservation ceiling for models that spend reasoning tokens inside their output
-* budget (see reasonsWithinOutputBudget in llm-adapters/thinkingParams.ts). Those
-* tokens bill as output on top of the visible answer, so the 16K figure above -
-* which was measured on visible artifact size alone - under-reserves them badly.
-*
-* Deliberately below ADAPTIVE_THINKING_MAX_TOKENS_FLOOR (64K), which sizes the
-* request's real ceiling and therefore has to cover the worst case: exceeding it
-* truncates a reply mid-tag, an unrecoverable failure. A hold has no such duty -
-* exceeding it settles as a shortfall debit - so it is sized for the long turn
-* (roughly 3x the largest observed visible answer, leaving the rest for the trace)
-* rather than the worst one, which is what keeps the gate off affordable requests.
-*/
-const PREFLIGHT_RESERVATION_REASONING_OUTPUT_TOKENS = 32768;
-/**
-* Output-token figure to price a pre-flight credit hold at, given the max_tokens
-* this request will actually send. Never raises the caller's ceiling: a request
-* that asks for less than the cap holds only what it can possibly spend.
-*
-* Reserving only, never gating: the per-member org credit cap is still priced on
-* the unshrunk ceiling at both call sites, since that check has no settlement
-* counterpart to correct an under-estimate. That is a strictly larger figure than
-* the hold, not a true upper bound on the turn - it prices one model round trip,
-* at the uncached input rate, on the primary model - so it still under-counts a
-* multi-round tool loop, a cache-write turn, or a fallback hop onto pricier pricing.
-*
-* @param reasonsWithinOutputBudget - reasonsWithinOutputBudget(modelInfo); passed as
-*   a boolean because common cannot import llm-adapters.
-*/
-const reservationOutputTokens = (requestedMaxTokens, reasonsWithinOutputBudget = false) => Math.min(requestedMaxTokens, reasonsWithinOutputBudget ? PREFLIGHT_RESERVATION_REASONING_OUTPUT_TOKENS : PREFLIGHT_RESERVATION_OUTPUT_TOKENS);
 z.enum([
 	"openai",
 	"test",
@@ -3511,7 +2963,22 @@ const PromptBatchQuerySchema = z$1.object({
 	personal: z$1.boolean().optional()
 });
 z$1.object({ queries: z$1.array(PromptBatchQuerySchema).min(1).max(32).refine((qs) => new Set(qs.map((q) => q.key)).size === qs.length, { message: "Batch query keys must be unique" }) });
-z$1.object({
+/**
+* Request schema for POST /api/chat - the simplified external chat surface.
+*
+* Shared between the Next.js API handler (apps/client/pages/api/chat.ts, which
+* validates req.body with this exact object) and the OpenAPI registry
+* (b4m-core/common/src/openapi), so the published contract cannot drift from
+* what the handler actually accepts. The model is optional here and resolved
+* server-side from admin settings when omitted.
+*
+* Public-API rule: no `.catch()` / top-level `.transform()`. Both silently mutate
+* caller input (fail-quiet) and are opaque to zod-to-openapi. `historyCount` uses
+* `.default()` (fail loud on a bad value); unknown tool ids are filtered in the
+* handler (see filterKnownTools) instead of by a schema transform. This keeps the
+* schema fully OpenAPI-representable with no doc projection needed.
+*/
+const SimplifiedChatRequestSchema = z$1.object({
 	sessionId: z$1.string().nullish(),
 	message: z$1.string(),
 	organizationId: z$1.string().optional(),
@@ -3535,18 +3002,28 @@ z$1.object({
 		"grounded",
 		"surface"
 	]).optional(),
-	skip_auto_offers: z$1.boolean().optional().describe("Suppress tools the server would otherwise attach on its own for this session (the knowledge-base search offer, in-app view navigation, blog drafting/editing/publishing, and skill invocation). Tools you request explicitly are unaffected. One system-prompt block goes with them: withholding in-app view navigation also drops the view-registry block that exists only to describe it. No other prompt content changes. This does not switch off retrieval: a session with forced knowledge retrieval still retrieves, and documents already attached to the session are still placed in the prompt directly. Any promptMode suppresses these too, so false has no effect alongside one."),
+	skip_auto_offers: z$1.boolean().optional().describe("Suppress tools the server would otherwise attach on its own for this session (the knowledge-base search offer, in-app view navigation, blog drafting/editing/publishing, skill invocation, and every tool from a connected MCP server). Native tools you request explicitly in `tools` are unaffected, but an MCP server tool cannot be named through this field, so with this flag set a caller with an MCP server connected sees none of its tools regardless of `tools`. One system-prompt block goes with them: withholding in-app view navigation also drops the view-registry block that exists only to describe it. No other prompt content changes. This does not switch off retrieval: a session with forced knowledge retrieval still retrieves, and documents already attached to the session are still placed in the prompt directly. Any promptMode suppresses these too, so false has no effect alongside one."),
 	includePromptDetails: z$1.boolean().optional(),
 	includeSystemPrompt: z$1.boolean().optional(),
 	systemPrompt: z$1.string().max(PROMPT_TEXT_MAX).optional().describe("System-prompt text for this request only, never persisted. Rendered as a defended block appended after every other system-prompt source, with prose instructing the model to defer to organization, session and data-lake guidance. Over the cap is a 422, never truncated.")
 });
-z$1.object({
+/**
+* Async ACK returned on the default (wait:false) path of POST /api/chat. The
+* `type`/`errorCode` pair below is the same classifier the `wait: true` body and
+* the polled quest (`GET /api/quests/{id}`) carry, so it is modelled once here -
+* the rest of those two bodies is NOT described by this schema. The
+* handler assembles the ack body inline (apps/client/pages/api/chat.ts), so
+* this schema MUST stay in sync with that `res.json({...})` shape.
+*/
+const ChatAckSchema = z$1.object({
 	id: z$1.string(),
 	status: z$1.string(),
 	message_received: z$1.boolean(),
 	timestamp: z$1.string(),
 	model: z$1.string(),
 	message: z$1.string().optional(),
+	type: z$1.enum(CHAT_HISTORY_ITEM_TYPES).optional(),
+	errorCode: z$1.enum(QUEST_ERROR_CODES).optional(),
 	tools: z$1.object({
 		toolMode: z$1.enum(["fast", "smart"]).optional(),
 		autoSelectedTools: z$1.array(z$1.string()).optional(),
@@ -3560,6 +3037,44 @@ z$1.object({
 	})
 });
 /**
+* The quest a `wait: false` caller polls at `GET /api/quests/{id}` - the outcome
+* of the turn the ACK above only acknowledged.
+*
+* Deliberately the OUTCOME SUBSET, not the whole quest: that endpoint is a plain
+* handler rather than a contract, so this models only what decides whether the
+* turn succeeded, and a poll body carries further fields (`images`, `files`,
+* `toolPayloads`, `promptMeta`, ...). Must stay in sync with that handler's
+* `res.json` shape (apps/client/pages/api/quests/[id]/index.ts) - unlike a
+* contract-registered request/response schema, nothing validates this at
+* runtime. The "parses against the published ChatQuestPollResultSchema"
+* integration test (index.integration.test.ts) only proves the handler's
+* CURRENT response satisfies this schema - a non-strict `z.object` strips
+* unknown keys rather than rejecting them, and only `id` is required, so a
+* field the handler starts returning without a matching addition here keeps
+* that test green. The real per-field coverage lives in the sibling
+* assertions in that same test file; a shape addition still needs a schema
+* update by hand.
+*
+* A failed turn is still `status: 'done'` with the failure text in `reply`, so
+* `reply` alone cannot tell an answer from a failure - `type` and `errorCode` are
+* what separate a CLASSIFIED failure. A run recovered from a timeout with partial
+* content is not one of those: `terminalRecoveryFor` (questTimeoutRecovery.ts)
+* flips only `status` to preserve the surviving content, so it polls back as
+* `type: 'message'` even though it never finished.
+*/
+const ChatQuestPollResultSchema = z$1.object({
+	id: z$1.string(),
+	status: z$1.enum([
+		"stopped",
+		"running",
+		"done"
+	]).optional(),
+	type: z$1.enum(CHAT_HISTORY_ITEM_TYPES).optional(),
+	errorCode: z$1.enum(QUEST_ERROR_CODES).optional(),
+	reply: z$1.string().nullable().optional(),
+	replies: z$1.array(z$1.string()).optional()
+});
+/**
 * Reusable JSON error envelope (plain; the OpenAPI layer annotates it).
 *
 * Must stay in sync with the published `ErrorResponse` component
@@ -3578,7 +3093,18 @@ const ApiErrorSchema = z$1.object({
 	*/
 	name: z$1.string().optional()
 });
-ApiErrorSchema.extend({ errorCode: z$1.literal("insufficient_credits").optional() });
+/**
+* Error envelope for the 422 a credit-metered endpoint returns for two unrelated
+* reasons: "your body is invalid" and "you cannot afford this". `errorCode` is
+* what separates them - `insufficientCreditsError` (see insufficientCredits.ts)
+* tags the credit case, so its absence means an ordinary validation failure.
+*
+* Derived from `ApiErrorSchema` rather than re-declaring `error`/`request_id`:
+* both of those 422s are *thrown*, so errorHandler serves the body and adds
+* `name`. Extending is what keeps that documented here (and what drops it again
+* on the sunset date) instead of leaving a bespoke copy behind to drift.
+*/
+const InsufficientCreditsErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal("insufficient_credits").optional() });
 const supportedVoiceGenerationVendor = z.enum(["openai", "elevenlabs"]);
 const voiceOutputFormatSchema = z.enum([
 	"mp3",
@@ -3589,13 +3115,12 @@ const voiceOutputFormatSchema = z.enum([
 	"pcm"
 ]);
 const voiceResponseEncodingSchema = z.enum(["binary", "base64"]);
-const TTS_MAX_INPUT_CHARS = {
+const TTS_ABSOLUTE_MAX_INPUT_CHARS = Math.max(...Object.values({
 	openai: 4096,
 	elevenlabs: 1e4
-};
-const TTS_ABSOLUTE_MAX_INPUT_CHARS = Math.max(...Object.values(TTS_MAX_INPUT_CHARS));
+}));
 const ttsLanguageCodeSchema = z.string().regex(/^[a-z]{2}$/, "languageCode must be a lowercase ISO 639-1 code, e.g. \"en\" or \"ja\"");
-z.object({
+const ttsRequestSchema = z.object({
 	text: z.string().min(1).max(TTS_ABSOLUTE_MAX_INPUT_CHARS),
 	provider: supportedVoiceGenerationVendor.optional(),
 	model: z.string().optional(),
@@ -3621,7 +3146,18 @@ const audioSaveSkippedReasonSchema = z.enum([
 	"file_too_large",
 	"error"
 ]);
-z.object({
+/**
+* JSON body of `POST /api/ai/tts` when the caller asks for `encoding: 'base64'`.
+* The default `binary` encoding returns raw audio bytes instead and has no JSON
+* shape.
+*
+* The save + provider fields are all optional because the handler spreads them in
+* only when they apply: the save fields are absent when no copy was attempted
+* (`preview: true`, or the saveGeneratedAudio preference is off), and
+* `provider`/`fallbackFrom` appear only when the requested provider was
+* unavailable and another one stood in.
+*/
+const ttsBase64ResponseSchema = z.object({
 	/** Base64-encoded audio payload. */
 	audio: z.string(),
 	format: voiceOutputFormatSchema,
@@ -3635,7 +3171,32 @@ z.object({
 	/** The originally requested provider that could not serve the request. */
 	fallbackFrom: supportedVoiceGenerationVendor.optional()
 });
-ApiErrorSchema.extend({
+/**
+* Error body for `POST /api/ai/tts`, shared by the 401, 422, 429 and 502; the 413
+* has a shape of its own (`ttsResponseTooLargeSchema`). `errorCode` is present only
+* on the conditions that carry a classifier; an ordinary validation 422 has none.
+*
+* Extends `ApiErrorSchema` because what decides whether a body carries the fields
+* errorHandler adds - `request_id`, and `name` until its 2026-12-01 sunset - is
+* whether the body was THROWN, not which status it wears, and three of these four
+* statuses are reachable both ways:
+*
+* - 401: thrown by apiKeyAuth on a rejected key; written by `auth` when no
+*   credential was presented at all, and by the handler for
+*   `provider_not_configured` and for an upstream credential rejection
+*   (`provider_rejected`).
+* - 422: thrown by request validation and by the char-limit / format guards;
+*   written by the handler for `insufficient_credits` and for an upstream 422.
+* - 429: thrown by apiKeyRateLimit; written by the handler on an upstream 429.
+* - 502: only ever written.
+*
+* So those two are genuinely optional here, and splitting this per status would be
+* wrong for the first three. The 502 does advertise both without ever sending them;
+* that is not worth a fourth error schema on one route, and `request_id` missing from
+* this handler's written bodies is a gap in the handler rather than something to
+* enshrine in a schema.
+*/
+const ttsErrorResponseSchema = ApiErrorSchema.extend({
 	provider: supportedVoiceGenerationVendor.optional(),
 	errorCode: z.enum([
 		"insufficient_credits",
@@ -3643,7 +3204,21 @@ ApiErrorSchema.extend({
 		"provider_rejected"
 	]).optional()
 });
-z.object({
+/**
+* 413 body: the audio was generated and billed but exceeds the serverless
+* response-size cap. When a browsable copy was saved, `fileUrl` is how the caller
+* retrieves the audio it paid for.
+*
+* Not derived from `ApiErrorSchema`: every 413 on this route is written, never
+* thrown, so errorHandler never serves one and `name` is genuinely absent rather than
+* optional - a stronger claim than `ttsErrorResponseSchema` can make for its own
+* statuses, see the note there. Two writers, and only the first matches the paragraph
+* above: the exceedsTtsResponseLimit guard, and the upstream-4xx passthrough relaying
+* a provider 413, where nothing was generated or billed and there is no `fileUrl`. An
+* oversized *request* body is a third 413 that never reaches this schema at all -
+* Next's own body parser answers it in plain text before the router runs.
+*/
+const ttsResponseTooLargeSchema = z.object({
 	error: z.string(),
 	provider: supportedVoiceGenerationVendor,
 	saved: z.literal(true).optional(),
@@ -3656,7 +3231,15 @@ z.enum(["openai"]);
 * New vendors are added here and in the `aiSoundService` factory.
 */
 const supportedSoundGenerationVendor = z.enum(["elevenlabs"]);
-z.object({
+/**
+* Inbound request body for `POST /api/ai/sound-effects`.
+*
+* `durationSeconds` and `promptInfluence` bounds mirror the ElevenLabs
+* sound-generation limits (0.5-30s for the default eleven_text_to_sound_v2
+* model, prompt influence 0-1). `format` is the provider-specific output
+* encoding token (e.g. `mp3_44100_128`).
+*/
+const soundEffectsRequestSchema = z.object({
 	provider: supportedSoundGenerationVendor.default("elevenlabs"),
 	text: z.string().min(1).max(1e3),
 	durationSeconds: z.number().min(.5).max(30).optional(),
@@ -3674,13 +3257,23 @@ const supportedMusicGenerationVendor = z.enum(["elevenlabs"]);
 * change the request surface needs to accept it.
 */
 const supportedMusicModel = z.enum(["music_v1"]);
-const DEFAULT_MUSIC_MODEL_ID = "music_v1";
-z.object({
+/**
+* Inbound request body for `POST /api/ai/music`.
+*
+* `lengthMs` upper bound is capped below the ElevenLabs Music API ceiling to fit
+* the serving function's time budget (see MAX_MUSIC_LENGTH_MS). It carries a
+* default rather than being optional so the billed
+* length is always known up front (the reserve/settle path needs a deterministic
+* cost before generation) and the route can force that exact length on the
+* provider. `format` is the provider-specific output encoding token (e.g.
+* `mp3_44100_128`).
+*/
+const musicRequestSchema = z.object({
 	provider: supportedMusicGenerationVendor.default("elevenlabs"),
 	prompt: z.string().min(1).max(2e3),
 	lengthMs: z.number().int().min(3e3).max(12e4).default(1e4),
 	forceInstrumental: z.boolean().optional(),
-	modelId: supportedMusicModel.default(DEFAULT_MUSIC_MODEL_ID),
+	modelId: supportedMusicModel.default("music_v1"),
 	format: z.string().optional()
 });
 VIDEO_SIZE_CONSTRAINTS.SORA.durations;
@@ -3776,6 +3369,41 @@ const AGENT_EXECUTION_STATUSES = [
 	"aborted"
 ];
 /**
+* Why a session summarization happened, stamped on `ISession.summaryTrigger`. Single source for the
+* places that each used to spell this list out: the Session zod schema (schemas/actions.ts), the
+* entity type (types/entities/SessionTypes.ts), the Mongoose path (packages/database SessionModel)
+* and the session.summarize event payload (apps/client server/utils/eventBus.ts). They drifted -
+* the Mongoose enum said 'milestone'/'growth' for two values nothing produces - and a drift there
+* is invisible on the update path, because BaseModel's findOneAndUpdate writes without
+* runValidators.
+*
+* Those surfaces now name PERSISTED_SESSION_SUMMARY_TRIGGERS below, not the full union: a stored
+* field may only carry a reason a run HAPPENED. 'throttling' is the exception that forced the
+* split - shouldSummarizeSession (b4m-core/services ChatCompletionFeatures) returns it as the
+* reason it DECLINED to summarize, so it describes no run and belongs to a decision, not a
+* document. It is typed by SummarizationDecision there, not by the session field.
+*
+* 'manual' means someone asked for one notebook's summary. The admin sweep (apps/client
+* server/events/spider.ts) summarizes every un-summarized notebook of the admin who ran it in one
+* billed pass, so it stamps 'spider' instead: without that, one deliberate click and a whole sweep
+* are indistinguishable when someone investigates unexpected summarization spend.
+*/
+/**
+* The triggers a document may actually carry - every reason a summarization HAPPENED. The event
+* payload and createSessionParametersSchema both name this list rather than the full union below,
+* so 'throttling' cannot be published, cannot be stored, and therefore cannot reach a copy path.
+* Add a new reason-it-happened here, not to SESSION_SUMMARY_TRIGGERS, and every one of those
+* boundaries picks it up.
+*/
+const PERSISTED_SESSION_SUMMARY_TRIGGERS = [
+	"manual",
+	"project",
+	"earlyMilestone",
+	"contentGrowth",
+	"spider"
+];
+[...PERSISTED_SESSION_SUMMARY_TRIGGERS];
+/**
 * Operator allow-list for the client-authored Mongo filter carried on a `subscribe_query` frame.
 *
 * The WS data-subscribe handler forwards that filter to `Model.find` and persists it on the
@@ -4037,11 +3665,24 @@ const QuestExportProgressAction = z$1.object({
 		"failed"
 	]),
 	progress: z$1.number(),
-	detail: z$1.string().optional(),
-	downloadUrl: z$1.string().optional(),
-	filename: z$1.string().optional(),
+	detail: z$1.string().optional(),
+	downloadUrl: z$1.string().optional(),
+	filename: z$1.string().optional(),
+	errorMessage: z$1.string().optional(),
+	droppedQuestCount: z$1.number().optional(),
+	clientId: z$1.string().optional()
+});
+const OrgFeedbackSummaryProgressAction = z$1.object({
+	action: z$1.literal("org_feedback_summary_progress"),
+	summaryJobId: z$1.string(),
+	organizationId: z$1.string(),
+	status: z$1.enum([
+		"processing",
+		"completed",
+		"failed"
+	]),
+	progress: z$1.number(),
 	errorMessage: z$1.string().optional(),
-	droppedQuestCount: z$1.number().optional(),
 	clientId: z$1.string().optional()
 });
 const SpiderProgressUpdateAction = z$1.object({
@@ -4128,13 +3769,7 @@ const StreamedChatCompletionAction = z$1.object({
 		replies: z$1.array(z$1.string()).optional(),
 		images: z$1.array(z$1.string()).optional(),
 		videos: z$1.array(z$1.string()).optional(),
-		type: z$1.enum([
-			"message",
-			"oob",
-			"error",
-			"system",
-			"voice_transcript"
-		]),
+		type: z$1.enum(CHAT_HISTORY_ITEM_TYPES),
 		status: z$1.enum([
 			"stopped",
 			"running",
@@ -4935,18 +4570,13 @@ const SessionCreatedAction = shareableDocumentSchema.extend({
 	claudeConversationId: z$1.string().optional(),
 	summary: z$1.string().optional(),
 	summaryAt: z$1.date().optional(),
-	summaryTrigger: z$1.enum([
-		"manual",
-		"project",
-		"earlyMilestone",
-		"contentGrowth",
-		"throttling"
-	]).optional(),
+	summaryTrigger: z$1.enum(PERSISTED_SESSION_SUMMARY_TRIGGERS).optional(),
 	deletedAt: z$1.date().optional(),
 	tags: z$1.array(z$1.object({
 		name: z$1.string(),
 		strength: z$1.number()
 	})).optional(),
+	taggedAt: z$1.date().optional(),
 	clonedSourceId: z$1.string().nullable().optional(),
 	forkedSourceId: z$1.string().nullable().optional(),
 	isAutoNamed: z$1.boolean().optional(),
@@ -5137,7 +4767,14 @@ const PermissionRequestAction = z$1.object({
 	executionId: z$1.string(),
 	toolName: z$1.string(),
 	toolInput: z$1.unknown(),
-	iteration: z$1.number()
+	iteration: z$1.number(),
+	/**
+	* Provider tool_use id of the specific gated call this card is asking about.
+	* The client echoes it back on `permission_response` so the server can bind
+	* the answer to THIS pause rather than the latest one that happens to share
+	* a tool name - see `handlePermissionResponse`'s toolCallId check.
+	*/
+	toolCallId: z$1.string().optional()
 });
 const ChildExecutionSnapshotSchema = z$1.lazy(() => z$1.object({
 	executionId: z$1.string(),
@@ -5159,7 +4796,8 @@ const ReconnectResultAction = z$1.object({
 	pendingPermission: z$1.object({
 		toolName: z$1.string(),
 		toolInput: z$1.unknown(),
-		requestedAt: z$1.union([z$1.string(), z$1.date()])
+		requestedAt: z$1.union([z$1.string(), z$1.date()]),
+		toolCallId: z$1.string().optional()
 	}).optional(),
 	totalCreditsUsed: z$1.number().optional(),
 	iterationCount: z$1.number().optional(),
@@ -5208,6 +4846,7 @@ z$1.discriminatedUnion("action", [
 	ResearchTaskStatusUpdateAction,
 	NotebookCurationProgressUpdateAction,
 	QuestExportProgressAction,
+	OrgFeedbackSummaryProgressAction,
 	SpiderProgressUpdateAction,
 	SpiderCompleteAction,
 	SpiderErrorAction,
@@ -5250,7 +4889,29 @@ z$1.discriminatedUnion("action", [
 	PermissionRequestAction,
 	ReconnectResultAction
 ]);
-z$1.object({
+/**
+* Public wire schemas for the agent-executor (ReAct) endpoints:
+* `POST /api/v1/agent-executions` and `GET /api/v1/agent-executions/{id}`.
+*
+* These are the REST twin of the WebSocket `agent_execute` command surface
+* (apps/client/server/websocket/agentExecute.ts). Both transports funnel into the
+* same `startAgentExecution` service, but the wire shapes are deliberately separate:
+* the WS payload carries UI-only fields (routing provenance, an optimistic-bubble
+* back-reference) that must never become published API surface, and public fields are
+* snake_case per CONVENTIONS.md section 2 while the WS command is camelCase.
+*
+* Public-API rules apply here: no `.catch()`, no top-level `.transform()`.
+*/
+/**
+* Request body for `POST /api/v1/agent-executions`.
+*
+* `session_id` is required rather than defaulted (unlike `POST /api/chat`, which falls
+* back to the caller's last notebook): the session is what determines which agent
+* profile the executor builds, so guessing it would silently change the run's
+* behaviour. Everything else is optional and falls back to admin defaults or the
+* agent's own orchestration profile.
+*/
+const AgentExecutionStartRequestSchema = z$1.object({
 	session_id: z$1.string().min(1),
 	message: z$1.string().min(1),
 	/** Falls back to the deployment's default chat model when omitted. */
@@ -5307,7 +4968,11 @@ z$1.object({
 	*/
 	enable_artifacts: z$1.boolean().optional()
 });
-z$1.object({
+/**
+* 202 ACK for `POST /api/v1/agent-executions`. The run is fire-and-forget: nothing is
+* streamed back over REST, so the caller polls `poll_url` until `status` is terminal.
+*/
+const AgentExecutionAckSchema = z$1.object({
 	id: z$1.string(),
 	status: z$1.literal("pending"),
 	session_id: z$1.string(),
@@ -5337,7 +5002,15 @@ const AgentExecutionStepSchema = z$1.object({
 	/** Set on `action` steps: the tool the agent invoked. */
 	tool_name: z$1.string().optional()
 });
-z$1.object({
+/**
+* Poll response for `GET /api/v1/agent-executions/{id}`.
+*
+* `steps` is the live trace: it grows while the run is in flight (read from the
+* checkpoint) and freezes at the final one. `answer` is null until the run reaches a
+* terminal status, and stays null on `failed` / `aborted` - where `error` carries the
+* reason instead.
+*/
+const AgentExecutionStatusResponseSchema = z$1.object({
 	id: z$1.string(),
 	status: z$1.enum([
 		"pending",
@@ -5369,7 +5042,8 @@ z$1.object({
 	created_at: z$1.string(),
 	updated_at: z$1.string()
 });
-z$1.object({ id: z$1.string().min(1) });
+/** Path parameter for `GET /api/v1/agent-executions/{id}`. */
+const AgentExecutionIdParamSchema = z$1.object({ id: z$1.string().min(1) });
 /**
 * Tool schema matching ICompletionOptionTools.toolSchema. The Zod surface only
 * covers wire-format fields (toolFn is server-side). Replaces the historical
@@ -5419,7 +5093,17 @@ const CompletionMessageSchema = z$1.object({
 	content: z$1.union([z$1.string(), z$1.array(z$1.any())]),
 	cache: z$1.boolean().optional()
 });
-z$1.object({
+/**
+* Schema for CLI LLM completion requests
+* Shared between Next.js API route (dev) and Lambda function (production)
+*
+* `response_format`, `stream`, `tools`, `temperature`, and `max_tokens` are all
+* accepted at the top level (OpenAI-compatible, matching how every major LLM
+* SDK shapes a completion request) AND nested under `options` (legacy shape).
+* Use `normalizeCompletionRequest()` to collapse both surfaces into the
+* canonical `options.<field>` location before downstream consumption.
+*/
+const CompletionRequestSchema = z$1.object({
 	model: z$1.string(),
 	messages: z$1.array(CompletionMessageSchema),
 	response_format: ResponseFormatSchema.optional(),
@@ -5466,18 +5150,42 @@ const CompletionContentEventSchema = z$1.object({
 	stopReason: z$1.string().optional(),
 	thinking: z$1.array(z$1.any()).optional()
 });
+/**
+* The in-band terminal failure frame. Because this endpoint flushes SSE headers
+* before it authenticates or prices anything, EVERY failure past the malformed-body
+* check arrives here under a 200 - there is no pre-stream 422 on this surface the
+* way there is on /api/chat and /api/embed/chat.
+*
+* `code` is the machine-readable classifier, drawn from QUEST_ERROR_CODES (itself a
+* narrowing of the platform-wide API_ERROR_CODES, so it cannot drift from the codes
+* the JSON surfaces use). It is what makes mid-generation credit exhaustion
+* detectable: the `message` is prose and callers must never match on it. Absent for
+* unclassified failures, so treat it as optional.
+*
+* The field is `code` rather than the conventions' `errorCode` because this frame
+* shipped that way and is a published wire shape; the vocabulary is what had to be
+* shared, not the key.
+*/
 const CompletionSseErrorEventSchema = z$1.object({
 	type: z$1.literal("error"),
 	message: z$1.string(),
 	requestId: z$1.string().optional(),
-	code: z$1.string().optional()
+	code: z$1.enum(QUEST_ERROR_CODES).optional()
 });
-z$1.union([
+/** One `data:` event in the `text/event-stream` completions response. */
+const CompletionStreamEventSchema = z$1.union([
 	CompletionMetaEventSchema,
 	CompletionContentEventSchema,
 	CompletionSseErrorEventSchema
 ]);
-z$1.object({
+/**
+* Server-side tool execution schemas for POST /api/ai/v1/tools.
+*
+* Plain Zod (no `.openapi()`) so any runtime can import them; the OpenAPI layer
+* annotates them via the contract. The tool-name enum MUST stay in sync with
+* SUPPORTED_TOOLS in apps/client/server/cli/toolsHandler.shared.ts.
+*/
+const ToolExecutionRequestSchema = z$1.object({
 	toolName: z$1.enum([
 		"weather_info",
 		"web_search",
@@ -6156,21 +5864,9 @@ const ALL_IMAGE_MODELS = [
 	...XAI_IMAGE_MODELS,
 	...GEMINI_IMAGE_MODELS
 ];
-const OPENAI_GPT_IMAGE_1_IMAGE_SIZES = [
-	"1024x1024",
-	"1024x1536",
-	"1536x1024"
-];
-const OPENAI_GPT_IMAGE_2_IMAGE_SIZES = [
-	"1024x1024",
-	"1536x1024",
-	"1024x1536",
-	"2048x2048",
-	"2048x1152",
-	"3840x2160",
-	"2160x3840",
-	"auto"
-];
+const OPENAI_GPT_IMAGE_1_IMAGE_SIZES = IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_1.sizes;
+/** The UI presets plus the tier's non-resolution `autoSize`, which the picker cannot render. */
+const OPENAI_GPT_IMAGE_2_IMAGE_SIZES = [...IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.sizes, IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.autoSize];
 const BFL_IMAGE_SIZES = ["1024x768"];
 const OPENAI_IMAGE_SIZES = [...OPENAI_GPT_IMAGE_1_IMAGE_SIZES];
 const ALL_IMAGE_SIZES = [
@@ -6180,16 +5876,34 @@ const ALL_IMAGE_SIZES = [
 ];
 z$1.enum(OPENAI_IMAGE_SIZES);
 const ImageSizeSchema = z$1.union([z$1.enum(ALL_IMAGE_SIZES), z$1.string().regex(/^\d+x\d+$/, { error: "Size must be in format 'widthxheight'" })]);
-const OpenAIImageQualitySchema = z$1.enum([
+const OPENAI_IMAGE_QUALITIES = [
 	"standard",
 	"hd",
 	"low",
 	"medium",
 	"high",
 	"auto"
-]);
+];
+const OpenAIImageQualitySchema = z$1.enum(OPENAI_IMAGE_QUALITIES);
+OPENAI_IMAGE_QUALITIES.filter((quality) => quality !== "auto");
 const OpenAIImageStyleSchema = z$1.enum(["vivid", "natural"]);
 /**
+* Alpha handling for gpt-image renders. `transparent` only yields real alpha when the
+* output format also carries an alpha channel (png or webp) - OpenAI rejects it alongside
+* jpeg. Ignored by every other provider (see OpenAIImageService.generate).
+*/
+const OpenAIImageBackgroundSchema = z$1.enum([
+	"transparent",
+	"opaque",
+	"auto"
+]);
+/** Container for a generated image. `webp` is gpt-image only; BFL and Gemini take png/jpeg. */
+const ImageOutputFormatSchema = z$1.enum([
+	"png",
+	"jpeg",
+	"webp"
+]);
+/**
 * Maps legacy/removed image model IDs to their current replacements.
 * Prevents Zod validation failures when clients send stale persisted model names.
 *
@@ -6232,6 +5946,7 @@ const OpenAIImageGenerationInput = z$1.object({
 	response_format: z$1.enum(["b64_json", "url"]).optional(),
 	size: ImageSizeSchema.nullable().optional(),
 	style: OpenAIImageStyleSchema.optional(),
+	background: OpenAIImageBackgroundSchema.nullable().optional(),
 	width: z$1.number().optional(),
 	height: z$1.number().optional(),
 	aspect_ratio: z$1.string().optional()
@@ -6347,17 +6062,30 @@ const SessionTagSchema = z$1.object({
 	name: z$1.string(),
 	strength: z$1.number()
 });
-z$1.object({
+/**
+* Request schema for PUT /api/sessions/{id}. This is the exact field allowlist
+* sessionService.updateSession enforces (b4m-core/services/src/sessionService/update.ts,
+* which extends this schema with `id`) - shared so the public contract can never
+* document a field the service silently drops, or vice versa.
+*/
+const SessionUpdateRequestSchema = z$1.object({
 	name: z$1.string().min(1).optional(),
 	knowledgeIds: z$1.array(z$1.string()).optional(),
 	artifactIds: z$1.array(z$1.string()).optional(),
 	tags: z$1.array(SessionTagSchema).optional(),
 	lastUsedModel: z$1.string().min(1).nullish().describe("Pin a specific model id, or omit/send null to leave the current pin unchanged. Sending null does NOT clear it."),
 	forceKnowledgeRetrieval: z$1.boolean().optional(),
+	lakeScope: z$1.array(z$1.string()).nullable().optional().describe("The data lakes this session grounds on, as lake tags (the `datalakeTag` of each lake from GET /api/data-lakes). Send a list to ground only on those lakes, `[]` to ground on no lake at all, or `null` to clear the choice so retrieval falls back to every lake you can reach. Omit to leave the current choice unchanged. Tags naming a lake you cannot reach are ignored at retrieval time rather than rejected here. Narrowing the scope does not by itself turn retrieval on: pair it with `forceKnowledgeRetrieval: true` for a session that is not already grounded. Conversely `[]` leaves a grounded session nothing to retrieve from, so its forced retrieval is skipped rather than run against every lake."),
 	propagateToProjects: z$1.boolean().optional().describe("Defaults to true when omitted. When knowledgeIds grows, the newly-added file ids are also appended to every project that contains this session, granting every member of that project access to those files. This propagation is append-only and cannot be undone through the UI - pass false if newly-attached files should not be shared with the project.")
 });
-z$1.object({ id: z$1.string().min(1) });
-z$1.object({
+/** Path parameter for session-scoped endpoints, e.g. GET/PUT /api/sessions/{id}. */
+const SessionIdParamSchema = z$1.object({ id: z$1.string().min(1) });
+/**
+* Practical response subset for PUT /api/sessions/{id} - the fields a caller needs to
+* confirm an update took effect. ISession (types/entities/SessionTypes.ts) carries many
+* more server-internal fields not documented as public API surface here.
+*/
+const SessionResponseSchema = z$1.object({
 	id: z$1.string(),
 	name: z$1.string(),
 	userId: z$1.string(),
@@ -6365,6 +6093,8 @@ z$1.object({
 	artifactIds: z$1.array(z$1.string()).optional(),
 	tags: z$1.array(SessionTagSchema).optional(),
 	forceKnowledgeRetrieval: z$1.boolean().optional(),
+	retrievalTags: z$1.array(z$1.string()).optional(),
+	lakeScopeExplicit: z$1.boolean().optional().describe("True when `retrievalTags` is a deliberate choice, so an empty list means \"no lake\" rather than \"any\"."),
 	lastUsedModel: z$1.string().nullish(),
 	firstCreated: z$1.date(),
 	lastUpdated: z$1.date()
@@ -6484,15 +6214,6 @@ const CHUNK_STALL_REASONS = [
 	"unchunkedPaused"
 ];
 /**
-* Whether a file is stalled by the convergence kill switch, by any arm. THE predicate every
-* reader uses, so adding a stall reason reaches health, convergence and retrieval without separate
-* comparisons drifting apart. Also the in-memory mirror of a Mongo
-* `chunkStallReason: { $in: [...CHUNK_STALL_REASONS] }`.
-*/
-function isChunkStalled(reason) {
-	return CHUNK_STALL_REASONS.includes(reason);
-}
-/**
 * Which reasons leave the file with NO passages, as opposed to passages with no vectors. A `Record`
 * over every reason rather than a hand-written subset array: a new stall reason then cannot compile
 * until it is classified, where a member missing from a literal array would just make a health count
@@ -6519,76 +6240,7 @@ const CHUNK_STALL_NOTICES = {
 };
 CHUNK_STALL_NOTICES.vectorizePaused;
 CHUNK_STALL_NOTICES.rechunkPaused;
-/**
-* TRANSITIONAL, and the ONE stall predicate every RETRIEVAL path must use until #2016's migration
-* has run in every environment. Reads the new field, then falls back to the legacy prose that the
-* pre-migration rows still carry in `notes`.
-*
-* It exists for the FORWARD window only: `migratorInvocation` is a `dependsOn` of the web stack
-* only (infra/web.ts); the queue stack has none, so the executor can serve forced retrieval and
-* `knowledge_base_search` while rows still carry the marker in `notes` and no `chunkStallReason`. A
-* row stalled by the chunk arm then reads as a plain unindexed file: `isRetrievalExcluded` drops it
-* upstream of the withhold on a vectorizedOnly lake, and `partitionByIndexAvailability` calls it
-* servable everywhere else. The turn answers around a passage-less file and reports FULL coverage -
-* the silent degradation this whole path exists to prevent.
-*
-* A code ROLLBACK is the mirror image and this arm CANNOT cover it: the rows are already migrated
-* (`chunkStallReason` set, `notes` unset) and the code restored is pre-#2016, which does not contain
-* this function. Nothing reverts the data on its own either - `migratorInvocation` only ever runs
-* `up` and `migrate down` is a manual CLI step - so `migrate down` is a REQUIRED step of any
-* rollback past #2016, not an optional tidy-up. What this arm does buy is that `down()` is safe to
-* run FIRST: whichever stack is still new keeps honoring the prose it restores, so a staggered
-* rollback has no window where a restored marker is invisible. `down()` is a PARTIAL restore
-* though - it skips a row whose owner typed a note after `up()`, and that row grades as unstalled
-* on both stacks once the field is dropped. See its own comment.
-*
-* Deliberately NOT used by the grading/health/UI readers: they are gated behind the web stack, and
-* a legacy row there renders the notice line AND the identical text as the owner's note.
-*
-* Mirrored in Mongo by `buildFabFileSearchQuery`'s `vectorizedOnly` exemption. Delete the legacy arm
-* from both together, one release after the migration has landed everywhere.
-*
-* Pinned to the two reasons the migration backfilled rather than every notice: `unchunkedPaused`
-* postdates it, so no row carries its prose, and including it would read an owner who happens to type
-* that sentence into `notes` as stalled.
-*/
-const LEGACY_CHUNK_STALL_NOTES = [CHUNK_STALL_NOTICES.vectorizePaused, CHUNK_STALL_NOTICES.rechunkPaused];
-function isChunkStalledFile(file) {
-	return isChunkStalled(file.chunkStallReason) || LEGACY_CHUNK_STALL_NOTES.includes(file.notes ?? "");
-}
-/**
-* `FabFile.chunkRebuildRequestedAt`: stamped by `resetChunkStateByIds` in the SAME write that
-* clears a file's chunk rollups, so "this file's passages are being rebuilt" can never be lost the
-* way the pair of steps that creates the state can be. The reset and the queue send are two
-* operations - kill the producer between them, or lose the consumer's marker write, and the file
-* sits at `chunkCount: 0` with `error: null` and no stall reason, a shape indistinguishable from an
-* image or a still-uploading row. It then drops out of lake health's denominator, out of the
-* convergence plan and out of the retrieval withhold at the same moment: every rollup says its
-* passages are gone, and nothing reports it.
-*
-* Deliberately NOT the `rechunkPaused` stall reason pre-written by the producer, which is the obvious
-* fix and the wrong one: that marker means "halted, needs an administrator", so a file awaiting an
-* ORDINARY rebuild would read to every reader as permanently paused for the whole rebuild - search
-* would tell readers it does not return on its own, health would hard-fail P3, and "Rebuild
-* passages" would offer to repair a file that is already repairing. A flag that cries wolf on the
-* normal path is worse than the rare window it closes.
-*
-* So the two facts are distinct states, and the consumer UPGRADES one to the other: pending means
-* "in flight, returns on its own", the paused note means "halted, needs intervention". A LOST
-* upgrade therefore degrades to mislabelled-but-visible rather than invisible, which is the trade
-* this field exists to make - invisibility is the real harm, labelling is secondary.
-*
-* A dedicated field on purpose, and the precedent #2016 followed for the other two machine-written
-* facts: while they all shared `notes` every writer of that field clobbered the others, including
-* the user's own note.
-*
-* Cleared by `commitFabFileChunks` (the rebuild landed) and by the chunk handler's pause write (the
-* rebuild was halted instead). A file carrying `error` is settled regardless - see
-* `isMemberIndexingInFlight`, which is where the precedence between these three lives.
-*/
-function isChunkRebuildPending(requestedAt) {
-	return requestedAt !== null && requestedAt !== void 0 && requestedAt !== "";
-}
+CHUNK_STALL_NOTICES.vectorizePaused, CHUNK_STALL_NOTICES.rechunkPaused;
 /** Ceiling so "adjustable" cannot mean "unbounded" in either direction. */
 const LAKE_ACCESS_AUDIT_RETENTION_MAX_DAYS = 2555;
 /**
@@ -6683,46 +6335,7 @@ function defaultEmbeddingModelForEnv() {
 	const hasOllama = !!process.env.OLLAMA_BASE_URL?.trim();
 	const hasCloudEmbeddingKey = !isPlaceholderApiKey(process.env.OPENAI_API_KEY) || !isPlaceholderApiKey(process.env.VOYAGE_API_KEY);
 	if (selfHost && hasOllama && !hasCloudEmbeddingKey) return "qwen3-embedding:0.6b";
-	return "text-embedding-ada-002";
-}
-/**
-* True when this deployment can embed with no provider API key at all: a cloud stage reaches
-* Bedrock through its task/execution role's AWS credentials.
-*
-* Requires POSITIVE evidence of an execution role rather than merely "not self-host". A plain
-* `next dev` session and a CI job both leave B4M_SELF_HOST unset while holding no AWS credentials
-* at all, so an absence test would send them to the Bedrock SDK for an opaque `CredentialsProvider
-* Error` in place of the actionable OPENAI_KEY_MISSING_MESSAGE naming the key to set - the same
-* actionable-to-opaque trade this fallback exists to avoid, just in a different keyless place.
-*
-* BOTH runtimes must be covered, and they carry different markers. The Lambdas (vectorize
-* subscriber, the crons, the Next API routes) get AWS_LAMBDA_FUNCTION_NAME; ChatCompletion is a
-* Fargate service (infra/chatCompletion.ts) and gets the ECS task-role URI instead. Since
-* knowledgeBaseSearch runs inside that container, keying on the Lambda marker alone would leave
-* chat knowledge-base search failing on exactly the keyless stages this fallback is for.
-*
-* SST_RESOURCE_App is the third arm and the one this repo can prove: SST sets it on anything it
-* links, Lambda and Service alike (infra/chatCompletion.ts:129 and infra/agentExecutor.ts:54 both
-* note that linking alone exposes SST_RESOURCE_*). It covers the Fargate task whether or not the
-* ECS credential URI is present, and it is absent from a plain `next dev` and from CI, which is
-* the case that matters. `sst dev` does set it - correctly, since that session runs against real
-* AWS credentials.
-*
-* Self-host is excluded outright because it has no such role - its keyless path is the local
-* Ollama embedder (`isLocalEmbedderAvailable` in toolAvailability.ts), not Bedrock.
-*
-* Answers "is Bedrock reachable here", NOT "should we use it" - a keyed stage is keyless-capable
-* too, so this must only ever be asked ALONGSIDE a resolved credential table that came back empty.
-* `resolveEmbeddingWithKeylessFallback` is where the two questions are paired for callers free to
-* choose the model, and is what such a caller should use instead of asking this directly. The
-* direct callers are the ones that additionally need the answer BEFORE resolving, to decide
-* policy: toolAvailability reports whether embedding-backed tools are usable at all, and
-* data-lakes/semantic-search decides whether a substitution is permitted for this request before
-* it knows whether one is needed. Both still pair it with the table.
-*/
-function hasKeylessCloudEmbedder() {
-	if (process.env.B4M_SELF_HOST === "true") return false;
-	return !!(process.env.AWS_LAMBDA_FUNCTION_NAME || process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI || process.env.SST_RESOURCE_App);
+	return "text-embedding-3-small";
 }
 z$1.union([
 	z$1.enum(OpenAIEmbeddingModel),
@@ -6732,15 +6345,15 @@ z$1.union([
 ]);
 /**
 * The measured per-space floors, rendered for an admin-facing description (e.g. "75 for
-* text-embedding-ada-002, 35 for text-embedding-3-small").
+* text-embedding-ada-002, 58 for text-embedding-3-small").
 *
-* Rendered rather than written out in prose because these numbers are expected to move - 35 is
-* provisional until it is re-derived against a production lake - and a description that restates
-* the table is a wrong number shown to operators the moment it drifts, with nothing failing.
+* Rendered rather than written out in prose because these numbers move as each space is re-measured
+* against a production lake, and a description that restates the table is a wrong number shown to
+* operators the moment it drifts, with nothing failing.
 */
 const forcedRetrievalFloorsBySpaceSummary = Object.entries({
 	["text-embedding-ada-002"]: 75,
-	["text-embedding-3-small"]: 35
+	["text-embedding-3-small"]: 58
 }).map(([space, pct]) => `${pct} for ${space}`).join(", ");
 /**
 * Default text for the artifact-emission system prompt. Single source of truth used BOTH as the
@@ -6915,20 +6528,6 @@ Call \`search_knowledge_base\` BEFORE answering when that library would settle t
 Do not search when the answer is already in front of you or out of scope: general knowledge (definitions, mathematics, established theory, public facts); anything answerable from this conversation, from an attached document, or from content already retrieved for you this turn; or a request to transform, summarize or reformat text the user has just supplied. If the library has already been searched on this turn, do not search it again for the same question - a repeat spends a round trip to return the same passages.
 
 When a search does not turn up what was asked for, say so plainly rather than filling the gap from training data, and never imply an answer came from the user's documents when it did not.`;
-/**
-* Default text for the formatting system message. Runtime fallback used by
-* `includeHardcodedSystemMessage` (b4m-core/utils/src/llm/utils.ts) when the `FormatPromptTemplate`
-* admin setting is blank; that setting's own default is intentionally '' - keep this the sole home.
-*
-* Deliberately scoped to formatting ONLY. The previous wording ("Adhere to specific formatting
-* requests...") read as a general compliance instruction and bled into WHETHER to answer: as the
-* only system content it roughly halved refusal quality. The opening clause is the fix - it fences
-* this message off from the answer/abstain decision. Injected only when `UseFormatPrompt` is on.
-*
-* NOTE: a stored settings row pins its own wording, so changing this default does not reach an
-* existing deployment that has already saved a value - the row must be edited in admin settings too.
-*/
-const FORMAT_PROMPT_TEMPLATE = `Formatting only - nothing here decides whether or how fully to answer. Format replies to maintain the integrity of the requested style; default to markdown for text. Preserve proper structure for poems, songs, or haikus. When the user specifies an output format (e.g. TypeScript), use that format for the parts you do answer.`;
 z$1.enum([
 	"openaiDemoKey",
 	"anthropicDemoKey",
@@ -6972,13 +6571,16 @@ z$1.enum([
 	"EnableDataLakeSlackAdd",
 	"EnableDataLakeGroundingMode",
 	"EnableLakeMemory",
+	"EnableLakeModelInconsistencyDetection",
 	"EnableDataLakeVectorSearch",
 	"EnableRetrievalSupersessionCollapse",
 	"PauseLakeConvergence",
 	"LakeConvergenceBulkChangeSharePct",
 	"EnforceLakeReadGrants",
 	"EnableDataLakeDrivePoll",
+	"EnableDataLakeGitHub",
 	"EnforceLakeAdmission",
+	"EnforceLakeOriginOnIngest",
 	"EnableBriefcase",
 	"EnableBriefcaseDefault",
 	"EnableImageTemplates",
@@ -7078,6 +6680,7 @@ z$1.enum([
 	"kbSearchMinRelevancePct",
 	"forcedRetrievalRelativeFloorPct",
 	"forcedRetrievalMinSimilarityPct",
+	"forcedRetrievalSpreadFloorPct",
 	"dataLakeEmbeddingSpendEnabled",
 	"dataLakeEmbeddingBudgetPerRunUsd",
 	"dataLakeEmbeddingBudgetPerLakeUsd",
@@ -7183,7 +6786,13 @@ const IntentClassifierConfigSchema = z$1.object({
 	fallbackModels: z$1.array(z$1.string()).default(["gemini-2.5-flash-lite", "gpt-5.4-nano"])
 });
 const OrchestrationDefaultsSchema = z$1.object({
-	/** Tool names the synthetic profile is allowed to invoke. */
+	/**
+	* Tool names the synthetic profile is allowed to invoke. A DEFAULT toolbelt, not a gate:
+	* an agentless chat dispatch ships the user's ambient Smart Tools and the executor UNIONS
+	* them onto this list (`pickEffectiveEnabledTools`), so narrowing this narrows what the
+	* agent brings of its own rather than capping what the user may select. `deniedTools` below
+	* is the gate.
+	*/
 	allowedTools: z$1.array(z$1.string()).default([
 		"web_search",
 		"retrieve_knowledge_content",
@@ -7315,7 +6924,7 @@ function makeNumberSetting(config) {
 	return {
 		...config,
 		type: "number",
-		schema: numberSchema.prefault(config.defaultValue ?? 0)
+		schema: z$1.preprocess((val) => val === null || typeof val === "string" && val.trim() === "" ? void 0 : val, numberSchema.prefault(config.defaultValue ?? 0))
 	};
 }
 function makeBooleanSetting(config) {
@@ -7392,6 +7001,17 @@ const RapidReplySettingsSchema = z$1.object({
 		lastUpdated: /* @__PURE__ */ new Date()
 	})
 });
+/**
+* Canonical repository and branch the What's New generator reads from.
+*
+* Every default in the What's New path (zod schema, settings registry, server
+* config service, cron/backfill fallbacks, admin form seed) must resolve here.
+* A stale slug is invisible in production: GitHubService.listMergedPullRequests
+* returns [] for a repository outside the connection allowlist, so generation
+* records "no PRs today" instead of an error and the surface silently goes dark.
+*/
+const WHATS_NEW_DEFAULT_REPOSITORY = "Bike4Mind/bike4mind";
+const WHATS_NEW_DEFAULT_TARGET_BRANCH = "prod";
 const L = {
 	temperature: {
 		min: 0,
@@ -7495,8 +7115,8 @@ const WhatsNewConfigSchema = z$1.object({
 	maxCommitMessageLength: z$1.number().min(L.maxCommitMessageLength.min).max(L.maxCommitMessageLength.max).default(L.maxCommitMessageLength.default),
 	maxPRBodyLength: z$1.number().min(L.maxPRBodyLength.min).max(L.maxPRBodyLength.max).default(L.maxPRBodyLength.default),
 	maxChangelogLength: z$1.number().min(L.maxChangelogLength.min).max(L.maxChangelogLength.max).default(L.maxChangelogLength.default),
-	repository: z$1.string().regex(/^[\w.-]+\/[\w.-]+$/, "Must be in owner/repo format (e.g., MyOrg/my-repo)").default("MillionOnMars/lumina5"),
-	targetBranch: z$1.string().regex(/^[\w./-]+$/, "Must be a valid branch name").default("prod"),
+	repository: z$1.string().regex(/^[\w.-]+\/[\w.-]+$/, "Must be in owner/repo format (e.g., MyOrg/my-repo)").default(WHATS_NEW_DEFAULT_REPOSITORY),
+	targetBranch: z$1.string().regex(/^[\w./-]+$/, "Must be a valid branch name").default(WHATS_NEW_DEFAULT_TARGET_BRANCH),
 	promptTemplate: z$1.string().min(L.promptTemplate.min, `Prompt template must be at least ${L.promptTemplate.min} characters`).max(L.promptTemplate.max, `Prompt template cannot exceed ${L.promptTemplate.max.toLocaleString()} characters`).trim().optional()
 });
 const WhatsNewSyncConfigSchema = z$1.object({
@@ -7934,8 +7554,12 @@ const API_SERVICE_GROUPS = {
 				order: 10
 			},
 			{
-				key: "dataLakeSearchMaxChunksPerFile",
+				key: "forcedRetrievalSpreadFloorPct",
 				order: 11
+			},
+			{
+				key: "dataLakeSearchMaxChunksPerFile",
+				order: 12
 			}
 		]
 	},
@@ -8929,6 +8553,16 @@ const settingsMap = {
 		order: 91,
 		dependsOn: "EnableDataLakes"
 	}),
+	EnableLakeModelInconsistencyDetection: makeBooleanSetting({
+		key: "EnableLakeModelInconsistencyDetection",
+		name: "Data Lakes: Model-driven contradiction pass",
+		defaultValue: false,
+		description: "Gate for the model-driven reading pass (#3057) that finds cross-document contradictions the lexical pattern rules cannot - two documents stating incompatible things in ordinary prose. Off by default: unlike the free lexical pass, this reads corpus content through an LLM, so it costs real money per run. Findings land in the same durable findings collection (detector: 'model') as the lexical pass, triggered the same way (POST /api/data-lakes/:id/inconsistencies?detector=model), gated separately here and rate-limited far lower per caller. Detect only - see the guardrail on corpusInconsistency.ts.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 98,
+		dependsOn: "EnableDataLakes"
+	}),
 	EnableDataLakeVectorSearch: makeBooleanSetting({
 		key: "EnableDataLakeVectorSearch",
 		name: "Data Lakes: Use Atlas $vectorSearch",
@@ -9000,6 +8634,16 @@ const settingsMap = {
 		order: 95,
 		dependsOn: "EnableDataLakes"
 	}),
+	EnableDataLakeGitHub: makeBooleanSetting({
+		key: "EnableDataLakeGitHub",
+		name: "Data Lakes: GitHub repository source",
+		defaultValue: false,
+		description: "Server-side gate for connecting a GitHub repository to a data lake through the read-only GitHub App (contents:read + metadata:read on the one selected repository). Off by default while the connect, ingest and purge pieces land dark; every GitHub lake route answers 403 until it is on.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 96,
+		dependsOn: "EnableDataLakes"
+	}),
 	EnforceLakeAdmission: makeBooleanSetting({
 		key: "EnforceLakeAdmission",
 		name: "Data Lakes: Enforce the admission contract",
@@ -9015,6 +8659,21 @@ const settingsMap = {
 			"lake"
 		] }
 	}),
+	EnforceLakeOriginOnIngest: makeBooleanSetting({
+		key: "EnforceLakeOriginOnIngest",
+		name: "Data Lakes: Enforce curated-lake origin on ingest",
+		defaultValue: true,
+		description: "ON by default: unattended ingest (the Drive folder sync) refuses to add content to a lake whose owner declared it curated. OFF makes the refusal advisory and lets the write through. Unlike the admission contract this ships ON, because it refuses on an explicit owner declaration rather than a heuristic, and because the origin backfill marks every lake that currently has a connector as connector-fed - so at rollout this refuses nothing that exists. The lake rung is the one that matters; the org and owner rungs disable it across every lake in that scope at once. A flip is not instantaneous: the settings cache is per-instance, so it applies immediately on the instance that served the change and within ~5 min elsewhere.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 97,
+		dependsOn: "EnableDataLakes",
+		scope: { settableAt: [
+			"organization",
+			"owner",
+			"lake"
+		] }
+	}),
 	EnableBriefcase: makeBooleanSetting({
 		key: "EnableBriefcase",
 		name: "Enable Briefcase",
@@ -10192,7 +9851,7 @@ const settingsMap = {
 		description: "Most chunks from any ONE source document a data-lake semantic search may return in its top-K. A diversity guard for CONTESTED slots: where several documents answer the question, it stops the best-scoring one from taking slots the others could have filled. It is NOT a fix for severe crowding - the cap redistributes only among the candidates retrieval already returned, so a document that supplies enough of the top-scoring chunks to fill that pool on its own is one the cap cannot change at all. On a corpus of book-length documents, expect enabling this to change little beyond widening the vector-search request. 0 (default) disables the cap, byte-identical to behavior before this setting existed. The cap never SHRINKS a result set - once the spread-out picks are in, any slots still open are backfilled with the highest-scoring chunks the cap held back, so a lake whose only match is one document still returns a full top-K. A value at or above the result count is also a no-op, since nothing can ever be held back. Below it, each retrieval stream's candidate pool is widened to a fixed multiple of the result count so the cap has a spread to choose from. The scanned corpus itself does not grow (that is bounded separately), but the vector-search backends are asked for that many more matches, and a larger in-memory ranking pool costs some CPU. 2-3 is the useful range; 1 serves one passage per document, which suits a corpus of many short documents and starves a question whose answer spans one long one. The chat knowledge-base path ranks more passages than it serves, so it applies the cap a second time at the count it actually serves - otherwise the spread-out picks, which are by definition the lowest-scoring ones admitted, would land in the passages that path discards.",
 		category: "AI",
 		group: API_SERVICE_GROUPS.EMBEDDING.id,
-		order: 11,
+		order: 12,
 		scope: { settableAt: ["organization", "owner"] }
 	}),
 	forcedRetrievalCharBudget: makeNumberSetting({
@@ -10275,12 +9934,25 @@ const settingsMap = {
 		min: 1,
 		max: 100,
 		int: true,
-		description: `Absolute minimum cosine similarity, as a percent, a chunk must clear to be injected on a Data-Lake-mode turn. This is a sanity floor for genuinely unrelated content, NOT the ranking gate - the relative floor above does the ranking. LEAVE IT AT 75 UNLESS YOU HAVE MEASURED YOUR OWN CORPUS: a raw cosine means nothing outside the embedding model it was fitted to, so while this reads 75 the server ignores it and applies the floor measured for whichever model your documents are actually embedded with (${forcedRetrievalFloorsBySpaceSummary}, and no absolute floor at all for a model nobody has measured - the relative floor still applies). Set any other value and the server uses exactly that, in every space, which is yours to get right: 75 against text-embedding-3-small sits above that band entirely and returns nothing on every query. Where this floor lands inside your band decides a lot - on one measured corpus 74 / 75 / 76 swung recall 91% / 65% / 40% - and the same 75 that is a cliff on one lake rejects nothing at all on another. Re-measure after changing the embedding model; the sweep tool is packages/scripts/retrieval/forcedFloorSweep.ts.`,
+		description: `Absolute minimum cosine similarity, as a percent, a chunk must clear to be injected on a Data-Lake-mode turn. This is a sanity floor for genuinely unrelated content, NOT the ranking gate - the relative floor above does the ranking. LEAVE IT AT 75 UNLESS YOU HAVE MEASURED YOUR OWN CORPUS: a raw cosine means nothing outside the embedding model it was fitted to, so while this reads 75 the server ignores it and applies the floor measured for whichever model your documents are actually embedded with (${forcedRetrievalFloorsBySpaceSummary}, and no absolute floor at all for a model nobody has measured - the relative floor still applies). Set any other value and the server uses exactly that, in every space, which is yours to get right: 75 against text-embedding-3-small sits above that band entirely and returns nothing on every query. Where this floor lands inside your band decides a lot - on one measured corpus 74 / 75 / 76 swung recall 91% / 65% / 40% - and the same 75 that is a cliff on one lake rejects nothing at all on another. Re-measure after changing the embedding model.`,
 		category: "AI",
 		group: API_SERVICE_GROUPS.EMBEDDING.id,
 		order: 10,
 		scope: { settableAt: ["organization", "owner"] }
 	}),
+	forcedRetrievalSpreadFloorPct: makeNumberSetting({
+		key: "forcedRetrievalSpreadFloorPct",
+		name: "Forced Retrieval Spread Floor (%)",
+		defaultValue: 0,
+		min: 0,
+		max: 100,
+		int: true,
+		description: "How far below the best-scoring passage of the SAME turn a chunk may score and still be injected, as a percent of the gap between that best score and a typical one (this turn's median). 0 (the default) disables it. This is the only one of the three floors whose cut depends on the QUESTION rather than on where the score band sits: a question one document answers sharply leaves its answer far above the median and admits few passages, while a broad question leaves many passages bunched near the top and admits many. The other two floors cannot tell those turns apart, which is why retrieved volume otherwise tracks the character budget instead of the question. Because it is measured in units of the band rather than against a fixed cosine, the same value means the same thing in every embedding space and does not need re-tuning when the embedding model changes. Lower is stricter (10 keeps only passages within a tenth of the way down to the median); 100 cuts at the median itself. It can never empty a turn - the best passage always clears its own cutoff. Ships off because no magnitude has been measured yet; measure one offline before turning it on.",
+		category: "AI",
+		group: API_SERVICE_GROUPS.EMBEDDING.id,
+		order: 11,
+		scope: { settableAt: ["organization", "owner"] }
+	}),
 	LakeAccessAuditRetentionDays: makeNumberSetting({
 		key: "LakeAccessAuditRetentionDays",
 		name: "Lake Access Audit Retention (days)",
@@ -10708,8 +10380,8 @@ const settingsMap = {
 			maxCommitMessageLength: 200,
 			maxPRBodyLength: 500,
 			maxChangelogLength: 1e3,
-			repository: "MillionOnMars/lumina5",
-			targetBranch: "main"
+			repository: WHATS_NEW_DEFAULT_REPOSITORY,
+			targetBranch: WHATS_NEW_DEFAULT_TARGET_BRANCH
 		},
 		description: "Configuration for automated What's New modal generation, including LLM model selection, prompt parameters, validation rules, and content sanitization limits.",
 		category: "Admin",
@@ -11281,7 +10953,14 @@ const TokensBySourceSchema = z$1.object({
 	fabFiles: z$1.number(),
 	urlContent: z$1.number(),
 	toolSchemas: z$1.number(),
-	userPrompt: z$1.number()
+	userPrompt: z$1.number(),
+	/**
+	* Lake-sourced content injected this turn (forced retrieval + the lake-memory hot card), split out
+	* of `systemPrompts`. Optional and absent means UNKNOWN, never zero - telemetry captured before
+	* this bucket existed has no value to report and must not be read as "no lake content". Mirrors
+	* PromptMetaTokensBySourceSchema in promptMeta.ts.
+	*/
+	lakeRetrieval: z$1.number().optional()
 });
 z$1.object({
 	/** gen_ai.usage.input_tokens */
@@ -11528,6 +11207,7 @@ const PromptMetaModelParametersSchema = z$1.object({
 	prompt_upsampling: z$1.boolean().optional(),
 	seed: z$1.number().optional(),
 	output_format: z$1.string().optional(),
+	background: z$1.string().optional(),
 	response_format: z$1.string().optional(),
 	seconds: z$1.number().optional(),
 	model: z$1.string().optional()
@@ -11535,11 +11215,7 @@ const PromptMetaModelParametersSchema = z$1.object({
 const PromptMetaModelSchema = z$1.object({
 	name: z$1.string(),
 	parameters: PromptMetaModelParametersSchema.optional(),
-	type: z$1.enum([
-		"text",
-		"image",
-		"video"
-	]).optional(),
+	type: z$1.enum(PROMPT_META_MODEL_TYPES).optional(),
 	backend: z$1.string().optional(),
 	contextWindow: z$1.number().optional(),
 	maxTokens: z$1.number().optional(),
@@ -11593,7 +11269,16 @@ const PromptMetaTokensBySourceSchema = z$1.object({
 	fabFiles: z$1.number(),
 	urlContent: z$1.number(),
 	toolSchemas: z$1.number(),
-	userPrompt: z$1.number()
+	userPrompt: z$1.number(),
+	/**
+	* Lake-sourced content injected this turn - forced retrieval (`knowledge_retrieval`) plus the
+	* lake-memory hot card (`lake_memory`) - moved out of the `systemPrompts` residual so the
+	* breakdown can price the lake separately. Optional, and absent means UNKNOWN, never zero: turns
+	* recorded before this field existed carry no value and none can be backfilled, because the only
+	* evidence was the residual this split had not yet made. Same absent-is-unknown rule as
+	* `retrieval.injected` below.
+	*/
+	lakeRetrieval: z$1.number().optional()
 });
 const PromptMetaContextSchema = z$1.object({
 	attachedFiles: z$1.array(PromptMetaAttachedFileSchema).optional(),
@@ -11765,7 +11450,28 @@ const CitableSourceSchema = z$1.object({
 		practiceAreas: z$1.array(z$1.string()).optional(),
 		chunkId: z$1.string().optional(),
 		relevanceScore: z$1.number().optional(),
-		fullContext: z$1.string().optional()
+		fullContext: z$1.string().optional(),
+		/** web_search's own thumbnail/image cluster for this source, gated on `withImages`. */
+		thumbnail: z$1.string().optional(),
+		images: z$1.array(z$1.string()).optional(),
+		/**
+		* Ids of the other cited sources this one provably disagrees with (#3041). Declared rather
+		* than left to the loose object, for the same reason chunkId/fullContext are: a writer that
+		* stamps the wrong shape should fail here, not render a badge that silently names nobody.
+		*/
+		conflictsWith: z$1.array(z$1.string()).optional(),
+		/** web_search's provider-located place (WebSearchPlace), the only source of map coordinates. */
+		place: z$1.object({
+			id: z$1.string(),
+			name: z$1.string(),
+			lat: z$1.number(),
+			lng: z$1.number(),
+			rating: z$1.number().optional(),
+			reviews: z$1.number().optional(),
+			category: z$1.string().optional(),
+			address: z$1.string().optional(),
+			thumbnail: z$1.string().optional()
+		}).optional()
 	}).optional()
 });
 /**
@@ -11903,12 +11609,28 @@ const RetrievalSummarySchema = z$1.object({
 	* the per-turn routing question is about, and before this it was indistinguishable from a turn
 	* where forced retrieval was never configured at all.
 	*/
-	forcedSkipReason: z$1.enum(["attached_files", "personal_corpus"]).optional(),
+	forcedSkipReason: z$1.enum([
+		"attached_files",
+		"personal_corpus",
+		"no_lake_scope"
+	]).optional(),
 	/** Which retrieval-capable surface(s) ran this turn, e.g. 'lake-memory', 'knowledgeBaseSearch'. */
 	surfaces: z$1.array(z$1.string()),
 	/** Lakes resolved at the moment retrieval ran, stamped point-in-time (not read live from the session). */
 	dataLakeTags: z$1.array(z$1.string()),
 	/**
+	* The subset of `dataLakeTags` that actually put files into the ranked scope. `dataLakeTags`
+	* alone says which lakes were REQUESTED, which read as "searched" while a lake could contribute
+	* nothing - the retrieval budget used to be spent in file order and starved whichever lake
+	* sorted last.
+	*
+	* Optional because attribution is best-effort: a file matched by a lake's prefix/membership arm
+	* can carry no reversible `datalake:` tag (see attributeAccessedLakes), and the producer omits
+	* this rather than reporting an inconclusive scope as "no lake contributed". Absent means
+	* unknown, NOT none.
+	*/
+	dataLakeTagsWithCandidates: z$1.array(z$1.string()).optional(),
+	/**
 	* The lake scope the turn's retrieval surfaces WOULD have searched, resolved at the seed site
 	* whether or not any of them ran: the caller's accessible lakes narrowed to the session
 	* (narrowLakeAccessToSession), or empty where the corpus is personal and the lake arms are
@@ -11995,16 +11717,25 @@ const RetrievalSummarySchema = z$1.object({
 	* not "what reached the model": `ranked.length` and `scored.length` in KnowledgeRetrievalFeature
 	* - the candidates left after the absolute similarity floor, and after the relative floor
 	* trims them. `chunks` is what survived the char budget on top of that, so the three
-	* numbers bracket two independent trimmers:
+	* numbers bracket three independent trimmers:
 	*
-	*   pre -> [relative floor] -> post -> [char budget] -> chunks
+	*   pre -> [relative floor] -> post -> [spread floor] -> postSpread -> [char budget] -> chunks
 	*
 	* They exist so a low `chunks` is diagnosable - a small corpus and a floor that trimmed a large
-	* pool end in the same `chunks`. `pre - post` is the floor's own effect and nothing else;
+	* pool end in the same `chunks`. `pre - post` is the relative floor's own effect and nothing
+	* else, and `post - postSpread` the spread floor's;
 	* `pre - chunks` is NOT, because the budget trims the same walk. Both optional: only forced
 	* retrieval computes a ranked pool, a surface without one (lake memory, the knowledge tools)
-	* never writes either, and absence must not read as zero candidates. SUMMED like `chunks`, with
-	* the same absent-is-not-zero handling as `topScore`.
+	* never writes any of them, and absence must not read as zero candidates. SUMMED like `chunks`,
+	* with the same absent-is-not-zero handling as `topScore`.
+	*
+	* `backgroundScore` is the median of every score the turn compared, and `postSpreadFloorCandidates`
+	* what is left once the spread floor cuts against it. Recorded even while that floor is OFF (its
+	* shipped default), in which case `postSpread` equals `post` and the pair degenerates to a
+	* diagnostic: `topScore - backgroundScore` is the turn's signal spread, and the distribution of
+	* that quantity over production traffic is what a value for `forcedRetrievalSpreadFloorPct` has to
+	* be chosen from. NOT comparable across embedding spaces as an absolute number, for the same
+	* reason `topScore` is not; the RATIO of the two floors' cuts is.
 	*
 	* COMPARE THE PAIR ONLY TO ITSELF, never to `chunks`, unless `surfaces` is forced retrieval
 	* alone. `chunks` and `chars` sum across ALL surfaces while this pair is forced-only, so a mixed
@@ -12026,7 +11757,9 @@ const RetrievalSummarySchema = z$1.object({
 		chars: z$1.number(),
 		topScore: z$1.number().optional(),
 		preRelativeFloorCandidates: z$1.number().optional(),
-		postRelativeFloorCandidates: z$1.number().optional()
+		postRelativeFloorCandidates: z$1.number().optional(),
+		postSpreadFloorCandidates: z$1.number().optional(),
+		backgroundScore: z$1.number().optional()
 	}).optional(),
 	/**
 	* Could the corpus in scope have answered this turn, whether or not the model went looking?
@@ -12125,7 +11858,44 @@ const RetrievalSummarySchema = z$1.object({
 	* absence is weaker evidence than presence. Date-bound any rollup: turns predating this field
 	* carry nothing, and no backfill is possible - a past turn's grant rows have moved on.
 	*/
-	grantedLakeIdsUsed: z$1.array(z$1.string()).optional()
+	grantedLakeIdsUsed: z$1.array(z$1.string()).optional(),
+	/**
+	* How many lakes were excluded from this turn's scope because the caller lacks the access to
+	* search them, and why (#3055). Resolved at the seed alongside `lakeScope`, from a dedicated
+	* count-only query (see excludedByAccessCount on getDynamicDataLakeAccess - NOT derived from
+	* the candidate set `lakeScope` comes from, which already has the gate enforced datastore-side
+	* and so cannot see this population).
+	*
+	* ABSENT MEANS NOT RECORDED, never "nothing was excluded" - a turn with nothing excluded records
+	* `count: 0` explicitly. Three distinct causes collapse into this one absent state and are not
+	* distinguishable from it: a turn predating this field, a turn whose `retrieval` was written
+	* only by a tool arm rather than by the seed, and the count-only query itself failing or not
+	* being wired on this host (mirrors `lakeViewComplete`'s contract on the access resolver: a
+	* failure must report unknown, never a false zero).
+	*
+	* COUNT AND REASON ONLY, DELIBERATELY. Never a lake id, name, or tag: the caller may not be
+	* permitted to know a given excluded lake exists at all, and this field must stay safe to show
+	* them regardless of which specific lake(s) it is counting. `reason` is a closed enum, not free
+	* text - prose could leak a lake's identity through phrasing - so a future exclusion cause (e.g.
+	* an archived or quota-limited lake) adds an enum value here rather than a description.
+	*
+	* 'access' is the only reason today: the caller's org membership or the lake's public listing
+	* surfaced it as a candidate (they could see it exists) but they hold neither its own
+	* gate/entitlement nor an ownership or grant exception for it.
+	*
+	* A session-preauthorized lake (unionPreauthorizedLakeAccess) that is ALSO gate-dropped from
+	* this account-wide count is corrected, not merely narrow: the seed's targeted measurement
+	* (measureIdentityNamedExclusion, ChatCompletionProcess's promptMeta seed) excludes exactly the
+	* tags this turn successfully admitted via preauthorization before running the gate query, so an
+	* admitted-and-searched lake never reports here as excluded. This account-wide number itself
+	* (excludedByAccessCount on getDynamicDataLakeAccess) is still computed before that union and is
+	* NOT corrected the same way - only the per-turn targeted measurement is, which is what a
+	* preauthorized session's own narrowing always uses (see sessionNamesALake's call site).
+	*/
+	excludedLakes: z$1.object({
+		count: z$1.number().int().nonnegative(),
+		reason: z$1.enum(["access"])
+	}).optional()
 });
 /**
 * Why a grounded turn's library scan stopped short of the whole library.
@@ -12264,9 +12034,18 @@ z$1.object({
 	schemaVersion: z$1.number().int().positive(),
 	/** Product identifier: 'vibeswire', 'bike4mind', 'stocksandvibes', 'k2kanji', etc. */
 	productId: z$1.string().min(1).max(64),
-	/** Product's internal user ID */
+	/**
+	* Product's internal user ID, or OVERWATCH_ANONYMOUS_USER_ID when the event has no
+	* identified user. See the session and identity conventions below.
+	*/
 	userId: z$1.string().min(1).max(256),
-	/** Session identifier for retention/funnel analysis */
+	/**
+	* Visit identifier. Overwatch counts distinct values of this per product as the first
+	* stage of its acquisition funnel, so one value per visit is what makes that count a
+	* count of visits. An emitter that cannot tell which visit a request belongs to sends
+	* OVERWATCH_UNKNOWN_SESSION_ID rather than a value of its own invention - see the
+	* conventions below.
+	*/
 	sessionId: z$1.string().min(1).max(256),
 	/** Event type: 'session_start', 'signup', 'feature_used', etc. */
 	event: z$1.string().min(1).max(128),
@@ -12283,6 +12062,153 @@ z$1.object({
 		z$1.boolean()
 	])).refine((v) => JSON.stringify(v).length <= 1024, "metadata must be ≤ 1KB serialized").optional()
 });
+/**
+* Public wire schema for `GET /api/v1/me` - the caller's own identity and
+* commercial state, and nothing else.
+*
+* Deliberately narrower than the user document `/api/identify` returns: no email,
+* no tags, no internal flags. Everything here answers one of three questions a
+* downstream app has to ask before it spends - who is this, what have they paid
+* for, can they afford the next call.
+*
+* Public-API rules apply: snake_case wire fields, no `.catch()`, no top-level
+* `.transform()`.
+*/
+/**
+* Rung on the B4M plan ladder the caller currently sits on.
+*
+* `free` means no active subscription. `other` is still a paying customer: either
+* an active plan that is not on the ladder (`SubscriptionPlanDetail.tier` is
+* optional - a standalone product omits it so it stays out of the cross-plan
+* change flow), or one whose Stripe price the deployment can no longer name, as
+* happens to a subscriber grandfathered on a superseded price. `subscription` is
+* `null` in that second case.
+*
+* Gate on `tier !== 'free'` for "is this caller paying" and on `subscription.
+* price_id` for "which product" - NOT on `basic`/`pro`, whose ordinals come from
+* the internal change-flow ladder and do not track a plan's marketing name (the
+* Professional plan occupies the `basic` rung today).
+*/
+const ME_TIERS = [
+	"free",
+	"basic",
+	"pro",
+	"other"
+];
+/** The caller's active subscription, or `null` when they have none the deployment can name. */
+const MeSubscriptionSchema = z$1.object({
+	plan_name: z$1.string(),
+	price_id: z$1.string(),
+	interval: z$1.enum(["monthly", "yearly"]),
+	/** ISO 8601. When the current billing period ends - not a cancellation date. */
+	current_period_ends_at: z$1.string()
+});
+const MeResponseSchema = z$1.object({
+	/** Stable B4M user id. Safe to key an integrator's own records on. */
+	id: z$1.string(),
+	/** Display name. Never the email address. */
+	name: z$1.string(),
+	tier: z$1.enum(ME_TIERS),
+	subscription: MeSubscriptionSchema.nullable(),
+	credits: z$1.object({ 
+	/**
+	* Spendable credits on the caller's PERSONAL ledger. Organization pools are not
+	* included - a call billed to an organization draws on a balance this number
+	* does not describe.
+	*/
+balance: z$1.number() }),
+	/** Entitlement keys the caller currently holds, e.g. `base`. */
+	entitlements: z$1.array(z$1.string())
+});
+/**
+* Every tool name in `b4mLLMTools`. Exhaustive by annotation - do not widen the type.
+*/
+const CORE_TOOL_SIDE_EFFECTS = {
+	dice_roll: "none",
+	weather_info: "none",
+	web_search: "none",
+	web_fetch: "none",
+	wolfram_alpha: "none",
+	deep_research: "none",
+	math_evaluate: "none",
+	current_datetime: "none",
+	prompt_enhancement: "none",
+	wikipedia_on_this_day: "none",
+	moon_phase: "none",
+	sunrise_sunset: "none",
+	iss_tracker: "none",
+	planet_visibility: "none",
+	search_knowledge_base: "none",
+	retrieve_knowledge_content: "none",
+	count_knowledge_base: "none",
+	describe_knowledge_base: "none",
+	chess_engine: "none",
+	fmp_financial_data: "none",
+	bob_panel_read: "none",
+	skill: "none",
+	recharts: "local",
+	mermaid_chart: "local",
+	navigate_view: "local",
+	generate_jupyter_notebook: "local",
+	optihashi_schedule: "local",
+	optihashi_formulate: "local",
+	optihashi_edit_problem: "local",
+	image_generation: "external",
+	edit_image: "external",
+	music_generation: "external",
+	audio_generation: "external",
+	excel_generation: "external",
+	edit_file: "external",
+	blog_publish: "external",
+	blog_edit: "external",
+	blog_draft: "external",
+	delegate_to_agent: "external"
+};
+/**
+* Tool names that reach the pipeline from outside `b4mLLMTools` - the CLI tool set, the
+* Slack tool set, and premium-overlay tools supplied at runtime via the `externalTools`
+* merge. No enum to key off, so these get no compile-time exhaustiveness; an unlisted name
+* falls through to the gated default, which is the correct failure direction.
+*/
+const EXTERNAL_REGISTRY_SIDE_EFFECTS = {
+	file_read: "none",
+	glob_files: "none",
+	grep_search: "none",
+	recent_changes: "none",
+	check_shell_output: "none",
+	list_background_shells: "none",
+	lattice_query: "none",
+	lattice_explain: "none",
+	ask_user_question: "local",
+	create_file: "external",
+	edit_local_file: "external",
+	delete_file: "external",
+	bash_execute: "external",
+	write_shell_stdin: "external",
+	kill_background_shell: "external",
+	lattice_create_model: "external",
+	lattice_add_entity: "external",
+	lattice_set_value: "external",
+	lattice_create_rule: "external",
+	slackbot_help: "none",
+	list_curated_files: "none",
+	notebook_status: "none",
+	share_curated_file: "external",
+	notebook_new: "external",
+	confirm_pending_action: "external",
+	cancel_pending_action: "external",
+	mission_status: "none",
+	optihashi_decompose: "local",
+	optihashi_solve: "local",
+	send_slack_message: "external",
+	coordinate_task: "external",
+	code_execute: "external",
+	video_generation: "external"
+};
+({
+	...CORE_TOOL_SIDE_EFFECTS,
+	...EXTERNAL_REGISTRY_SIDE_EFFECTS
+});
 const InternalTeamMemberSchema = z$1.object({
 	name: z$1.string().min(1, "Name is required"),
 	phone: z$1.string().min(1, "Phone is required"),
@@ -12827,22 +12753,17 @@ const DATA_LAKES = [{
 	}
 })()];
 new Set(DATA_LAKES.map((l) => l.id));
-/**
-* Canonical normalization for entitlement keys + `requiredEntitlement` values - the ONE
-* rule, applied at write time (create/update/stamp) and at match time. Mirrors the
-* entitlement registry's `normalizeTag` (trim + lowercase) so a value authored in any
-* casing matches the lowercase keys the resolver produces.
-*/
-const normalizeEntitlementKey = (key) => key.trim().toLowerCase();
 const sha256Regex = /^[a-f0-9]{64}$/;
+const requiredUserTagValue = z.string().trim().min(1).max(100).refine((s) => !/[,;]/.test(s), "User tag must be a single tag with no commas or semicolons (e.g. \"vip\" or \"Sales Team\")");
 z.object({
 	name: z.string().min(1).max(200),
 	slug: z.string().min(2).max(60).regex(DATA_LAKE_SLUG_REGEX, "Slug must be lowercase alphanumeric with hyphens (e.g. \"my-data-lake\")"),
 	description: z.string().max(2e3).optional(),
 	fileTagPrefix: z.string().trim().min(2).max(30).refine((s) => s.endsWith(":"), "Tag prefix must end with \":\" (e.g. \"acme:\")").refine((s) => !hasBlankTagPrefixSegment(s), "Tag prefix segments must be non-empty (e.g. \"acme:\" or \"acme:legal:\")").refine((s) => !isReservedTagPrefix(s), `Tag prefix cannot use the reserved "${DATALAKE_TAG_PREFIX}" namespace`),
-	requiredUserTag: z.string().min(1).max(100).optional(),
+	requiredUserTag: requiredUserTagValue.optional(),
 	requiredEntitlement: z.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")").optional(),
-	organizationId: z.string().optional()
+	organizationId: z.string().optional(),
+	origin: z.enum(DATA_LAKE_ORIGINS).optional()
 });
 z.object({
 	name: z.string().min(1).max(200).optional(),
@@ -12850,11 +12771,12 @@ z.object({
 	systemPrompt: z.string().optional(),
 	preferredSystemPromptId: z.union([z.literal(""), z.string().min(1).max(200)]).optional(),
 	groundingMode: z.enum(DATA_LAKE_GROUNDING_MODES).optional(),
-	requiredUserTag: z.union([z.literal(""), z.string().min(1).max(100)]).optional(),
+	requiredUserTag: z.union([z.literal(""), requiredUserTagValue]).optional(),
 	requiredEntitlement: z.union([z.literal(""), z.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")")]).optional(),
 	auditQueryTextEnabled: z.boolean().optional(),
 	lakeMemoryEnabled: z.boolean().optional(),
-	requiredPassageTokenTarget: z.number().int().min(64).max(OVERSIZED_PASSAGE_TOKEN_THRESHOLD).nullable().optional()
+	requiredPassageTokenTarget: z.number().int().min(64).max(OVERSIZED_PASSAGE_TOKEN_THRESHOLD).nullable().optional(),
+	origin: z.enum(DATA_LAKE_ORIGINS).optional()
 });
 z.object({
 	groundingMode: z.enum(DATA_LAKE_GROUNDING_MODES).optional(),
@@ -12989,14 +12911,387 @@ const ImageTemplateSettingsSchema = z$1.object({
 	safety_tolerance: z$1.number().min(0).max(6).optional(),
 	prompt_upsampling: z$1.boolean().optional()
 });
-z$1.object({
-	name: z$1.string().min(1).max(100),
-	description: z$1.string().max(500).optional(),
-	category: z$1.string().max(50).optional(),
-	model: ImageTemplateModelSchema,
-	settings: ImageTemplateSettingsSchema
-}).omit({ model: true }).partial();
-z$1.union([ToolExecutionResponseSchema, ApiErrorSchema]);
+z$1.object({
+	name: z$1.string().min(1).max(100),
+	description: z$1.string().max(500).optional(),
+	category: z$1.string().max(50).optional(),
+	model: ImageTemplateModelSchema,
+	settings: ImageTemplateSettingsSchema
+}).omit({ model: true }).partial();
+/**
+* Identity factory that pins an endpoint contract's type. The `const` type
+* parameter preserves the concrete request-schema type so downstream adapters
+* can infer the validated body type (`z.infer<contract['request']>`) rather than
+* collapsing to the `z.ZodTypeAny` constraint.
+*
+* Otherwise deliberately a no-op at runtime (no registry side effect, no
+* `.openapi()`) so a contract stays a plain, transport-agnostic value that any
+* runtime can import - the one exception is the `pathParams`/`queryParams`
+* overlap check below, a plain assertion with no side effect of its own.
+*/
+function defineEndpoint(contract) {
+	if (contract.pathParams && contract.queryParams) {
+		const queryKeys = new Set(Object.keys(contract.queryParams.shape));
+		const overlap = Object.keys(contract.pathParams.shape).filter((key) => queryKeys.has(key));
+		if (overlap.length > 0) throw new Error(`defineEndpoint(${contract.operationId}): pathParams and queryParams both declare ${JSON.stringify(overlap)}. Next merges both into req.query by name, so the path segment would silently win over the query value. Rename one side.`);
+	}
+	return contract;
+}
+defineEndpoint({
+	method: "post",
+	path: "/api/chat",
+	operationId: "sendChatMessage",
+	summary: "Send a chat message",
+	description: "Sends a message to the AI and creates a quest to process it. By default (async) the call returns immediately with a quest id; poll `GET /api/quests/{id}` for the reply. Send `wait: true` to block until the reply is ready and receive it inline. A tool that produced machine-readable state reports it under `toolPayloads` - an array of `{ type, payload }` entries in emission order, alongside (never instead of) the prose reply - on the `wait: true` body and on the polled quest. A turn can FAIL after the ACK - reported on the polled quest as `type: \"error\"`, since the ACK was already sent. A terminal `status: \"stopped\"` (a missing session, a user-cancelled turn) is ALSO a failure even without `type: \"error\"` - it carries an explanatory string in `reply`/`replies` rather than an answer. `type` is the failure signal for the classified failure classes (an abort, a provider timeout, credit exhaustion); `errorCode` is an optional refinement present only when the failure is a classified billing reason. A recovered stuck quest is NOT in that list: one that still has renderable content resolves as a success by design. `QUEST_ERROR_CODES` has two members, but only `insufficient_credits` is raised as a quest errorCode by any current throw site on this endpoint - `spend_cap_exceeded` is thrown only by the embed chat route's pre-flight, which fires outside the process try/catch that would classify it onto a quest. A caller must treat `type: \"error\"` OR a terminal `status: \"stopped\"` as failure even when `errorCode` is absent, and must not read `reply` as an answer without checking those first. Authenticate with an API key (`b4m_live_`) or a JWT.",
+	tags: ["AI"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:chat", "ai:generate"],
+	request: SimplifiedChatRequestSchema,
+	requestExample: {
+		message: "How do I reset my password?",
+		toolMode: "smart"
+	},
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "Message accepted - NOT a completed turn. The default (async) path returns this queued ACK; the outcome arrives on `GET /api/quests/{id}` (see the `sendChatMessage200PollResult` schema). With `wait: true` the body additionally carries the completed reply (`response`/`responses`), `toolPayloads`, `createdAt`, and `performance` timings - fields not modelled here yet; the synchronous response shape is a follow-up. A turn that FAILS still resolves with `200`, never a 4xx, on both that `wait: true` body and the polled quest (`GET /api/quests/{id}`) - the prose explaining why lands in `reply`/`response` like any other answer, so the reply text alone cannot tell a failure from an answer. `type` is the field that can: both surfaces carry it unconditionally, so match on `type: \"error\"` first - it covers credit exhaustion, a provider timeout or overload, and an in-process aborted turn; a real answer carries the turn's actual completion type instead (`\"message\"` for an ordinary reply). Two related states do NOT set `type: \"error\"`: a user-cancelled turn resolves as `status: \"stopped\"` with `type` left at `\"message\"`, and a recovered stuck quest that still has renderable content resolves as a success (`status: \"done\"`, no error) by design, to avoid destroying content to report a failure. `errorCode` then names the failure reason, but only for the billing failures that have one - `\"insufficient_credits\"` today; it is absent on every other `type: \"error\"` turn, so never use its absence to infer success. On a real answer `errorCode` is absent from the `wait: true` body. Contrast the tts/music/soundEffects contracts, which reject synchronously with a 422 carrying the same `errorCode` vocabulary.",
+			schema: ChatAckSchema,
+			pollResult: {
+				schema: ChatQuestPollResultSchema,
+				description: "Outcome fields of the quest polled at `GET /api/quests/{id}` after this ACK. A finished turn that failed is `status: \"done\"` with `type: \"error\"` and the failure text in `reply`, so a caller reading `reply` alone cannot tell a failure from an answer - check `type` first, and also treat a terminal `status: \"stopped\"` (a missing session, a user-cancelled turn) as failure even though it never sets `type`. `errorCode` is an optional refinement of `type: \"error\"`, present only for a classified billing failure; credit exhaustion arrives here as `insufficient_credits`, the same vocabulary the synchronous 422s on `/api/ai/music`, `/api/ai/sound-effects` and `/api/ai/tts` use. `QUEST_ERROR_CODES` publishes a second member, `spend_cap_exceeded`, but no current throw site on this endpoint raises it as a quest errorCode: its only one, the embed chat route's pre-flight 422, fires outside the process try/catch that would classify it onto the quest. Most `type: \"error\"` turns - an abort, a provider timeout or overload - have NO `errorCode`; its absence does not mean success, only that the failure is unclassified. A recovered stuck quest that still has renderable content is not a failure at all: it keeps `type: \"message\"` even though it did not finish, so a caller gets the content rather than an error. The poll body carries further fields not modelled here, including `images`, `files`, `toolPayloads`, `promptMeta`, and the attachment report (`attachmentNotices`/`attachmentDelivery`) - only the outcome subset is modelled here.",
+				example: {
+					id: "664f1c2b9a1e4d0012ab34cd",
+					status: "done",
+					type: "error",
+					errorCode: "insufficient_credits",
+					reply: "You're out of credits. This request needs about 12 credits, but only 3 are available."
+				}
+			}
+		},
+		400: {
+			description: "No usable default chat model is configured and none was supplied.",
+			schema: ApiErrorSchema
+		},
+		404: {
+			description: "No notebook/session exists to attach the message to.",
+			schema: ApiErrorSchema
+		},
+		422: {
+			description: "Request body failed schema validation.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			message: "How do I reset my password?",
+			toolMode: "smart"
+		}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/v1/agent-executions",
+	operationId: "startAgentExecution",
+	summary: "Start an agent execution",
+	description: "Runs the tool-using agent (ReAct) loop against a session - the same pipeline the product UI's Agent Mode toggle dispatches to, and the REST equivalent of the `agent_execute` WebSocket command. The run is asynchronous: this returns `202` with an execution id, and the caller polls `GET /api/v1/agent-executions/{id}` until `status` is terminal (`completed`, `failed`, or `aborted`). Nothing is streamed back over REST - for live iteration events, use the WebSocket route instead. Omit `agent_id` to get the profile the session's own surface resolves to, which is what reproduces the in-app toggle. The final reply is also written to the session as a normal chat message, so it appears in history. Naming a tool in `tools` also PRE-APPROVES it for the run: there is no interactive client to answer a permission prompt, so a run that calls an approval-gated tool you did not name fails with that tool named in `error` rather than hanging. Authenticate with an API key (`b4m_live_`) or a JWT.",
+	tags: ["AI"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:chat", "ai:generate"],
+	request: AgentExecutionStartRequestSchema,
+	requestExample: {
+		session_id: "<sessionId>",
+		message: "Audit this data set and summarize what stands out."
+	},
+	emitsRateLimitHeaders: true,
+	responses: {
+		202: {
+			description: "Run accepted and dispatched. Poll `tracking_info.poll_url` for status and the answer.",
+			schema: AgentExecutionAckSchema
+		},
+		400: {
+			description: "No usable default chat model is configured and none was supplied.",
+			schema: ApiErrorSchema
+		},
+		404: {
+			description: "No session with the given `session_id` is owned by the caller, or `organization_id` names an organization the caller does not belong to. \"Exists but is not yours\" is reported as 404 too, so neither session ids nor org membership can be probed through this endpoint.",
+			schema: ApiErrorSchema
+		},
+		409: {
+			description: "The caller already has the maximum number of agent runs in flight - a per-user cap shared with runs started from the product UI. Wait for one to reach a terminal status before starting another; aborting a run is currently only possible over the WebSocket route.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		},
+		502: {
+			description: "The executor could not be dispatched. The run did not start, so a retry is safe.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			session_id: "<sessionId>",
+			message: "Audit this data set and summarize what stands out."
+		}
+	}
+});
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/agent-executions/{id}",
+	operationId: "getAgentExecution",
+	summary: "Get an agent execution",
+	description: "Returns the status, reasoning trace, and (once terminal) the final answer of a run started by `POST /api/v1/agent-executions`. `steps` grows while the run is in flight, so polling this endpoint is also how a REST caller follows the loop. Safe (GET) requests on this route are exempt from the per-day API-key quota so polling a single run costs one daily slot, not one per poll; the per-minute burst limit still applies.",
+	tags: ["AI"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:chat", "ai:generate"],
+	pathParams: AgentExecutionIdParamSchema,
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "The execution, its trace, and its answer if it has finished.",
+			schema: AgentExecutionStatusResponseSchema
+		},
+		404: {
+			description: "No execution with that id is visible to the caller.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {}
+	}
+});
+defineEndpoint({
+	method: "put",
+	path: "/api/sessions/{id}",
+	operationId: "updateSession",
+	summary: "Update a session",
+	description: "Updates a session (called a \"notebook\" in the product UI): its name, attached knowledge files, tags, or retrieval settings. Set `knowledgeIds` and `forceKnowledgeRetrieval: true` together to enable grounded retrieval for `POST /api/chat` against this session - retrieval is gated by these session fields, not by the chat request. `lakeScope` narrows that retrieval to a chosen set of data lakes; omit it to leave the current choice unchanged, or send `null` to clear it so retrieval reaches every lake you can access. Authenticate with an API key (`b4m_live_`) or a JWT. Warning: adding to `knowledgeIds` shares those files with every member of every project containing this session by default (see `propagateToProjects`), and that sharing cannot be undone through the UI.",
+	tags: ["Sessions"],
+	auth: "apiKeyOrJwt",
+	scopes: ["notebooks:write"],
+	pathParams: SessionIdParamSchema,
+	request: SessionUpdateRequestSchema,
+	emitsRateLimitHeaders: true,
+	requestExample: {
+		knowledgeIds: ["<fabFileId>"],
+		forceKnowledgeRetrieval: true
+	},
+	responses: {
+		200: {
+			description: "The updated session.",
+			schema: SessionResponseSchema
+		},
+		404: {
+			description: "No session exists with the given id.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			knowledgeIds: ["<fabFileId>"],
+			forceKnowledgeRetrieval: true
+		}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/ai/v1/tools",
+	operationId: "executeTool",
+	summary: "Execute a server-side tool",
+	description: "Runs one of the built-in server-side tools (`weather_info`, `web_search`, `web_fetch`) and returns its result as JSON. Authenticate with a JWT access token only - API keys are NOT accepted on this endpoint. Rate-limited to 100 requests/hour. `request_id` echoes the X-Request-ID response header.",
+	tags: ["AI"],
+	auth: "jwtOnly",
+	request: ToolExecutionRequestSchema,
+	requestExample: {
+		toolName: "web_search",
+		input: { query: "how to reset a password" }
+	},
+	responses: {
+		200: {
+			description: "Tool executed successfully (`success` is always true here).",
+			schema: ToolExecutionResponseSchema,
+			example: {
+				success: true,
+				result: { summary: "Top results for the query." },
+				executionTimeMs: 842,
+				request_id: "abc-123"
+			}
+		},
+		400: {
+			description: "Malformed JSON body.",
+			schema: ApiErrorSchema
+		},
+		401: {
+			description: "Missing or invalid JWT (an API key is rejected here).",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Rate limit exceeded (100 requests/hour).",
+			schema: ApiErrorSchema
+		},
+		500: {
+			description: "Tool execution failed (`success: false` with `error`) or an unexpected server error.",
+			schema: z$1.union([ToolExecutionResponseSchema, ApiErrorSchema]),
+			bespokeErrorShape: "A tool that ran but failed returns the full ToolExecutionResponse (success: false), not an error envelope."
+		}
+	},
+	codeSample: {
+		authToken: "<access_token>",
+		streaming: false,
+		body: {
+			toolName: "web_search",
+			input: { query: "how to reset a password" }
+		}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/ai/v1/completions",
+	operationId: "createCompletion",
+	summary: "Create a chat completion",
+	description: "OpenAI-compatible completion. The response is ALWAYS an SSE stream (`text/event-stream`), regardless of the `stream` flag: a `meta` event, then `content`/`tool_use` events carrying `usage`/`credits`, terminated by `data: [DONE]`. Once the stream has opened the HTTP status stays 200 and failures arrive as an in-band `error` event. The terminal event carries `stopReason`; treat `max_tokens` as a TRUNCATED reply rather than a complete one, and note that omitting `max_tokens` on the request lets the server size the output ceiling for the model (recommended for reasoning models, which spend thinking tokens inside that ceiling). A message `content` may be a string or an array of parts; image parts are accepted in OpenAI Chat (`image_url`), OpenAI Responses (`input_image`) or Anthropic (`image` with a `source`) form and are translated to whatever the target model speaks. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nBILLING FAILURES. Headers are flushed before authentication or pricing, so unlike the JSON surfaces this endpoint has no pre-stream `422` + `errorCode: \"insufficient_credits\"` to pair with: credit exhaustion ALWAYS arrives as the in-band `error` event, whether it is caught by the reservation before the first token or by settlement mid-generation. Branch on that event's `code` (`insufficient_credits` - buy credits; `spend_cap_exceeded` - the owner is solvent but this key hit its admin-set ceiling, so raise the cap), never on `message`, which is prose and may change. `code` is absent on unclassified failures.",
+	tags: ["AI"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:chat", "ai:generate"],
+	request: CompletionRequestSchema,
+	requestExample: {
+		model: "claude-opus-4-8",
+		messages: [{
+			role: "user",
+			content: "How do I reset my password?"
+		}],
+		max_tokens: 500
+	},
+	streaming: true,
+	responses: {
+		200: {
+			description: "SSE stream of completion events (see the CompletionStreamEvent shape).",
+			contentType: "text/event-stream",
+			schema: CompletionStreamEventSchema,
+			example: {
+				type: "content",
+				text: "To reset your password, click 'Forgot password' on the login screen.",
+				usage: {
+					inputTokens: 42,
+					outputTokens: 12
+				},
+				credits: {
+					used: 1,
+					usdCost: 37e-5
+				},
+				stopReason: "end_turn"
+			}
+		},
+		400: {
+			description: "Malformed JSON body (rejected before the stream opens).",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: true,
+		body: {
+			model: "claude-opus-4-8",
+			messages: [{
+				role: "user",
+				content: "How do I reset my password?"
+			}],
+			max_tokens: 500
+		}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/ai/tts",
+	operationId: "synthesizeSpeech",
+	summary: "Synthesize speech from text",
+	description: "Generates speech from text using OpenAI or ElevenLabs. The default `encoding: \"binary\"` streams raw audio bytes with an `audio/*` Content-Type; `encoding: \"base64\"` returns JSON instead. When the requested provider has no usable key (or the provider rejects it), another configured provider stands in and the substitution is reported via `provider`/`fallbackFrom` and the `X-B4M-Tts-Provider*` headers. Input length is capped per provider (OpenAI 4096 characters, ElevenLabs 10000), and an output `format` the chosen provider cannot produce is rejected with a 422 before any provider cost is incurred. Generated audio is saved to the file browser by default (opt out per-user via the saveGeneratedAudio preference, or per-call with `preview`); the outcome is reported via `saved`/`fabFileId` and the `X-B4M-Audio-*` headers. Authenticate with an API key (`b4m_live_`) or a JWT.",
+	tags: ["Audio"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:generate"],
+	request: ttsRequestSchema,
+	requestExample: {
+		text: "Your password has been reset.",
+		provider: "openai",
+		voice: "alloy",
+		format: "mp3"
+	},
+	responses: {
+		200: {
+			description: "Speech synthesized. The default `encoding: \"binary\"` returns raw audio bytes whose Content-Type follows the requested `format` (`audio/mpeg` for mp3, else `audio/wav`, `audio/opus`, `audio/aac`, `audio/flac`, `audio/pcm`); `encoding: \"base64\"` returns the JSON body.",
+			schema: ttsBase64ResponseSchema,
+			example: {
+				audio: "SUQzBAAAAAAA...",
+				format: "mp3",
+				contentType: "audio/mpeg",
+				saved: true,
+				fabFileId: "664f1c2b9a1e4d0012ab34cd"
+			},
+			alsoReturns: [
+				{ contentType: "audio/mpeg" },
+				{ contentType: "audio/wav" },
+				{ contentType: "audio/opus" },
+				{ contentType: "audio/aac" },
+				{ contentType: "audio/flac" },
+				{ contentType: "audio/pcm" }
+			],
+			headers: {
+				"X-B4M-Tts-Provider": "The provider that produced the audio. Present only when a fallback happened.",
+				"X-B4M-Tts-Provider-Fallback-From": "The originally requested provider that could not serve the request. Present only on a fallback.",
+				"X-B4M-Audio-Saved": "Whether a browsable copy was saved to the file browser (\"true\"/\"false\").",
+				"X-B4M-Audio-Fab-File-Id": "Id of the saved file. Present only when the copy was saved."
+			}
+		},
+		401: {
+			description: "Missing/invalid credentials, or no provider has a usable key (`provider_not_configured`).",
+			schema: ttsErrorResponseSchema
+		},
+		413: {
+			description: "The audio was generated (and billed) but is too large to return over this endpoint. Retrieve it from `fileUrl` when a browsable copy was saved.",
+			schema: ttsResponseTooLargeSchema
+		},
+		422: {
+			description: "Request body failed validation, the text exceeds the provider character limit, the provider cannot produce the requested `format`, or the caller cannot afford the synthesis - the last of those is the only one tagged `errorCode: \"insufficient_credits\"`, so match on the classifier rather than the status to tell a billing failure from a bad request.",
+			schema: ttsErrorResponseSchema
+		},
+		429: {
+			description: "The provider rate-limited the request.",
+			schema: ttsErrorResponseSchema
+		},
+		502: {
+			description: "The provider failed to generate speech.",
+			schema: ttsErrorResponseSchema
+		}
+	},
+	emitsRateLimitHeaders: true,
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			text: "Your password has been reset.",
+			provider: "openai",
+			voice: "alloy",
+			encoding: "base64"
+		}
+	}
+});
 /**
 * Response details shared by the endpoints that return generated audio as raw
 * bytes (music, sound effects). Not a contract - just the pieces both of their
@@ -13033,8 +13328,179 @@ const generatedAudioBody = () => ({
 	alsoReturns: GENERATED_AUDIO_CONTENT_TYPES.slice(1).map((contentType) => ({ contentType })),
 	headers: GENERATED_AUDIO_SAVE_HEADERS
 });
-({ ...generatedAudioBody() });
-({ ...generatedAudioBody() });
+defineEndpoint({
+	method: "post",
+	path: "/api/ai/music",
+	operationId: "generateMusic",
+	summary: "Generate background music",
+	description: "Generates an instrumental or vocal background-music track from a text prompt and returns the raw audio bytes. `lengthMs` (3000-120000, default 10000) is forced on the provider, so the generated track always matches the billed length; credits are reserved before generation and refunded if it fails. Generated audio is saved to the file browser by default (opt out via the saveGeneratedAudio preference); the outcome is reported via the `X-B4M-Audio-Saved` / `X-B4M-Audio-Fab-File-Id` / `X-B4M-Audio-File-Url` response headers - use `X-B4M-Audio-File-Url` to fetch the saved copy, since `GET /api/files/{id}` fails closed until moderation completes. Authenticate with an API key (`b4m_live_`) or a JWT.",
+	tags: ["Audio"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:generate"],
+	request: musicRequestSchema,
+	requestExample: {
+		prompt: "calm lo-fi study beat with soft piano",
+		lengthMs: 3e4,
+		forceInstrumental: true
+	},
+	responses: {
+		200: {
+			description: "Raw audio bytes; the Content-Type follows the requested `format` (mp3 by default).",
+			...generatedAudioBody()
+		},
+		400: {
+			description: "The billing user or organization could not be resolved.",
+			schema: ApiErrorSchema
+		},
+		422: {
+			description: "Request body failed validation, or the caller cannot afford the track - the latter is tagged `errorCode: \"insufficient_credits\"` (the balance is short, or the org member credit cap is exhausted).",
+			schema: InsufficientCreditsErrorSchema
+		},
+		502: {
+			description: "The provider failed to generate the track; reserved credits are refunded.",
+			schema: ApiErrorSchema
+		},
+		503: {
+			description: "No provider API key is configured for this deployment.",
+			schema: ApiErrorSchema
+		}
+	},
+	emitsRateLimitHeaders: true,
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			prompt: "calm lo-fi study beat with soft piano",
+			lengthMs: 3e4,
+			forceInstrumental: true
+		}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/ai/sound-effects",
+	operationId: "generateSoundEffect",
+	summary: "Generate a sound effect",
+	description: "Generates a short sound effect from a text description and returns the raw audio bytes. Omitting `durationSeconds` lets the provider pick the length (and bills at its default); `promptInfluence` trades prompt fidelity (1) against variation (0). Credits are reserved before generation and refunded if it fails. Generated audio is saved to the file browser by default (opt out via the saveGeneratedAudio preference); the outcome is reported via the `X-B4M-Audio-Saved` / `X-B4M-Audio-Fab-File-Id` / `X-B4M-Audio-File-Url` response headers - use `X-B4M-Audio-File-Url` to fetch the saved copy, since `GET /api/files/{id}` fails closed until moderation completes. Authenticate with an API key (`b4m_live_`) or a JWT.",
+	tags: ["Audio"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:generate"],
+	request: soundEffectsRequestSchema,
+	requestExample: {
+		text: "heavy wooden door creaking open",
+		durationSeconds: 3,
+		promptInfluence: .5
+	},
+	responses: {
+		200: {
+			description: "Raw audio bytes; the Content-Type follows the requested `format` (mp3 by default).",
+			...generatedAudioBody()
+		},
+		400: {
+			description: "The billing user or organization could not be resolved.",
+			schema: ApiErrorSchema
+		},
+		422: {
+			description: "Request body failed validation, or the caller cannot afford the effect - the latter is tagged `errorCode: \"insufficient_credits\"` (the balance is short, or the org member credit cap is exhausted).",
+			schema: InsufficientCreditsErrorSchema
+		},
+		502: {
+			description: "The provider failed to generate the effect; reserved credits are refunded.",
+			schema: ApiErrorSchema
+		},
+		503: {
+			description: "No provider API key is configured for this deployment.",
+			schema: ApiErrorSchema
+		}
+	},
+	emitsRateLimitHeaders: true,
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			text: "heavy wooden door creaking open",
+			durationSeconds: 3,
+			promptInfluence: .5
+		}
+	}
+});
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/me",
+	operationId: "getMe",
+	summary: "Get the authenticated caller",
+	description: "Returns the authenticated caller: stable id, display name, plan tier, personal credit balance, and entitlement keys. The subject is always the credential holder - this endpoint accepts no user id, owner id, or impersonation parameter of any kind, so a key can only ever read its own owner. `credits.balance` is the caller's personal ledger; a call billed to an organization draws on a pool this number does not describe. Gate on `tier != \"free\"` for \"is this caller paying\" and on `subscription.price_id` for which product - the `basic`/`pro` rungs come from an internal plan ladder and do not track a plan's marketing name. Responses are never cacheable. Authenticate with an API key (`b4m_live_`) carrying `me:read`, or a JWT.",
+	tags: ["Account"],
+	auth: "apiKeyOrJwt",
+	scopes: ["me:read"],
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "The caller, their tier, their personal credit balance, and their entitlement keys.",
+			schema: MeResponseSchema,
+			example: {
+				id: "507f1f77bcf86cd799439011",
+				name: "Ada Lovelace",
+				tier: "basic",
+				subscription: {
+					plan_name: "Professional",
+					price_id: "price_123",
+					interval: "monthly",
+					current_period_ends_at: "2026-10-18T00:00:00.000Z"
+				},
+				credits: { balance: 31667 },
+				entitlements: ["base"]
+			}
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {}
+	}
+});
+/**
+* The fence language the model writes to place an inline map of search-result places in a reply.
+*
+* Same contract as SEARCH_RESULT_CARDS_LANGUAGE (searchResultCards.ts): `\w`-only and lowercase,
+* taught by WEB_SEARCH_MAP_PROMPT (@bike4mind/services), rendered by the reply renderer
+* (apps/client .../Session/PromptReplies.tsx), and rewritten to a plain list for every other
+* surface by `stripSearchResultCardFences`.
+*/
+const LOCATION_MAP_LANGUAGE = "b4m_map";
+function googleMapsSearchUrl(name, placeId) {
+	const params = new URLSearchParams({
+		api: "1",
+		query: name
+	});
+	if (placeId?.startsWith("ChIJ")) params.set("query_place_id", placeId);
+	return `https://www.google.com/maps/search/?${params.toString()}`;
+}
+/**
+* The fence language the model writes to place image cards inline in a reply.
+*
+* Two families of consumer must agree on this constant:
+*   - WEB_SEARCH_CARDS_PROMPT (@bike4mind/services) teaches the model to emit it, and the reply
+*     renderer (apps/client .../Session/PromptReplies.tsx) intercepts it to render cards instead
+*     of raw text.
+*   - Every other surface that reads reply markdown for an export, download, copy, publish, or
+*     Slack delivery must strip the fenced block entirely with `stripSearchResultCardFences`
+*     below, rather than passing the model-authored card JSON through verbatim. See that
+*     function's own doc comment for the current list of call sites.
+*
+* MUST contain only `\w` characters: both the renderer (`/language-(\w+)/`) and the notebook
+* curation extractor (```` /```(\w+)?/ ````) capture the language with `\w+`, so a hyphen would
+* silently truncate this and the cards would never render or be skipped.
+*
+* MUST already be lowercase: some consumers lowercase the language they capture before
+* comparing, so an uppercase-containing value would pass the `\w`-only rule above while silently
+* breaking that comparison.
+*/
+const SEARCH_RESULT_CARDS_LANGUAGE = "b4m_cards";
 z$1.enum(["user", "convergence"]).optional().catch(void 0), z$1.string().optional();
 /**
 * Blessed, self-hosted artifact library script paths (root-relative).
@@ -13096,6 +13562,7 @@ const OPTIONAL_DEP_BLESSED_SCRIPT_PATHS = Object.values({
 	}
 }).map((d) => d.path);
 [...REACT_BLESSED_SCRIPT_PATHS, ...OPTIONAL_DEP_BLESSED_SCRIPT_PATHS];
+[...OPENAI_IMAGE_MODELS, ...GEMINI_IMAGE_MODELS];
 const DashboardParamsSchema = z$1.object({
 	dashboardDataSources: z$1.array(z$1.object({
 		sourceName: z$1.string(),
@@ -13139,11 +13606,21 @@ OpenAIImageGenerationInput.extend({
 	height: z$1.number().optional(),
 	aspect_ratio: z$1.string().optional(),
 	fabFileIds: z$1.array(z$1.string()).prefault([]),
+	/**
+	* Extra gpt-image "style anchor" images, as fabFile ids. They ride alongside the primary
+	* input image (the first image-type entry in `fabFileIds`) rather than replacing it, and
+	* OpenAI receives them in this order - which matters, because a mask always applies to the
+	* first image in the array. fabFile ids rather than URLs so the existing access +
+	* moderation gates (findAccessibleInIds, isImageServeable) still apply. Ignored by every
+	* non-gpt-image provider. Repeated ids collapse to one anchor. See MAX_REFERENCE_IMAGES for
+	* why the cap is 4 and not OpenAI's 16.
+	*/
+	referenceImageFabFileIds: z$1.array(z$1.string()).max(4).optional(),
 	tools: z$1.array(z$1.union([b4mLLMTools, z$1.string()])).optional(),
 	safety_tolerance: BFLSafetyToleranceSchema,
 	prompt_upsampling: z$1.boolean().optional(),
 	seed: z$1.number().nullable().optional(),
-	output_format: z$1.enum(["jpeg", "png"]).nullable().optional(),
+	output_format: ImageOutputFormatSchema.nullable().optional(),
 	/** Resolved by the API route's prompt resolver. Defaults to 'fresh' for first-turn or sessions with no prior image. */
 	intent: PromptIntentSchema.optional(),
 	promptEnhancement: z$1.object({
@@ -13161,7 +13638,7 @@ OpenAIImageGenerationInput.extend({
 const GenerateImageToolCallSchema = OpenAIImageGenerationInput.extend({
 	safety_tolerance: z$1.number().optional(),
 	prompt_upsampling: z$1.boolean().optional(),
-	output_format: z$1.enum(["jpeg", "png"]).nullable().optional(),
+	output_format: ImageOutputFormatSchema.nullable().optional(),
 	seed: z$1.number().nullable().optional(),
 	editModel: z$1.string().optional()
 }).omit({ prompt: true });
@@ -13198,15 +13675,19 @@ OpenAIImageGenerationInput.extend({
 	organizationId: z$1.string().nullable().optional(),
 	aspect_ratio: z$1.string().optional(),
 	fabFileIds: z$1.array(z$1.string()).prefault([]),
-	image: z$1.string()
+	/**
+	* Extra gpt-image "style anchor" images, as fabFile ids. On this endpoint `fabFileIds` is
+	* the inpainting mask, not an image input, so references need their own field: they are
+	* appended after `image` (the edit source), and OpenAI applies the mask to the first entry
+	* of that array - i.e. always to `image`, never to a reference. fabFile ids rather than URLs
+	* so the existing access + moderation gates (findAccessibleInIds, isImageServeable) still
+	* apply. Ignored by BFL and Gemini. Repeated ids collapse to one anchor. See
+	* MAX_REFERENCE_IMAGES for why the cap is 4, not 16.
+	*/
+	referenceImageFabFileIds: z$1.array(z$1.string()).max(4).optional(),
+	image: z$1.string(),
+	output_format: ImageOutputFormatSchema.nullable().optional()
 });
-const isUnlimitedHistory = (historyCount) => historyCount === -1;
-/**
-* A usable number for callers that need one (page size, overflow math, telemetry). Unlimited
-* history has no count, so it resolves to the default page size, which is what an unwindowed
-* request has always actually fetched.
-*/
-const resolveHistoryFetchLimit = (historyCount) => isUnlimitedHistory(historyCount) || historyCount == null ? 14 : historyCount;
 z$1.object({
 	/** Notebook session ID */
 	sessionId: z$1.string(),
@@ -13232,6 +13713,13 @@ z$1.object({
 	message: z$1.string(),
 	messageFileIds: z$1.array(z$1.string()).prefault([]),
 	questId: z$1.string().optional(),
+	/**
+	* Correct-and-retry: the quest whose answer the user says was wrong. Produces a NEW quest
+	* carrying the user's correction, rather than overwriting the flagged one the way `questId`
+	* (retry) does - the original answer has to survive for the evaluation-pair export to read it.
+	* Validated server-side against the resolved session before it is persisted.
+	*/
+	correctsQuestId: z$1.string().optional(),
 	/** Extra context messages to include in the conversation from external sources */
 	extraContextMessages: z$1.array(z$1.object({
 		role: z$1.enum([
@@ -13267,11 +13755,19 @@ z$1.object({
 	* was the only switch for the offer and it also strips every authored prompt, so no caller could
 	* have an arm that went unoffered AND kept the abstention licence.
 	*
-	* Gates the three auto-add sites (the knowledge offer in resolveEnabledTools, the navigate_view
+	* Gates the auto-add sites (the knowledge offer in resolveEnabledTools, the navigate_view
 	* auto-add, the blog/skill gate), unioned with `Boolean(promptMode)` by
 	* resolveSkipAutoOffers. A force-on, not an override: `false` under a promptMode still suppresses.
 	* Withholding navigate_view also drops the viewRegistry system block, which only describes it.
 	*
+	* `buildSharedTools`' `offerOnlyNamedTools` (see sharedToolBuilder.ts) reads the same union for
+	* the same reason: MCP tools merged past the `enabledTools` filter are withheld too, since the
+	* caller never named them either. Unlike the auto-add sites, this one can still be reached per
+	* tool - a caller with `session.enabledTools` (not the public `tools` field, which
+	* `filterKnownTools` strips non-native ids from before this flag is even consulted) can name one
+	* MCP tool by its namespaced `server__tool` id and keep it while every unnamed sibling is
+	* withheld.
+	*
 	* Withholds the OFFER, not knowledge: `session.forceKnowledgeRetrieval` is untouched, and an
 	* already-attached corpus is inlined rather than deferred to the tool. An arm that must see no
 	* knowledge at all also needs a session with no attachments and forced retrieval off.
@@ -13713,6 +14209,18 @@ const ArtifactVersionMetaSchema = z$1.object({
 	}),
 	sha256Index: z$1.string()
 });
+/** One no-sign-in share link. `token` is the capability itself and is stripped from every
+*  serialized response, so it is optional here: an owner-facing read carries the metadata
+*  (id to revoke by, timestamps, per-link view count) with no token at all. `id` is the
+*  subdocument `_id`, rendered as a string. */
+const ShareTokenEntrySchema = z$1.object({
+	id: z$1.string().optional(),
+	token: z$1.string().optional(),
+	createdAt: z$1.date().optional(),
+	revokedAt: z$1.date().nullish(),
+	viewCount: z$1.int().nonnegative().prefault(0),
+	lastViewedAt: z$1.date().nullish()
+});
 /** Reserved slugs - must include every tier URL token so a slug can't shadow routing. */
 const RESERVED_SLUGS = [
 	"api",
@@ -13836,6 +14344,10 @@ z$1.object({
 	shareToken: z$1.string().optional(),
 	/** When `shareToken` was last minted/rotated; drives the owner-facing "link created" surface. */
 	shareTokenUpdatedAt: z$1.date().nullish(),
+	/** Every share link ever minted, revoked ones included. Mirrors the two fields above during
+	*  the rollout and becomes the source of truth once the backfill has run everywhere; `token`
+	*  is stripped from serialized responses, so an owner-facing read sees only the metadata. */
+	shareTokens: z$1.array(ShareTokenEntrySchema).prefault([]),
 	/** Collaboration gate: who (among viewers) may annotate. Orthogonal to
 	*  `visibility`. Defaults to `none` (read-only) until the owner opts in. */
 	commentPolicy: CommentPolicySchema.prefault("none"),
@@ -13866,6 +14378,9 @@ z$1.object({
 	declaredApiEndpoints: z$1.array(z$1.string()).prefault([]),
 	/** Rendered body snapshot for reply/fabfile viewer pages (markdown or text). */
 	renderedBody: z$1.string().optional(),
+	/** Snapshot of the source reply's citables (reply source only), so a `b4m_map` fence in
+	*  `renderedBody` can still resolve its place ids after the source Quest is edited or deleted. */
+	citables: z$1.array(CitableSourceSchema).optional(),
 	publishedAt: z$1.date(),
 	previousVersionMeta: ArtifactVersionMetaSchema.optional(),
 	/** Full version history (oldest to newest); each entry's bytes are archived at
@@ -14119,56 +14634,71 @@ z$1.object({
 	createdAt: z$1.union([z$1.string(), z$1.date()]).optional(),
 	updatedAt: z$1.union([z$1.string(), z$1.date()]).optional()
 });
+ClaudeArtifactMimeTypes.RECHARTS, ClaudeArtifactMimeTypes.MERMAID, ClaudeArtifactMimeTypes.LATTICE, ClaudeArtifactMimeTypes.BLOG_DRAFT, ClaudeArtifactMimeTypes.CHESS;
+[...IMAGE_SIZE_CONSTRAINTS.DALL_E_2.sizes, ...IMAGE_SIZE_CONSTRAINTS.DALL_E_3.sizes];
 /**
-* Length of `text` in Unicode CODE POINTS - the unit `IFabFileChunk.charLength` is stored in.
-* Matches MongoDB's `$strLenCP`, which is what lets the char-length backfill
-* (packages/scripts/datalake/backfill-chunk-char-length.ts) compute the same number server-side
-* without reading chunk text out of the database. Deliberately NOT `text.length` (UTF-16 code
-* units): the two differ on astral characters (surrogate pairs), and the write path and the
-* backfill must agree exactly.
+* Zero-width space spliced into a defanged marker. It is invisible wherever the text is
+* rendered, so escaping never changes what the reader sees - only what the parser matches.
 */
-const countCodePoints = (text) => {
-	let count = 0;
-	for (const _ch of text) count++;
-	return count;
-};
-function isGPTImageModel(model) {
-	if (!model) return false;
-	return OPENAI_IMAGE_MODELS.includes(model) || model.startsWith("gpt-image-");
+const ZERO_WIDTH_SPACE = "​";
+/**
+* Defangs think-marker-shaped substrings inside provider-authored reasoning text so they can
+* never be mistaken for the real control markers adapters wrap around that same text.
+*
+* A reasoning delta is provider output, not our control plane - a model can say `<think>` or
+* `</think>` as literal content (reasoning about the protocol itself, or a leading/trailing
+* `</think>` from a provider that already delimits its own monologue). Adapters wrap the whole
+* delta in real markers via plain string concatenation, so an unescaped literal is
+* indistinguishable from a genuine open/close once it lands in the same string. Call this on
+* every raw reasoning delta before it is concatenated with THINK_OPEN_TAG/THINK_CLOSE_TAG.
+*/
+function escapeThinkMarkers(text) {
+	if (!text) return text;
+	return text.replace(/<(\/?)think>/g, `<${ZERO_WIDTH_SPACE}$1think>`);
 }
-/** Returns true specifically for gpt-image-2 (including versioned snapshots like gpt-image-2-2026-04-21). */
-function isGPTImage2Model(model) {
-	if (!model) return false;
-	return model === "gpt-image-2" || model.startsWith("gpt-image-2");
+/** One less than the longer marker's length: the most characters a real marker prefix can span. */
+const MAX_PARTIAL_MARKER_LENGTH = 7;
+/** Length of the longest suffix of `text` that is a proper prefix of either marker token. */
+function partialMarkerSuffixLength(text) {
+	const max = Math.min(MAX_PARTIAL_MARKER_LENGTH, text.length);
+	for (let len = max; len > 0; len--) {
+		const suffix = text.slice(-len);
+		if ("<think>".startsWith(suffix) || "</think>".startsWith(suffix)) return len;
+	}
+	return 0;
 }
 /**
-* Whether a user can access a model. Access is any-of (mirrors the Q3b data-lake
-* rule, `getAccessibleDataLakes`): a non-admin reaches the model via
-* `allowedUserTags ∩ userTags` OR `allowedEntitlements ∩ entitlementKeys`.
+* Stateful counterpart to escapeThinkMarkers for text that arrives in streamed pieces.
 *
-* `entitlementKeys` is optional - when omitted/empty the entitlement branch is
-* inert, so a model with no `allowedEntitlements` behaves exactly as before
-* (tag-only). This lets a tag-less subscriber reach an entitlement-gated model
-* while leaving every existing tag-gated model unchanged (zero regression).
+* escapeThinkMarkers alone is only safe on a complete string: adapters call it once per
+* delta, but a provider is free to split a marker-shaped substring across two adjacent
+* deltas (e.g. 'wrote <th' then 'ink> tag'). Escaping each half independently leaves both
+* halves unescaped, and concatenating them reassembles a literal `<think>`/`</think>` that
+* is then indistinguishable from the real control marker wrapped around the same text.
 *
-* Pure + zero-dependency (only types + the shared key normalizer), so it lives
-* in `@bike4mind/common` as the SINGLE source of truth - imported by the core
-* `@bike4mind/utils` re-export (server/services) AND the client
-* `useAccessibleModels` hook, which previously kept a hand-rolled twin "to avoid
-* AWS SDK imports". Common is browser-safe, so there is no longer any reason to
-* duplicate the logic.
-*/
-function isModelAccessible(model, userTags, isAdmin = false, entitlementKeys = []) {
-	if (!model.enabled) return false;
-	if (isAdmin) return true;
-	const normalizedUserTags = userTags.map((tag) => tag.toLowerCase());
-	const normalizedAllowedTags = (model.allowedUserTags ?? []).map((tag) => tag.toLowerCase());
-	if (normalizedUserTags.some((tag) => normalizedAllowedTags.includes(tag))) return true;
-	const normalizedKeys = entitlementKeys.map(normalizeEntitlementKey);
-	const normalizedAllowedEntitlements = (model.allowedEntitlements ?? []).map(normalizeEntitlementKey);
-	return normalizedKeys.some((key) => normalizedAllowedEntitlements.includes(key));
+* This holds back any trailing substring of the buffered text that could still extend into
+* a marker (up to `<think>`/`</think>`'s length minus one) until the next push resolves it
+* one way or the other, or flush() is called at the end of the reasoning span.
+*/
+function createThinkMarkerEscaper() {
+	let pending = "";
+	return {
+		push(chunk) {
+			if (!chunk) return "";
+			const combined = pending + chunk;
+			const holdLength = partialMarkerSuffixLength(combined);
+			const safeLength = combined.length - holdLength;
+			const safe = combined.slice(0, safeLength);
+			pending = combined.slice(safeLength);
+			return escapeThinkMarkers(safe);
+		},
+		flush() {
+			const remaining = pending;
+			pending = "";
+			return escapeThinkMarkers(remaining);
+		}
+	};
 }
-[...OPENAI_IMAGE_MODELS, ...GEMINI_IMAGE_MODELS];
 /** Generation was cut off against the output-token ceiling. */
 const TRUNCATED_FINISH_REASON = "max_tokens";
 /**
@@ -14195,6 +14725,115 @@ function isEarlyStop(stopReason) {
 	return !!stopReason && EARLY_STOP_FINISH_REASONS.has(stopReason);
 }
 /**
+* Signs the image URLs `web_search` writes into its tool output, so `/api/search-image` (the
+* same-origin proxy that fetches them server-side) can verify a URL actually came from our own
+* search-provider results, not from a hostile page's snippet text steering the model into writing
+* an attacker-controlled URL with exfiltrated data in the query string.
+*
+* The signature is a trailing `&b4mSig=<hex>` (or `?b4mSig=<hex>` with no prior query string)
+* appended by plain string concatenation - never by reparsing the URL through `URLSearchParams`,
+* which re-serializes every existing param (e.g. turning a literal space into `+`) and would send
+* a byte-different URL to a host whose own signature (an imgix/S3-presigned link) covers the exact
+* query string the provider returned. Anchoring the signature to the END of the string, and
+* requiring it to be the only occurrence, is what makes verification unambiguous: anything a
+* tamperer appends after signing - including a second `b4mSig` - changes what's left of the anchor
+* match, which changes the canonical text, which invalidates the signature. There is deliberately
+* no "read the first/last `b4mSig` param and ignore the rest" step, since that step is exactly
+* where an earlier version of this file's bypass lived (verify read the URL's first `b4mSig` via
+* `searchParams.get` while signing canonicalized by deleting *every* `b4mSig`, so a validly-signed
+* URL with a second, attacker-authored `b4mSig` appended still verified, and was then forwarded to
+* `safeFetch` with that attacker data still attached).
+*
+* The model is already told to copy an `Images:` line's URL verbatim, so no new instruction is
+* needed for the signature to survive.
+*
+* The signature has no expiry: a stored reply, citable, published page, or curation transcript
+* persists indefinitely, and nothing re-signs a URL on read, so a TTL would make every card
+* permanently break once it lapsed rather than bound anything meaningful. What actually bounds
+* a leaked signed URL's usefulness is the same thing that bounds the route otherwise: it's only
+* reachable at all behind `jwtOnly` auth (apps/client/pages/api/search-image.ts) and is capped by
+* a per-user rate limit there.
+*/
+const SIGNATURE_PARAM = "b4mSig";
+const TRAILING_SIGNATURE_RE = new RegExp(`[?&]${SIGNATURE_PARAM}=([0-9a-f]{32})$`);
+const KNOWN_PLACEHOLDER_SECRETS = /* @__PURE__ */ new Set([
+	"",
+	"my-secret-placeholder-value",
+	"not-configured"
+]);
+/**
+* True for an empty or known-placeholder signing secret. Shared so any caller that would
+* otherwise sign-and-fail (e.g. web_search deciding whether to pay for image results at all)
+* uses the same definition `verifyImageUrlSignature` fails closed on, rather than a second one
+* that could drift out of sync.
+*/
+function isPlaceholderImageSigningSecret(secret) {
+	return KNOWN_PLACEHOLDER_SECRETS.has(secret ?? "");
+}
+function computeSignature(canonical, secret) {
+	return createHmac("sha256", secret).update(canonical).digest("hex").slice(0, 32);
+}
+/**
+* Appends expiry + signature query params by string concatenation (never reparses or
+* re-serializes the existing query string - see the file-level comment). Returns the URL
+* unchanged if it fails to parse as a URL, or if it already carries a trailing signature.
+*/
+function signImageUrl(rawUrl, secret) {
+	try {
+		new URL(rawUrl);
+	} catch {
+		return rawUrl;
+	}
+	if (TRAILING_SIGNATURE_RE.test(rawUrl)) return rawUrl;
+	const separator = rawUrl.includes("?") ? "&" : "?";
+	const signature = computeSignature(rawUrl, secret);
+	return `${rawUrl}${separator}${SIGNATURE_PARAM}=${signature}`;
+}
+/**
+* promptMeta.functionCalls fields that must never reach a viewer who only holds a
+* "read this conversation" grant - a session share, a live subscription, a bug-report
+* egress to a third party (Slack/email), or a session clone made by a share holder
+* (b4m-core/services/src/sessionService/clone.ts, which copies quest.promptMeta wholesale
+* onto a session the sharee then OWNS - a share/subscribe grant must not become a durable
+* unredacted copy just because the copy has a new owner).
+*
+* `returnValue` is the verbatim output of a tool call the OWNER's turn made - up to 8000 chars
+* per call (see recordToolResult.ts) - and a tool can read the owner's private corpus, files, or
+* connected integrations. A share/subscribe grant authorizes reading the conversation the owner
+* had, not re-reading whatever the owner's tools touched on the owner's behalf. `error` is
+* currently unwritten but carries the same class of content on the failure path, so it is
+* redacted alongside it.
+*
+* This list is the single source of truth: add a field here and every response boundary that
+* routes through {@link redactFunctionCallsForViewer} inherits the redaction - PROVIDED the field
+* is a top-level, directly-owned-content field like these two. The redaction itself is a shallow
+* `delete` per field (see below), so a future owner-only value nested inside another field (e.g. a
+* private blob inside `parameters`) would NOT be caught by adding its name here; that shape needs
+* its own per-field handling, not just a new entry in this array.
+*
+* Adjacent unredacted shape, not yet a leak: `promptMeta.executionTracking.steps[].result`/
+* `.error` (PromptMetaZodSchema) are the same class of owner-only content but nothing writes them
+* today, so there is nothing to redact yet. A future writer landing there bypasses this list
+* entirely unless it is added here too.
+*/
+const OWNER_ONLY_FUNCTION_CALL_FIELDS = ["returnValue", "error"];
+/**
+* Verbatim retrieved passage text on a citation chip (#3038). Owner-only for exactly the reason
+* `returnValue` is: it is a slice of a document the OWNER's retrieval read on the owner's behalf,
+* and a share/subscribe/clone grant authorizes reading the conversation, not re-reading the
+* owner's corpus through it. The sibling `chunkId` is deliberately kept - an opaque id is not
+* content, and `citables[].id` (the file id) is already unredacted beside it.
+*
+* `conflictsWith` (#3041) is kept for the same reason, recorded here so the next reader does not
+* re-derive it: it holds `fabFileId`s of other cited sources, so it adds a RELATIONSHIP between
+* chips the viewer can already see rather than a slice of the owner's corpus. That holds only while
+* the field stays ids - a future version carrying the conflicting SENTENCES (the detector has them:
+* InconsistencyEvidence.excerpt) would be `fullContext`'s class exactly and would have to join the
+* list below rather than ride along inside this one.
+*/
+const OWNER_ONLY_CITABLE_METADATA_FIELDS = ["fullContext"];
+[...OWNER_ONLY_FUNCTION_CALL_FIELDS.map((field) => `promptMeta.functionCalls.${field}`), ...OWNER_ONLY_CITABLE_METADATA_FIELDS.map((field) => `promptMeta.citables.metadata.${field}`)];
+/**
 * Trigger-word validation, shared between client form and server agent
 * endpoints so the validation rules can't drift.
 *
@@ -14227,47 +14866,7 @@ z$1.array(triggerWordSchema).max(20, "Up to 20 trigger words allowed.").transfor
 	}
 	return out;
 });
-/**
-* Serve gate for uploaded FabFiles: hold-until-scanned, fail-closed on ALL mime
-* types, not just images. A file is serveable only once moderation has run to
-* completion on it, REGARDLESS of its declared `mimeType`.
-*
-* Why gate non-images too: `mimeType` is client-declared at upload time and is only
-* corrected by the S3 scan ~1-2s later (see `moderateUploadedFile`'s byte-sniffing). If this
-* gate special-cased "non-images always serveable" based on that same untrusted declared
-* mimeType, a file uploaded as `application/pdf` but actually a PNG (or vice versa) would be
-* served during that window before the sniff/scan ever runs. Gating on `moderationStatus`
-* alone closes that window for every file, image or not.
-*
-* `moderationStatus` semantics:
-*  - 'clean'                      -> serveable
-*  - 'pending' | 'scanning'       -> NOT serveable (not yet through the scan)
-*  - 'blocked'                    -> NOT serveable (confirmed block / unscannable format)
-*  - null | undefined             -> NOT serveable (fail-closed; legacy rows are
-*                                    backfilled to 'clean', see backfill-fabfile-moderation-status.ts)
-*
-* Non-image files (PDFs, docs, text, ...) are NOT scanned by Rekognition, but they still
-* pass through `moderateUploadedFile`/`objectCreated`, which resolves them to 'clean'
-* immediately (no image bytes to hold on), so the hold is brief (one S3 event round trip),
-* not an indefinite block.
-*/
-function isImageServeable(f) {
-	return f.moderationStatus === "clean";
-}
-/**
-* Is this mime type an image? `image/svg+xml` counts, since vision models receive it
-* as an image.
-*
-* The repo has ~50 inline `startsWith('image/')` checks and they disagree on the edges
-* (case, null handling). Only the ones on the attachment pipeline - composer upload,
-* chat context assembly, attachment capability warnings - have been converted here.
-* Icon pickers, avatar validation and resize eligibility still carry their own copies:
-* same question, unrelated subsystems, and folding them in would have made this a
-* repo-wide diff.
-*/
-function isImageAttachment(mimeType) {
-	return typeof mimeType === "string" && mimeType.toLowerCase().startsWith("image/");
-}
+IMAGE_SIZE_CONSTRAINTS.BFL.minWidth, IMAGE_SIZE_CONSTRAINTS.BFL.maxWidth;
 Array.from(new Set([
 	{
 		id: "opti.root",
@@ -15174,71 +15773,10 @@ Array.from(new Set([
 	const [, top] = v.target.split("/");
 	return `/${top}`;
 })));
-function getHeader(headers, name) {
-	if (!headers || typeof headers !== "object") return null;
-	if (typeof headers.get === "function") {
-		const value = headers.get(name);
-		return typeof value === "string" ? value : null;
-	}
-	const value = headers[name] ?? headers[name.toLowerCase()];
-	return typeof value === "string" ? value : null;
-}
-function parseCount(value) {
-	if (value === null) return null;
-	const trimmed = value.trim();
-	if (!trimmed) return null;
-	const parsed = Number(trimmed);
-	return Number.isFinite(parsed) ? parsed : null;
-}
-const UNIT_MS = {
-	ms: 1,
-	s: 1e3,
-	m: 6e4,
-	h: 36e5
-};
-const DURATION_PART = /(\d+(?:\.\d+)?)(ms|h|m|s)/g;
-/**
-* Parse a Go-style duration ("6ms", "0s", "1m30s", "1h2m3s") to milliseconds.
-*
-* Exported for its own tests: it is the part of this module that can be wrong in a way the
-* numbers still look plausible.
-*/
-function parseDurationMs(value) {
-	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
-	if (!trimmed) return null;
-	DURATION_PART.lastIndex = 0;
-	let total = 0;
-	let matched = 0;
-	let consumed = 0;
-	for (const part of trimmed.matchAll(DURATION_PART)) {
-		total += Number(part[1]) * UNIT_MS[part[2]];
-		consumed += part[0].length;
-		matched += 1;
-	}
-	if (matched === 0 || consumed !== trimmed.length) return null;
-	return total;
-}
-/** Read both rate-limit dimensions off a provider response. */
-function parseEmbeddingRateLimitHeaders(headers) {
-	return {
-		limitTokens: parseCount(getHeader(headers, "x-ratelimit-limit-tokens")),
-		limitRequests: parseCount(getHeader(headers, "x-ratelimit-limit-requests")),
-		remainingTokens: parseCount(getHeader(headers, "x-ratelimit-remaining-tokens")),
-		remainingRequests: parseCount(getHeader(headers, "x-ratelimit-remaining-requests")),
-		resetTokensMs: parseDurationMs(getHeader(headers, "x-ratelimit-reset-tokens")),
-		resetRequestsMs: parseDurationMs(getHeader(headers, "x-ratelimit-reset-requests"))
-	};
-}
-/** True when the provider reported at least one usable ceiling. */
-function hasUsableLimits(snapshot) {
-	return snapshot.limitTokens !== null || snapshot.limitRequests !== null;
-}
 dayjs.extend(utc);
 dayjs.extend(timezone);
 dayjs.extend(relativeTime);
 dayjs.extend(localizedFormat);
-var dayjsConfig_default = dayjs;
 /**
 * Default retryable errors for LLM API calls
 */
@@ -15526,6 +16064,225 @@ function getEnvironmentName(configApiConfig) {
 	if (/^https?:\/\/(localhost|127\.0\.0\.1)(:|\/|$)/i.test(endpoint.url)) return "Local Dev";
 	return "Self-Hosted";
 }
+//#endregion
+//#region src/utils/validateSessionId.ts
+/**
+* Session and resume ids arrive from the environment (`B4M_SESSION_ID`,
+* `B4M_RESUME_ID`) and are used as filesystem path components by the session
+* store and the debug logger. Restrict them to a strict charset (which still
+* covers UUIDs) so a hostile launcher cannot traverse out of the base dir via
+* e.g. `B4M_SESSION_ID=../config`.
+*/
+const SESSION_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+function isValidSessionId(value) {
+	return SESSION_ID_PATTERN.test(value);
+}
+//#endregion
+//#region src/config/toolSafety.ts
+/**
+* Tool safety categories determine when permission is required
+*/
+const ToolCategorySchema = z$1.enum([
+	"auto_approve",
+	"prompt_always",
+	"prompt_default"
+]);
+z$1.object({
+	categories: z$1.record(z$1.string(), ToolCategorySchema),
+	trustedTools: z$1.array(z$1.string())
+});
+/**
+* Default tool categories
+*
+* Categories:
+* - auto_approve: Safe tools that don't need permission (math, search, datetime)
+* - prompt_always: Dangerous tools that ALWAYS need permission, cannot be trusted (file edits, shell commands)
+* - prompt_default: Tools that prompt by default but users can trust them (file reads, searches)
+*/
+const DEFAULT_TOOL_CATEGORIES = {
+	math_evaluate: "auto_approve",
+	current_datetime: "auto_approve",
+	dice_roll: "auto_approve",
+	prompt_enhancement: "auto_approve",
+	find_definition: "auto_approve",
+	ask_user_question: "auto_approve",
+	weather_info: "prompt_default",
+	edit_file: "prompt_always",
+	edit_local_file: "prompt_always",
+	create_file: "prompt_always",
+	delete_file: "prompt_always",
+	shell_execute: "prompt_always",
+	bash_execute: "prompt_always",
+	write_shell_stdin: "prompt_always",
+	kill_background_shell: "prompt_always",
+	git_commit: "prompt_always",
+	git_push: "prompt_always",
+	skill: "prompt_always",
+	web_search: "prompt_default",
+	check_shell_output: "prompt_default",
+	list_background_shells: "prompt_default",
+	web_fetch: "prompt_default",
+	deep_research: "prompt_default",
+	file_read: "prompt_default",
+	grep_search: "prompt_default",
+	glob_files: "prompt_default",
+	get_file_tree: "prompt_default",
+	get_file_structure: "prompt_default",
+	git_status: "prompt_default",
+	git_diff: "prompt_default",
+	git_log: "prompt_default",
+	git_branch: "prompt_default"
+};
+/**
+* Get the category for a tool
+* Returns 'prompt_default' if tool is not in the default categories
+*/
+function getToolCategory(toolName, customCategories) {
+	if (toolName.startsWith("agent_hook:") || toolName.startsWith("skill_hook:")) return "prompt_always";
+	if (customCategories && toolName in customCategories) return customCategories[toolName];
+	if (toolName in DEFAULT_TOOL_CATEGORIES) return DEFAULT_TOOL_CATEGORIES[toolName];
+	if (toolName.startsWith("mcp__")) return "prompt_always";
+	return "prompt_default";
+}
+/**
+* Check if a tool can be trusted (not prompt_always)
+*/
+function canTrustTool(toolName, customCategories) {
+	return getToolCategory(toolName, customCategories) !== "prompt_always";
+}
+/**
+* Check if a tool is read-only (safe for parallel execution).
+* Write tools (prompt_always category) must always be sequential.
+*
+* @param toolName - Name of the tool to check
+* @param customCategories - Optional custom category overrides
+* @returns true if the tool is read-only, false if it's a write tool
+*/
+function isReadOnlyTool(toolName, customCategories) {
+	return getToolCategory(toolName, customCategories) !== "prompt_always";
+}
+const PROJECT_CONTEXT_FILES = [
+	"CLAUDE.local.md",
+	"CLAUDE.md",
+	"AGENTS.md",
+	"AI.local.md",
+	"AI.md",
+	"INSTRUCTIONS.md"
+];
+const GLOBAL_CONTEXT_FILES = ["AI.local.md", "AI.md"];
+/**
+* Format file size for display
+*/
+function formatFileSize(bytes) {
+	if (bytes < 1024) return `${bytes}B`;
+	if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)}KB`;
+	return `${(bytes / 1048576).toFixed(1)}MB`;
+}
+/**
+* Try to read a context file from a directory
+*
+* Security: Only reads regular files (not directories or symlinks) within the specified directory.
+* Files must be under 100KB to prevent abuse. Symlinks are rejected to prevent reading
+* files outside the intended directory.
+*
+* @param dir - The directory to read from (must be a controlled location)
+* @param filename - The filename to read (must not contain path separators)
+* @param source - Whether this is a 'global' or 'project' context file
+* @returns The file result, an error object, or null if file doesn't exist
+*/
+function tryReadContextFile(dir, filename, source) {
+	const filePath = path$1.join(dir, filename);
+	try {
+		const stats = fs$1.lstatSync(filePath);
+		if (stats.isDirectory()) return null;
+		if (stats.isSymbolicLink()) return { error: `${source === "global" ? "Global" : "Project"} ${filename} is a symlink (not allowed for security)` };
+		if (stats.size > 102400) return { error: `${source === "global" ? "Global" : "Project"} ${filename} exceeds 100KB limit (${formatFileSize(stats.size)})` };
+		return {
+			filename,
+			content: fs$1.readFileSync(filePath, "utf-8"),
+			source,
+			path: filePath
+		};
+	} catch (err) {
+		if (err.code === "ENOENT") return null;
+		if (err.code === "EACCES") return { error: `Cannot read ${source} ${filename}: permission denied` };
+		return { error: `Cannot read ${source} ${filename}: ${err instanceof Error ? err.message : "Unknown error"}` };
+	}
+}
+/**
+* Find the first context file in a directory from a list of candidates
+*/
+function findContextFile(dir, candidates, source) {
+	for (const filename of candidates) {
+		const result = tryReadContextFile(dir, filename, source);
+		if (result === null) continue;
+		if ("error" in result) return {
+			result: null,
+			error: result.error
+		};
+		return {
+			result,
+			error: null
+		};
+	}
+	return {
+		result: null,
+		error: null
+	};
+}
+/**
+* Merge global and project context into a single string
+*/
+function mergeContextContent(global, project) {
+	if (global && project) return `${global.content}\n\n---\n\n${project.content}`;
+	if (global) return global.content;
+	if (project) return project.content;
+	return "";
+}
+/**
+* Load context files from global and project directories
+*
+* Global files are loaded from ~/.bike4mind/
+* Project files are loaded from `projectDir`. When it is null the project layer
+* is SKIPPED entirely (not defaulted to cwd) - the folder-trust gate passes null
+* for an untrusted project so its repo context file is never loaded.
+*
+* Returns the first matching file from each layer based on priority order
+*/
+async function loadContextFiles(projectDir) {
+	const errors = [];
+	const globalDir = path$1.join(homedir$1(), ".bike4mind");
+	const [globalResult, projectResult] = await Promise.all([Promise.resolve(findContextFile(globalDir, GLOBAL_CONTEXT_FILES, "global")), Promise.resolve(projectDir ? findContextFile(projectDir, PROJECT_CONTEXT_FILES, "project") : {
+		result: null,
+		error: null
+	})]);
+	if (globalResult.error) errors.push(globalResult.error);
+	if (projectResult.error) errors.push(projectResult.error);
+	const mergedContent = mergeContextContent(globalResult.result, projectResult.result);
+	return {
+		globalContext: globalResult.result,
+		projectContext: projectResult.result,
+		mergedContent,
+		errors
+	};
+}
+/**
+* Extract "# Compact Instructions" or "## Compact Instructions" section from CLAUDE.md content
+*
+* This section provides project-specific instructions for how conversations should be
+* summarized when compacting context.
+*
+* @param contextContent - The merged context content from CLAUDE.md files
+* @returns The extracted instructions content, or undefined if not found
+*/
+function extractCompactInstructions(contextContent) {
+	const match = contextContent.match(/^#{1,2}\s*Compact\s*Instructions\s*$/im);
+	if (!match || match.index === void 0) return;
+	const startIndex = match.index + match[0].length;
+	const remainingContent = contextContent.slice(startIndex);
+	const endIndex = remainingContent.match(/^#{1,2}\s+\S/m)?.index ?? remainingContent.length;
+	return remainingContent.slice(0, endIndex).trim() || void 0;
+}
 const logger = class Logger {
 	static {
 		this.instance = null;
@@ -15544,9 +16301,10 @@ const logger = class Logger {
 	* Initialize the logger with a session ID
 	*/
 	async initialize(sessionId) {
+		if (!isValidSessionId(sessionId)) throw new Error(`Invalid session id "${sessionId}": must match ${SESSION_ID_PATTERN.source}`);
 		this.sessionId = sessionId;
 		const debugDir = path.join(os.homedir(), ".bike4mind", "debug");
-		await fs$1.mkdir(debugDir, { recursive: true });
+		await fs.mkdir(debugDir, { recursive: true });
 		this.logFilePath = path.join(debugDir, `${sessionId}.txt`);
 		await this.writeToFile("INFO", "=== CLI SESSION START ===");
 	}
@@ -15598,7 +16356,7 @@ const logger = class Logger {
 		if (!this.fileLoggingEnabled || !this.logFilePath) return;
 		try {
 			const logEntry = `[${(/* @__PURE__ */ new Date()).toISOString().replace("T", " ").substring(0, 19)}] [${level}] ${message}\n`;
-			await fs$1.appendFile(this.logFilePath, logEntry, "utf-8");
+			await fs.appendFile(this.logFilePath, logEntry, "utf-8");
 		} catch (error) {
 			console.error("File logging failed:", error);
 		}
@@ -15715,11 +16473,11 @@ const logger = class Logger {
 		if (!this.fileLoggingEnabled) return;
 		try {
 			const debugDir = path.join(os.homedir(), ".bike4mind", "debug");
-			const files = await fs$1.readdir(debugDir);
+			const files = await fs.readdir(debugDir);
 			const thirtyDaysAgo = Date.now() - 2592e6;
 			for (const file of files) {
 				const filePath = path.join(debugDir, file);
-				if ((await fs$1.stat(filePath)).mtime.getTime() < thirtyDaysAgo) await fs$1.unlink(filePath);
+				if ((await fs.stat(filePath)).mtime.getTime() < thirtyDaysAgo) await fs.unlink(filePath);
 			}
 		} catch (error) {
 			console.error("Failed to cleanup old logs:", error);
@@ -15943,6 +16701,7 @@ const CliConfigSchema = z$1.object({
 		hearth: z$1.boolean().optional()
 	}).catchall(z$1.boolean())).optional().prefault({}),
 	trustedTools: z$1.array(z$1.string()).optional().prefault([]),
+	trustedProjects: z$1.array(z$1.string()).optional().prefault([]),
 	sandbox: SandboxConfigSchema.optional(),
 	additionalDirectories: z$1.array(z$1.string()).optional().prefault([]),
 	fallbackModels: z$1.array(z$1.string()).optional()
@@ -16051,6 +16810,7 @@ const DEFAULT_CONFIG = {
 		config: {}
 	},
 	trustedTools: [],
+	trustedProjects: [],
 	additionalDirectories: []
 };
 /**
@@ -16071,6 +16831,19 @@ function findProjectConfigDir(startDir = process.cwd()) {
 	return process.cwd();
 }
 /**
+* Canonicalize a path via realpath, returning null if it doesn't exist or can't
+* be resolved. Used so a symlinked or relative project root is compared against
+* the trust set by its real location, and a resolve failure fails safe
+* (untrusted) rather than crashing the launch.
+*/
+async function safeRealpath(p) {
+	try {
+		return await promises.realpath(p);
+	} catch {
+		return null;
+	}
+}
+/**
 * Load project config from .bike4mind/config.json
 * Returns null if file doesn't exist (this is normal - config.json is optional)
 */
@@ -16178,32 +16951,89 @@ function mergeMcpServers(...serverArrays) {
 	for (const servers of serverArrays) if (servers) for (const server of servers) serverMap.set(server.name, server);
 	return Array.from(serverMap.values());
 }
+/** Sandbox modes ordered from weakest to strongest posture. */
+const SANDBOX_MODE_RANK = {
+	disabled: 0,
+	"auto-allow": 1,
+	permissions: 2
+};
+function intersectStrings(a, b) {
+	const set = new Set(a);
+	return b.filter((x) => set.has(x));
+}
+function unionStrings(a, b) {
+	return Array.from(/* @__PURE__ */ new Set([...a, ...b]));
+}
+/** True when `target` is `root` itself or nested under it (no `..` escape). */
+function isWithin(root, target) {
+	const rel = path.relative(root, target);
+	return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+}
 /**
-* Deep-merge sandbox configs. Later values override earlier ones.
-* Arrays (allowedReadPaths, deniedPaths, excludedCommands) are replaced, not concatenated.
+* Merge a repo-sourced sandbox override onto the user's base posture so it can
+* only ever TIGHTEN it, never loosen it. A repo layer may enable the sandbox,
+* raise the mode (disabled < auto-allow < permissions) but never select
+* auto-allow itself, add denied paths, narrow read paths / domains / excluded
+* commands, turn the network filter on, and force allowUnsandboxedCommands off.
+* Every loosening value is ignored with a warning. `platform` is ignored.
 */
-function mergeSandboxConfig(base, override) {
-	const resolved = base ?? DEFAULT_SANDBOX_CONFIG;
-	if (!override) return resolved;
-	return {
-		enabled: override.enabled ?? resolved.enabled,
-		mode: override.mode ?? resolved.mode,
-		filesystem: {
-			...resolved.filesystem,
-			...override.filesystem ?? {}
-		},
-		network: {
-			...resolved.network,
-			...override.network ?? {}
-		},
-		excludedCommands: override.excludedCommands ?? resolved.excludedCommands,
-		allowUnsandboxedCommands: override.allowUnsandboxedCommands ?? resolved.allowUnsandboxedCommands,
-		platform: override.platform ?? resolved.platform
+function tightenSandbox(base, repo) {
+	const b = base ?? DEFAULT_SANDBOX_CONFIG;
+	if (!repo) return b;
+	const warn = (what) => logger.warn(`Ignoring repo sandbox override that would loosen posture: ${what}`);
+	const result = {
+		...b,
+		filesystem: { ...b.filesystem },
+		network: { ...b.network }
 	};
+	if (repo.enabled === true) result.enabled = true;
+	else if (repo.enabled === false && b.enabled) warn("sandbox.enabled=false");
+	if (repo.mode !== void 0) if (repo.mode === "auto-allow") warn("sandbox.mode=auto-allow");
+	else if (SANDBOX_MODE_RANK[repo.mode] >= SANDBOX_MODE_RANK[b.mode]) result.mode = repo.mode;
+	else warn(`sandbox.mode=${repo.mode} weaker than ${b.mode}`);
+	if (repo.filesystem) {
+		const fsr = repo.filesystem;
+		if (fsr.deniedPaths) result.filesystem.deniedPaths = unionStrings(result.filesystem.deniedPaths, fsr.deniedPaths);
+		if (fsr.allowedReadPaths) result.filesystem.allowedReadPaths = intersectStrings(result.filesystem.allowedReadPaths, fsr.allowedReadPaths);
+		if (fsr.writeOnlyToWorkingDir === true) result.filesystem.writeOnlyToWorkingDir = true;
+		else if (fsr.writeOnlyToWorkingDir === false && b.filesystem.writeOnlyToWorkingDir) warn("filesystem.writeOnlyToWorkingDir=false");
+	}
+	if (repo.network) {
+		const nr = repo.network;
+		if (nr.enabled === true) result.network.enabled = true;
+		else if (nr.enabled === false && b.network.enabled) warn("network.enabled=false");
+		if (nr.allowedDomains) result.network.allowedDomains = intersectStrings(result.network.allowedDomains, nr.allowedDomains);
+	}
+	if (repo.excludedCommands) result.excludedCommands = intersectStrings(result.excludedCommands, repo.excludedCommands);
+	if (repo.allowUnsandboxedCommands === false) result.allowUnsandboxedCommands = false;
+	else if (repo.allowUnsandboxedCommands === true && !b.allowUnsandboxedCommands) warn("allowUnsandboxedCommands=true");
+	if (result.enabled && result.mode === "disabled") result.mode = "permissions";
+	if (!result.enabled) result.mode = "disabled";
+	return result;
 }
 /**
-* Merge configs with priority: global -> project -> local
-* Each layer overrides the previous one
+* Fold repo-sourced MCP servers under the global set so a repo entry can never
+* REPLACE a same-named global server. Global definitions always win; repo
+* entries only fill names global does not already use. Later repo layers win
+* over earlier ones for names global does not define.
+*/
+function mergeMcpServersGlobalWins(global, ...repoLayers) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const layer of repoLayers) {
+		if (!layer) continue;
+		for (const server of layer) byName.set(server.name, server);
+	}
+	if (global) for (const server of global) byName.set(server.name, server);
+	return Array.from(byName.values());
+}
+/**
+* Merge configs with priority: global -> project -> local, with the invariant
+* that repo layers may only TIGHTEN the user's global security posture, never
+* loosen it. Sandbox goes through `tightenSandbox`; the repo `trustedTools`
+* union is filtered to tools that can actually be trusted and aren't globally
+* disabled; and any tool a repo tries to re-enable while it is disabled is
+* dropped. `mcpServers` is NOT merged here - callers fold repo servers in via
+* `mergeMcpServersGlobalWins` where all repo layers are visible together.
 */
 function mergeConfigs(global, project, local) {
 	const merged = { ...global };
@@ -16222,8 +17052,7 @@ function mergeConfigs(global, project, local) {
 				...project.tools.config
 			}
 		};
-		if (project.mcpServers) merged.mcpServers = mergeMcpServers(merged.mcpServers, project.mcpServers);
-		if (project.sandbox) merged.sandbox = mergeSandboxConfig(merged.sandbox, project.sandbox);
+		if (project.sandbox) merged.sandbox = tightenSandbox(merged.sandbox, project.sandbox);
 	}
 	if (local) {
 		if (local.trustedTools) {
@@ -16238,9 +17067,15 @@ function mergeConfigs(global, project, local) {
 			...merged.preferences,
 			...local.preferences
 		};
-		if (local.mcpServers) merged.mcpServers = mergeMcpServers(merged.mcpServers, local.mcpServers);
-		if (local.sandbox) merged.sandbox = mergeSandboxConfig(merged.sandbox, local.sandbox);
+		if (local.sandbox) merged.sandbox = tightenSandbox(merged.sandbox, local.sandbox);
 	}
+	const disabledSet = new Set(merged.tools.disabled);
+	merged.tools = {
+		...merged.tools,
+		enabled: merged.tools.enabled.filter((t) => !disabledSet.has(t))
+	};
+	const globalTrusted = new Set(global.trustedTools || []);
+	merged.trustedTools = (merged.trustedTools || []).filter((t) => globalTrusted.has(t) || canTrustTool(t) && !disabledSet.has(t));
 	return merged;
 }
 /**
@@ -16270,6 +17105,12 @@ var ConfigStore = class {
 	constructor(configPath) {
 		this.config = null;
 		this.projectConfigDir = null;
+		this.globalConfig = null;
+		this.projectRealPath = null;
+		this.projectTrusted = false;
+		this.rawProjectConfig = null;
+		this.rawProjectLocalConfig = null;
+		this.rawMcpJsonServers = null;
 		this.configPath = configPath || path.join(homedir(), ".bike4mind", "config.json");
 	}
 	/**
@@ -16336,35 +17177,33 @@ var ConfigStore = class {
 					trustedTools: validated.trustedTools || []
 				};
 			} catch (error) {
-				if (error.code === "ENOENT") globalConfig = { ...DEFAULT_CONFIG };
+				if (error.code === "ENOENT") globalConfig = structuredClone(DEFAULT_CONFIG);
 				else if (error instanceof z$1.ZodError) {
 					console.error("Global config validation error:", error.issues);
 					console.error("Using default configuration");
-					globalConfig = { ...DEFAULT_CONFIG };
+					globalConfig = structuredClone(DEFAULT_CONFIG);
 				} else throw error;
 			}
-			let projectConfig = null;
-			let projectLocalConfig = null;
-			let mcpJsonServers = null;
+			this.globalConfig = globalConfig;
+			this.projectConfigDir = null;
+			this.projectRealPath = null;
+			this.projectTrusted = false;
+			this.rawProjectConfig = null;
+			this.rawProjectLocalConfig = null;
+			this.rawMcpJsonServers = null;
 			if (process.env.B4M_NO_PROJECT_CONFIG !== "1") {
 				this.projectConfigDir = findProjectConfigDir();
 				if (this.projectConfigDir) {
-					projectConfig = await loadProjectConfig(this.projectConfigDir);
-					projectLocalConfig = await loadProjectLocalConfig(this.projectConfigDir);
-					mcpJsonServers = await loadMcpJsonConfig(this.projectConfigDir);
-					if (projectConfig) logger.debug(`📁 Project config loaded from: ${this.projectConfigDir}/.bike4mind/`);
-					if (mcpJsonServers && mcpJsonServers.length > 0) logger.debug(`📁 Project MCP config loaded from: ${this.projectConfigDir}/.mcp.json`);
+					this.projectRealPath = await safeRealpath(this.projectConfigDir) ?? this.projectConfigDir;
+					this.projectTrusted = (globalConfig.trustedProjects || []).includes(this.projectRealPath);
+					if (this.projectTrusted) {
+						const loaded = await this.loadProjectLayers();
+						if (loaded.hasConfig) logger.debug(`📁 Project config loaded from: ${this.projectConfigDir}/.bike4mind/`);
+						if (loaded.mcpCount > 0) logger.debug(`📁 Project MCP config loaded from: ${this.projectConfigDir}/.mcp.json`);
+					}
 				}
-			} else this.projectConfigDir = null;
-			const mergedConfig = mergeConfigs(globalConfig, projectConfig, projectLocalConfig);
-			if (mcpJsonServers && mcpJsonServers.length > 0) mergedConfig.mcpServers = mergeMcpServers(mcpJsonServers, mergedConfig.mcpServers);
-			const mcpConfigFile = process.env.B4M_MCP_CONFIG_FILE;
-			if (mcpConfigFile) {
-				const injected = await loadMcpConfigFile(mcpConfigFile);
-				if (process.env.B4M_STRICT_MCP_CONFIG === "1") mergedConfig.mcpServers = injected ?? [];
-				else if (injected) mergedConfig.mcpServers = mergeMcpServers(mergedConfig.mcpServers, injected);
 			}
-			this.config = mergedConfig;
+			this.config = await this.computeMerged();
 			return this.config;
 		} catch (error) {
 			if (error.code === "ENOENT") return this.reset();
@@ -16378,6 +17217,116 @@ var ConfigStore = class {
 		}
 	}
 	/**
+	* Load the raw repo config layers for the current project root. Called only
+	* for a trusted root; stores them on `this` so trust changes can re-merge
+	* without re-reading the global config file.
+	*/
+	async loadProjectLayers() {
+		if (!this.projectConfigDir) return {
+			hasConfig: false,
+			mcpCount: 0
+		};
+		this.rawProjectConfig = await loadProjectConfig(this.projectConfigDir);
+		this.rawProjectLocalConfig = await loadProjectLocalConfig(this.projectConfigDir);
+		this.rawMcpJsonServers = await loadMcpJsonConfig(this.projectConfigDir);
+		return {
+			hasConfig: !!this.rawProjectConfig,
+			mcpCount: this.rawMcpJsonServers?.length ?? 0
+		};
+	}
+	/**
+	* Build the merged effective config from the global layer plus the raw repo
+	* layers - but only when the project is trusted, so an untrusted root
+	* contributes nothing. Repo MCP servers are folded in global-wins (a repo
+	* name can never replace a global server); an explicit `--mcp-config` is host-
+	* injected (not repo-sourced) and keeps its override-by-name / strict scope.
+	*/
+	async computeMerged() {
+		const global = this.globalConfig;
+		const project = this.projectTrusted ? this.rawProjectConfig : null;
+		const local = this.projectTrusted ? this.rawProjectLocalConfig : null;
+		const mcpJson = this.projectTrusted ? this.rawMcpJsonServers : null;
+		const merged = mergeConfigs(global, project, local);
+		merged.mcpServers = mergeMcpServersGlobalWins(global.mcpServers, mcpJson, project?.mcpServers, local?.mcpServers);
+		const mcpConfigFile = process.env.B4M_MCP_CONFIG_FILE;
+		if (mcpConfigFile) {
+			const injected = await loadMcpConfigFile(mcpConfigFile);
+			if (process.env.B4M_STRICT_MCP_CONFIG === "1") merged.mcpServers = injected ?? [];
+			else if (injected) merged.mcpServers = mergeMcpServers(merged.mcpServers, injected);
+		}
+		return merged;
+	}
+	/** Whether the current project root is trusted (folder-trust gate). */
+	isProjectTrusted() {
+		return this.projectTrusted;
+	}
+	/** Canonicalized project root discovered this session, or null. */
+	getProjectRealPath() {
+		return this.projectRealPath;
+	}
+	/** The realpath'd roots the user has explicitly trusted. */
+	getTrustedProjects() {
+		return this.globalConfig?.trustedProjects ? [...this.globalConfig.trustedProjects] : [];
+	}
+	/**
+	* Whether the current project root ships any repo-committed b4m files that the
+	* trust gate governs. Used to decide whether the startup trust prompt is even
+	* worth showing (nothing to gate = no prompt).
+	*/
+	projectHasB4mFiles() {
+		const root = this.projectConfigDir;
+		if (!root) return false;
+		return [
+			[".bike4mind", "config.json"],
+			[".bike4mind", "local.json"],
+			[".bike4mind", "agents"],
+			[".bike4mind", "commands"],
+			[".mcp.json"],
+			[".claude", "agents"],
+			[".claude", "skills"],
+			[".claude", "commands"],
+			...PROJECT_CONTEXT_FILES.map((name) => [name])
+		].some((parts) => existsSync(path.join(root, ...parts)));
+	}
+	/**
+	* Trust a project root (default: the current one). Persists the realpath'd
+	* root to the global `trustedProjects` and, when it's the current root, loads
+	* its repo layers and re-merges so they take effect for this session.
+	*/
+	async trustProject(root) {
+		await this.load();
+		const target = root ? await safeRealpath(root) : this.projectRealPath;
+		if (!target) return false;
+		const g = this.globalConfig;
+		if (!g.trustedProjects) g.trustedProjects = [];
+		if (!g.trustedProjects.includes(target)) g.trustedProjects.push(target);
+		if (target === this.projectRealPath && this.projectConfigDir && process.env.B4M_NO_PROJECT_CONFIG !== "1") {
+			this.projectTrusted = true;
+			await this.loadProjectLayers();
+		}
+		await this.save();
+		return true;
+	}
+	/**
+	* Revoke trust for a project root (default: the current one). Next launch
+	* re-prompts and repo layers stay inert until re-trusted. Revoking the current
+	* root drops its raw layers so nothing repo-sourced survives in this session.
+	*/
+	async untrustProject(root) {
+		await this.load();
+		const target = root ? await safeRealpath(root) : this.projectRealPath;
+		if (!target) return;
+		const g = this.globalConfig;
+		g.trustedProjects = (g.trustedProjects || []).filter((p) => p !== target);
+		if (target === this.projectRealPath) {
+			this.projectTrusted = false;
+			this.rawProjectConfig = null;
+			this.rawProjectLocalConfig = null;
+			this.rawMcpJsonServers = null;
+		}
+		await this.save();
+	}
+	/**
 	* Read the features map straight from the global config file, bypassing the
 	* in-memory cache. save() merges over this so concurrent writers (the
 	* interactive session vs `b4m plugin add`) don't clobber each other's keys.
@@ -16412,47 +17361,52 @@ var ConfigStore = class {
 	/**
 	* Save configuration to disk
 	*/
-	async save(config) {
+	async save(config, opts) {
 		await this.init();
+		if (!this.globalConfig) await this.load();
+		const global = this.globalConfig;
 		if (config) {
-			const existingConfig = await this.load();
-			this.config = {
-				...existingConfig,
-				...config,
-				auth: config.auth !== void 0 ? config.auth : existingConfig.auth,
+			const { mcpServers, trustedTools, additionalDirectories, trustedProjects, tools, sandbox, ...rest } = config;
+			this.globalConfig = {
+				...global,
+				...rest,
+				auth: "auth" in config ? config.auth : global.auth,
 				preferences: {
-					...existingConfig.preferences,
+					...global.preferences,
 					...config.preferences || {}
 				},
-				tools: {
-					...existingConfig.tools,
-					...config.tools || {}
-				},
 				toolApiKeys: {
-					...existingConfig.toolApiKeys,
+					...global.toolApiKeys,
 					...config.toolApiKeys || {}
 				},
-				features: this.mergeFeatures(await this.readDiskFeatures(), existingConfig.features, config.features ?? existingConfig.features)
+				features: opts?.clearFeatures ? {} : this.mergeFeatures(await this.readDiskFeatures(), global.features, config.features ?? global.features)
 			};
-		}
-		if (!this.config) throw new Error("No configuration to save");
+		} else this.globalConfig = {
+			...global,
+			features: opts?.clearFeatures ? {} : await this.readDiskFeatures()
+		};
 		try {
-			await promises.writeFile(this.configPath, JSON.stringify(this.config, null, 2), "utf-8");
+			await promises.writeFile(this.configPath, JSON.stringify(this.globalConfig, null, 2), "utf-8");
 			await promises.chmod(this.configPath, 384);
 		} catch (error) {
 			console.error("Failed to save config:", error);
 			throw error;
 		}
+		this.config = await this.computeMerged();
 	}
 	/**
 	* Reset configuration to defaults
 	*/
 	async reset() {
-		this.config = {
-			...DEFAULT_CONFIG,
+		this.globalConfig = {
+			...structuredClone(DEFAULT_CONFIG),
 			userId: v4()
 		};
-		await this.save();
+		this.projectTrusted = false;
+		this.rawProjectConfig = null;
+		this.rawProjectLocalConfig = null;
+		this.rawMcpJsonServers = null;
+		await this.save(void 0, { clearFeatures: true });
 		return this.config;
 	}
 	/**
@@ -16468,56 +17422,71 @@ var ConfigStore = class {
 		await this.save(updates);
 	}
 	/**
+	* Persist a sandbox config to the GLOBAL layer (the `/sandbox` handlers' path).
+	* Sandbox is excluded from the generic `save()` allowlist so it flows only
+	* through here - a merged-config save() can never launder a repo-tightened
+	* sandbox into the user's global default.
+	*/
+	async saveSandboxConfig(sandbox) {
+		await this.load();
+		this.globalConfig.sandbox = structuredClone(sandbox);
+		await this.save();
+	}
+	/**
 	* Add MCP server configuration
 	*/
 	async addMcpServer(server) {
-		const config = await this.load();
-		config.mcpServers = config.mcpServers.filter((s) => s.name !== server.name);
-		config.mcpServers.push(server);
-		await this.save(config);
+		await this.load();
+		const g = this.globalConfig;
+		g.mcpServers = g.mcpServers.filter((s) => s.name !== server.name);
+		g.mcpServers.push(server);
+		await this.save();
 	}
 	/**
 	* Remove MCP server configuration
 	*/
 	async removeMcpServer(name) {
-		const config = await this.load();
-		config.mcpServers = config.mcpServers.filter((s) => s.name !== name);
-		await this.save(config);
+		await this.load();
+		const g = this.globalConfig;
+		g.mcpServers = g.mcpServers.filter((s) => s.name !== name);
+		await this.save();
 	}
 	/**
 	* Enable/disable MCP server
 	*/
 	async toggleMcpServer(name, enabled) {
-		const config = await this.load();
-		const server = config.mcpServers.find((s) => s.name === name);
+		await this.load();
+		const server = this.globalConfig.mcpServers.find((s) => s.name === name);
 		if (server) {
 			server.enabled = enabled;
-			await this.save(config);
+			await this.save();
 		}
 	}
 	/**
 	* Add a tool to trusted tools list
 	*/
 	async trustTool(toolName) {
-		const config = await this.load();
-		if (!config.trustedTools) config.trustedTools = [];
-		if (!config.trustedTools.includes(toolName)) {
-			config.trustedTools.push(toolName);
-			await this.save(config);
+		await this.load();
+		const g = this.globalConfig;
+		if (!g.trustedTools) g.trustedTools = [];
+		if (!g.trustedTools.includes(toolName)) {
+			g.trustedTools.push(toolName);
+			await this.save();
 		}
 	}
 	/**
 	* Remove a tool from trusted tools list
 	*/
 	async untrustTool(toolName) {
-		const config = await this.load();
-		if (config.trustedTools) {
-			config.trustedTools = config.trustedTools.filter((t) => t !== toolName);
-			await this.save(config);
+		await this.load();
+		const g = this.globalConfig;
+		if (g.trustedTools) {
+			g.trustedTools = g.trustedTools.filter((t) => t !== toolName);
+			await this.save();
 		}
 	}
 	/**
-	* Get list of trusted tools
+	* Get list of trusted tools (merged effective view)
 	*/
 	async getTrustedTools() {
 		return (await this.load()).trustedTools || [];
@@ -16526,9 +17495,9 @@ var ConfigStore = class {
 	* Clear all trusted tools
 	*/
 	async clearTrustedTools() {
-		const config = await this.load();
-		config.trustedTools = [];
-		await this.save(config);
+		await this.load();
+		this.globalConfig.trustedTools = [];
+		await this.save();
 	}
 	/**
 	* Get authentication tokens
@@ -16540,17 +17509,17 @@ var ConfigStore = class {
 	* Set authentication tokens
 	*/
 	async setAuthTokens(tokens) {
-		const config = await this.load();
-		config.auth = tokens;
-		await this.save(config);
+		await this.load();
+		this.globalConfig.auth = tokens;
+		await this.save();
 	}
 	/**
 	* Clear authentication tokens (logout)
 	*/
 	async clearAuthTokens() {
-		const config = await this.load();
-		config.auth = void 0;
-		await this.save(config);
+		await this.load();
+		this.globalConfig.auth = void 0;
+		await this.save();
 	}
 	/**
 	* Check if user is authenticated
@@ -16571,10 +17540,9 @@ var ConfigStore = class {
 	* Pass null to reset to the build-time default service.
 	*/
 	async setCustomApiUrl(url) {
-		const config = await this.load();
-		if (url === null) config.apiConfig = void 0;
-		else config.apiConfig = { customUrl: url };
-		await this.save(config);
+		await this.load();
+		this.globalConfig.apiConfig = url === null ? void 0 : { customUrl: url };
+		await this.save();
 	}
 	/**
 	* Switch the active API environment, caching auth tokens per-environment so
@@ -16591,8 +17559,9 @@ var ConfigStore = class {
 	* preserve the previous `auth` and defeat the per-env swap.
 	*/
 	async switchApiEnvironment(target) {
-		const config = await this.load();
-		const prevKey = normalizeEnvKey(config.apiConfig?.customUrl || getDefaultApiUrl());
+		await this.load();
+		const g = this.globalConfig;
+		const prevKey = normalizeEnvKey(g.apiConfig?.customUrl || getDefaultApiUrl());
 		let newUrl;
 		let newApiConfig;
 		if (target === "prod") {
@@ -16611,16 +17580,15 @@ var ConfigStore = class {
 			url: newUrl,
 			envName,
 			changed: false,
-			authenticated: hasValidAuth(config.auth)
+			authenticated: hasValidAuth(g.auth)
 		};
-		const authByEnv = { ...config.authByEnv || {} };
-		if (config.auth) authByEnv[prevKey] = config.auth;
+		const authByEnv = { ...g.authByEnv || {} };
+		if (g.auth) authByEnv[prevKey] = g.auth;
 		else delete authByEnv[prevKey];
 		const restored = authByEnv[newKey];
-		config.apiConfig = newApiConfig;
-		config.authByEnv = authByEnv;
-		config.auth = restored;
-		config.features = await this.readDiskFeatures();
+		g.apiConfig = newApiConfig;
+		g.authByEnv = authByEnv;
+		g.auth = restored;
 		await this.save();
 		return {
 			url: newUrl,
@@ -16708,40 +17676,48 @@ var ConfigStore = class {
 	* Persists to global config
 	*/
 	async addDirectory(dirPath) {
-		const config = await this.load();
-		if (!config.additionalDirectories) config.additionalDirectories = [];
+		await this.load();
+		const g = this.globalConfig;
+		if (!g.additionalDirectories) g.additionalDirectories = [];
 		const resolvedPath = path.resolve(dirPath);
-		if (!config.additionalDirectories.includes(resolvedPath)) {
-			config.additionalDirectories.push(resolvedPath);
-			await this.save(config);
+		if (!g.additionalDirectories.includes(resolvedPath)) {
+			g.additionalDirectories.push(resolvedPath);
+			await this.save();
 		}
 	}
 	/**
 	* Remove a directory from the allowed directories list
 	*/
 	async removeDirectory(dirPath) {
-		const config = await this.load();
-		if (config.additionalDirectories) {
+		await this.load();
+		const g = this.globalConfig;
+		if (g.additionalDirectories) {
 			const resolvedPath = path.resolve(dirPath);
-			config.additionalDirectories = config.additionalDirectories.filter((d) => path.resolve(d) !== resolvedPath);
-			await this.save(config);
+			g.additionalDirectories = g.additionalDirectories.filter((d) => path.resolve(d) !== resolvedPath);
+			await this.save();
 		}
 	}
 	/**
-	* Get all additional directories (merged from global + project configs)
-	* Returns resolved absolute paths
+	* Get all additional directories (global config + trusted-project config).
+	* Returns resolved absolute paths. Project-declared directories are included
+	* ONLY when the project is trusted, and each must resolve inside the project
+	* root (a repo cannot widen file access beyond its own tree).
 	*/
 	async getAdditionalDirectories() {
-		const config = await this.load();
+		await this.load();
+		const g = this.globalConfig;
 		const dirs = /* @__PURE__ */ new Set();
-		if (config.additionalDirectories) for (const dir of config.additionalDirectories) dirs.add(path.resolve(dir));
-		const projectConfig = await this.loadRawProjectConfig();
-		if (projectConfig?.additionalDirectories) {
-			const projectRoot = this.projectConfigDir || process.cwd();
-			for (const dir of projectConfig.additionalDirectories) dirs.add(path.resolve(projectRoot, dir));
+		if (g.additionalDirectories) for (const dir of g.additionalDirectories) dirs.add(path.resolve(dir));
+		if (this.projectTrusted && this.rawProjectConfig?.additionalDirectories) {
+			const projectRoot = this.projectRealPath || this.projectConfigDir;
+			if (projectRoot) for (const dir of this.rawProjectConfig.additionalDirectories) {
+				const real = await safeRealpath(path.resolve(projectRoot, dir));
+				if (real && isWithin(projectRoot, real)) dirs.add(real);
+				else logger.warn(`Ignoring project additionalDirectory outside project root: ${dir}`);
+			}
 		}
 		return Array.from(dirs);
 	}
 };
 //#endregion
-export { SupportedFabFileMimeTypes as $, actorKindSchema as $t, HTTPError as A, isModelDeprecated as At, OPENAI_GPT_IMAGE_1_IMAGE_SIZES as B, parseEmbeddingRateLimitHeaders as Bt, DEFAULT_MUSIC_MODEL_ID as C, isGPTImage2Model as Ct, FIXED_TEMPERATURE_MODELS as D, isImageServeable as Dt, FIELD_GROUP_OF as E, isImageAttachment as Et, MODEL_INFO_FIELD_GROUP_OF as F, isUnlimitedHistory as Ft, PermissionDeniedError as G, toModelInfo as Gt, OllamaEmbeddingModel as H, resolveHistoryFetchLimit as Ht, McpServerName as I, isUserInitiatedAbort as It, REFUSAL_FALLBACK_MODELS as J, usdToCreditsStochastic as Jt, REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS as K, toModelRecord as Kt, ModelBackend as L, isZodError as Lt, IMAGE_SIZE_CONSTRAINTS as M, isRenderableModelType as Mt, ImageModels as N, isRetryableError as Nt, FORMAT_PROMPT_TEMPLATE as O, isMediaModelType as Ot, InternalServerError as P, isSupportedFabFileMimeType as Pt, SpeechToTextModels as Q, actorKindMarker as Qt, NO_TEMPERATURE_MODELS as R, mapMimeTypeToArtifactType as Rt, CorruptedFileError as S, isFieldGroup as St, DEGENERATE_FINISH_REASON as T, isGeminiModelId as Tt, OpenAIEmbeddingModel as U, secureParameters as Ut, OPENAI_GPT_IMAGE_2_IMAGE_SIZES as V, reservationOutputTokens as Vt, PROMPT_TEXT_MAX as W, settingsMap as Wt, REVIEW_GATE_STATUS_VALUES as X, ACTOR_COLOR_SLOTS as Xt, RESPONSES_API_TOOL_MODELS as Y, withRetry as Yt, SUBQUEST_STATUS_VALUES as Z, actorColorIndex as Zt, BadRequestError as _, hasUsableLimits as _t, getCreditsUrl as a, VideoModels as at, CREDIT_DEDUCT_TRANSACTION_TYPES as b, isChunkStalledFile as bt, requireApiUrl as c, applyModelPriceCatalog as ct, AGENT_QUEST_MANIFEST as d, dayjsConfig_default as dt, selfClaimedActorKindSchema as en, TTS_MAX_INPUT_CHARS as et, AGENT_QUEST_MCP_URI as f, defaultEmbeddingModelForEnv as ft, BFL_SAFETY_TOLERANCE as g, hasKeylessCloudEmbedder as gt, BEDROCK_NO_PROMPT_CACHING_MODELS as h, getRetryAfterMs as ht, LOCAL_DEV_URL as i, parseRateLimitHeaders as in, VIDEO_SIZE_CONSTRAINTS as it, HttpStatus as j, isPlaceholderApiKey as jt, ForbiddenError as k, isModelAccessible as kt, resolveApiEndpoint as l, calculateRetryDelay as lt, ApiKeyType as m, getQuestErrorCode as mt, logger as n, extractSnippetMeta as nn, UnauthorizedError as nt, getEnvironmentName as o, VoyageAIEmbeddingModel as ot, ARTIFACT_ATTRS_PATTERN as p, getMcpProviderMetadata as pt, REASONING_SUPPORTED_MODELS as q, usdToCredits as qt, ApiEndpointUnconfiguredError as r, isNearLimit as rn, UnprocessableEntityError as rt, parseApiUrl as s, WORK_ITEM_STATUSES as st, ConfigStore as t, buildRateLimitLogEntry as tn, TooManyRequestsError as tt, AGENT_QUEST_ID as u, countCodePoints as ut, BedrockEmbeddingModel as v, isAudioMimeType as vt, DEFAULT_UNKNOWN_CONTEXT_WINDOW as w, isGPTImageModel as wt, ChatModels as x, isEarlyStop as xt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as y, isChunkRebuildPending as yt, NotFoundError as z, obfuscateApiKey as zt };
+export { withRetry as $, NotFoundError as A, WORK_ITEM_STATUSES as B, CREDIT_DEDUCT_TRANSACTION_TYPES as C, MODEL_INFO_FIELD_GROUP_OF as D, LOCATION_MAP_LANGUAGE as E, REVIEW_GATE_STATUS_VALUES as F, googleMapsSearchUrl as G, escapeThinkMarkers as H, SEARCH_RESULT_CARDS_LANGUAGE as I, isRetryableError as J, isEarlyStop as K, SUBQUEST_STATUS_VALUES as L, OpenAIEmbeddingModel as M, PROMPT_TEXT_MAX as N, McpServerName as O, PermissionDeniedError as P, signImageUrl as Q, SupportedFabFileMimeTypes as R, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as S, DEGENERATE_FINISH_REASON as T, getMcpProviderMetadata as U, createThinkMarkerEscaper as V, getQuestErrorCode as W, obfuscateApiKey as X, isUserInitiatedAbort as Y, secureParameters as Z, AGENT_QUEST_ID as _, canTrustTool as a, ApiKeyType as b, SESSION_ID_PATTERN as c, LOCAL_DEV_URL as d, ACTOR_COLOR_SLOTS as et, getCreditsUrl as f, resolveApiEndpoint as g, requireApiUrl as h, loadContextFiles as i, selfClaimedActorKindSchema as it, OllamaEmbeddingModel as j, ModelBackend as k, isValidSessionId as l, parseApiUrl as m, logger as n, actorKindMarker as nt, getToolCategory as o, getEnvironmentName as p, isPlaceholderImageSigningSecret as q, extractCompactInstructions as r, actorKindSchema as rt, isReadOnlyTool as s, ConfigStore as t, actorColorIndex as tt, ApiEndpointUnconfiguredError as u, AGENT_QUEST_MANIFEST as v, ChatModels as w, BedrockEmbeddingModel as x, AGENT_QUEST_MCP_URI as y, VoyageAIEmbeddingModel as z };