@bike4mind/cli 1.1.0 → 1.2.0

package/dist/{ConfigStore-DdHHCH2t.mjs → ConfigStore-qV7NrCgZ.mjs}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { t as DEFAULT_SANDBOX_CONFIG } from "./types-F61_hxmG.mjs";
-import "crypto";
+import { createHmac } from "crypto";
 import { existsSync, promises } from "fs";
 import os, { homedir } from "os";
 import path from "path";
 import { v4 } from "uuid";
 import * as path$1 from "node:path";
-import * as fs$2 from "node:fs";
+import * as fs$1 from "node:fs";
 import * as z$2 from "zod";
 import z, { ZodError, z as z$1 } from "zod";
 import dayjs from "dayjs";
@@ -16,162 +16,9 @@ import relativeTime from "dayjs/plugin/relativeTime.js";
 import localizedFormat from "dayjs/plugin/localizedFormat.js";
 import { isAxiosError } from "axios";
 import { homedir as homedir$1 } from "node:os";
-import fs$1 from "fs/promises";
+import fs from "fs/promises";
 process.env.APP_NAME;
 process.env.WEBSITE_URL;
-const SNIPPET_META_OPEN = "<!--snippet-meta";
-const SNIPPET_META_CLOSE = "-->";
-/** Index of the first non-whitespace character at or after `from`. */
-const skipSpaceForward = (text, from) => {
-	let i = from;
-	while (i < text.length && /\s/.test(text[i])) i++;
-	return i;
-};
-/** Index just past the last non-whitespace character before `before`. */
-const skipSpaceBackward = (text, before) => {
-	let i = before;
-	while (i > 0 && /\s/.test(text[i - 1])) i--;
-	return i;
-};
-/**
-* Split a prompt into its `<!--snippet-meta {...}-->` sections and the text around them.
-*
-* Scanned with indexOf rather than a regex. The regex this replaces backtracked
-* super-linearly on a marker whose JSON never closed, which invited a parse cap - but a
-* cap could not be applied safely here: the section pattern was terminated by
-* `(?=<!--snippet-meta|$)`, so capping moved `$` and changed section SHAPE, not just
-* length. Past the cap a snippet re-emitted as a `text` section, and callers that skip
-* snippets when collecting URLs to fetch (utils/src/llm/utils.ts) would start fetching
-* them. A linear scan needs no cap, so the shape is the same at every input length.
-*/
-const extractSnippetMeta = (content) => {
-	const sections = [];
-	let cursor = 0;
-	let search = 0;
-	while (search < content.length) {
-		const open = content.indexOf(SNIPPET_META_OPEN, search);
-		if (open === -1) break;
-		const metaStart = skipSpaceForward(content, open + 16);
-		if (content[metaStart] !== "{") {
-			search = open + 16;
-			continue;
-		}
-		let close = content.indexOf(SNIPPET_META_CLOSE, metaStart);
-		while (close !== -1) {
-			const metaEnd = skipSpaceBackward(content, close);
-			if (metaEnd > metaStart && content[metaEnd - 1] === "}") break;
-			close = content.indexOf(SNIPPET_META_CLOSE, close + 3);
-		}
-		if (close === -1) break;
-		const bodyStart = close + 3;
-		const nextMarker = content.indexOf(SNIPPET_META_OPEN, bodyStart);
-		const bodyEnd = nextMarker === -1 ? content.length : nextMarker;
-		const textBefore = content.slice(cursor, open).trim();
-		if (textBefore) sections.push({
-			type: "text",
-			content: textBefore
-		});
-		try {
-			const meta = JSON.parse(content.slice(metaStart, skipSpaceBackward(content, close)));
-			const snippetContent = content.slice(bodyStart, bodyEnd).trim();
-			if (meta && snippetContent) sections.push({
-				type: "snippet",
-				meta,
-				content: snippetContent
-			});
-		} catch (e) {
-			console.error("Error parsing snippet meta:", e);
-		}
-		cursor = bodyEnd;
-		search = bodyEnd;
-	}
-	const remainingText = content.slice(cursor).trim();
-	if (remainingText) sections.push({
-		type: "text",
-		content: remainingText
-	});
-	return { sections };
-};
-function getHeader$1(headers, name) {
-	if (!headers || typeof headers !== "object") return null;
-	if (typeof headers.get === "function") {
-		const val = headers.get(name);
-		return typeof val === "string" ? val : null;
-	}
-	const value = headers[name] ?? headers[name.toLowerCase()];
-	return typeof value === "string" ? value : null;
-}
-function parseNumber(value) {
-	if (value === null || value === void 0) return null;
-	const num = Number(value);
-	return Number.isFinite(num) ? num : null;
-}
-/**
-* Parse rate limit headers from an HTTP response.
-*
-* Reads standard headers:
-* - `X-RateLimit-Limit` - max requests per window
-* - `X-RateLimit-Remaining` - requests left
-* - `X-RateLimit-Reset` - Unix epoch seconds when the window resets
-* - `Retry-After` - seconds to wait (on 429 responses), or an HTTP-date
-*/
-function parseRateLimitHeaders(headers) {
-	const limitStr = getHeader$1(headers, "X-RateLimit-Limit") ?? getHeader$1(headers, "x-ratelimit-limit");
-	const remainingStr = getHeader$1(headers, "X-RateLimit-Remaining") ?? getHeader$1(headers, "x-ratelimit-remaining");
-	const resetStr = getHeader$1(headers, "X-RateLimit-Reset") ?? getHeader$1(headers, "x-ratelimit-reset");
-	const retryAfterStr = getHeader$1(headers, "Retry-After") ?? getHeader$1(headers, "retry-after");
-	const limit = parseNumber(limitStr);
-	const remaining = parseNumber(remainingStr);
-	let resetAt = null;
-	if (resetStr !== null) {
-		const resetNum = Number(resetStr);
-		if (Number.isFinite(resetNum)) resetAt = /* @__PURE__ */ new Date(resetNum * 1e3);
-		else {
-			const parsed = new Date(resetStr);
-			if (!isNaN(parsed.getTime())) resetAt = parsed;
-		}
-	}
-	let retryAfterMs = null;
-	if (retryAfterStr !== null) {
-		const retryNum = Number(retryAfterStr);
-		if (Number.isFinite(retryNum)) retryAfterMs = retryNum * 1e3;
-		else {
-			const parsed = new Date(retryAfterStr);
-			if (!isNaN(parsed.getTime())) retryAfterMs = Math.max(0, parsed.getTime() - Date.now());
-		}
-	}
-	let usagePercent = null;
-	if (limit !== null && limit > 0 && remaining !== null && remaining >= 0) usagePercent = Math.round((limit - remaining) / limit * 100);
-	return {
-		limit,
-		remaining,
-		resetAt,
-		retryAfterMs,
-		usagePercent
-	};
-}
-function isNearLimit(info, thresholdPercent = 80) {
-	if (info.usagePercent === null) return false;
-	return info.usagePercent >= thresholdPercent;
-}
-/**
-* Build a structured log object for rate limit events.
-* Used by all integration clients to emit consistent log lines.
-*/
-function buildRateLimitLogEntry(integration, endpoint, info, wasThrottled = false) {
-	return {
-		type: wasThrottled ? "RATE_LIMIT_ERROR" : "RATE_LIMIT",
-		integration,
-		endpoint,
-		limit: info.limit,
-		remaining: info.remaining,
-		resetAt: info.resetAt?.toISOString() ?? null,
-		retryAfterMs: info.retryAfterMs,
-		usagePercent: info.usagePercent,
-		wasThrottled,
-		timestamp: (/* @__PURE__ */ new Date()).toISOString()
-	};
-}
 //#endregion
 //#region ../../b4m-core/hearth/dist/index.mjs
 /**
@@ -319,23 +166,14 @@ z$1.object({
 });
 //#endregion
 //#region ../../b4m-core/common/dist/index.mjs
-let HttpStatus = /* @__PURE__ */ function(HttpStatus) {
-	HttpStatus[HttpStatus["Ok"] = 200] = "Ok";
-	HttpStatus[HttpStatus["Created"] = 201] = "Created";
-	HttpStatus[HttpStatus["BadRequest"] = 400] = "BadRequest";
-	HttpStatus[HttpStatus["Unauthorized"] = 401] = "Unauthorized";
-	HttpStatus[HttpStatus["Forbidden"] = 403] = "Forbidden";
-	HttpStatus[HttpStatus["NotFound"] = 404] = "NotFound";
-	HttpStatus[HttpStatus["Conflict"] = 409] = "Conflict";
-	HttpStatus[HttpStatus["UnprocessableEntity"] = 422] = "UnprocessableEntity";
-	HttpStatus[HttpStatus["TooManyRequests"] = 429] = "TooManyRequests";
-	HttpStatus[HttpStatus["InternalServerError"] = 500] = "InternalServerError";
-	HttpStatus[HttpStatus["BadGateway"] = 502] = "BadGateway";
-	return HttpStatus;
-}({});
 var HTTPError = class extends Error {
 	statusCode;
 	additionalInfo;
+	/**
+	* Set on a 5xx that reports a third party's failure the server handled correctly (a source site
+	* timing out), so `errorHandler` logs it at warn rather than paging as a server fault.
+	*/
+	expected;
 	constructor(statusCode, message, additionalInfo) {
 		super(message);
 		this.statusCode = statusCode;
@@ -367,47 +205,6 @@ var UnprocessableEntityError = class extends HTTPError {
 		this.name = "UnprocessableEntityError";
 	}
 };
-var BadRequestError = class extends HTTPError {
-	additionalInfo;
-	constructor(message, additionalInfo) {
-		super(400, message, additionalInfo);
-		this.additionalInfo = additionalInfo;
-		this.name = "BadRequestError";
-	}
-};
-var UnauthorizedError = class extends HTTPError {
-	additionalInfo;
-	constructor(message, additionalInfo) {
-		super(401, message, additionalInfo);
-		this.additionalInfo = additionalInfo;
-		this.name = "UnauthorizedError";
-	}
-};
-var ForbiddenError = class extends HTTPError {
-	additionalInfo;
-	constructor(message, additionalInfo) {
-		super(403, message, additionalInfo);
-		this.additionalInfo = additionalInfo;
-		this.name = "ForbiddenError";
-	}
-};
-var TooManyRequestsError = class extends HTTPError {
-	additionalInfo;
-	constructor(message, additionalInfo) {
-		super(429, message, additionalInfo);
-		this.additionalInfo = additionalInfo;
-		this.name = "TooManyRequestsError";
-	}
-};
-var CorruptedFileError = class extends HTTPError {
-	additionalInfo;
-	constructor(fileName, fileType, corruptionDetails, additionalInfo) {
-		const message = `File '${fileName}' (${fileType}) appears to be corrupted${corruptionDetails ? `: ${corruptionDetails}` : ""}. Please try uploading the file again.`;
-		super(422, message, additionalInfo);
-		this.additionalInfo = additionalInfo;
-		this.name = "CorruptedFileError";
-	}
-};
 function isZodError(err) {
 	return Boolean(err && (err instanceof ZodError || err.name === "ZodError"));
 }
@@ -800,19 +597,7 @@ z$1.object({
 	content: z$1.string(),
 	metadata: ArtifactMetadataSchema.optional()
 });
-/**
-* Regex sub-pattern (as a string) that matches the attribute portion of an
-* `<artifact ...>` opening tag. It handles:
-*  - newlines inside the attribute list (AI sometimes wraps long tags),
-*  - `>` characters inside double- or single-quoted attribute values.
-*
-* Exported as a string (not a compiled RegExp) so each consumer can
-* compose it into their own regex with the flags they need, avoiding
-* shared mutable `lastIndex` state.
-*
-* Usage: `new RegExp('<artifact\\s+(' + ARTIFACT_ATTRS_PATTERN + ')>...')`
-*/
-const ARTIFACT_ATTRS_PATTERN = String.raw`(?:[^>"']|"[^"]*"|'[^']*')*`;
+String.raw`(?:[^>"']|"[^"]*"|'[^']*')*`;
 const ClaudeArtifactMimeTypes = {
 	REACT: "application/vnd.ant.react",
 	HTML: "text/html",
@@ -826,45 +611,6 @@ const ClaudeArtifactMimeTypes = {
 	PYTHON: "application/vnd.ant.python",
 	BLOG_DRAFT: "application/vnd.b4m.blog-draft"
 };
-/**
-* Map a MIME type (or AI-provider artifact-type string) to an internal {@link ArtifactType}.
-*
-* Single source of truth - consumed by the artifact parsers (b4m-core/utils + client) and the
-* tool_result dedup in ChatCompletionProcess. Exact blessed-type matches first (case-insensitive,
-* since MIME types are), then language/format inference; returns null if unrecognized.
-*
-* This previously lived as three hand-maintained copies that drifted - e.g. the lattice
-* tool emits `application/vnd.b4m.lattice` but a copy matched `application/vnd.ant.lattice`,
-* letting lattice tool_result artifacts dodge the dedup set.
-*/
-function mapMimeTypeToArtifactType(mimeType) {
-	if (!mimeType) return null;
-	const normalized = mimeType.toLowerCase().trim();
-	switch (normalized) {
-		case ClaudeArtifactMimeTypes.REACT.toLowerCase(): return "react";
-		case ClaudeArtifactMimeTypes.HTML.toLowerCase(): return "html";
-		case ClaudeArtifactMimeTypes.SVG.toLowerCase(): return "svg";
-		case ClaudeArtifactMimeTypes.MERMAID.toLowerCase(): return "mermaid";
-		case ClaudeArtifactMimeTypes.RECHARTS.toLowerCase(): return "recharts";
-		case ClaudeArtifactMimeTypes.CHESS.toLowerCase(): return "chess";
-		case ClaudeArtifactMimeTypes.CODE.toLowerCase(): return "code";
-		case ClaudeArtifactMimeTypes.MARKDOWN.toLowerCase(): return "code";
-		case ClaudeArtifactMimeTypes.LATTICE.toLowerCase(): return "lattice";
-		case ClaudeArtifactMimeTypes.PYTHON.toLowerCase(): return "python";
-		case ClaudeArtifactMimeTypes.BLOG_DRAFT.toLowerCase(): return "blog-draft";
-	}
-	if (normalized.includes("jsx") || normalized.includes("react")) return "react";
-	if (normalized.includes("javascript") || normalized.includes("typescript")) return "code";
-	if (normalized.includes("python") || normalized === "text/x-python") return "python";
-	if (normalized.includes("java") || normalized.includes("c++") || normalized.includes("rust") || normalized.includes("go") || normalized.includes("ruby") || normalized.includes("php") || normalized.includes("swift") || normalized.includes("kotlin") || normalized.includes("csharp") || normalized.includes("c#")) return "code";
-	if (normalized.includes("html") || normalized.includes("xhtml")) return "html";
-	if (normalized.includes("svg")) return "svg";
-	if (normalized.includes("markdown") || normalized.includes("md")) return "code";
-	if (normalized.includes("mermaid")) return "mermaid";
-	if (normalized.includes("recharts") || normalized.includes("chart")) return "recharts";
-	if (normalized.includes("chess")) return "chess";
-	return null;
-}
 let KnowledgeType = /* @__PURE__ */ function(KnowledgeType) {
 	/**
 	* A knowledge that is from a URL.
@@ -1062,9 +808,8 @@ const IMAGE_SIZE_CONSTRAINTS = {
 	},
 	/**
 	* dall-e-3 is no longer in ImageModels, but the generate path still accepts its sizes
-	* for callers holding a persisted one. Listed separately to record what each tier really
-	* accepts; isSupportedImageSize currently measures both against the union of the two
-	* (OPENAI_LEGACY_IMAGE_SIZES), so the split is documentation rather than enforcement.
+	* for callers holding a persisted one. Reached by LEGACY_DALL_E_3_MODEL_ID rather than an
+	* enum member; isSupportedImageSize measures each dall-e tier against its own list.
 	*/
 	DALL_E_3: {
 		sizes: [
@@ -1154,6 +899,7 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 	ChatModels["CLAUDE_4_8_OPUS"] = "claude-opus-4-8";
 	ChatModels["CLAUDE_FABLE_5"] = "claude-fable-5";
 	ChatModels["CLAUDE_5_OPUS"] = "claude-opus-5";
+	ChatModels["CLAUDE_5_5_OPUS"] = "claude-opus-5-5";
 	ChatModels["JURASSIC2_ULTRA"] = "ai21.j2-ultra-v1";
 	ChatModels["JURASSIC2_MID"] = "ai21.j2-mid-v1";
 	ChatModels["GEMINI_3_5_FLASH"] = "gemini-3.5-flash";
@@ -1195,12 +941,6 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 const CHAT_MODELS = Object.values(ChatModels);
 const supportedChatModels = z$1.enum(ChatModels);
 /**
-* Every `ChatModels` Gemini entry is named `gemini...` (see the GEMINI block above) - a prefix
-* check tracks that naming convention automatically as new Gemini models are added, unlike an
-* explicit id list that would need updating in lockstep and could silently miss one.
-*/
-const isGeminiModelId = (model) => model.startsWith("gemini");
-/**
 * Models that support the reasoning_effort parameter.
 * o1-preview and o1-mini do NOT support reasoning_effort.
 */
@@ -1221,137 +961,7 @@ const REASONING_SUPPORTED_MODELS = /* @__PURE__ */ new Set([
 	"gpt-5.6-luna",
 	"gpt-5.6-terra"
 ]);
-/**
-* GPT-5-family reasoning models whose tool calling breaks on
-* `/v1/chat/completions` when `reasoning_effort` is also sent. OpenAI requires
-* this combination to go through `/v1/responses` instead. The failure mode
-* differs by model:
-*   - GPT-5.4 (and -mini/-nano) hard-reject with a 400:
-*       "Function tools with reasoning_effort are not supported for <model> in
-*        /v1/chat/completions. Please use /v1/responses instead."
-*   - GPT-5 / -mini / -nano / 5.1 / 5.2 return 200 but silently degrade: the
-*     model *narrates* the tool call in its text ("Calling the tool now...")
-*     instead of emitting a real `tool_calls` entry, so no tool ever executes.
-*     This surfaced as the /opti optimizer's "Draft with AI" doing nothing on
-*     GPT-5: the same request on a model with `reasoning_effort`
-*     dropped (or on Claude) fires the tool correctly.
-*
-* We drop `reasoning_effort` when tools are sent for these models so tool
-* calling continues to work on `/v1/chat/completions`. Dropping it only forgoes
-* explicit effort control - the model still reasons at its default.
-*
-* NOTE: for the base GPT-5 narrator family (`RESPONSES_API_TOOL_MODELS`), the
-* adapter now routes tool turns to `/v1/responses` instead - where reasoning +
-* tools work together, so `reasoning_effort` is kept. This drop remains as
-* defense-in-depth for the (now-unreached) chat path and covers the GPT-5.4
-* family, which is NOT routed to Responses (its drop-path already works).
-*
-* O-series reasoning models (o1/o3/o4) are intentionally excluded: they call
-* tools correctly with `reasoning_effort` on `/v1/chat/completions`.
-*
-* Invariant: every member here MUST also be in `REASONING_SUPPORTED_MODELS`.
-* The gate in `openaiBackend.ts` short-circuits when a model doesn't support
-* reasoning at all, so adding a non-reasoning model here would make the gate
-* a no-op and silently leak `reasoning_effort` to the request.
-*/
-const REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS = /* @__PURE__ */ new Set([
-	"gpt-5",
-	"gpt-5-mini",
-	"gpt-5-nano",
-	"gpt-5.1",
-	"gpt-5.2",
-	"gpt-5.4",
-	"gpt-5.4-mini",
-	"gpt-5.4-nano",
-	"gpt-5.6-sol",
-	"gpt-5.6-luna",
-	"gpt-5.6-terra"
-]);
-/**
-* GPT-5 reasoning models that silently *narrate* tool calls on
-* `/v1/chat/completions` (return 200 with the call written as text instead of a
-* real `tool_calls` entry, so nothing executes). The adapter
-* routes these to OpenAI's `/v1/responses` API when function tools are present,
-* where reasoning + tools work together and `reasoning_effort` can be kept.
-*
-* Deliberately excludes the GPT-5.4 family: it *hard-errors* (400) on that
-* combination and is already handled by dropping `reasoning_effort` on the chat
-* path (see `REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS`), so it stays on
-* the working chat path to keep this routing's blast radius small. Also excludes
-* `*-chat-latest` (non-reasoning) and O-series (tools work there already).
-*
-* Invariant: every member MUST also be in `REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS`
-* so the chat path still drops `reasoning_effort` as a fallback if routing is bypassed.
-*/
-const RESPONSES_API_TOOL_MODELS = /* @__PURE__ */ new Set([
-	"gpt-5",
-	"gpt-5-mini",
-	"gpt-5-nano",
-	"gpt-5.1",
-	"gpt-5.2",
-	"gpt-5.6-sol",
-	"gpt-5.6-luna",
-	"gpt-5.6-terra"
-]);
-/**
-* Models that only support temperature=1 (no custom temperature).
-* Includes:
-*  - All reasoning models (OpenAI requires temp=1 when reasoning is active)
-*  - chat-latest variants that enforce this constraint
-*  - GPT-5.5, which rejects custom temperature even though it does not expose
-*    reasoning controls
-*/
-const FIXED_TEMPERATURE_MODELS = /* @__PURE__ */ new Set([
-	...Array.from(REASONING_SUPPORTED_MODELS),
-	"gpt-5.1-chat-latest",
-	"gpt-5.2-chat-latest",
-	"gpt-5.5"
-]);
-/**
-* Models that do not accept the temperature parameter at all.
-* The API will reject requests that include temperature for these models.
-*/
-const NO_TEMPERATURE_MODELS = /* @__PURE__ */ new Set([
-	"claude-opus-4-7",
-	"global.anthropic.claude-opus-4-7",
-	"claude-opus-4-8",
-	"global.anthropic.claude-opus-4-8",
-	"claude-sonnet-5",
-	"global.anthropic.claude-sonnet-5",
-	"claude-fable-5",
-	"claude-opus-5",
-	"kimi-k3",
-	"kimi-k2.7-code",
-	"kimi-k2.7-code-highspeed",
-	"kimi-k2.6",
-	"kimi-k2.5",
-	"deepseek-flash",
-	"deepseek-v4-pro"
-]);
-/**
-* Models whose safety classifiers can decline a request with `stop_reason: 'refusal'`
-* (HTTP 200, empty or partial content) - Claude Fable 5's GA classifiers target research
-* biology and most cybersecurity content and occasionally false-positive on benign adjacent
-* work. Per Anthropic's GA guidance a refusal from these is opt-in recoverable: rather than
-* surfacing a hard refusal, the backend throws so the completion loop's existing fallback
-* machinery continues the request on Opus 5 (whose classifiers intervene far less often).
-* A refusal from any *other* model is a genuine decline and surfaces unchanged. Keep in
-* sync with the `claude-fable-5` fallback preference chain in `adminSettings/fallback.ts`.
-*/
-const REFUSAL_FALLBACK_MODELS = /* @__PURE__ */ new Set(["claude-fable-5"]);
-/**
-* Bedrock-hosted Claude models that do NOT support prompt caching (`cache_control`).
-* Sending `cache_control` to these models triggers a Bedrock deserialization error:
-*   `tools.N.cache_control: Extra inputs are not permitted`
-*
-* AWS Bedrock added prompt caching for Claude 3.5 Haiku and Claude 3.7 Sonnet (and later);
-* the OG Claude 3 Haiku and the v1 Claude 3.5 Sonnet were not retrofitted.
-*
-* Keep this set narrow - default behavior is to apply caching when `cacheStrategy.enableCaching`
-* is true. Add a model here only when we have concrete evidence (a Bedrock validation error)
-* that it rejects `cache_control`.
-*/
-const BEDROCK_NO_PROMPT_CACHING_MODELS = /* @__PURE__ */ new Set(["anthropic.claude-3-haiku-20240307-v1:0", "anthropic.claude-3-5-sonnet-20240620-v1:0"]);
+[...Array.from(REASONING_SUPPORTED_MODELS)];
 /**
 * Speech to Text Models
 *
@@ -1397,13 +1007,6 @@ z$1.enum({
 	...SpeechToTextModels,
 	...VideoModels
 });
-/** Returns true if the model is deprecated on or before the provided date (default: now). */
-const isModelDeprecated = (model, now = /* @__PURE__ */ new Date()) => {
-	if (!model.deprecationDate) return false;
-	const todayYMD = new Date(now.toISOString().slice(0, 10));
-	const cutoff = /* @__PURE__ */ new Date(model.deprecationDate + "T00:00:00Z");
-	return todayYMD.getTime() >= cutoff.getTime();
-};
 /**
 * Valid status values for sub-quests.
 * Canonical vocabulary - the mongoose schema, zod schemas, and client all
@@ -1599,7 +1202,14 @@ const RealtimeVoiceUsageTransaction = BaseCreditTransaction.extend({
 });
 const ToolUsageTransaction = BaseCreditTransaction.extend({
 	type: z$1.literal("tool_usage"),
-	model: z$1.string(),
+	/**
+	* The model that actually incurred the tool cost (e.g. 'gpt-image-2'), NOT the chat
+	* model of the quest that ran the tool. The row is one aggregate over every charging
+	* tool call in the quest, so this is set only when exactly one model charged; a quest
+	* that charged on two or more models leaves it unset rather than naming one of them.
+	* Per-call attribution always lives on the `feature: 'tool'` UsageEventModel rows.
+	*/
+	model: z$1.string().optional(),
 	questId: z$1.string(),
 	sessionId: z$1.string()
 });
@@ -1685,8 +1295,8 @@ z$1.object({
 	ownerType: z$1.enum(CreditHolderType),
 	sessionId: z$1.string().optional(),
 	/**
-	* Data lake this call is 1:1 attributable to (ingestion embeds only - a query
-	* embedding can span multiple lakes and is never attributed here). Unset for
+	* Data lake this call is 1:1 attributable to (ingestion embeds and research-run judge calls -
+	* a query embedding can span multiple lakes and is never attributed here). Unset for
 	* every other feature/call.
 	*/
 	dataLakeId: z$1.string().optional(),
@@ -1841,7 +1451,6 @@ const FIELD_GROUPS = [
 	"dispatch",
 	"availability"
 ];
-const isFieldGroup = (value) => FIELD_GROUPS.includes(value);
 /** YYYY-MM-DD, the format every date-ish ModelInfo field already uses. */
 const CALENDAR_DATE = z$1.string().regex(/^\d{4}-\d{2}-\d{2}$/, "expected a YYYY-MM-DD calendar date");
 const ReasoningWrite = z$1.strictObject({
@@ -2656,6 +2265,7 @@ const DATA_LAKE_STABLE_STATUSES = [
 	"deleted"
 ];
 DATA_LAKE_STATUSES.filter((s) => !DATA_LAKE_STABLE_STATUSES.includes(s));
+const DATA_LAKE_ORIGINS = ["curated", "connector-fed"];
 z$1.object({
 	/**
 	* The granting lake's Mongo `_id`. ALWAYS a persisted DB lake: a hardcoded/fallback lake has no
@@ -2703,6 +2313,14 @@ z$1.object({
 	removedAt: z$1.date(),
 	expiresAt: z$1.date()
 });
+/** Mirrors the read model's vocabulary deliberately (aliased, not re-declared, so the two can
+* never drift) - an audit reader learns one principal shape for both halves of the trail. */
+const LAKE_CONFIG_CHANGE_PRINCIPAL_KINDS = [
+	"user",
+	"agent",
+	"apiKey",
+	"system"
+];
 /**
 * Every `IDataLake` field, classified as audited or not. A TOTAL map keyed by `keyof IDataLake`,
 * exactly like `LAKE_FIELD_VISIBILITY` in redactLakeForActor.ts and for the same reason: a list of
@@ -2731,6 +2349,7 @@ const LAKE_CONFIG_FIELD_AUDIT = {
 	auditQueryTextEnabled: "audited",
 	lakeMemoryEnabled: "audited",
 	status: "audited",
+	origin: "audited",
 	createdByUserId: "audited",
 	lastUpdatedByUserId: "excluded",
 	fileCount: "excluded",
@@ -2739,15 +2358,58 @@ const LAKE_CONFIG_FIELD_AUDIT = {
 	embeddingSpendMicroUsd: "excluded",
 	lastSyncAt: "excluded",
 	lastHealthCheckedAt: "excluded",
+	lastInconsistencyScanAt: "excluded",
 	filesDeletedAt: "excluded",
 	filesArchivedAt: "excluded",
 	lakeMemoryExtractionAt: "excluded",
 	lakeMemoryCursor: "excluded",
 	lakeMemoryPurgedAt: "excluded",
 	inconsistencyReport: "excluded",
-	inconsistencyComputedAt: "excluded"
+	inconsistencyComputedAt: "excluded",
+	modelInconsistencyRunAt: "excluded"
 };
 [...Object.keys(LAKE_CONFIG_FIELD_AUDIT).filter((field) => LAKE_CONFIG_FIELD_AUDIT[field] === "audited")];
+z$1.object({
+	dataLakeId: z$1.string(),
+	/** Denormalized from the lake at offer time: a recipient route can filter by it without a join. */
+	organizationId: z$1.string().nullish(),
+	/** The actor who made the offer - always the eventual `grantedByUserId` of an accepted transfer. */
+	offeredByUserId: z$1.string(),
+	recipientUserId: z$1.string(),
+	status: z$1.enum([
+		"pending",
+		"accepted",
+		"declined",
+		"cancelled",
+		"expired"
+	]),
+	expiresAt: z$1.date(),
+	/** Set by the atomic `resolve` when the offer leaves `pending`; null while it is still open. */
+	resolvedAt: z$1.date().nullish(),
+	/**
+	* The lake's effective owner ids AT OFFER TIME. Accept re-resolves them and refuses if they moved,
+	* so an offer can never apply a transfer over another transfer (or a departure succession) that
+	* happened in between. Snapshotted rather than recomputed because "stale" is exactly the case
+	* where today's answer differs from the one the offer was made under.
+	*/
+	priorOwnerUserIds: z$1.array(z$1.string()),
+	offeredVia: z$1.enum([
+		"grant-owner",
+		"creator",
+		"platform-admin",
+		"org-admin"
+	]),
+	/**
+	* The principal to attribute the applied transfer to, resolved by the route at OFFER time (only a
+	* route can tell an API key from a session). Carried so the eventual audit row keeps naming the
+	* same principal the offer was made under, rather than whichever principal happens to accept.
+	*/
+	auditPrincipal: z$1.object({
+		principalKind: z$1.enum(LAKE_CONFIG_CHANGE_PRINCIPAL_KINDS),
+		principalId: z$1.string(),
+		onBehalfOfUserId: z$1.string().optional()
+	}).optional()
+});
 /**
 * SRE Agent Trio - Shared Types
 *
@@ -3099,52 +2761,7 @@ let SupportedFabFileMimeTypes = /* @__PURE__ */ function(SupportedFabFileMimeTyp
 	SupportedFabFileMimeTypes["CONF"] = "text/plain";
 	return SupportedFabFileMimeTypes;
 }({});
-/**
-* The canonical set of MIME types the ingest pipeline can actually chunk +
-* vectorize. Kept in lockstep with the `SmartChunker` switch in
-* `@bike4mind/fab-pipeline`.
-*/
-const SUPPORTED_FAB_FILE_MIME_TYPES = new Set(Object.values(SupportedFabFileMimeTypes));
-/**
-* Type guard: is a claimed MIME type one we actually support ingesting?
-*
-* Used to gate uploads so unsupported/binary files (e.g. `.exe`) are rejected
-* with a clear error instead of being stored and silently "vectorized" into 0
-* chunks. Node-free so it can run on both the client (upload UI) and server
-* (ingest endpoints).
-*/
-function isSupportedFabFileMimeType(mimeType) {
-	return !!mimeType && SUPPORTED_FAB_FILE_MIME_TYPES.has(mimeType);
-}
-/**
-* Known MIME types emitted by the generated-audio endpoints (TTS + sound
-* effects). Deliberately SEPARATE from SupportedFabFileMimeTypes: that set is
-* the ingest pipeline's chunk+vectorize allowlist, and audio is intentionally
-* NOT vectorizable and NOT attachable to a chat completion (no model accepts
-* audio input). Kept only for extension mapping / documentation; the runtime
-* guard below matches any `audio/*` so unusual provider subtypes are still
-* treated as audio (i.e. still excluded from every LLM path).
-*/
-let AudioMimeType = /* @__PURE__ */ function(AudioMimeType) {
-	AudioMimeType["MP3"] = "audio/mpeg";
-	AudioMimeType["WAV"] = "audio/wav";
-	AudioMimeType["OPUS"] = "audio/opus";
-	AudioMimeType["AAC"] = "audio/aac";
-	AudioMimeType["FLAC"] = "audio/flac";
-	AudioMimeType["PCM"] = "audio/pcm";
-	AudioMimeType["OGG"] = "audio/ogg";
-	AudioMimeType["WEBM"] = "audio/webm";
-	return AudioMimeType;
-}({});
-/**
-* Is this an audio MIME type? Matches any `audio/*` (not just the known set)
-* so the LLM-exclusion and vectorization-skip guards fail safe for any audio
-* subtype a provider might emit.
-*/
-function isAudioMimeType(mimeType) {
-	if (!mimeType) return false;
-	return mimeType.split(";")[0].trim().toLowerCase().startsWith("audio/");
-}
+new Set(Object.values(SupportedFabFileMimeTypes));
 /** Reads back the classifier set by the tagged-error helpers above; `undefined` for untagged errors. */
 function getQuestErrorCode(error) {
 	const code = error?.additionalInfo?.errorCode;
@@ -3223,77 +2840,12 @@ const AGENT_QUEST_MANIFEST = {
 	}
 };
 /**
-* The catalog row in force for a model and unit at a given time: newest
-* effectiveFrom <= at AMONG ROWS OF THAT UNIT. Units are independent price
-* streams - a newer per_minute row must never shadow the in-force per_token
-* row (that would silently revert token billing to the adapter literal).
-* Rows are append-only, so this is the whole time-travel story (see
-* ModelPriceTypes).
-*/
-function resolveModelPriceRow(rows, modelId, unit, at) {
-	let inForce;
-	for (const row of rows) {
-		if (row.modelId !== modelId || row.unit !== unit) continue;
-		if (row.effectiveFrom.getTime() > at.getTime()) continue;
-		if (!inForce || row.effectiveFrom.getTime() > inForce.effectiveFrom.getTime()) inForce = row;
-	}
-	return inForce;
-}
-/**
-* Overlay catalog prices onto assembled ModelInfo. Only per_token rows apply
-* here (they feed getTextModelCost via ModelInfo.pricing); per_minute and
-* per_image rows are consumed by their own settlement paths. A model with no
-* per_token row in force keeps its adapter literal - the fallback that keeps
-* zero-config self-host deployments working.
-*/
-function applyModelPriceCatalog(models, rows, at = /* @__PURE__ */ new Date()) {
-	if (rows.length === 0) return models;
-	return models.map((model) => {
-		if (model.type !== "text") return model;
-		const row = resolveModelPriceRow(rows, model.id, "per_token", at);
-		if (!row) return model;
-		const pricing = {};
-		for (const [threshold, tier] of Object.entries(row.pricing)) pricing[Number(threshold)] = tier;
-		return {
-			...model,
-			pricing
-		};
-	});
-}
-/**
 * Input headroom the chat path holds back on top of a request's reserved output.
 * safeInputWindow (ChatCompletionProcess) subtracts it, so a text entry whose output
 * reserve leaves less than this has no room for a prompt at all.
 */
 const CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS = 1e3;
 /**
-* Fallback context window for a media row whose catalog value is not usable (a discovery feed's
-* literal 0, meaning "not applicable" rather than a real budget - see isMediaModelType). Shared by
-* effectiveContextWindow (@bike4mind/utils, server) and useTokenLimits (apps/client, browser) so
-* the two do not drift onto different placeholder numbers for the same "unknown" case.
-*/
-const DEFAULT_UNKNOWN_CONTEXT_WINDOW = 2e5;
-/**
-* The model types this build's ModelInfo consumers narrow on. ModelRecord.type is
-* wider (embedding / tts / realtime-voice), so the read path drops and counts any
-* record outside this set: an old build must degrade to "I do not see the new video
-* models", never to a runtime narrowing failure.
-*/
-const MODEL_INFO_TYPES = [
-	"text",
-	"image",
-	"speech-to-text",
-	"video"
-];
-const isRenderableModelType = (type) => MODEL_INFO_TYPES.includes(type);
-/**
-* Whether a ModelInfo type returns media (image/video) rather than tokens. Shared by
-* safeInputWindow/effectiveContextWindow (@bike4mind/utils, server) and useTokenLimits
-* (apps/client, browser) so "what counts as media" cannot drift between the two halves of the
-* same guard - both need it, and common is the one package already safe to import from either.
-*/
-const isMediaModelType = (type) => type === "image" || type === "video";
-/**
 * The modalities promptMeta.model.type is allowed to record. Deliberately NARROWER than
 * MODEL_INFO_TYPES: 'speech-to-text' is served by its own transcription route, never by a
 * completion, so recording it would put a value in the field that no reader narrows on.
@@ -3305,162 +2857,6 @@ const PROMPT_META_MODEL_TYPES = [
 	"image",
 	"video"
 ];
-/**
-* The record -> ModelInfo adapter: one place where every ModelInfo field a
-* catalog record does not carry gets its default. Each default degrades to the
-* visible, recoverable behavior rather than the silent or expensive one.
-*
-* Pricing is never sourced here: applyModelPriceCatalog overlays the ModelPrice
-* rows afterwards, and an empty map trips the [UNPRICED_MODEL] alarm on first
-* billed use, which is the intended fail-loud path.
-*/
-function toModelInfo(record) {
-	const retired = record.lifecycle?.status === "retired";
-	const disabled = record.disabled === true || record.autoDisabled === true || retired;
-	return {
-		id: record.id,
-		type: record.type,
-		name: record.name,
-		backend: record.backend,
-		contextWindow: record.contextWindow,
-		max_tokens: record.maxOutputTokens ?? Math.min(record.contextWindow, 4096),
-		...record.maxOutputTokens === void 0 ? { maxOutputTokensDerived: true } : {},
-		pricing: {},
-		can_stream: record.canStream,
-		can_think: record.reasoning?.supported ?? false,
-		thinkingStyle: toThinkingStyle(record),
-		adapterFamily: record.adapterFamily,
-		dispatchProfile: record.dispatchProfile,
-		supportsVision: record.supportsVision,
-		supportsTools: record.supportsTools,
-		supportsImageVariation: record.supportsImageVariation ?? false,
-		supportsSafetyTolerance: record.supportsSafetyTolerance,
-		freeToRun: record.freeToRun,
-		private: record.private ?? false,
-		disabled,
-		disabledReason: record.disabledReason ?? record.autoDisabledReason ?? (retired ? "retired by the provider" : void 0),
-		deprecationDate: record.lifecycle?.deprecationDate,
-		replacedBy: record.lifecycle?.replacedBy,
-		trainingCutoff: record.trainingCutoff,
-		releaseDate: record.releaseDate,
-		logoFile: record.logoFile,
-		rank: record.rank,
-		description: record.description,
-		isSlowModel: record.isSlowModel
-	};
-}
-/**
-* ModelInfo.thinkingStyle only describes the two Anthropic request shapes. Other
-* reasoning styles map to undefined rather than to a wrong shape; the backends
-* treat unset as their own default.
-*/
-function toThinkingStyle(record) {
-	switch (record.reasoning?.style) {
-		case "anthropic-adaptive": return "adaptive";
-		case "anthropic-legacy": return "legacy";
-		default: return;
-	}
-}
-function fromThinkingStyle(style) {
-	if (style === "adaptive") return "anthropic-adaptive";
-	if (style === "legacy") return "anthropic-legacy";
-}
-/** Who makes the model, when the id namespace says so: [region.]<vendor>.<model>. */
-const BEDROCK_REGION_PREFIX = /^(us|eu|apac|global)\./;
-const VENDOR_BY_BACKEND = {
-	["openai"]: "openai",
-	["anthropic"]: "anthropic",
-	["gemini"]: "google",
-	["xai"]: "xai",
-	["kimi"]: "moonshotai",
-	["deepseek"]: "deepseek",
-	["bfl"]: "black-forest-labs",
-	["aws"]: "amazon",
-	["voyageai"]: "voyageai",
-	["ollama"]: "ollama",
-	["local-image"]: "local",
-	["bedrock"]: "amazon"
-};
-/**
-* ModelInfo carries no vendor (that is one of the four disagreeing taxonomies
-* this catalog replaces), so the inverse adapter derives it: the backend answers
-* it for direct providers, and for Bedrock the id namespace does.
-*/
-/**
-* Bedrock id prefixes that name the same maker as a different string. AWS spells
-* Kimi K2.5 `moonshotai.` and K2 Thinking `moonshot.`, so the raw prefix would
-* file one vendor's two models under two vendors and split them in the admin
-* dashboard. Canonicalized to the spelling the direct backend and the models.dev
-* provider both use.
-*/
-const BEDROCK_VENDOR_ALIASES = { moonshot: "moonshotai" };
-function inferVendor(info) {
-	if (info.backend === "bedrock") {
-		const withoutRegion = String(info.id).replace(BEDROCK_REGION_PREFIX, "");
-		const dot = withoutRegion.indexOf(".");
-		if (dot > 0) {
-			const prefix = withoutRegion.slice(0, dot);
-			return BEDROCK_VENDOR_ALIASES[prefix] ?? prefix;
-		}
-	}
-	return VENDOR_BY_BACKEND[info.backend] ?? String(info.backend);
-}
-/**
-* ModelInfo -> ModelRecord, the inverse of toModelInfo. Two callers: the
-* fallback seed generator (adapter literals become seed rows) and the merge's
-* base tier (a seeded model becomes a record that a catalog row can then claim
-* groups of).
-*
-* `pricing` has no ModelInfo spelling here and is deliberately absent rather
-* than guessed: catalog rows never carry it. The dispatch group round-trips
-* (ModelInfo carries it since dispatch consumes it), but no feed may author it -
-* a wrong value there mis-routes a request, so it stays seed- or
-* operator-sourced, or comes from the seed-side DispatchResolver.
-*
-* Round-tripping normalizes the optional booleans toModelInfo defaults
-* (can_think, private, disabled, supportsImageVariation): undefined becomes an
-* explicit false. That is only observable for a model whose merged record a
-* catalog row actually owns a group of.
-*/
-function toModelRecord(info) {
-	return {
-		id: info.id,
-		vendor: inferVendor(info),
-		backend: info.backend,
-		type: info.type,
-		name: info.name,
-		contextWindow: info.contextWindow,
-		maxOutputTokens: info.maxOutputTokensDerived === true ? void 0 : info.max_tokens,
-		canStream: info.can_stream,
-		reasoning: info.can_think === void 0 && info.thinkingStyle === void 0 ? void 0 : {
-			supported: info.can_think === true,
-			style: fromThinkingStyle(info.thinkingStyle)
-		},
-		adapterFamily: info.adapterFamily,
-		dispatchProfile: info.dispatchProfile,
-		supportsVision: info.supportsVision,
-		supportsTools: info.supportsTools,
-		supportsImageVariation: info.supportsImageVariation,
-		supportsSafetyTolerance: info.supportsSafetyTolerance,
-		lifecycle: {
-			...info.deprecationDate ? {
-				status: "deprecated",
-				deprecationDate: info.deprecationDate
-			} : { status: "active" },
-			...info.replacedBy ? { replacedBy: info.replacedBy } : {}
-		},
-		description: info.description,
-		logoFile: info.logoFile,
-		rank: info.rank,
-		isSlowModel: info.isSlowModel,
-		trainingCutoff: info.trainingCutoff,
-		releaseDate: info.releaseDate,
-		private: info.private,
-		freeToRun: info.freeToRun,
-		disabled: info.disabled,
-		disabledReason: info.disabledReason
-	};
-}
 const DEFAULT_PRICE_MARGIN = 1.2;
 const DEFAULT_USD_TO_CREDITS_RATE = 6e-4;
 /**
@@ -3508,140 +2904,6 @@ const CREDITS_PER_USD_COST = (() => {
 	console.warn(`[pricing] Env-configured margin/rate derive ${derived} credits per USD cost; using defaults`);
 	return Math.round(DEFAULT_PRICE_MARGIN / DEFAULT_USD_TO_CREDITS_RATE);
 })();
-/**
-* Converts a USD cost to credits, including markup, rounding UP (minimum 1).
-*
-* Use for reservations, eligibility checks, estimates, and display - anywhere
-* a deterministic, conservative number is needed. Final settlement of variable
-* usage should use usdToCreditsStochastic so users pay the exact fraction in
-* expectation instead of the round-up.
-*
-* Examples (defaults):
-* $1 USD = 2000 credits (1.2x markup at $0.0006/credit)
-* $0.001 USD = 2 credits
-* $0.0001 USD = 1 credit (minimum)
-*
-* @param rate - Credits per $1, defaults to the platform-wide CREDITS_PER_USD_COST.
-*   Pass an override for a provider-specific admin-tunable rate (e.g. a
-*   billing-sensitive external compute path priced independently of the
-*   platform default).
-*/
-const usdToCredits = (usd, rate = CREDITS_PER_USD_COST) => {
-	return Math.max(1, Math.ceil(usd * rate));
-};
-/**
-* Uniform draw in [0, 1) from the platform CSPRNG. Billing draws MUST be
-* unpredictable: a caller who can foresee the stream could time requests to
-* land on the no-charge side of every draw. Node >= 19 and all browsers
-* expose globalThis.crypto; the Math.random fallback exists only so tests
-* and exotic runtimes do not crash, and it warns once.
-*/
-let warnedNonCryptoRng = false;
-const cryptoUniform = () => {
-	const cryptoObj = globalThis.crypto;
-	if (cryptoObj?.getRandomValues) {
-		const buf = /* @__PURE__ */ new Uint32Array(1);
-		cryptoObj.getRandomValues(buf);
-		return buf[0] / 4294967296;
-	}
-	if (!warnedNonCryptoRng) {
-		warnedNonCryptoRng = true;
-		console.warn("[pricing] globalThis.crypto unavailable; billing rounding falls back to Math.random");
-	}
-	return Math.random();
-};
-/**
-* Converts a USD cost to credits with markup using UNBIASED stochastic
-* rounding: the integer part is always charged, and the fractional part
-* charges one extra credit with probability equal to the fraction.
-* E[charge] equals the exact fractional cost at every call size - no
-* round-up overcharge, no 1-credit minimum, and no free-below-threshold
-* leak. Because draws are independent and priced at exact cost, no calling
-* pattern (splitting, retrying, aborting) changes expected cost.
-*
-* Server-side settlement only. Do NOT use for display, estimates, or
-* reservations (it is non-deterministic; use usdToCredits). Zero or
-* non-finite cost charges 0.
-*
-* @param usd - The raw provider cost in USD to convert
-* @param rng - Uniform [0,1) source, injectable for tests; defaults to CSPRNG
-* @param rate - Credits per $1, defaults to the platform-wide CREDITS_PER_USD_COST.
-*   Callers settling a provider-specific admin-tunable rate must pass the SAME
-*   rate value that was used at reservation time (snapshot it, don't re-read
-*   a live admin setting), or the settlement math mixes scales.
-*/
-const usdToCreditsStochastic = (usd, rng = cryptoUniform, rate = CREDITS_PER_USD_COST) => {
-	const raw = usd * rate;
-	if (!Number.isFinite(raw) || raw <= 0) return 0;
-	const base = Math.floor(raw);
-	const fraction = raw - base;
-	return base + (rng() < fraction ? 1 : 0);
-};
-/**
-* Output tokens the pre-flight credit hold prices when a request's max_tokens
-* ceiling exceeds it.
-*
-* max_tokens is a *ceiling*, not a prediction: adaptive reasoning models stop at
-* end_turn well short of it, so pricing the hold at the full window (128K on the
-* flagship models) reserved several thousand credits per turn regardless of answer
-* length. The excess was always refunded at settlement, but the hold IS the
-* insufficient-funds gate, so users whose balance sat between their real cost and
-* the worst case were falsely blocked.
-*
-* 16K covers the realistic long answer with headroom - the largest replies seen in
-* practice are HTML-artifact turns at roughly 10-11K output tokens (see
-* buildThinkingParams in llm-adapters/thinkingParams.ts, whose max_tokens floor was
-* sized off the same measurement).
-*
-* UNDER-RESERVATION IS ACCEPTED, NOT PREVENTED. A turn that emits more than this
-* settles as a shortfall debit at reconciliation, which is already a supported path
-* (provider-basis settlement could always exceed a hold priced on the local
-* estimate). The two sites clamp the shortfall differently: chat's
-* computeSettlementDelta (services/llm/ChatCompletionProcess.ts) floors the debit at
-* the balance snapshot taken at its OWN admission and reports the remainder as
-* writtenOffCredits; cliCompletions.ts does an unclamped $inc on success and only
-* logs an ALERT if it lands negative. Neither is a non-negativity guarantee: the
-* chat snapshot predates any sibling turn's spend (see that function's own "best
-* effort" note), and when the shortfall still fits the stale snapshot the debit
-* applies in full - writtenOffCredits 0, and no BILLING_SHORTFALL_CLAMP log - so a
-* concurrent holder can land negative there too. Either way the resulting balance
-* fails the *next* turn's own admission gate - but that bound is per turn, not per
-* holder: turns admitted concurrently are each checked against the balance at their
-* own admission and settle against a snapshot that predates their siblings' spend,
-* so a holder running turns in parallel can be shorted once per in-flight turn, not
-* once total.
-*/
-const PREFLIGHT_RESERVATION_OUTPUT_TOKENS = 16384;
-/**
-* Reservation ceiling for models that spend reasoning tokens inside their output
-* budget (see reasonsWithinOutputBudget in llm-adapters/thinkingParams.ts). Those
-* tokens bill as output on top of the visible answer, so the 16K figure above -
-* which was measured on visible artifact size alone - under-reserves them badly.
-*
-* Deliberately below ADAPTIVE_THINKING_MAX_TOKENS_FLOOR (64K), which sizes the
-* request's real ceiling and therefore has to cover the worst case: exceeding it
-* truncates a reply mid-tag, an unrecoverable failure. A hold has no such duty -
-* exceeding it settles as a shortfall debit - so it is sized for the long turn
-* (roughly 3x the largest observed visible answer, leaving the rest for the trace)
-* rather than the worst one, which is what keeps the gate off affordable requests.
-*/
-const PREFLIGHT_RESERVATION_REASONING_OUTPUT_TOKENS = 32768;
-/**
-* Output-token figure to price a pre-flight credit hold at, given the max_tokens
-* this request will actually send. Never raises the caller's ceiling: a request
-* that asks for less than the cap holds only what it can possibly spend.
-*
-* Reserving only, never gating: the per-member org credit cap is still priced on
-* the unshrunk ceiling at both call sites, since that check has no settlement
-* counterpart to correct an under-estimate. That is a strictly larger figure than
-* the hold, not a true upper bound on the turn - it prices one model round trip,
-* at the uncached input rate, on the primary model - so it still under-counts a
-* multi-round tool loop, a cache-write turn, or a fallback hop onto pricier pricing.
-*
-* @param reasonsWithinOutputBudget - reasonsWithinOutputBudget(modelInfo); passed as
-*   a boolean because common cannot import llm-adapters.
-*/
-const reservationOutputTokens = (requestedMaxTokens, reasonsWithinOutputBudget = false) => Math.min(requestedMaxTokens, reasonsWithinOutputBudget ? PREFLIGHT_RESERVATION_REASONING_OUTPUT_TOKENS : PREFLIGHT_RESERVATION_OUTPUT_TOKENS);
 z.enum([
 	"openai",
 	"test",
@@ -3701,7 +2963,22 @@ const PromptBatchQuerySchema = z$1.object({
 	personal: z$1.boolean().optional()
 });
 z$1.object({ queries: z$1.array(PromptBatchQuerySchema).min(1).max(32).refine((qs) => new Set(qs.map((q) => q.key)).size === qs.length, { message: "Batch query keys must be unique" }) });
-z$1.object({
+/**
+* Request schema for POST /api/chat - the simplified external chat surface.
+*
+* Shared between the Next.js API handler (apps/client/pages/api/chat.ts, which
+* validates req.body with this exact object) and the OpenAPI registry
+* (b4m-core/common/src/openapi), so the published contract cannot drift from
+* what the handler actually accepts. The model is optional here and resolved
+* server-side from admin settings when omitted.
+*
+* Public-API rule: no `.catch()` / top-level `.transform()`. Both silently mutate
+* caller input (fail-quiet) and are opaque to zod-to-openapi. `historyCount` uses
+* `.default()` (fail loud on a bad value); unknown tool ids are filtered in the
+* handler (see filterKnownTools) instead of by a schema transform. This keeps the
+* schema fully OpenAPI-representable with no doc projection needed.
+*/
+const SimplifiedChatRequestSchema = z$1.object({
 	sessionId: z$1.string().nullish(),
 	message: z$1.string(),
 	organizationId: z$1.string().optional(),
@@ -3730,7 +3007,15 @@ z$1.object({
 	includeSystemPrompt: z$1.boolean().optional(),
 	systemPrompt: z$1.string().max(PROMPT_TEXT_MAX).optional().describe("System-prompt text for this request only, never persisted. Rendered as a defended block appended after every other system-prompt source, with prose instructing the model to defer to organization, session and data-lake guidance. Over the cap is a 422, never truncated.")
 });
-z$1.object({
+/**
+* Async ACK returned on the default (wait:false) path of POST /api/chat. The
+* `type`/`errorCode` pair below is the same classifier the `wait: true` body and
+* the polled quest (`GET /api/quests/{id}`) carry, so it is modelled once here -
+* the rest of those two bodies is NOT described by this schema. The
+* handler assembles the ack body inline (apps/client/pages/api/chat.ts), so
+* this schema MUST stay in sync with that `res.json({...})` shape.
+*/
+const ChatAckSchema = z$1.object({
 	id: z$1.string(),
 	status: z$1.string(),
 	message_received: z$1.boolean(),
@@ -3751,7 +3036,33 @@ z$1.object({
 		poll_url: z$1.string().optional()
 	})
 });
-z$1.object({
+/**
+* The quest a `wait: false` caller polls at `GET /api/quests/{id}` - the outcome
+* of the turn the ACK above only acknowledged.
+*
+* Deliberately the OUTCOME SUBSET, not the whole quest: that endpoint is a plain
+* handler rather than a contract, so this models only what decides whether the
+* turn succeeded, and a poll body carries further fields (`images`, `files`,
+* `toolPayloads`, `promptMeta`, ...). Must stay in sync with that handler's
+* `res.json` shape (apps/client/pages/api/quests/[id]/index.ts) - unlike a
+* contract-registered request/response schema, nothing validates this at
+* runtime. The "parses against the published ChatQuestPollResultSchema"
+* integration test (index.integration.test.ts) only proves the handler's
+* CURRENT response satisfies this schema - a non-strict `z.object` strips
+* unknown keys rather than rejecting them, and only `id` is required, so a
+* field the handler starts returning without a matching addition here keeps
+* that test green. The real per-field coverage lives in the sibling
+* assertions in that same test file; a shape addition still needs a schema
+* update by hand.
+*
+* A failed turn is still `status: 'done'` with the failure text in `reply`, so
+* `reply` alone cannot tell an answer from a failure - `type` and `errorCode` are
+* what separate a CLASSIFIED failure. A run recovered from a timeout with partial
+* content is not one of those: `terminalRecoveryFor` (questTimeoutRecovery.ts)
+* flips only `status` to preserve the surviving content, so it polls back as
+* `type: 'message'` even though it never finished.
+*/
+const ChatQuestPollResultSchema = z$1.object({
 	id: z$1.string(),
 	status: z$1.enum([
 		"stopped",
@@ -3782,7 +3093,18 @@ const ApiErrorSchema = z$1.object({
 	*/
 	name: z$1.string().optional()
 });
-ApiErrorSchema.extend({ errorCode: z$1.literal("insufficient_credits").optional() });
+/**
+* Error envelope for the 422 a credit-metered endpoint returns for two unrelated
+* reasons: "your body is invalid" and "you cannot afford this". `errorCode` is
+* what separates them - `insufficientCreditsError` (see insufficientCredits.ts)
+* tags the credit case, so its absence means an ordinary validation failure.
+*
+* Derived from `ApiErrorSchema` rather than re-declaring `error`/`request_id`:
+* both of those 422s are *thrown*, so errorHandler serves the body and adds
+* `name`. Extending is what keeps that documented here (and what drops it again
+* on the sunset date) instead of leaving a bespoke copy behind to drift.
+*/
+const InsufficientCreditsErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal("insufficient_credits").optional() });
 const supportedVoiceGenerationVendor = z.enum(["openai", "elevenlabs"]);
 const voiceOutputFormatSchema = z.enum([
 	"mp3",
@@ -3793,13 +3115,12 @@ const voiceOutputFormatSchema = z.enum([
 	"pcm"
 ]);
 const voiceResponseEncodingSchema = z.enum(["binary", "base64"]);
-const TTS_MAX_INPUT_CHARS = {
+const TTS_ABSOLUTE_MAX_INPUT_CHARS = Math.max(...Object.values({
 	openai: 4096,
 	elevenlabs: 1e4
-};
-const TTS_ABSOLUTE_MAX_INPUT_CHARS = Math.max(...Object.values(TTS_MAX_INPUT_CHARS));
+}));
 const ttsLanguageCodeSchema = z.string().regex(/^[a-z]{2}$/, "languageCode must be a lowercase ISO 639-1 code, e.g. \"en\" or \"ja\"");
-z.object({
+const ttsRequestSchema = z.object({
 	text: z.string().min(1).max(TTS_ABSOLUTE_MAX_INPUT_CHARS),
 	provider: supportedVoiceGenerationVendor.optional(),
 	model: z.string().optional(),
@@ -3825,7 +3146,18 @@ const audioSaveSkippedReasonSchema = z.enum([
 	"file_too_large",
 	"error"
 ]);
-z.object({
+/**
+* JSON body of `POST /api/ai/tts` when the caller asks for `encoding: 'base64'`.
+* The default `binary` encoding returns raw audio bytes instead and has no JSON
+* shape.
+*
+* The save + provider fields are all optional because the handler spreads them in
+* only when they apply: the save fields are absent when no copy was attempted
+* (`preview: true`, or the saveGeneratedAudio preference is off), and
+* `provider`/`fallbackFrom` appear only when the requested provider was
+* unavailable and another one stood in.
+*/
+const ttsBase64ResponseSchema = z.object({
 	/** Base64-encoded audio payload. */
 	audio: z.string(),
 	format: voiceOutputFormatSchema,
@@ -3839,7 +3171,32 @@ z.object({
 	/** The originally requested provider that could not serve the request. */
 	fallbackFrom: supportedVoiceGenerationVendor.optional()
 });
-ApiErrorSchema.extend({
+/**
+* Error body for `POST /api/ai/tts`, shared by the 401, 422, 429 and 502; the 413
+* has a shape of its own (`ttsResponseTooLargeSchema`). `errorCode` is present only
+* on the conditions that carry a classifier; an ordinary validation 422 has none.
+*
+* Extends `ApiErrorSchema` because what decides whether a body carries the fields
+* errorHandler adds - `request_id`, and `name` until its 2026-12-01 sunset - is
+* whether the body was THROWN, not which status it wears, and three of these four
+* statuses are reachable both ways:
+*
+* - 401: thrown by apiKeyAuth on a rejected key; written by `auth` when no
+*   credential was presented at all, and by the handler for
+*   `provider_not_configured` and for an upstream credential rejection
+*   (`provider_rejected`).
+* - 422: thrown by request validation and by the char-limit / format guards;
+*   written by the handler for `insufficient_credits` and for an upstream 422.
+* - 429: thrown by apiKeyRateLimit; written by the handler on an upstream 429.
+* - 502: only ever written.
+*
+* So those two are genuinely optional here, and splitting this per status would be
+* wrong for the first three. The 502 does advertise both without ever sending them;
+* that is not worth a fourth error schema on one route, and `request_id` missing from
+* this handler's written bodies is a gap in the handler rather than something to
+* enshrine in a schema.
+*/
+const ttsErrorResponseSchema = ApiErrorSchema.extend({
 	provider: supportedVoiceGenerationVendor.optional(),
 	errorCode: z.enum([
 		"insufficient_credits",
@@ -3847,7 +3204,21 @@ ApiErrorSchema.extend({
 		"provider_rejected"
 	]).optional()
 });
-z.object({
+/**
+* 413 body: the audio was generated and billed but exceeds the serverless
+* response-size cap. When a browsable copy was saved, `fileUrl` is how the caller
+* retrieves the audio it paid for.
+*
+* Not derived from `ApiErrorSchema`: every 413 on this route is written, never
+* thrown, so errorHandler never serves one and `name` is genuinely absent rather than
+* optional - a stronger claim than `ttsErrorResponseSchema` can make for its own
+* statuses, see the note there. Two writers, and only the first matches the paragraph
+* above: the exceedsTtsResponseLimit guard, and the upstream-4xx passthrough relaying
+* a provider 413, where nothing was generated or billed and there is no `fileUrl`. An
+* oversized *request* body is a third 413 that never reaches this schema at all -
+* Next's own body parser answers it in plain text before the router runs.
+*/
+const ttsResponseTooLargeSchema = z.object({
 	error: z.string(),
 	provider: supportedVoiceGenerationVendor,
 	saved: z.literal(true).optional(),
@@ -3860,7 +3231,15 @@ z.enum(["openai"]);
 * New vendors are added here and in the `aiSoundService` factory.
 */
 const supportedSoundGenerationVendor = z.enum(["elevenlabs"]);
-z.object({
+/**
+* Inbound request body for `POST /api/ai/sound-effects`.
+*
+* `durationSeconds` and `promptInfluence` bounds mirror the ElevenLabs
+* sound-generation limits (0.5-30s for the default eleven_text_to_sound_v2
+* model, prompt influence 0-1). `format` is the provider-specific output
+* encoding token (e.g. `mp3_44100_128`).
+*/
+const soundEffectsRequestSchema = z.object({
 	provider: supportedSoundGenerationVendor.default("elevenlabs"),
 	text: z.string().min(1).max(1e3),
 	durationSeconds: z.number().min(.5).max(30).optional(),
@@ -3878,13 +3257,23 @@ const supportedMusicGenerationVendor = z.enum(["elevenlabs"]);
 * change the request surface needs to accept it.
 */
 const supportedMusicModel = z.enum(["music_v1"]);
-const DEFAULT_MUSIC_MODEL_ID = "music_v1";
-z.object({
+/**
+* Inbound request body for `POST /api/ai/music`.
+*
+* `lengthMs` upper bound is capped below the ElevenLabs Music API ceiling to fit
+* the serving function's time budget (see MAX_MUSIC_LENGTH_MS). It carries a
+* default rather than being optional so the billed
+* length is always known up front (the reserve/settle path needs a deterministic
+* cost before generation) and the route can force that exact length on the
+* provider. `format` is the provider-specific output encoding token (e.g.
+* `mp3_44100_128`).
+*/
+const musicRequestSchema = z.object({
 	provider: supportedMusicGenerationVendor.default("elevenlabs"),
 	prompt: z.string().min(1).max(2e3),
 	lengthMs: z.number().int().min(3e3).max(12e4).default(1e4),
 	forceInstrumental: z.boolean().optional(),
-	modelId: supportedMusicModel.default(DEFAULT_MUSIC_MODEL_ID),
+	modelId: supportedMusicModel.default("music_v1"),
 	format: z.string().optional()
 });
 VIDEO_SIZE_CONSTRAINTS.SORA.durations;
@@ -3980,32 +3369,40 @@ const AGENT_EXECUTION_STATUSES = [
 	"aborted"
 ];
 /**
-* Why a session summarization happened, stamped on `ISession.summaryTrigger`. Single source for
-* the four places that each used to spell this list out: the Session zod schema
-* (schemas/actions.ts), the entity type (types/entities/SessionTypes.ts), the Mongoose path
-* (packages/database SessionModel) and the session.summarize event payload (apps/client
-* server/utils/eventBus.ts). They drifted - the Mongoose enum said 'milestone'/'growth' for two
-* values nothing produces - and a drift there is invisible at runtime, because BaseModel's
-* findOneAndUpdate writes without runValidators.
+* Why a session summarization happened, stamped on `ISession.summaryTrigger`. Single source for the
+* places that each used to spell this list out: the Session zod schema (schemas/actions.ts), the
+* entity type (types/entities/SessionTypes.ts), the Mongoose path (packages/database SessionModel)
+* and the session.summarize event payload (apps/client server/utils/eventBus.ts). They drifted -
+* the Mongoose enum said 'milestone'/'growth' for two values nothing produces - and a drift there
+* is invisible on the update path, because BaseModel's findOneAndUpdate writes without
+* runValidators.
 *
-* 'throttling' is the one member no stored document can carry: shouldSummarizeSession
-* (b4m-core/services ChatCompletionFeatures) returns it as the reason it declined to summarize,
-* so it never reaches a write. It stays in the union because that return value is typed as
-* `ISessionDocument['summaryTrigger']`.
+* Those surfaces now name PERSISTED_SESSION_SUMMARY_TRIGGERS below, not the full union: a stored
+* field may only carry a reason a run HAPPENED. 'throttling' is the exception that forced the
+* split - shouldSummarizeSession (b4m-core/services ChatCompletionFeatures) returns it as the
+* reason it DECLINED to summarize, so it describes no run and belongs to a decision, not a
+* document. It is typed by SummarizationDecision there, not by the session field.
 *
 * 'manual' means someone asked for one notebook's summary. The admin sweep (apps/client
 * server/events/spider.ts) summarizes every un-summarized notebook of the admin who ran it in one
 * billed pass, so it stamps 'spider' instead: without that, one deliberate click and a whole sweep
 * are indistinguishable when someone investigates unexpected summarization spend.
 */
-const SESSION_SUMMARY_TRIGGERS = [
+/**
+* The triggers a document may actually carry - every reason a summarization HAPPENED. The event
+* payload and createSessionParametersSchema both name this list rather than the full union below,
+* so 'throttling' cannot be published, cannot be stored, and therefore cannot reach a copy path.
+* Add a new reason-it-happened here, not to SESSION_SUMMARY_TRIGGERS, and every one of those
+* boundaries picks it up.
+*/
+const PERSISTED_SESSION_SUMMARY_TRIGGERS = [
 	"manual",
 	"project",
 	"earlyMilestone",
 	"contentGrowth",
-	"throttling",
 	"spider"
 ];
+[...PERSISTED_SESSION_SUMMARY_TRIGGERS];
 /**
 * Operator allow-list for the client-authored Mongo filter carried on a `subscribe_query` frame.
 *
@@ -5173,7 +4570,7 @@ const SessionCreatedAction = shareableDocumentSchema.extend({
 	claudeConversationId: z$1.string().optional(),
 	summary: z$1.string().optional(),
 	summaryAt: z$1.date().optional(),
-	summaryTrigger: z$1.enum(SESSION_SUMMARY_TRIGGERS).optional(),
+	summaryTrigger: z$1.enum(PERSISTED_SESSION_SUMMARY_TRIGGERS).optional(),
 	deletedAt: z$1.date().optional(),
 	tags: z$1.array(z$1.object({
 		name: z$1.string(),
@@ -5370,7 +4767,14 @@ const PermissionRequestAction = z$1.object({
 	executionId: z$1.string(),
 	toolName: z$1.string(),
 	toolInput: z$1.unknown(),
-	iteration: z$1.number()
+	iteration: z$1.number(),
+	/**
+	* Provider tool_use id of the specific gated call this card is asking about.
+	* The client echoes it back on `permission_response` so the server can bind
+	* the answer to THIS pause rather than the latest one that happens to share
+	* a tool name - see `handlePermissionResponse`'s toolCallId check.
+	*/
+	toolCallId: z$1.string().optional()
 });
 const ChildExecutionSnapshotSchema = z$1.lazy(() => z$1.object({
 	executionId: z$1.string(),
@@ -5392,7 +4796,8 @@ const ReconnectResultAction = z$1.object({
 	pendingPermission: z$1.object({
 		toolName: z$1.string(),
 		toolInput: z$1.unknown(),
-		requestedAt: z$1.union([z$1.string(), z$1.date()])
+		requestedAt: z$1.union([z$1.string(), z$1.date()]),
+		toolCallId: z$1.string().optional()
 	}).optional(),
 	totalCreditsUsed: z$1.number().optional(),
 	iterationCount: z$1.number().optional(),
@@ -5484,7 +4889,29 @@ z$1.discriminatedUnion("action", [
 	PermissionRequestAction,
 	ReconnectResultAction
 ]);
-z$1.object({
+/**
+* Public wire schemas for the agent-executor (ReAct) endpoints:
+* `POST /api/v1/agent-executions` and `GET /api/v1/agent-executions/{id}`.
+*
+* These are the REST twin of the WebSocket `agent_execute` command surface
+* (apps/client/server/websocket/agentExecute.ts). Both transports funnel into the
+* same `startAgentExecution` service, but the wire shapes are deliberately separate:
+* the WS payload carries UI-only fields (routing provenance, an optimistic-bubble
+* back-reference) that must never become published API surface, and public fields are
+* snake_case per CONVENTIONS.md section 2 while the WS command is camelCase.
+*
+* Public-API rules apply here: no `.catch()`, no top-level `.transform()`.
+*/
+/**
+* Request body for `POST /api/v1/agent-executions`.
+*
+* `session_id` is required rather than defaulted (unlike `POST /api/chat`, which falls
+* back to the caller's last notebook): the session is what determines which agent
+* profile the executor builds, so guessing it would silently change the run's
+* behaviour. Everything else is optional and falls back to admin defaults or the
+* agent's own orchestration profile.
+*/
+const AgentExecutionStartRequestSchema = z$1.object({
 	session_id: z$1.string().min(1),
 	message: z$1.string().min(1),
 	/** Falls back to the deployment's default chat model when omitted. */
@@ -5541,7 +4968,11 @@ z$1.object({
 	*/
 	enable_artifacts: z$1.boolean().optional()
 });
-z$1.object({
+/**
+* 202 ACK for `POST /api/v1/agent-executions`. The run is fire-and-forget: nothing is
+* streamed back over REST, so the caller polls `poll_url` until `status` is terminal.
+*/
+const AgentExecutionAckSchema = z$1.object({
 	id: z$1.string(),
 	status: z$1.literal("pending"),
 	session_id: z$1.string(),
@@ -5571,7 +5002,15 @@ const AgentExecutionStepSchema = z$1.object({
 	/** Set on `action` steps: the tool the agent invoked. */
 	tool_name: z$1.string().optional()
 });
-z$1.object({
+/**
+* Poll response for `GET /api/v1/agent-executions/{id}`.
+*
+* `steps` is the live trace: it grows while the run is in flight (read from the
+* checkpoint) and freezes at the final one. `answer` is null until the run reaches a
+* terminal status, and stays null on `failed` / `aborted` - where `error` carries the
+* reason instead.
+*/
+const AgentExecutionStatusResponseSchema = z$1.object({
 	id: z$1.string(),
 	status: z$1.enum([
 		"pending",
@@ -5603,7 +5042,8 @@ z$1.object({
 	created_at: z$1.string(),
 	updated_at: z$1.string()
 });
-z$1.object({ id: z$1.string().min(1) });
+/** Path parameter for `GET /api/v1/agent-executions/{id}`. */
+const AgentExecutionIdParamSchema = z$1.object({ id: z$1.string().min(1) });
 /**
 * Tool schema matching ICompletionOptionTools.toolSchema. The Zod surface only
 * covers wire-format fields (toolFn is server-side). Replaces the historical
@@ -5653,7 +5093,17 @@ const CompletionMessageSchema = z$1.object({
 	content: z$1.union([z$1.string(), z$1.array(z$1.any())]),
 	cache: z$1.boolean().optional()
 });
-z$1.object({
+/**
+* Schema for CLI LLM completion requests
+* Shared between Next.js API route (dev) and Lambda function (production)
+*
+* `response_format`, `stream`, `tools`, `temperature`, and `max_tokens` are all
+* accepted at the top level (OpenAI-compatible, matching how every major LLM
+* SDK shapes a completion request) AND nested under `options` (legacy shape).
+* Use `normalizeCompletionRequest()` to collapse both surfaces into the
+* canonical `options.<field>` location before downstream consumption.
+*/
+const CompletionRequestSchema = z$1.object({
 	model: z$1.string(),
 	messages: z$1.array(CompletionMessageSchema),
 	response_format: ResponseFormatSchema.optional(),
@@ -5722,12 +5172,20 @@ const CompletionSseErrorEventSchema = z$1.object({
 	requestId: z$1.string().optional(),
 	code: z$1.enum(QUEST_ERROR_CODES).optional()
 });
-z$1.union([
+/** One `data:` event in the `text/event-stream` completions response. */
+const CompletionStreamEventSchema = z$1.union([
 	CompletionMetaEventSchema,
 	CompletionContentEventSchema,
 	CompletionSseErrorEventSchema
 ]);
-z$1.object({
+/**
+* Server-side tool execution schemas for POST /api/ai/v1/tools.
+*
+* Plain Zod (no `.openapi()`) so any runtime can import them; the OpenAPI layer
+* annotates them via the contract. The tool-name enum MUST stay in sync with
+* SUPPORTED_TOOLS in apps/client/server/cli/toolsHandler.shared.ts.
+*/
+const ToolExecutionRequestSchema = z$1.object({
 	toolName: z$1.enum([
 		"weather_info",
 		"web_search",
@@ -6446,13 +5904,6 @@ const ImageOutputFormatSchema = z$1.enum([
 	"webp"
 ]);
 /**
-* Degrade a shared output-format setting to what BFL and Gemini accept, so selecting
-* webp for gpt-image cannot fail an unrelated render after a model switch.
-*/
-function toNonWebpOutputFormat(format) {
-	return format === "webp" ? "png" : format;
-}
-/**
 * Maps legacy/removed image model IDs to their current replacements.
 * Prevents Zod validation failures when clients send stale persisted model names.
 *
@@ -6611,7 +6062,13 @@ const SessionTagSchema = z$1.object({
 	name: z$1.string(),
 	strength: z$1.number()
 });
-z$1.object({
+/**
+* Request schema for PUT /api/sessions/{id}. This is the exact field allowlist
+* sessionService.updateSession enforces (b4m-core/services/src/sessionService/update.ts,
+* which extends this schema with `id`) - shared so the public contract can never
+* document a field the service silently drops, or vice versa.
+*/
+const SessionUpdateRequestSchema = z$1.object({
 	name: z$1.string().min(1).optional(),
 	knowledgeIds: z$1.array(z$1.string()).optional(),
 	artifactIds: z$1.array(z$1.string()).optional(),
@@ -6621,8 +6078,14 @@ z$1.object({
 	lakeScope: z$1.array(z$1.string()).nullable().optional().describe("The data lakes this session grounds on, as lake tags (the `datalakeTag` of each lake from GET /api/data-lakes). Send a list to ground only on those lakes, `[]` to ground on no lake at all, or `null` to clear the choice so retrieval falls back to every lake you can reach. Omit to leave the current choice unchanged. Tags naming a lake you cannot reach are ignored at retrieval time rather than rejected here. Narrowing the scope does not by itself turn retrieval on: pair it with `forceKnowledgeRetrieval: true` for a session that is not already grounded. Conversely `[]` leaves a grounded session nothing to retrieve from, so its forced retrieval is skipped rather than run against every lake."),
 	propagateToProjects: z$1.boolean().optional().describe("Defaults to true when omitted. When knowledgeIds grows, the newly-added file ids are also appended to every project that contains this session, granting every member of that project access to those files. This propagation is append-only and cannot be undone through the UI - pass false if newly-attached files should not be shared with the project.")
 });
-z$1.object({ id: z$1.string().min(1) });
-z$1.object({
+/** Path parameter for session-scoped endpoints, e.g. GET/PUT /api/sessions/{id}. */
+const SessionIdParamSchema = z$1.object({ id: z$1.string().min(1) });
+/**
+* Practical response subset for PUT /api/sessions/{id} - the fields a caller needs to
+* confirm an update took effect. ISession (types/entities/SessionTypes.ts) carries many
+* more server-internal fields not documented as public API surface here.
+*/
+const SessionResponseSchema = z$1.object({
 	id: z$1.string(),
 	name: z$1.string(),
 	userId: z$1.string(),
@@ -6751,15 +6214,6 @@ const CHUNK_STALL_REASONS = [
 	"unchunkedPaused"
 ];
 /**
-* Whether a file is stalled by the convergence kill switch, by any arm. THE predicate every
-* reader uses, so adding a stall reason reaches health, convergence and retrieval without separate
-* comparisons drifting apart. Also the in-memory mirror of a Mongo
-* `chunkStallReason: { $in: [...CHUNK_STALL_REASONS] }`.
-*/
-function isChunkStalled(reason) {
-	return CHUNK_STALL_REASONS.includes(reason);
-}
-/**
 * Which reasons leave the file with NO passages, as opposed to passages with no vectors. A `Record`
 * over every reason rather than a hand-written subset array: a new stall reason then cannot compile
 * until it is classified, where a member missing from a literal array would just make a health count
@@ -6786,76 +6240,7 @@ const CHUNK_STALL_NOTICES = {
 };
 CHUNK_STALL_NOTICES.vectorizePaused;
 CHUNK_STALL_NOTICES.rechunkPaused;
-/**
-* TRANSITIONAL, and the ONE stall predicate every RETRIEVAL path must use until #2016's migration
-* has run in every environment. Reads the new field, then falls back to the legacy prose that the
-* pre-migration rows still carry in `notes`.
-*
-* It exists for the FORWARD window only: `migratorInvocation` is a `dependsOn` of the web stack
-* only (infra/web.ts); the queue stack has none, so the executor can serve forced retrieval and
-* `knowledge_base_search` while rows still carry the marker in `notes` and no `chunkStallReason`. A
-* row stalled by the chunk arm then reads as a plain unindexed file: `isRetrievalExcluded` drops it
-* upstream of the withhold on a vectorizedOnly lake, and `partitionByIndexAvailability` calls it
-* servable everywhere else. The turn answers around a passage-less file and reports FULL coverage -
-* the silent degradation this whole path exists to prevent.
-*
-* A code ROLLBACK is the mirror image and this arm CANNOT cover it: the rows are already migrated
-* (`chunkStallReason` set, `notes` unset) and the code restored is pre-#2016, which does not contain
-* this function. Nothing reverts the data on its own either - `migratorInvocation` only ever runs
-* `up` and `migrate down` is a manual CLI step - so `migrate down` is a REQUIRED step of any
-* rollback past #2016, not an optional tidy-up. What this arm does buy is that `down()` is safe to
-* run FIRST: whichever stack is still new keeps honoring the prose it restores, so a staggered
-* rollback has no window where a restored marker is invisible. `down()` is a PARTIAL restore
-* though - it skips a row whose owner typed a note after `up()`, and that row grades as unstalled
-* on both stacks once the field is dropped. See its own comment.
-*
-* Deliberately NOT used by the grading/health/UI readers: they are gated behind the web stack, and
-* a legacy row there renders the notice line AND the identical text as the owner's note.
-*
-* Mirrored in Mongo by `buildFabFileSearchQuery`'s `vectorizedOnly` exemption. Delete the legacy arm
-* from both together, one release after the migration has landed everywhere.
-*
-* Pinned to the two reasons the migration backfilled rather than every notice: `unchunkedPaused`
-* postdates it, so no row carries its prose, and including it would read an owner who happens to type
-* that sentence into `notes` as stalled.
-*/
-const LEGACY_CHUNK_STALL_NOTES = [CHUNK_STALL_NOTICES.vectorizePaused, CHUNK_STALL_NOTICES.rechunkPaused];
-function isChunkStalledFile(file) {
-	return isChunkStalled(file.chunkStallReason) || LEGACY_CHUNK_STALL_NOTES.includes(file.notes ?? "");
-}
-/**
-* `FabFile.chunkRebuildRequestedAt`: stamped by `resetChunkStateByIds` in the SAME write that
-* clears a file's chunk rollups, so "this file's passages are being rebuilt" can never be lost the
-* way the pair of steps that creates the state can be. The reset and the queue send are two
-* operations - kill the producer between them, or lose the consumer's marker write, and the file
-* sits at `chunkCount: 0` with `error: null` and no stall reason, a shape indistinguishable from an
-* image or a still-uploading row. It then drops out of lake health's denominator, out of the
-* convergence plan and out of the retrieval withhold at the same moment: every rollup says its
-* passages are gone, and nothing reports it.
-*
-* Deliberately NOT the `rechunkPaused` stall reason pre-written by the producer, which is the obvious
-* fix and the wrong one: that marker means "halted, needs an administrator", so a file awaiting an
-* ORDINARY rebuild would read to every reader as permanently paused for the whole rebuild - search
-* would tell readers it does not return on its own, health would hard-fail P3, and "Rebuild
-* passages" would offer to repair a file that is already repairing. A flag that cries wolf on the
-* normal path is worse than the rare window it closes.
-*
-* So the two facts are distinct states, and the consumer UPGRADES one to the other: pending means
-* "in flight, returns on its own", the paused note means "halted, needs intervention". A LOST
-* upgrade therefore degrades to mislabelled-but-visible rather than invisible, which is the trade
-* this field exists to make - invisibility is the real harm, labelling is secondary.
-*
-* A dedicated field on purpose, and the precedent #2016 followed for the other two machine-written
-* facts: while they all shared `notes` every writer of that field clobbered the others, including
-* the user's own note.
-*
-* Cleared by `commitFabFileChunks` (the rebuild landed) and by the chunk handler's pause write (the
-* rebuild was halted instead). A file carrying `error` is settled regardless - see
-* `isMemberIndexingInFlight`, which is where the precedence between these three lives.
-*/
-function isChunkRebuildPending(requestedAt) {
-	return requestedAt !== null && requestedAt !== void 0 && requestedAt !== "";
-}
+CHUNK_STALL_NOTICES.vectorizePaused, CHUNK_STALL_NOTICES.rechunkPaused;
 /** Ceiling so "adjustable" cannot mean "unbounded" in either direction. */
 const LAKE_ACCESS_AUDIT_RETENTION_MAX_DAYS = 2555;
 /**
@@ -6949,47 +6334,8 @@ function defaultEmbeddingModelForEnv() {
 	const selfHost = process.env.B4M_SELF_HOST === "true";
 	const hasOllama = !!process.env.OLLAMA_BASE_URL?.trim();
 	const hasCloudEmbeddingKey = !isPlaceholderApiKey(process.env.OPENAI_API_KEY) || !isPlaceholderApiKey(process.env.VOYAGE_API_KEY);
-	if (selfHost && hasOllama && !hasCloudEmbeddingKey) return "qwen3-embedding:0.6b";
-	return "text-embedding-3-small";
-}
-/**
-* True when this deployment can embed with no provider API key at all: a cloud stage reaches
-* Bedrock through its task/execution role's AWS credentials.
-*
-* Requires POSITIVE evidence of an execution role rather than merely "not self-host". A plain
-* `next dev` session and a CI job both leave B4M_SELF_HOST unset while holding no AWS credentials
-* at all, so an absence test would send them to the Bedrock SDK for an opaque `CredentialsProvider
-* Error` in place of the actionable OPENAI_KEY_MISSING_MESSAGE naming the key to set - the same
-* actionable-to-opaque trade this fallback exists to avoid, just in a different keyless place.
-*
-* BOTH runtimes must be covered, and they carry different markers. The Lambdas (vectorize
-* subscriber, the crons, the Next API routes) get AWS_LAMBDA_FUNCTION_NAME; ChatCompletion is a
-* Fargate service (infra/chatCompletion.ts) and gets the ECS task-role URI instead. Since
-* knowledgeBaseSearch runs inside that container, keying on the Lambda marker alone would leave
-* chat knowledge-base search failing on exactly the keyless stages this fallback is for.
-*
-* SST_RESOURCE_App is the third arm and the one this repo can prove: SST sets it on anything it
-* links, Lambda and Service alike (infra/chatCompletion.ts:129 and infra/agentExecutor.ts:54 both
-* note that linking alone exposes SST_RESOURCE_*). It covers the Fargate task whether or not the
-* ECS credential URI is present, and it is absent from a plain `next dev` and from CI, which is
-* the case that matters. `sst dev` does set it - correctly, since that session runs against real
-* AWS credentials.
-*
-* Self-host is excluded outright because it has no such role - its keyless path is the local
-* Ollama embedder (`isLocalEmbedderAvailable` in toolAvailability.ts), not Bedrock.
-*
-* Answers "is Bedrock reachable here", NOT "should we use it" - a keyed stage is keyless-capable
-* too, so this must only ever be asked ALONGSIDE a resolved credential table that came back empty.
-* `resolveEmbeddingWithKeylessFallback` is where the two questions are paired for callers free to
-* choose the model, and is what such a caller should use instead of asking this directly. The
-* direct callers are the ones that additionally need the answer BEFORE resolving, to decide
-* policy: toolAvailability reports whether embedding-backed tools are usable at all, and
-* data-lakes/semantic-search decides whether a substitution is permitted for this request before
-* it knows whether one is needed. Both still pair it with the table.
-*/
-function hasKeylessCloudEmbedder() {
-	if (process.env.B4M_SELF_HOST === "true") return false;
-	return !!(process.env.AWS_LAMBDA_FUNCTION_NAME || process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI || process.env.SST_RESOURCE_App);
+	if (selfHost && hasOllama && !hasCloudEmbeddingKey) return "qwen3-embedding:0.6b";
+	return "text-embedding-3-small";
 }
 z$1.union([
 	z$1.enum(OpenAIEmbeddingModel),
@@ -7182,20 +6528,6 @@ Call \`search_knowledge_base\` BEFORE answering when that library would settle t
 Do not search when the answer is already in front of you or out of scope: general knowledge (definitions, mathematics, established theory, public facts); anything answerable from this conversation, from an attached document, or from content already retrieved for you this turn; or a request to transform, summarize or reformat text the user has just supplied. If the library has already been searched on this turn, do not search it again for the same question - a repeat spends a round trip to return the same passages.
 
 When a search does not turn up what was asked for, say so plainly rather than filling the gap from training data, and never imply an answer came from the user's documents when it did not.`;
-/**
-* Default text for the formatting system message. Runtime fallback used by
-* `includeHardcodedSystemMessage` (b4m-core/utils/src/llm/utils.ts) when the `FormatPromptTemplate`
-* admin setting is blank; that setting's own default is intentionally '' - keep this the sole home.
-*
-* Deliberately scoped to formatting ONLY. The previous wording ("Adhere to specific formatting
-* requests...") read as a general compliance instruction and bled into WHETHER to answer: as the
-* only system content it roughly halved refusal quality. The opening clause is the fix - it fences
-* this message off from the answer/abstain decision. Injected only when `UseFormatPrompt` is on.
-*
-* NOTE: a stored settings row pins its own wording, so changing this default does not reach an
-* existing deployment that has already saved a value - the row must be edited in admin settings too.
-*/
-const FORMAT_PROMPT_TEMPLATE = `Formatting only - nothing here decides whether or how fully to answer. Format replies to maintain the integrity of the requested style; default to markdown for text. Preserve proper structure for poems, songs, or haikus. When the user specifies an output format (e.g. TypeScript), use that format for the parts you do answer.`;
 z$1.enum([
 	"openaiDemoKey",
 	"anthropicDemoKey",
@@ -7239,13 +6571,16 @@ z$1.enum([
 	"EnableDataLakeSlackAdd",
 	"EnableDataLakeGroundingMode",
 	"EnableLakeMemory",
+	"EnableLakeModelInconsistencyDetection",
 	"EnableDataLakeVectorSearch",
 	"EnableRetrievalSupersessionCollapse",
 	"PauseLakeConvergence",
 	"LakeConvergenceBulkChangeSharePct",
 	"EnforceLakeReadGrants",
 	"EnableDataLakeDrivePoll",
+	"EnableDataLakeGitHub",
 	"EnforceLakeAdmission",
+	"EnforceLakeOriginOnIngest",
 	"EnableBriefcase",
 	"EnableBriefcaseDefault",
 	"EnableImageTemplates",
@@ -7451,7 +6786,13 @@ const IntentClassifierConfigSchema = z$1.object({
 	fallbackModels: z$1.array(z$1.string()).default(["gemini-2.5-flash-lite", "gpt-5.4-nano"])
 });
 const OrchestrationDefaultsSchema = z$1.object({
-	/** Tool names the synthetic profile is allowed to invoke. */
+	/**
+	* Tool names the synthetic profile is allowed to invoke. A DEFAULT toolbelt, not a gate:
+	* an agentless chat dispatch ships the user's ambient Smart Tools and the executor UNIONS
+	* them onto this list (`pickEffectiveEnabledTools`), so narrowing this narrows what the
+	* agent brings of its own rather than capping what the user may select. `deniedTools` below
+	* is the gate.
+	*/
 	allowedTools: z$1.array(z$1.string()).default([
 		"web_search",
 		"retrieve_knowledge_content",
@@ -9212,6 +8553,16 @@ const settingsMap = {
 		order: 91,
 		dependsOn: "EnableDataLakes"
 	}),
+	EnableLakeModelInconsistencyDetection: makeBooleanSetting({
+		key: "EnableLakeModelInconsistencyDetection",
+		name: "Data Lakes: Model-driven contradiction pass",
+		defaultValue: false,
+		description: "Gate for the model-driven reading pass (#3057) that finds cross-document contradictions the lexical pattern rules cannot - two documents stating incompatible things in ordinary prose. Off by default: unlike the free lexical pass, this reads corpus content through an LLM, so it costs real money per run. Findings land in the same durable findings collection (detector: 'model') as the lexical pass, triggered the same way (POST /api/data-lakes/:id/inconsistencies?detector=model), gated separately here and rate-limited far lower per caller. Detect only - see the guardrail on corpusInconsistency.ts.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 98,
+		dependsOn: "EnableDataLakes"
+	}),
 	EnableDataLakeVectorSearch: makeBooleanSetting({
 		key: "EnableDataLakeVectorSearch",
 		name: "Data Lakes: Use Atlas $vectorSearch",
@@ -9283,6 +8634,16 @@ const settingsMap = {
 		order: 95,
 		dependsOn: "EnableDataLakes"
 	}),
+	EnableDataLakeGitHub: makeBooleanSetting({
+		key: "EnableDataLakeGitHub",
+		name: "Data Lakes: GitHub repository source",
+		defaultValue: false,
+		description: "Server-side gate for connecting a GitHub repository to a data lake through the read-only GitHub App (contents:read + metadata:read on the one selected repository). Off by default while the connect, ingest and purge pieces land dark; every GitHub lake route answers 403 until it is on.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 96,
+		dependsOn: "EnableDataLakes"
+	}),
 	EnforceLakeAdmission: makeBooleanSetting({
 		key: "EnforceLakeAdmission",
 		name: "Data Lakes: Enforce the admission contract",
@@ -9298,6 +8659,21 @@ const settingsMap = {
 			"lake"
 		] }
 	}),
+	EnforceLakeOriginOnIngest: makeBooleanSetting({
+		key: "EnforceLakeOriginOnIngest",
+		name: "Data Lakes: Enforce curated-lake origin on ingest",
+		defaultValue: true,
+		description: "ON by default: unattended ingest (the Drive folder sync) refuses to add content to a lake whose owner declared it curated. OFF makes the refusal advisory and lets the write through. Unlike the admission contract this ships ON, because it refuses on an explicit owner declaration rather than a heuristic, and because the origin backfill marks every lake that currently has a connector as connector-fed - so at rollout this refuses nothing that exists. The lake rung is the one that matters; the org and owner rungs disable it across every lake in that scope at once. A flip is not instantaneous: the settings cache is per-instance, so it applies immediately on the instance that served the change and within ~5 min elsewhere.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 97,
+		dependsOn: "EnableDataLakes",
+		scope: { settableAt: [
+			"organization",
+			"owner",
+			"lake"
+		] }
+	}),
 	EnableBriefcase: makeBooleanSetting({
 		key: "EnableBriefcase",
 		name: "Enable Briefcase",
@@ -12074,7 +11450,28 @@ const CitableSourceSchema = z$1.object({
 		practiceAreas: z$1.array(z$1.string()).optional(),
 		chunkId: z$1.string().optional(),
 		relevanceScore: z$1.number().optional(),
-		fullContext: z$1.string().optional()
+		fullContext: z$1.string().optional(),
+		/** web_search's own thumbnail/image cluster for this source, gated on `withImages`. */
+		thumbnail: z$1.string().optional(),
+		images: z$1.array(z$1.string()).optional(),
+		/**
+		* Ids of the other cited sources this one provably disagrees with (#3041). Declared rather
+		* than left to the loose object, for the same reason chunkId/fullContext are: a writer that
+		* stamps the wrong shape should fail here, not render a badge that silently names nobody.
+		*/
+		conflictsWith: z$1.array(z$1.string()).optional(),
+		/** web_search's provider-located place (WebSearchPlace), the only source of map coordinates. */
+		place: z$1.object({
+			id: z$1.string(),
+			name: z$1.string(),
+			lat: z$1.number(),
+			lng: z$1.number(),
+			rating: z$1.number().optional(),
+			reviews: z$1.number().optional(),
+			category: z$1.string().optional(),
+			address: z$1.string().optional(),
+			thumbnail: z$1.string().optional()
+		}).optional()
 	}).optional()
 });
 /**
@@ -12461,7 +11858,44 @@ const RetrievalSummarySchema = z$1.object({
 	* absence is weaker evidence than presence. Date-bound any rollup: turns predating this field
 	* carry nothing, and no backfill is possible - a past turn's grant rows have moved on.
 	*/
-	grantedLakeIdsUsed: z$1.array(z$1.string()).optional()
+	grantedLakeIdsUsed: z$1.array(z$1.string()).optional(),
+	/**
+	* How many lakes were excluded from this turn's scope because the caller lacks the access to
+	* search them, and why (#3055). Resolved at the seed alongside `lakeScope`, from a dedicated
+	* count-only query (see excludedByAccessCount on getDynamicDataLakeAccess - NOT derived from
+	* the candidate set `lakeScope` comes from, which already has the gate enforced datastore-side
+	* and so cannot see this population).
+	*
+	* ABSENT MEANS NOT RECORDED, never "nothing was excluded" - a turn with nothing excluded records
+	* `count: 0` explicitly. Three distinct causes collapse into this one absent state and are not
+	* distinguishable from it: a turn predating this field, a turn whose `retrieval` was written
+	* only by a tool arm rather than by the seed, and the count-only query itself failing or not
+	* being wired on this host (mirrors `lakeViewComplete`'s contract on the access resolver: a
+	* failure must report unknown, never a false zero).
+	*
+	* COUNT AND REASON ONLY, DELIBERATELY. Never a lake id, name, or tag: the caller may not be
+	* permitted to know a given excluded lake exists at all, and this field must stay safe to show
+	* them regardless of which specific lake(s) it is counting. `reason` is a closed enum, not free
+	* text - prose could leak a lake's identity through phrasing - so a future exclusion cause (e.g.
+	* an archived or quota-limited lake) adds an enum value here rather than a description.
+	*
+	* 'access' is the only reason today: the caller's org membership or the lake's public listing
+	* surfaced it as a candidate (they could see it exists) but they hold neither its own
+	* gate/entitlement nor an ownership or grant exception for it.
+	*
+	* A session-preauthorized lake (unionPreauthorizedLakeAccess) that is ALSO gate-dropped from
+	* this account-wide count is corrected, not merely narrow: the seed's targeted measurement
+	* (measureIdentityNamedExclusion, ChatCompletionProcess's promptMeta seed) excludes exactly the
+	* tags this turn successfully admitted via preauthorization before running the gate query, so an
+	* admitted-and-searched lake never reports here as excluded. This account-wide number itself
+	* (excludedByAccessCount on getDynamicDataLakeAccess) is still computed before that union and is
+	* NOT corrected the same way - only the per-turn targeted measurement is, which is what a
+	* preauthorized session's own narrowing always uses (see sessionNamesALake's call site).
+	*/
+	excludedLakes: z$1.object({
+		count: z$1.number().int().nonnegative(),
+		reason: z$1.enum(["access"])
+	}).optional()
 });
 /**
 * Why a grounded turn's library scan stopped short of the whole library.
@@ -12669,7 +12103,7 @@ const MeSubscriptionSchema = z$1.object({
 	/** ISO 8601. When the current billing period ends - not a cancellation date. */
 	current_period_ends_at: z$1.string()
 });
-z$1.object({
+const MeResponseSchema = z$1.object({
 	/** Stable B4M user id. Safe to key an integrator's own records on. */
 	id: z$1.string(),
 	/** Display name. Never the email address. */
@@ -13319,13 +12753,6 @@ const DATA_LAKES = [{
 	}
 })()];
 new Set(DATA_LAKES.map((l) => l.id));
-/**
-* Canonical normalization for entitlement keys + `requiredEntitlement` values - the ONE
-* rule, applied at write time (create/update/stamp) and at match time. Mirrors the
-* entitlement registry's `normalizeTag` (trim + lowercase) so a value authored in any
-* casing matches the lowercase keys the resolver produces.
-*/
-const normalizeEntitlementKey = (key) => key.trim().toLowerCase();
 const sha256Regex = /^[a-f0-9]{64}$/;
 const requiredUserTagValue = z.string().trim().min(1).max(100).refine((s) => !/[,;]/.test(s), "User tag must be a single tag with no commas or semicolons (e.g. \"vip\" or \"Sales Team\")");
 z.object({
@@ -13335,7 +12762,8 @@ z.object({
 	fileTagPrefix: z.string().trim().min(2).max(30).refine((s) => s.endsWith(":"), "Tag prefix must end with \":\" (e.g. \"acme:\")").refine((s) => !hasBlankTagPrefixSegment(s), "Tag prefix segments must be non-empty (e.g. \"acme:\" or \"acme:legal:\")").refine((s) => !isReservedTagPrefix(s), `Tag prefix cannot use the reserved "${DATALAKE_TAG_PREFIX}" namespace`),
 	requiredUserTag: requiredUserTagValue.optional(),
 	requiredEntitlement: z.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")").optional(),
-	organizationId: z.string().optional()
+	organizationId: z.string().optional(),
+	origin: z.enum(DATA_LAKE_ORIGINS).optional()
 });
 z.object({
 	name: z.string().min(1).max(200).optional(),
@@ -13347,7 +12775,8 @@ z.object({
 	requiredEntitlement: z.union([z.literal(""), z.string().min(3).max(100).refine((s) => s.includes(":") && s.split(":").every((part) => part.length > 0), "Entitlement key must be namespaced with non-empty parts (e.g. \"product:pro\")")]).optional(),
 	auditQueryTextEnabled: z.boolean().optional(),
 	lakeMemoryEnabled: z.boolean().optional(),
-	requiredPassageTokenTarget: z.number().int().min(64).max(OVERSIZED_PASSAGE_TOKEN_THRESHOLD).nullable().optional()
+	requiredPassageTokenTarget: z.number().int().min(64).max(OVERSIZED_PASSAGE_TOKEN_THRESHOLD).nullable().optional(),
+	origin: z.enum(DATA_LAKE_ORIGINS).optional()
 });
 z.object({
 	groundingMode: z.enum(DATA_LAKE_GROUNDING_MODES).optional(),
@@ -13489,7 +12918,380 @@ z$1.object({
 	model: ImageTemplateModelSchema,
 	settings: ImageTemplateSettingsSchema
 }).omit({ model: true }).partial();
-z$1.union([ToolExecutionResponseSchema, ApiErrorSchema]);
+/**
+* Identity factory that pins an endpoint contract's type. The `const` type
+* parameter preserves the concrete request-schema type so downstream adapters
+* can infer the validated body type (`z.infer<contract['request']>`) rather than
+* collapsing to the `z.ZodTypeAny` constraint.
+*
+* Otherwise deliberately a no-op at runtime (no registry side effect, no
+* `.openapi()`) so a contract stays a plain, transport-agnostic value that any
+* runtime can import - the one exception is the `pathParams`/`queryParams`
+* overlap check below, a plain assertion with no side effect of its own.
+*/
+function defineEndpoint(contract) {
+	if (contract.pathParams && contract.queryParams) {
+		const queryKeys = new Set(Object.keys(contract.queryParams.shape));
+		const overlap = Object.keys(contract.pathParams.shape).filter((key) => queryKeys.has(key));
+		if (overlap.length > 0) throw new Error(`defineEndpoint(${contract.operationId}): pathParams and queryParams both declare ${JSON.stringify(overlap)}. Next merges both into req.query by name, so the path segment would silently win over the query value. Rename one side.`);
+	}
+	return contract;
+}
+defineEndpoint({
+	method: "post",
+	path: "/api/chat",
+	operationId: "sendChatMessage",
+	summary: "Send a chat message",
+	description: "Sends a message to the AI and creates a quest to process it. By default (async) the call returns immediately with a quest id; poll `GET /api/quests/{id}` for the reply. Send `wait: true` to block until the reply is ready and receive it inline. A tool that produced machine-readable state reports it under `toolPayloads` - an array of `{ type, payload }` entries in emission order, alongside (never instead of) the prose reply - on the `wait: true` body and on the polled quest. A turn can FAIL after the ACK - reported on the polled quest as `type: \"error\"`, since the ACK was already sent. A terminal `status: \"stopped\"` (a missing session, a user-cancelled turn) is ALSO a failure even without `type: \"error\"` - it carries an explanatory string in `reply`/`replies` rather than an answer. `type` is the failure signal for the classified failure classes (an abort, a provider timeout, credit exhaustion); `errorCode` is an optional refinement present only when the failure is a classified billing reason. A recovered stuck quest is NOT in that list: one that still has renderable content resolves as a success by design. `QUEST_ERROR_CODES` has two members, but only `insufficient_credits` is raised as a quest errorCode by any current throw site on this endpoint - `spend_cap_exceeded` is thrown only by the embed chat route's pre-flight, which fires outside the process try/catch that would classify it onto a quest. A caller must treat `type: \"error\"` OR a terminal `status: \"stopped\"` as failure even when `errorCode` is absent, and must not read `reply` as an answer without checking those first. Authenticate with an API key (`b4m_live_`) or a JWT.",
+	tags: ["AI"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:chat", "ai:generate"],
+	request: SimplifiedChatRequestSchema,
+	requestExample: {
+		message: "How do I reset my password?",
+		toolMode: "smart"
+	},
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "Message accepted - NOT a completed turn. The default (async) path returns this queued ACK; the outcome arrives on `GET /api/quests/{id}` (see the `sendChatMessage200PollResult` schema). With `wait: true` the body additionally carries the completed reply (`response`/`responses`), `toolPayloads`, `createdAt`, and `performance` timings - fields not modelled here yet; the synchronous response shape is a follow-up. A turn that FAILS still resolves with `200`, never a 4xx, on both that `wait: true` body and the polled quest (`GET /api/quests/{id}`) - the prose explaining why lands in `reply`/`response` like any other answer, so the reply text alone cannot tell a failure from an answer. `type` is the field that can: both surfaces carry it unconditionally, so match on `type: \"error\"` first - it covers credit exhaustion, a provider timeout or overload, and an in-process aborted turn; a real answer carries the turn's actual completion type instead (`\"message\"` for an ordinary reply). Two related states do NOT set `type: \"error\"`: a user-cancelled turn resolves as `status: \"stopped\"` with `type` left at `\"message\"`, and a recovered stuck quest that still has renderable content resolves as a success (`status: \"done\"`, no error) by design, to avoid destroying content to report a failure. `errorCode` then names the failure reason, but only for the billing failures that have one - `\"insufficient_credits\"` today; it is absent on every other `type: \"error\"` turn, so never use its absence to infer success. On a real answer `errorCode` is absent from the `wait: true` body. Contrast the tts/music/soundEffects contracts, which reject synchronously with a 422 carrying the same `errorCode` vocabulary.",
+			schema: ChatAckSchema,
+			pollResult: {
+				schema: ChatQuestPollResultSchema,
+				description: "Outcome fields of the quest polled at `GET /api/quests/{id}` after this ACK. A finished turn that failed is `status: \"done\"` with `type: \"error\"` and the failure text in `reply`, so a caller reading `reply` alone cannot tell a failure from an answer - check `type` first, and also treat a terminal `status: \"stopped\"` (a missing session, a user-cancelled turn) as failure even though it never sets `type`. `errorCode` is an optional refinement of `type: \"error\"`, present only for a classified billing failure; credit exhaustion arrives here as `insufficient_credits`, the same vocabulary the synchronous 422s on `/api/ai/music`, `/api/ai/sound-effects` and `/api/ai/tts` use. `QUEST_ERROR_CODES` publishes a second member, `spend_cap_exceeded`, but no current throw site on this endpoint raises it as a quest errorCode: its only one, the embed chat route's pre-flight 422, fires outside the process try/catch that would classify it onto the quest. Most `type: \"error\"` turns - an abort, a provider timeout or overload - have NO `errorCode`; its absence does not mean success, only that the failure is unclassified. A recovered stuck quest that still has renderable content is not a failure at all: it keeps `type: \"message\"` even though it did not finish, so a caller gets the content rather than an error. The poll body carries further fields not modelled here, including `images`, `files`, `toolPayloads`, `promptMeta`, and the attachment report (`attachmentNotices`/`attachmentDelivery`) - only the outcome subset is modelled here.",
+				example: {
+					id: "664f1c2b9a1e4d0012ab34cd",
+					status: "done",
+					type: "error",
+					errorCode: "insufficient_credits",
+					reply: "You're out of credits. This request needs about 12 credits, but only 3 are available."
+				}
+			}
+		},
+		400: {
+			description: "No usable default chat model is configured and none was supplied.",
+			schema: ApiErrorSchema
+		},
+		404: {
+			description: "No notebook/session exists to attach the message to.",
+			schema: ApiErrorSchema
+		},
+		422: {
+			description: "Request body failed schema validation.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			message: "How do I reset my password?",
+			toolMode: "smart"
+		}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/v1/agent-executions",
+	operationId: "startAgentExecution",
+	summary: "Start an agent execution",
+	description: "Runs the tool-using agent (ReAct) loop against a session - the same pipeline the product UI's Agent Mode toggle dispatches to, and the REST equivalent of the `agent_execute` WebSocket command. The run is asynchronous: this returns `202` with an execution id, and the caller polls `GET /api/v1/agent-executions/{id}` until `status` is terminal (`completed`, `failed`, or `aborted`). Nothing is streamed back over REST - for live iteration events, use the WebSocket route instead. Omit `agent_id` to get the profile the session's own surface resolves to, which is what reproduces the in-app toggle. The final reply is also written to the session as a normal chat message, so it appears in history. Naming a tool in `tools` also PRE-APPROVES it for the run: there is no interactive client to answer a permission prompt, so a run that calls an approval-gated tool you did not name fails with that tool named in `error` rather than hanging. Authenticate with an API key (`b4m_live_`) or a JWT.",
+	tags: ["AI"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:chat", "ai:generate"],
+	request: AgentExecutionStartRequestSchema,
+	requestExample: {
+		session_id: "<sessionId>",
+		message: "Audit this data set and summarize what stands out."
+	},
+	emitsRateLimitHeaders: true,
+	responses: {
+		202: {
+			description: "Run accepted and dispatched. Poll `tracking_info.poll_url` for status and the answer.",
+			schema: AgentExecutionAckSchema
+		},
+		400: {
+			description: "No usable default chat model is configured and none was supplied.",
+			schema: ApiErrorSchema
+		},
+		404: {
+			description: "No session with the given `session_id` is owned by the caller, or `organization_id` names an organization the caller does not belong to. \"Exists but is not yours\" is reported as 404 too, so neither session ids nor org membership can be probed through this endpoint.",
+			schema: ApiErrorSchema
+		},
+		409: {
+			description: "The caller already has the maximum number of agent runs in flight - a per-user cap shared with runs started from the product UI. Wait for one to reach a terminal status before starting another; aborting a run is currently only possible over the WebSocket route.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		},
+		502: {
+			description: "The executor could not be dispatched. The run did not start, so a retry is safe.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			session_id: "<sessionId>",
+			message: "Audit this data set and summarize what stands out."
+		}
+	}
+});
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/agent-executions/{id}",
+	operationId: "getAgentExecution",
+	summary: "Get an agent execution",
+	description: "Returns the status, reasoning trace, and (once terminal) the final answer of a run started by `POST /api/v1/agent-executions`. `steps` grows while the run is in flight, so polling this endpoint is also how a REST caller follows the loop. Safe (GET) requests on this route are exempt from the per-day API-key quota so polling a single run costs one daily slot, not one per poll; the per-minute burst limit still applies.",
+	tags: ["AI"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:chat", "ai:generate"],
+	pathParams: AgentExecutionIdParamSchema,
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "The execution, its trace, and its answer if it has finished.",
+			schema: AgentExecutionStatusResponseSchema
+		},
+		404: {
+			description: "No execution with that id is visible to the caller.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {}
+	}
+});
+defineEndpoint({
+	method: "put",
+	path: "/api/sessions/{id}",
+	operationId: "updateSession",
+	summary: "Update a session",
+	description: "Updates a session (called a \"notebook\" in the product UI): its name, attached knowledge files, tags, or retrieval settings. Set `knowledgeIds` and `forceKnowledgeRetrieval: true` together to enable grounded retrieval for `POST /api/chat` against this session - retrieval is gated by these session fields, not by the chat request. `lakeScope` narrows that retrieval to a chosen set of data lakes; omit it to leave the current choice unchanged, or send `null` to clear it so retrieval reaches every lake you can access. Authenticate with an API key (`b4m_live_`) or a JWT. Warning: adding to `knowledgeIds` shares those files with every member of every project containing this session by default (see `propagateToProjects`), and that sharing cannot be undone through the UI.",
+	tags: ["Sessions"],
+	auth: "apiKeyOrJwt",
+	scopes: ["notebooks:write"],
+	pathParams: SessionIdParamSchema,
+	request: SessionUpdateRequestSchema,
+	emitsRateLimitHeaders: true,
+	requestExample: {
+		knowledgeIds: ["<fabFileId>"],
+		forceKnowledgeRetrieval: true
+	},
+	responses: {
+		200: {
+			description: "The updated session.",
+			schema: SessionResponseSchema
+		},
+		404: {
+			description: "No session exists with the given id.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			knowledgeIds: ["<fabFileId>"],
+			forceKnowledgeRetrieval: true
+		}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/ai/v1/tools",
+	operationId: "executeTool",
+	summary: "Execute a server-side tool",
+	description: "Runs one of the built-in server-side tools (`weather_info`, `web_search`, `web_fetch`) and returns its result as JSON. Authenticate with a JWT access token only - API keys are NOT accepted on this endpoint. Rate-limited to 100 requests/hour. `request_id` echoes the X-Request-ID response header.",
+	tags: ["AI"],
+	auth: "jwtOnly",
+	request: ToolExecutionRequestSchema,
+	requestExample: {
+		toolName: "web_search",
+		input: { query: "how to reset a password" }
+	},
+	responses: {
+		200: {
+			description: "Tool executed successfully (`success` is always true here).",
+			schema: ToolExecutionResponseSchema,
+			example: {
+				success: true,
+				result: { summary: "Top results for the query." },
+				executionTimeMs: 842,
+				request_id: "abc-123"
+			}
+		},
+		400: {
+			description: "Malformed JSON body.",
+			schema: ApiErrorSchema
+		},
+		401: {
+			description: "Missing or invalid JWT (an API key is rejected here).",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Rate limit exceeded (100 requests/hour).",
+			schema: ApiErrorSchema
+		},
+		500: {
+			description: "Tool execution failed (`success: false` with `error`) or an unexpected server error.",
+			schema: z$1.union([ToolExecutionResponseSchema, ApiErrorSchema]),
+			bespokeErrorShape: "A tool that ran but failed returns the full ToolExecutionResponse (success: false), not an error envelope."
+		}
+	},
+	codeSample: {
+		authToken: "<access_token>",
+		streaming: false,
+		body: {
+			toolName: "web_search",
+			input: { query: "how to reset a password" }
+		}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/ai/v1/completions",
+	operationId: "createCompletion",
+	summary: "Create a chat completion",
+	description: "OpenAI-compatible completion. The response is ALWAYS an SSE stream (`text/event-stream`), regardless of the `stream` flag: a `meta` event, then `content`/`tool_use` events carrying `usage`/`credits`, terminated by `data: [DONE]`. Once the stream has opened the HTTP status stays 200 and failures arrive as an in-band `error` event. The terminal event carries `stopReason`; treat `max_tokens` as a TRUNCATED reply rather than a complete one, and note that omitting `max_tokens` on the request lets the server size the output ceiling for the model (recommended for reasoning models, which spend thinking tokens inside that ceiling). A message `content` may be a string or an array of parts; image parts are accepted in OpenAI Chat (`image_url`), OpenAI Responses (`input_image`) or Anthropic (`image` with a `source`) form and are translated to whatever the target model speaks. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nBILLING FAILURES. Headers are flushed before authentication or pricing, so unlike the JSON surfaces this endpoint has no pre-stream `422` + `errorCode: \"insufficient_credits\"` to pair with: credit exhaustion ALWAYS arrives as the in-band `error` event, whether it is caught by the reservation before the first token or by settlement mid-generation. Branch on that event's `code` (`insufficient_credits` - buy credits; `spend_cap_exceeded` - the owner is solvent but this key hit its admin-set ceiling, so raise the cap), never on `message`, which is prose and may change. `code` is absent on unclassified failures.",
+	tags: ["AI"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:chat", "ai:generate"],
+	request: CompletionRequestSchema,
+	requestExample: {
+		model: "claude-opus-4-8",
+		messages: [{
+			role: "user",
+			content: "How do I reset my password?"
+		}],
+		max_tokens: 500
+	},
+	streaming: true,
+	responses: {
+		200: {
+			description: "SSE stream of completion events (see the CompletionStreamEvent shape).",
+			contentType: "text/event-stream",
+			schema: CompletionStreamEventSchema,
+			example: {
+				type: "content",
+				text: "To reset your password, click 'Forgot password' on the login screen.",
+				usage: {
+					inputTokens: 42,
+					outputTokens: 12
+				},
+				credits: {
+					used: 1,
+					usdCost: 37e-5
+				},
+				stopReason: "end_turn"
+			}
+		},
+		400: {
+			description: "Malformed JSON body (rejected before the stream opens).",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: true,
+		body: {
+			model: "claude-opus-4-8",
+			messages: [{
+				role: "user",
+				content: "How do I reset my password?"
+			}],
+			max_tokens: 500
+		}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/ai/tts",
+	operationId: "synthesizeSpeech",
+	summary: "Synthesize speech from text",
+	description: "Generates speech from text using OpenAI or ElevenLabs. The default `encoding: \"binary\"` streams raw audio bytes with an `audio/*` Content-Type; `encoding: \"base64\"` returns JSON instead. When the requested provider has no usable key (or the provider rejects it), another configured provider stands in and the substitution is reported via `provider`/`fallbackFrom` and the `X-B4M-Tts-Provider*` headers. Input length is capped per provider (OpenAI 4096 characters, ElevenLabs 10000), and an output `format` the chosen provider cannot produce is rejected with a 422 before any provider cost is incurred. Generated audio is saved to the file browser by default (opt out per-user via the saveGeneratedAudio preference, or per-call with `preview`); the outcome is reported via `saved`/`fabFileId` and the `X-B4M-Audio-*` headers. Authenticate with an API key (`b4m_live_`) or a JWT.",
+	tags: ["Audio"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:generate"],
+	request: ttsRequestSchema,
+	requestExample: {
+		text: "Your password has been reset.",
+		provider: "openai",
+		voice: "alloy",
+		format: "mp3"
+	},
+	responses: {
+		200: {
+			description: "Speech synthesized. The default `encoding: \"binary\"` returns raw audio bytes whose Content-Type follows the requested `format` (`audio/mpeg` for mp3, else `audio/wav`, `audio/opus`, `audio/aac`, `audio/flac`, `audio/pcm`); `encoding: \"base64\"` returns the JSON body.",
+			schema: ttsBase64ResponseSchema,
+			example: {
+				audio: "SUQzBAAAAAAA...",
+				format: "mp3",
+				contentType: "audio/mpeg",
+				saved: true,
+				fabFileId: "664f1c2b9a1e4d0012ab34cd"
+			},
+			alsoReturns: [
+				{ contentType: "audio/mpeg" },
+				{ contentType: "audio/wav" },
+				{ contentType: "audio/opus" },
+				{ contentType: "audio/aac" },
+				{ contentType: "audio/flac" },
+				{ contentType: "audio/pcm" }
+			],
+			headers: {
+				"X-B4M-Tts-Provider": "The provider that produced the audio. Present only when a fallback happened.",
+				"X-B4M-Tts-Provider-Fallback-From": "The originally requested provider that could not serve the request. Present only on a fallback.",
+				"X-B4M-Audio-Saved": "Whether a browsable copy was saved to the file browser (\"true\"/\"false\").",
+				"X-B4M-Audio-Fab-File-Id": "Id of the saved file. Present only when the copy was saved."
+			}
+		},
+		401: {
+			description: "Missing/invalid credentials, or no provider has a usable key (`provider_not_configured`).",
+			schema: ttsErrorResponseSchema
+		},
+		413: {
+			description: "The audio was generated (and billed) but is too large to return over this endpoint. Retrieve it from `fileUrl` when a browsable copy was saved.",
+			schema: ttsResponseTooLargeSchema
+		},
+		422: {
+			description: "Request body failed validation, the text exceeds the provider character limit, the provider cannot produce the requested `format`, or the caller cannot afford the synthesis - the last of those is the only one tagged `errorCode: \"insufficient_credits\"`, so match on the classifier rather than the status to tell a billing failure from a bad request.",
+			schema: ttsErrorResponseSchema
+		},
+		429: {
+			description: "The provider rate-limited the request.",
+			schema: ttsErrorResponseSchema
+		},
+		502: {
+			description: "The provider failed to generate speech.",
+			schema: ttsErrorResponseSchema
+		}
+	},
+	emitsRateLimitHeaders: true,
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			text: "Your password has been reset.",
+			provider: "openai",
+			voice: "alloy",
+			encoding: "base64"
+		}
+	}
+});
 /**
 * Response details shared by the endpoints that return generated audio as raw
 * bytes (music, sound effects). Not a contract - just the pieces both of their
@@ -13526,8 +13328,179 @@ const generatedAudioBody = () => ({
 	alsoReturns: GENERATED_AUDIO_CONTENT_TYPES.slice(1).map((contentType) => ({ contentType })),
 	headers: GENERATED_AUDIO_SAVE_HEADERS
 });
-({ ...generatedAudioBody() });
-({ ...generatedAudioBody() });
+defineEndpoint({
+	method: "post",
+	path: "/api/ai/music",
+	operationId: "generateMusic",
+	summary: "Generate background music",
+	description: "Generates an instrumental or vocal background-music track from a text prompt and returns the raw audio bytes. `lengthMs` (3000-120000, default 10000) is forced on the provider, so the generated track always matches the billed length; credits are reserved before generation and refunded if it fails. Generated audio is saved to the file browser by default (opt out via the saveGeneratedAudio preference); the outcome is reported via the `X-B4M-Audio-Saved` / `X-B4M-Audio-Fab-File-Id` / `X-B4M-Audio-File-Url` response headers - use `X-B4M-Audio-File-Url` to fetch the saved copy, since `GET /api/files/{id}` fails closed until moderation completes. Authenticate with an API key (`b4m_live_`) or a JWT.",
+	tags: ["Audio"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:generate"],
+	request: musicRequestSchema,
+	requestExample: {
+		prompt: "calm lo-fi study beat with soft piano",
+		lengthMs: 3e4,
+		forceInstrumental: true
+	},
+	responses: {
+		200: {
+			description: "Raw audio bytes; the Content-Type follows the requested `format` (mp3 by default).",
+			...generatedAudioBody()
+		},
+		400: {
+			description: "The billing user or organization could not be resolved.",
+			schema: ApiErrorSchema
+		},
+		422: {
+			description: "Request body failed validation, or the caller cannot afford the track - the latter is tagged `errorCode: \"insufficient_credits\"` (the balance is short, or the org member credit cap is exhausted).",
+			schema: InsufficientCreditsErrorSchema
+		},
+		502: {
+			description: "The provider failed to generate the track; reserved credits are refunded.",
+			schema: ApiErrorSchema
+		},
+		503: {
+			description: "No provider API key is configured for this deployment.",
+			schema: ApiErrorSchema
+		}
+	},
+	emitsRateLimitHeaders: true,
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			prompt: "calm lo-fi study beat with soft piano",
+			lengthMs: 3e4,
+			forceInstrumental: true
+		}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/ai/sound-effects",
+	operationId: "generateSoundEffect",
+	summary: "Generate a sound effect",
+	description: "Generates a short sound effect from a text description and returns the raw audio bytes. Omitting `durationSeconds` lets the provider pick the length (and bills at its default); `promptInfluence` trades prompt fidelity (1) against variation (0). Credits are reserved before generation and refunded if it fails. Generated audio is saved to the file browser by default (opt out via the saveGeneratedAudio preference); the outcome is reported via the `X-B4M-Audio-Saved` / `X-B4M-Audio-Fab-File-Id` / `X-B4M-Audio-File-Url` response headers - use `X-B4M-Audio-File-Url` to fetch the saved copy, since `GET /api/files/{id}` fails closed until moderation completes. Authenticate with an API key (`b4m_live_`) or a JWT.",
+	tags: ["Audio"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:generate"],
+	request: soundEffectsRequestSchema,
+	requestExample: {
+		text: "heavy wooden door creaking open",
+		durationSeconds: 3,
+		promptInfluence: .5
+	},
+	responses: {
+		200: {
+			description: "Raw audio bytes; the Content-Type follows the requested `format` (mp3 by default).",
+			...generatedAudioBody()
+		},
+		400: {
+			description: "The billing user or organization could not be resolved.",
+			schema: ApiErrorSchema
+		},
+		422: {
+			description: "Request body failed validation, or the caller cannot afford the effect - the latter is tagged `errorCode: \"insufficient_credits\"` (the balance is short, or the org member credit cap is exhausted).",
+			schema: InsufficientCreditsErrorSchema
+		},
+		502: {
+			description: "The provider failed to generate the effect; reserved credits are refunded.",
+			schema: ApiErrorSchema
+		},
+		503: {
+			description: "No provider API key is configured for this deployment.",
+			schema: ApiErrorSchema
+		}
+	},
+	emitsRateLimitHeaders: true,
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			text: "heavy wooden door creaking open",
+			durationSeconds: 3,
+			promptInfluence: .5
+		}
+	}
+});
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/me",
+	operationId: "getMe",
+	summary: "Get the authenticated caller",
+	description: "Returns the authenticated caller: stable id, display name, plan tier, personal credit balance, and entitlement keys. The subject is always the credential holder - this endpoint accepts no user id, owner id, or impersonation parameter of any kind, so a key can only ever read its own owner. `credits.balance` is the caller's personal ledger; a call billed to an organization draws on a pool this number does not describe. Gate on `tier != \"free\"` for \"is this caller paying\" and on `subscription.price_id` for which product - the `basic`/`pro` rungs come from an internal plan ladder and do not track a plan's marketing name. Responses are never cacheable. Authenticate with an API key (`b4m_live_`) carrying `me:read`, or a JWT.",
+	tags: ["Account"],
+	auth: "apiKeyOrJwt",
+	scopes: ["me:read"],
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "The caller, their tier, their personal credit balance, and their entitlement keys.",
+			schema: MeResponseSchema,
+			example: {
+				id: "507f1f77bcf86cd799439011",
+				name: "Ada Lovelace",
+				tier: "basic",
+				subscription: {
+					plan_name: "Professional",
+					price_id: "price_123",
+					interval: "monthly",
+					current_period_ends_at: "2026-10-18T00:00:00.000Z"
+				},
+				credits: { balance: 31667 },
+				entitlements: ["base"]
+			}
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {}
+	}
+});
+/**
+* The fence language the model writes to place an inline map of search-result places in a reply.
+*
+* Same contract as SEARCH_RESULT_CARDS_LANGUAGE (searchResultCards.ts): `\w`-only and lowercase,
+* taught by WEB_SEARCH_MAP_PROMPT (@bike4mind/services), rendered by the reply renderer
+* (apps/client .../Session/PromptReplies.tsx), and rewritten to a plain list for every other
+* surface by `stripSearchResultCardFences`.
+*/
+const LOCATION_MAP_LANGUAGE = "b4m_map";
+function googleMapsSearchUrl(name, placeId) {
+	const params = new URLSearchParams({
+		api: "1",
+		query: name
+	});
+	if (placeId?.startsWith("ChIJ")) params.set("query_place_id", placeId);
+	return `https://www.google.com/maps/search/?${params.toString()}`;
+}
+/**
+* The fence language the model writes to place image cards inline in a reply.
+*
+* Two families of consumer must agree on this constant:
+*   - WEB_SEARCH_CARDS_PROMPT (@bike4mind/services) teaches the model to emit it, and the reply
+*     renderer (apps/client .../Session/PromptReplies.tsx) intercepts it to render cards instead
+*     of raw text.
+*   - Every other surface that reads reply markdown for an export, download, copy, publish, or
+*     Slack delivery must strip the fenced block entirely with `stripSearchResultCardFences`
+*     below, rather than passing the model-authored card JSON through verbatim. See that
+*     function's own doc comment for the current list of call sites.
+*
+* MUST contain only `\w` characters: both the renderer (`/language-(\w+)/`) and the notebook
+* curation extractor (```` /```(\w+)?/ ````) capture the language with `\w+`, so a hyphen would
+* silently truncate this and the cards would never render or be skipped.
+*
+* MUST already be lowercase: some consumers lowercase the language they capture before
+* comparing, so an uppercase-containing value would pass the `\w`-only rule above while silently
+* breaking that comparison.
+*/
+const SEARCH_RESULT_CARDS_LANGUAGE = "b4m_cards";
 z$1.enum(["user", "convergence"]).optional().catch(void 0), z$1.string().optional();
 /**
 * Blessed, self-hosted artifact library script paths (root-relative).
@@ -13589,50 +13562,6 @@ const OPTIONAL_DEP_BLESSED_SCRIPT_PATHS = Object.values({
 	}
 }).map((d) => d.path);
 [...REACT_BLESSED_SCRIPT_PATHS, ...OPTIONAL_DEP_BLESSED_SCRIPT_PATHS];
-function isGPTImageModel(model) {
-	if (!model) return false;
-	return OPENAI_IMAGE_MODELS.includes(model) || model.startsWith("gpt-image-");
-}
-/**
-* Flux Ultra is the only BFL generation model driven by `aspect_ratio`; the Pro family takes
-* discrete `width`/`height` and ignores aspect_ratio outright. Must stay in sync with the branch
-* in `BFLImageService.generate`, which is what actually builds the request body.
-*/
-function isBflUltraImageModel(model) {
-	return model === "flux-pro-1.1-ultra";
-}
-/** Returns true specifically for gpt-image-2 (including versioned snapshots like gpt-image-2-2026-04-21). */
-function isGPTImage2Model(model) {
-	if (!model) return false;
-	return model === "gpt-image-2" || model.startsWith("gpt-image-2");
-}
-/**
-* Whether a user can access a model. Access is any-of (mirrors the Q3b data-lake
-* rule, `getAccessibleDataLakes`): a non-admin reaches the model via
-* `allowedUserTags ∩ userTags` OR `allowedEntitlements ∩ entitlementKeys`.
-*
-* `entitlementKeys` is optional - when omitted/empty the entitlement branch is
-* inert, so a model with no `allowedEntitlements` behaves exactly as before
-* (tag-only). This lets a tag-less subscriber reach an entitlement-gated model
-* while leaving every existing tag-gated model unchanged (zero regression).
-*
-* Pure + zero-dependency (only types + the shared key normalizer), so it lives
-* in `@bike4mind/common` as the SINGLE source of truth - imported by the core
-* `@bike4mind/utils` re-export (server/services) AND the client
-* `useAccessibleModels` hook, which previously kept a hand-rolled twin "to avoid
-* AWS SDK imports". Common is browser-safe, so there is no longer any reason to
-* duplicate the logic.
-*/
-function isModelAccessible(model, userTags, isAdmin = false, entitlementKeys = []) {
-	if (!model.enabled) return false;
-	if (isAdmin) return true;
-	const normalizedUserTags = userTags.map((tag) => tag.toLowerCase());
-	const normalizedAllowedTags = (model.allowedUserTags ?? []).map((tag) => tag.toLowerCase());
-	if (normalizedUserTags.some((tag) => normalizedAllowedTags.includes(tag))) return true;
-	const normalizedKeys = entitlementKeys.map(normalizeEntitlementKey);
-	const normalizedAllowedEntitlements = (model.allowedEntitlements ?? []).map(normalizeEntitlementKey);
-	return normalizedKeys.some((key) => normalizedAllowedEntitlements.includes(key));
-}
 [...OPENAI_IMAGE_MODELS, ...GEMINI_IMAGE_MODELS];
 const DashboardParamsSchema = z$1.object({
 	dashboardDataSources: z$1.array(z$1.object({
@@ -13759,13 +13688,6 @@ OpenAIImageGenerationInput.extend({
 	image: z$1.string(),
 	output_format: ImageOutputFormatSchema.nullable().optional()
 });
-const isUnlimitedHistory = (historyCount) => historyCount === -1;
-/**
-* A usable number for callers that need one (page size, overflow math, telemetry). Unlimited
-* history has no count, so it resolves to the default page size, which is what an unwindowed
-* request has always actually fetched.
-*/
-const resolveHistoryFetchLimit = (historyCount) => isUnlimitedHistory(historyCount) || historyCount == null ? 14 : historyCount;
 z$1.object({
 	/** Notebook session ID */
 	sessionId: z$1.string(),
@@ -14287,6 +14209,18 @@ const ArtifactVersionMetaSchema = z$1.object({
 	}),
 	sha256Index: z$1.string()
 });
+/** One no-sign-in share link. `token` is the capability itself and is stripped from every
+*  serialized response, so it is optional here: an owner-facing read carries the metadata
+*  (id to revoke by, timestamps, per-link view count) with no token at all. `id` is the
+*  subdocument `_id`, rendered as a string. */
+const ShareTokenEntrySchema = z$1.object({
+	id: z$1.string().optional(),
+	token: z$1.string().optional(),
+	createdAt: z$1.date().optional(),
+	revokedAt: z$1.date().nullish(),
+	viewCount: z$1.int().nonnegative().prefault(0),
+	lastViewedAt: z$1.date().nullish()
+});
 /** Reserved slugs - must include every tier URL token so a slug can't shadow routing. */
 const RESERVED_SLUGS = [
 	"api",
@@ -14410,6 +14344,10 @@ z$1.object({
 	shareToken: z$1.string().optional(),
 	/** When `shareToken` was last minted/rotated; drives the owner-facing "link created" surface. */
 	shareTokenUpdatedAt: z$1.date().nullish(),
+	/** Every share link ever minted, revoked ones included. Mirrors the two fields above during
+	*  the rollout and becomes the source of truth once the backfill has run everywhere; `token`
+	*  is stripped from serialized responses, so an owner-facing read sees only the metadata. */
+	shareTokens: z$1.array(ShareTokenEntrySchema).prefault([]),
 	/** Collaboration gate: who (among viewers) may annotate. Orthogonal to
 	*  `visibility`. Defaults to `none` (read-only) until the owner opts in. */
 	commentPolicy: CommentPolicySchema.prefault("none"),
@@ -14440,6 +14378,9 @@ z$1.object({
 	declaredApiEndpoints: z$1.array(z$1.string()).prefault([]),
 	/** Rendered body snapshot for reply/fabfile viewer pages (markdown or text). */
 	renderedBody: z$1.string().optional(),
+	/** Snapshot of the source reply's citables (reply source only), so a `b4m_map` fence in
+	*  `renderedBody` can still resolve its place ids after the source Quest is edited or deleted. */
+	citables: z$1.array(CitableSourceSchema).optional(),
 	publishedAt: z$1.date(),
 	previousVersionMeta: ArtifactVersionMetaSchema.optional(),
 	/** Full version history (oldest to newest); each entry's bytes are archived at
@@ -14693,170 +14634,70 @@ z$1.object({
 	createdAt: z$1.union([z$1.string(), z$1.date()]).optional(),
 	updatedAt: z$1.union([z$1.string(), z$1.date()]).optional()
 });
+ClaudeArtifactMimeTypes.RECHARTS, ClaudeArtifactMimeTypes.MERMAID, ClaudeArtifactMimeTypes.LATTICE, ClaudeArtifactMimeTypes.BLOG_DRAFT, ClaudeArtifactMimeTypes.CHESS;
+[...IMAGE_SIZE_CONSTRAINTS.DALL_E_2.sizes, ...IMAGE_SIZE_CONSTRAINTS.DALL_E_3.sizes];
 /**
-* Length of `text` in Unicode CODE POINTS - the unit `IFabFileChunk.charLength` is stored in.
-* Matches MongoDB's `$strLenCP`, which is what lets the char-length backfill
-* (packages/scripts/datalake/backfill-chunk-char-length.ts) compute the same number server-side
-* without reading chunk text out of the database. Deliberately NOT `text.length` (UTF-16 code
-* units): the two differ on astral characters (surrogate pairs), and the write path and the
-* backfill must agree exactly.
-*/
-const countCodePoints = (text) => {
-	let count = 0;
-	for (const _ch of text) count++;
-	return count;
-};
-/**
-* Default character budget for a super-linear parse pass. A starting point only -
-* see the sizing rule below; any call site in front of a measured parser should pass
-* an explicit `max` derived from that parser's own curve.
+* Zero-width space spliced into a defanged marker. It is invisible wherever the text is
+* rendered, so escaping never changes what the reader sees - only what the parser matches.
 */
-const DEFAULT_PARSE_CAP = 1e5;
+const ZERO_WIDTH_SPACE = "​";
 /**
-* Bound the length of input a super-linear parser will scan.
+* Defangs think-marker-shaped substrings inside provider-authored reasoning text so they can
+* never be mistaken for the real control markers adapters wrap around that same text.
 *
-* A regex that backtracks polynomially (or worse) turns an unbounded input length
-* into unbounded CPU on a shared process - the algorithmic-DoS shape. Refusing to
-* scan more than `max` characters converts that into a fixed worst case regardless
-* of how pathological the input is.
-*
-* Truncation (never throwing) is deliberate: these caps sit in front of best-effort
-* cleaners and content detectors where an over-cap input should degrade quietly,
-* not crash the pipeline.
-*
-* PREFER LINEARIZING THE PARSER. A cap is the fallback, not the first move. The email
-* cleaners in services/lib/turndown.ts and the snippet-meta extractor in common/utils.ts
-* both started here and both ended up as single-pass scans instead, because a cap that
-* was small enough to bound their cost was also small enough to stop them working on
-* real content. When the parser is linear, the cap can go.
-*
-* SIZING RULE - if you do cap, pick `max` from the parser's measured cost AT the cap,
-* not from the headroom above real input. For an O(n^2)/O(n^3) inner loop, "far above
-* anything legitimate" is not a bound: the email cleaners were cubic, so a 512k cap
-* still ran for minutes. Measure the worst-case shape at the cap you intend to ship and
-* make sure the number of milliseconds is one you can defend.
-*
-* Four further traps this helper cannot solve for you:
-* - A per-item cap is not a total bound when the item count is also attacker-chosen
-*   (a .pptx picks its own slide count). Carry a running budget across the loop.
-* - Cap what is SCANNED, not what is returned. Where the result is rendered or
-*   stored, re-append `input.slice(max)` unchanged: truncating the value silently
-*   drops content, and a cut inside an element can strand its closing tag. Splicing
-*   the original halves back together also avoids leaving a lone surrogate, since
-*   `slice` cuts by UTF-16 code unit.
-* - Splicing the tail back is not enough when the cap changes the SHAPE of the parse
-*   rather than only its length - a pattern terminated by `$`, say, whose sections then
-*   end early and get classified differently. Check what an over-cap input parses INTO,
-*   not just that its characters survive.
-* - Cap in front of a best-effort cleaner or detector, where degrading quietly is
-*   acceptable. Do not cap in front of a parser whose output drives execution (a
-*   tool-call parser): silently parsing a prefix there means running a subset of what
-*   was asked. If such a parser caps internally, its callers must pass it text already
-*   scoped to the construct being parsed.
-*
-* @returns the input unchanged when within budget, otherwise its first `max` chars.
-*/
-function capForParse(input, max = DEFAULT_PARSE_CAP) {
-	if (!Number.isFinite(max) || max < 0) throw new RangeError(`capForParse: max must be a non-negative finite number, got ${max}`);
-	return input.length <= max ? input : input.slice(0, max);
-}
-/**
-* Exactly 'WIDTHxHEIGHT' - nothing else, no surrounding whitespace and no third segment.
-* Anchored on purpose: this module is the single source of the size rule, so a value that
-* only looks like a resolution ('1024x1024x1024') must not be measured as one.
-*/
-const SIZE_PATTERN = /^(\d+)x(\d+)$/;
-/**
-* Splits a 'WIDTHxHEIGHT' string into numeric edges, or null when it is not a pair
-* of positive numbers. Lets callers tell a resolution that breaks a rule apart from
-* a value that expresses no resolution at all ('auto', 'wide', undefined).
-*/
-function parseSizeEdges(size) {
-	if (typeof size !== "string") return null;
-	const match = SIZE_PATTERN.exec(size);
-	if (!match) return null;
-	const width = Number(match[1]);
-	const height = Number(match[2]);
-	if (!width || !height) return null;
-	return {
-		width,
-		height
-	};
-}
-/**
-* True when a custom gpt-image-2 resolution meets OpenAI's documented limits.
-* gpt-image-2 accepts any resolution satisfying these, not only the presets in
-* IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.sizes, so a flat preset check would reject
-* valid custom sizes.
-*/
-function satisfiesGptImage2Constraints({ width, height }) {
-	const { maxEdge, minTotalPixels, maxTotalPixels, edgeMultiple, maxAspectRatio } = IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.constraints;
-	const longEdge = Math.max(width, height);
-	const shortEdge = Math.min(width, height);
-	const totalPixels = width * height;
-	return longEdge <= maxEdge && width % edgeMultiple === 0 && height % edgeMultiple === 0 && longEdge / shortEdge <= maxAspectRatio && totalPixels >= minTotalPixels && totalPixels <= maxTotalPixels;
+* A reasoning delta is provider output, not our control plane - a model can say `<think>` or
+* `</think>` as literal content (reasoning about the protocol itself, or a leading/trailing
+* `</think>` from a provider that already delimits its own monologue). Adapters wrap the whole
+* delta in real markers via plain string concatenation, so an unescaped literal is
+* indistinguishable from a genuine open/close once it lands in the same string. Call this on
+* every raw reasoning delta before it is concatenated with THINK_OPEN_TAG/THINK_CLOSE_TAG.
+*/
+function escapeThinkMarkers(text) {
+	if (!text) return text;
+	return text.replace(/<(\/?)think>/g, `<${ZERO_WIDTH_SPACE}$1think>`);
 }
-/**
-* Sizes the legacy (pre-GPT-Image) OpenAI generate endpoint accepts. The two tiers
-* overlap on 1024x1024; the repeated entry is harmless because this list is only ever
-* tested for membership.
-*/
-const OPENAI_LEGACY_IMAGE_SIZES = [...IMAGE_SIZE_CONSTRAINTS.DALL_E_2.sizes, ...IMAGE_SIZE_CONSTRAINTS.DALL_E_3.sizes];
-/**
-* True when `size` may be sent to OpenAI for `model`. This is the single source of the
-* OpenAI image size rule - generate, edit, the variation endpoint, the cost estimate and
-* the settings UI all resolve through it, so a tier changing its accepted sizes is a
-* one-line edit to IMAGE_SIZE_CONSTRAINTS rather than a hunt through retyped lists.
-*
-* gpt-image-2 takes 'auto', its presets, or any custom WIDTHxHEIGHT meeting
-* satisfiesGptImage2Constraints. The gpt-image-1 family is limited to its three fixed
-* sizes. Anything else is treated as legacy dall-e.
-*
-* OpenAI image models only: BFL, Gemini and xAI sizes are validated by their own adapters,
-* and passing one of those models here would measure it against the wrong list.
-*/
-function isSupportedImageSize(model, size) {
-	if (typeof size !== "string") return false;
-	if (isGPTImage2Model(model)) {
-		if (size === IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.autoSize || IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.sizes.includes(size)) return true;
-		const edges = parseSizeEdges(size);
-		return edges !== null && satisfiesGptImage2Constraints(edges);
+/** One less than the longer marker's length: the most characters a real marker prefix can span. */
+const MAX_PARTIAL_MARKER_LENGTH = 7;
+/** Length of the longest suffix of `text` that is a proper prefix of either marker token. */
+function partialMarkerSuffixLength(text) {
+	const max = Math.min(MAX_PARTIAL_MARKER_LENGTH, text.length);
+	for (let len = max; len > 0; len--) {
+		const suffix = text.slice(-len);
+		if ("<think>".startsWith(suffix) || "</think>".startsWith(suffix)) return len;
 	}
-	if (isGPTImageModel(model)) return IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_1.sizes.includes(size);
-	return OPENAI_LEGACY_IMAGE_SIZES.includes(size);
+	return 0;
 }
 /**
-* The size to fall back to when a requested size is unsupported for `model`. Every tier
-* defaults to 1024x1024 today; the indirection keeps that a per-tier decision.
-*/
-function fallbackImageSize(model) {
-	if (isGPTImage2Model(model)) return IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.defaultSize;
-	if (isGPTImageModel(model)) return IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_1.defaultSize;
-	return IMAGE_SIZE_CONSTRAINTS.DALL_E_2.defaultSize;
-}
-/**
-* The size the generate endpoint should send for a GPT-Image `model`, given what the
-* caller asked for. Returns the input unchanged when nothing needs correcting, so a
-* caller can compare the two to decide whether to warn.
-*
-* Absent: gpt-image-2 gets 'auto' - it is the only tier that can pick its own - and the
-* gpt-image-1 family gets its fixed default.
+* Stateful counterpart to escapeThinkMarkers for text that arrives in streamed pieces.
 *
-* Present but unsupported: replaced by the tier fallback, with one deliberate exception.
-* A gpt-image-2 value that names no resolution at all ('wide') is forwarded untouched:
-* gpt-image-2 sizing is open-ended, so an unrecognized token is left for OpenAI to
-* interpret rather than second-guessed here. The gpt-image-1 family has fixed sizes and
-* no such pass-through.
+* escapeThinkMarkers alone is only safe on a complete string: adapters call it once per
+* delta, but a provider is free to split a marker-shaped substring across two adjacent
+* deltas (e.g. 'wrote <th' then 'ink> tag'). Escaping each half independently leaves both
+* halves unescaped, and concatenating them reassembles a literal `<think>`/`</think>` that
+* is then indistinguishable from the real control marker wrapped around the same text.
 *
-* GPT-Image tiers only - the legacy dall-e path has its own absent-size handling and
-* should gate on isSupportedImageSize directly.
-*/
-function resolveGptImageGenerateSize(model, size) {
-	const isGptImage2 = isGPTImage2Model(model);
-	if (!size) return isGptImage2 ? IMAGE_SIZE_CONSTRAINTS.GPT_IMAGE_2.autoSize : fallbackImageSize(model);
-	if (isSupportedImageSize(model, size)) return size;
-	if (isGptImage2 && parseSizeEdges(size) === null) return size;
-	return fallbackImageSize(model);
+* This holds back any trailing substring of the buffered text that could still extend into
+* a marker (up to `<think>`/`</think>`'s length minus one) until the next push resolves it
+* one way or the other, or flush() is called at the end of the reasoning span.
+*/
+function createThinkMarkerEscaper() {
+	let pending = "";
+	return {
+		push(chunk) {
+			if (!chunk) return "";
+			const combined = pending + chunk;
+			const holdLength = partialMarkerSuffixLength(combined);
+			const safeLength = combined.length - holdLength;
+			const safe = combined.slice(0, safeLength);
+			pending = combined.slice(safeLength);
+			return escapeThinkMarkers(safe);
+		},
+		flush() {
+			const remaining = pending;
+			pending = "";
+			return escapeThinkMarkers(remaining);
+		}
+	};
 }
 /** Generation was cut off against the output-token ceiling. */
 const TRUNCATED_FINISH_REASON = "max_tokens";
@@ -14884,6 +14725,71 @@ function isEarlyStop(stopReason) {
 	return !!stopReason && EARLY_STOP_FINISH_REASONS.has(stopReason);
 }
 /**
+* Signs the image URLs `web_search` writes into its tool output, so `/api/search-image` (the
+* same-origin proxy that fetches them server-side) can verify a URL actually came from our own
+* search-provider results, not from a hostile page's snippet text steering the model into writing
+* an attacker-controlled URL with exfiltrated data in the query string.
+*
+* The signature is a trailing `&b4mSig=<hex>` (or `?b4mSig=<hex>` with no prior query string)
+* appended by plain string concatenation - never by reparsing the URL through `URLSearchParams`,
+* which re-serializes every existing param (e.g. turning a literal space into `+`) and would send
+* a byte-different URL to a host whose own signature (an imgix/S3-presigned link) covers the exact
+* query string the provider returned. Anchoring the signature to the END of the string, and
+* requiring it to be the only occurrence, is what makes verification unambiguous: anything a
+* tamperer appends after signing - including a second `b4mSig` - changes what's left of the anchor
+* match, which changes the canonical text, which invalidates the signature. There is deliberately
+* no "read the first/last `b4mSig` param and ignore the rest" step, since that step is exactly
+* where an earlier version of this file's bypass lived (verify read the URL's first `b4mSig` via
+* `searchParams.get` while signing canonicalized by deleting *every* `b4mSig`, so a validly-signed
+* URL with a second, attacker-authored `b4mSig` appended still verified, and was then forwarded to
+* `safeFetch` with that attacker data still attached).
+*
+* The model is already told to copy an `Images:` line's URL verbatim, so no new instruction is
+* needed for the signature to survive.
+*
+* The signature has no expiry: a stored reply, citable, published page, or curation transcript
+* persists indefinitely, and nothing re-signs a URL on read, so a TTL would make every card
+* permanently break once it lapsed rather than bound anything meaningful. What actually bounds
+* a leaked signed URL's usefulness is the same thing that bounds the route otherwise: it's only
+* reachable at all behind `jwtOnly` auth (apps/client/pages/api/search-image.ts) and is capped by
+* a per-user rate limit there.
+*/
+const SIGNATURE_PARAM = "b4mSig";
+const TRAILING_SIGNATURE_RE = new RegExp(`[?&]${SIGNATURE_PARAM}=([0-9a-f]{32})$`);
+const KNOWN_PLACEHOLDER_SECRETS = /* @__PURE__ */ new Set([
+	"",
+	"my-secret-placeholder-value",
+	"not-configured"
+]);
+/**
+* True for an empty or known-placeholder signing secret. Shared so any caller that would
+* otherwise sign-and-fail (e.g. web_search deciding whether to pay for image results at all)
+* uses the same definition `verifyImageUrlSignature` fails closed on, rather than a second one
+* that could drift out of sync.
+*/
+function isPlaceholderImageSigningSecret(secret) {
+	return KNOWN_PLACEHOLDER_SECRETS.has(secret ?? "");
+}
+function computeSignature(canonical, secret) {
+	return createHmac("sha256", secret).update(canonical).digest("hex").slice(0, 32);
+}
+/**
+* Appends expiry + signature query params by string concatenation (never reparses or
+* re-serializes the existing query string - see the file-level comment). Returns the URL
+* unchanged if it fails to parse as a URL, or if it already carries a trailing signature.
+*/
+function signImageUrl(rawUrl, secret) {
+	try {
+		new URL(rawUrl);
+	} catch {
+		return rawUrl;
+	}
+	if (TRAILING_SIGNATURE_RE.test(rawUrl)) return rawUrl;
+	const separator = rawUrl.includes("?") ? "&" : "?";
+	const signature = computeSignature(rawUrl, secret);
+	return `${rawUrl}${separator}${SIGNATURE_PARAM}=${signature}`;
+}
+/**
 * promptMeta.functionCalls fields that must never reach a viewer who only holds a
 * "read this conversation" grant - a session share, a live subscription, a bug-report
 * egress to a third party (Slack/email), or a session clone made by a share holder
@@ -14917,6 +14823,13 @@ const OWNER_ONLY_FUNCTION_CALL_FIELDS = ["returnValue", "error"];
 * and a share/subscribe/clone grant authorizes reading the conversation, not re-reading the
 * owner's corpus through it. The sibling `chunkId` is deliberately kept - an opaque id is not
 * content, and `citables[].id` (the file id) is already unredacted beside it.
+*
+* `conflictsWith` (#3041) is kept for the same reason, recorded here so the next reader does not
+* re-derive it: it holds `fabFileId`s of other cited sources, so it adds a RELATIONSHIP between
+* chips the viewer can already see rather than a slice of the owner's corpus. That holds only while
+* the field stays ids - a future version carrying the conflicting SENTENCES (the detector has them:
+* InconsistencyEvidence.excerpt) would be `fullContext`'s class exactly and would have to join the
+* list below rather than ride along inside this one.
 */
 const OWNER_ONLY_CITABLE_METADATA_FIELDS = ["fullContext"];
 [...OWNER_ONLY_FUNCTION_CALL_FIELDS.map((field) => `promptMeta.functionCalls.${field}`), ...OWNER_ONLY_CITABLE_METADATA_FIELDS.map((field) => `promptMeta.citables.metadata.${field}`)];
@@ -14953,47 +14866,6 @@ z$1.array(triggerWordSchema).max(20, "Up to 20 trigger words allowed.").transfor
 	}
 	return out;
 });
-/**
-* Serve gate for uploaded FabFiles: hold-until-scanned, fail-closed on ALL mime
-* types, not just images. A file is serveable only once moderation has run to
-* completion on it, REGARDLESS of its declared `mimeType`.
-*
-* Why gate non-images too: `mimeType` is client-declared at upload time and is only
-* corrected by the S3 scan ~1-2s later (see `moderateUploadedFile`'s byte-sniffing). If this
-* gate special-cased "non-images always serveable" based on that same untrusted declared
-* mimeType, a file uploaded as `application/pdf` but actually a PNG (or vice versa) would be
-* served during that window before the sniff/scan ever runs. Gating on `moderationStatus`
-* alone closes that window for every file, image or not.
-*
-* `moderationStatus` semantics:
-*  - 'clean'                      -> serveable
-*  - 'pending' | 'scanning'       -> NOT serveable (not yet through the scan)
-*  - 'blocked'                    -> NOT serveable (confirmed block / unscannable format)
-*  - null | undefined             -> NOT serveable (fail-closed; legacy rows are
-*                                    backfilled to 'clean', see backfill-fabfile-moderation-status.ts)
-*
-* Non-image files (PDFs, docs, text, ...) are NOT scanned by Rekognition, but they still
-* pass through `moderateUploadedFile`/`objectCreated`, which resolves them to 'clean'
-* immediately (no image bytes to hold on), so the hold is brief (one S3 event round trip),
-* not an indefinite block.
-*/
-function isImageServeable(f) {
-	return f.moderationStatus === "clean";
-}
-/**
-* Is this mime type an image? `image/svg+xml` counts, since vision models receive it
-* as an image.
-*
-* The repo has ~50 inline `startsWith('image/')` checks and they disagree on the edges
-* (case, null handling). Only the ones on the attachment pipeline - composer upload,
-* chat context assembly, attachment capability warnings - have been converted here.
-* Icon pickers, avatar validation and resize eligibility still carry their own copies:
-* same question, unrelated subsystems, and folding them in would have made this a
-* repo-wide diff.
-*/
-function isImageAttachment(mimeType) {
-	return typeof mimeType === "string" && mimeType.toLowerCase().startsWith("image/");
-}
 IMAGE_SIZE_CONSTRAINTS.BFL.minWidth, IMAGE_SIZE_CONSTRAINTS.BFL.maxWidth;
 Array.from(new Set([
 	{
@@ -15901,71 +15773,10 @@ Array.from(new Set([
 	const [, top] = v.target.split("/");
 	return `/${top}`;
 })));
-function getHeader(headers, name) {
-	if (!headers || typeof headers !== "object") return null;
-	if (typeof headers.get === "function") {
-		const value = headers.get(name);
-		return typeof value === "string" ? value : null;
-	}
-	const value = headers[name] ?? headers[name.toLowerCase()];
-	return typeof value === "string" ? value : null;
-}
-function parseCount(value) {
-	if (value === null) return null;
-	const trimmed = value.trim();
-	if (!trimmed) return null;
-	const parsed = Number(trimmed);
-	return Number.isFinite(parsed) ? parsed : null;
-}
-const UNIT_MS = {
-	ms: 1,
-	s: 1e3,
-	m: 6e4,
-	h: 36e5
-};
-const DURATION_PART = /(\d+(?:\.\d+)?)(ms|h|m|s)/g;
-/**
-* Parse a Go-style duration ("6ms", "0s", "1m30s", "1h2m3s") to milliseconds.
-*
-* Exported for its own tests: it is the part of this module that can be wrong in a way the
-* numbers still look plausible.
-*/
-function parseDurationMs(value) {
-	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
-	if (!trimmed) return null;
-	DURATION_PART.lastIndex = 0;
-	let total = 0;
-	let matched = 0;
-	let consumed = 0;
-	for (const part of trimmed.matchAll(DURATION_PART)) {
-		total += Number(part[1]) * UNIT_MS[part[2]];
-		consumed += part[0].length;
-		matched += 1;
-	}
-	if (matched === 0 || consumed !== trimmed.length) return null;
-	return total;
-}
-/** Read both rate-limit dimensions off a provider response. */
-function parseEmbeddingRateLimitHeaders(headers) {
-	return {
-		limitTokens: parseCount(getHeader(headers, "x-ratelimit-limit-tokens")),
-		limitRequests: parseCount(getHeader(headers, "x-ratelimit-limit-requests")),
-		remainingTokens: parseCount(getHeader(headers, "x-ratelimit-remaining-tokens")),
-		remainingRequests: parseCount(getHeader(headers, "x-ratelimit-remaining-requests")),
-		resetTokensMs: parseDurationMs(getHeader(headers, "x-ratelimit-reset-tokens")),
-		resetRequestsMs: parseDurationMs(getHeader(headers, "x-ratelimit-reset-requests"))
-	};
-}
-/** True when the provider reported at least one usable ceiling. */
-function hasUsableLimits(snapshot) {
-	return snapshot.limitTokens !== null || snapshot.limitRequests !== null;
-}
 dayjs.extend(utc);
 dayjs.extend(timezone);
 dayjs.extend(relativeTime);
 dayjs.extend(localizedFormat);
-var dayjsConfig_default = dayjs;
 /**
 * Default retryable errors for LLM API calls
 */
@@ -16133,42 +15944,6 @@ async function withRetry(fn, options = {}) {
 		}
 	}
 }
-function readZipEntryBounded(entry, maxBytes) {
-	return new Promise((resolve, reject) => {
-		const stream = entry.internalStream("nodebuffer");
-		let parts = [];
-		let byteLength = 0;
-		let settled = false;
-		stream.on("data", (chunk) => {
-			if (settled) return;
-			byteLength += chunk.length;
-			if (byteLength > maxBytes) {
-				settled = true;
-				stream.pause();
-				parts = [];
-				resolve({
-					ok: false,
-					reason: "too-large"
-				});
-				return;
-			}
-			parts.push(chunk);
-		}).on("error", (error) => {
-			if (settled) return;
-			settled = true;
-			parts = [];
-			reject(error);
-		}).on("end", () => {
-			if (settled) return;
-			settled = true;
-			resolve({
-				ok: true,
-				text: Buffer.concat(parts).toString("utf8"),
-				byteLength
-			});
-		}).resume();
-	});
-}
 //#endregion
 //#region src/utils/apiUrl.ts
 /**
@@ -16290,6 +16065,19 @@ function getEnvironmentName(configApiConfig) {
 	return "Self-Hosted";
 }
 //#endregion
+//#region src/utils/validateSessionId.ts
+/**
+* Session and resume ids arrive from the environment (`B4M_SESSION_ID`,
+* `B4M_RESUME_ID`) and are used as filesystem path components by the session
+* store and the debug logger. Restrict them to a strict charset (which still
+* covers UUIDs) so a hostile launcher cannot traverse out of the base dir via
+* e.g. `B4M_SESSION_ID=../config`.
+*/
+const SESSION_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+function isValidSessionId(value) {
+	return SESSION_ID_PATTERN.test(value);
+}
+//#endregion
 //#region src/config/toolSafety.ts
 /**
 * Tool safety categories determine when permission is required
@@ -16405,13 +16193,13 @@ function formatFileSize(bytes) {
 function tryReadContextFile(dir, filename, source) {
 	const filePath = path$1.join(dir, filename);
 	try {
-		const stats = fs$2.lstatSync(filePath);
+		const stats = fs$1.lstatSync(filePath);
 		if (stats.isDirectory()) return null;
 		if (stats.isSymbolicLink()) return { error: `${source === "global" ? "Global" : "Project"} ${filename} is a symlink (not allowed for security)` };
 		if (stats.size > 102400) return { error: `${source === "global" ? "Global" : "Project"} ${filename} exceeds 100KB limit (${formatFileSize(stats.size)})` };
 		return {
 			filename,
-			content: fs$2.readFileSync(filePath, "utf-8"),
+			content: fs$1.readFileSync(filePath, "utf-8"),
 			source,
 			path: filePath
 		};
@@ -16513,9 +16301,10 @@ const logger = class Logger {
 	* Initialize the logger with a session ID
 	*/
 	async initialize(sessionId) {
+		if (!isValidSessionId(sessionId)) throw new Error(`Invalid session id "${sessionId}": must match ${SESSION_ID_PATTERN.source}`);
 		this.sessionId = sessionId;
 		const debugDir = path.join(os.homedir(), ".bike4mind", "debug");
-		await fs$1.mkdir(debugDir, { recursive: true });
+		await fs.mkdir(debugDir, { recursive: true });
 		this.logFilePath = path.join(debugDir, `${sessionId}.txt`);
 		await this.writeToFile("INFO", "=== CLI SESSION START ===");
 	}
@@ -16567,7 +16356,7 @@ const logger = class Logger {
 		if (!this.fileLoggingEnabled || !this.logFilePath) return;
 		try {
 			const logEntry = `[${(/* @__PURE__ */ new Date()).toISOString().replace("T", " ").substring(0, 19)}] [${level}] ${message}\n`;
-			await fs$1.appendFile(this.logFilePath, logEntry, "utf-8");
+			await fs.appendFile(this.logFilePath, logEntry, "utf-8");
 		} catch (error) {
 			console.error("File logging failed:", error);
 		}
@@ -16684,11 +16473,11 @@ const logger = class Logger {
 		if (!this.fileLoggingEnabled) return;
 		try {
 			const debugDir = path.join(os.homedir(), ".bike4mind", "debug");
-			const files = await fs$1.readdir(debugDir);
+			const files = await fs.readdir(debugDir);
 			const thirtyDaysAgo = Date.now() - 2592e6;
 			for (const file of files) {
 				const filePath = path.join(debugDir, file);
-				if ((await fs$1.stat(filePath)).mtime.getTime() < thirtyDaysAgo) await fs$1.unlink(filePath);
+				if ((await fs.stat(filePath)).mtime.getTime() < thirtyDaysAgo) await fs.unlink(filePath);
 			}
 		} catch (error) {
 			console.error("Failed to cleanup old logs:", error);
@@ -17640,7 +17429,7 @@ var ConfigStore = class {
 	*/
 	async saveSandboxConfig(sandbox) {
 		await this.load();
-		this.globalConfig.sandbox = sandbox;
+		this.globalConfig.sandbox = structuredClone(sandbox);
 		await this.save();
 	}
 	/**
@@ -17931,4 +17720,4 @@ var ConfigStore = class {
 	}
 };
 //#endregion
-export { RESPONSES_API_TOOL_MODELS as $, secureParameters as $t, DEFAULT_UNKNOWN_CONTEXT_WINDOW as A, isGPTImage2Model as At, InternalServerError as B, isRetryableError as Bt, BadRequestError as C, hasUsableLimits as Ct, ChatModels as D, isChunkStalledFile as Dt, CREDIT_DEDUCT_TRANSACTION_TYPES as E, isChunkRebuildPending as Et, ForbiddenError as F, isMediaModelType as Ft, NotFoundError as G, isZodError as Gt, McpServerName as H, isSupportedImageSize as Ht, HTTPError as I, isModelAccessible as It, PROMPT_TEXT_MAX as J, parseEmbeddingRateLimitHeaders as Jt, OllamaEmbeddingModel as K, mapMimeTypeToArtifactType as Kt, HttpStatus as L, isModelDeprecated as Lt, FIELD_GROUP_OF as M, isGeminiModelId as Mt, FIXED_TEMPERATURE_MODELS as N, isImageAttachment as Nt, CorruptedFileError as O, isEarlyStop as Ot, FORMAT_PROMPT_TEMPLATE as P, isImageServeable as Pt, REFUSAL_FALLBACK_MODELS as Q, resolveHistoryFetchLimit as Qt, IMAGE_SIZE_CONSTRAINTS as R, isPlaceholderApiKey as Rt, BFL_SAFETY_TOLERANCE as S, hasKeylessCloudEmbedder as St, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as T, isBflUltraImageModel as Tt, ModelBackend as U, isUnlimitedHistory as Ut, MODEL_INFO_FIELD_GROUP_OF as V, isSupportedFabFileMimeType as Vt, NO_TEMPERATURE_MODELS as W, isUserInitiatedAbort as Wt, REASONING_EFFORT_INCOMPATIBLE_WITH_TOOLS_MODELS as X, reservationOutputTokens as Xt, PermissionDeniedError as Y, readZipEntryBounded as Yt, REASONING_SUPPORTED_MODELS as Z, resolveGptImageGenerateSize as Zt, AGENT_QUEST_MCP_URI as _, defaultEmbeddingModelForEnv as _t, canTrustTool as a, usdToCreditsStochastic as an, TooManyRequestsError as at, AudioMimeType as b, getQuestErrorCode as bt, ApiEndpointUnconfiguredError as c, actorColorIndex as cn, VIDEO_SIZE_CONSTRAINTS as ct, getEnvironmentName as d, selfClaimedActorKindSchema as dn, WORK_ITEM_STATUSES as dt, settingsMap as en, REVIEW_GATE_STATUS_VALUES as et, parseApiUrl as f, buildRateLimitLogEntry as fn, applyModelPriceCatalog as ft, AGENT_QUEST_MANIFEST as g, dayjsConfig_default as gt, AGENT_QUEST_ID as h, parseRateLimitHeaders as hn, countCodePoints as ht, loadContextFiles as i, usdToCredits as in, TTS_MAX_INPUT_CHARS as it, DEGENERATE_FINISH_REASON as j, isGPTImageModel as jt, DEFAULT_MUSIC_MODEL_ID as k, isFieldGroup as kt, LOCAL_DEV_URL as l, actorKindMarker as ln, VideoModels as lt, resolveApiEndpoint as m, isNearLimit as mn, capForParse as mt, logger as n, toModelRecord as nn, SpeechToTextModels as nt, getToolCategory as o, withRetry as on, UnauthorizedError as ot, requireApiUrl as p, extractSnippetMeta as pn, calculateRetryDelay as pt, OpenAIEmbeddingModel as q, obfuscateApiKey as qt, extractCompactInstructions as r, toNonWebpOutputFormat as rn, SupportedFabFileMimeTypes as rt, isReadOnlyTool as s, ACTOR_COLOR_SLOTS as sn, UnprocessableEntityError as st, ConfigStore as t, toModelInfo as tn, SUBQUEST_STATUS_VALUES as tt, getCreditsUrl as u, actorKindSchema as un, VoyageAIEmbeddingModel as ut, ARTIFACT_ATTRS_PATTERN as v, fallbackImageSize as vt, BedrockEmbeddingModel as w, isAudioMimeType as wt, BEDROCK_NO_PROMPT_CACHING_MODELS as x, getRetryAfterMs as xt, ApiKeyType as y, getMcpProviderMetadata as yt, ImageModels as z, isRenderableModelType as zt };
+export { withRetry as $, NotFoundError as A, WORK_ITEM_STATUSES as B, CREDIT_DEDUCT_TRANSACTION_TYPES as C, MODEL_INFO_FIELD_GROUP_OF as D, LOCATION_MAP_LANGUAGE as E, REVIEW_GATE_STATUS_VALUES as F, googleMapsSearchUrl as G, escapeThinkMarkers as H, SEARCH_RESULT_CARDS_LANGUAGE as I, isRetryableError as J, isEarlyStop as K, SUBQUEST_STATUS_VALUES as L, OpenAIEmbeddingModel as M, PROMPT_TEXT_MAX as N, McpServerName as O, PermissionDeniedError as P, signImageUrl as Q, SupportedFabFileMimeTypes as R, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as S, DEGENERATE_FINISH_REASON as T, getMcpProviderMetadata as U, createThinkMarkerEscaper as V, getQuestErrorCode as W, obfuscateApiKey as X, isUserInitiatedAbort as Y, secureParameters as Z, AGENT_QUEST_ID as _, canTrustTool as a, ApiKeyType as b, SESSION_ID_PATTERN as c, LOCAL_DEV_URL as d, ACTOR_COLOR_SLOTS as et, getCreditsUrl as f, resolveApiEndpoint as g, requireApiUrl as h, loadContextFiles as i, selfClaimedActorKindSchema as it, OllamaEmbeddingModel as j, ModelBackend as k, isValidSessionId as l, parseApiUrl as m, logger as n, actorKindMarker as nt, getToolCategory as o, getEnvironmentName as p, isPlaceholderImageSigningSecret as q, extractCompactInstructions as r, actorKindSchema as rt, isReadOnlyTool as s, ConfigStore as t, actorColorIndex as tt, ApiEndpointUnconfiguredError as u, AGENT_QUEST_MANIFEST as v, ChatModels as w, BedrockEmbeddingModel as x, AGENT_QUEST_MCP_URI as y, VoyageAIEmbeddingModel as z };