@bike4mind/cli 2.0.0 → 2.1.0

package/dist/{ConfigStore-DIs-K9oD.mjs → ConfigStore-BygzEI6H.mjs}

@@ -61,6 +61,11 @@ const hearthEventKindSchema = z$1.enum([
 	"gate.resolve",
 	"system"
 ]);
+const hearthEventOriginSchema = z$1.enum([
+	"session",
+	"api-key",
+	"gateway"
+]);
 const hearthHumanBodySchema = z$1.object({
 	text: z$1.string().min(1),
 	format: z$1.enum(["md", "text"])
@@ -81,7 +86,8 @@ z$1.object({
 	kind: hearthEventKindSchema,
 	human: hearthHumanBodySchema,
 	machine: hearthMachineBodySchema.optional(),
-	refs: hearthEventRefsSchema
+	refs: hearthEventRefsSchema,
+	origin: hearthEventOriginSchema
 });
 /** djb2. Deterministic across processes and restarts, which is the whole point. */
 function hashOf(value) {
@@ -139,7 +145,18 @@ function lookup(map, kind, fallback) {
 function actorKindMarker(kind) {
 	return lookup(ACTOR_KIND_MARKERS, kind, "?");
 }
-z$1.object({
+/**
+* Every field optional and unknown keys dropped: a low-disclosure hook tier
+* forwards no activity block at all, and a hand-posted presence event should
+* still refresh lastSeen rather than being rejected. No length caps here on
+* purpose - the projection truncates, because losing a whole presence update
+* over a long workspace name is the worse failure.
+*
+* This is the bare SHAPE only. Validate a stored or wire payload with
+* `presencePayloadWithDefaults`, which reads a null payload as `{}`; this schema
+* alone would reject one.
+*/
+const presencePayloadSchema = z$1.object({
 	/** Claude Code lifecycle event name; the reason fallback for tiers 0 and 1. */
 	hook_event_name: z$1.string().nullish(),
 	session_id: z$1.string().nullish(),
@@ -166,6 +183,14 @@ z$1.object({
 		background_tasks: z$1.number().int().min(0).nullish()
 	}).nullish()
 });
+z$1.preprocess((v) => v ?? {}, presencePayloadSchema);
+/** `machine.schema` for `delegation` events; the only schema that kind accepts. */
+const DELEGATION_PAYLOAD_SCHEMA_NAME = "hearth.delegation@1";
+/** Extra keys are kept: hearth_delegate spreads caller-supplied extras into the payload. */
+const delegationPayloadSchema = z$1.looseObject({
+	targetActorId: z$1.string().min(1),
+	task: z$1.string().min(1).max(4e3)
+});
 //#endregion
 //#region ../../b4m-core/common/dist/index.mjs
 var HTTPError = class extends Error {
@@ -269,6 +294,7 @@ const b4mLLMTools = z$1.enum([
 	"edit_image",
 	"music_generation",
 	"audio_generation",
+	"video_generation",
 	"weather_info",
 	"web_search",
 	"web_fetch",
@@ -637,6 +663,8 @@ let KnowledgeType = /* @__PURE__ */ function(KnowledgeType) {
 	* excluded from every LLM-attachment and vectorization path.
 	*/
 	KnowledgeType["AUDIO"] = "AUDIO";
+	/** Generated video. Media-only like AUDIO: storable and browsable, never ingested. */
+	KnowledgeType["VIDEO"] = "VIDEO";
 	return KnowledgeType;
 }({});
 /**
@@ -896,9 +924,14 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 	ChatModels["CLAUDE_4_5_OPUS_BEDROCK"] = "global.anthropic.claude-opus-4-5-20251101-v1:0";
 	ChatModels["CLAUDE_4_6_SONNET_BEDROCK"] = "global.anthropic.claude-sonnet-4-6";
 	ChatModels["CLAUDE_5_SONNET_BEDROCK"] = "global.anthropic.claude-sonnet-5";
+	ChatModels["CLAUDE_5_5_SONNET_BEDROCK"] = "global.anthropic.claude-sonnet-5-5";
 	ChatModels["CLAUDE_4_6_OPUS_BEDROCK"] = "global.anthropic.claude-opus-4-6-v1";
 	ChatModels["CLAUDE_4_7_OPUS_BEDROCK"] = "global.anthropic.claude-opus-4-7";
 	ChatModels["CLAUDE_4_8_OPUS_BEDROCK"] = "global.anthropic.claude-opus-4-8";
+	ChatModels["CLAUDE_FABLE_5_BEDROCK"] = "global.anthropic.claude-fable-5";
+	ChatModels["CLAUDE_FABLE_5_1_BEDROCK"] = "global.anthropic.claude-fable-5-1";
+	ChatModels["CLAUDE_5_OPUS_BEDROCK"] = "global.anthropic.claude-opus-5";
+	ChatModels["CLAUDE_5_5_OPUS_BEDROCK"] = "global.anthropic.claude-opus-5-5";
 	ChatModels["CLAUDE_3_OPUS"] = "claude-3-opus-20240229";
 	ChatModels["CLAUDE_3_5_HAIKU_ANTHROPIC"] = "claude-3-5-haiku-20241022";
 	ChatModels["CLAUDE_3_5_SONNET_ANTHROPIC"] = "claude-3-5-sonnet-20241022";
@@ -990,39 +1023,10 @@ let SpeechToTextModels = /* @__PURE__ */ function(SpeechToTextModels) {
 }({});
 Object.values(SpeechToTextModels);
 z$1.enum(SpeechToTextModels);
-/**
-* Video Models
-*/
-let VideoModels = /* @__PURE__ */ function(VideoModels) {
-	VideoModels["SORA_2"] = "sora-2";
-	VideoModels["SORA_2_PRO"] = "sora-2-pro";
-	return VideoModels;
-}({});
-Object.values(VideoModels);
-z$1.enum(VideoModels);
-/**
-* Video size constraints and options for Sora
-*/
-const VIDEO_SIZE_CONSTRAINTS = { SORA: {
-	durations: [
-		4,
-		8,
-		12
-	],
-	sizes: [
-		"720x1280",
-		"1280x720",
-		"1024x1792",
-		"1792x1024"
-	],
-	defaultDuration: 4,
-	defaultSize: "720x1280"
-} };
 z$1.enum({
 	...ChatModels,
 	...ImageModels,
-	...SpeechToTextModels,
-	...VideoModels
+	...SpeechToTextModels
 });
 Object.freeze({
 	requestsPerMinute: 60,
@@ -1589,7 +1593,7 @@ const ModelRecordFields = z$1.strictObject({
 	/** Operator-owned block. Discovery may never set or clear it. */
 	disabled: z$1.boolean().optional(),
 	disabledReason: z$1.string().optional(),
-	/** Discovery-owned block ("discovered, awaiting price"). Operators may never clear it. */
+	/** Discovery-owned block (e.g. "discovered, awaiting price"). Operators may never clear it. */
 	autoDisabled: z$1.boolean().optional(),
 	autoDisabledReason: z$1.string().optional(),
 	private: z$1.boolean().optional(),
@@ -2034,6 +2038,8 @@ z$1.object({
 	joinCoverage: z$1.array(DiscoveryJoinCoverage).optional(),
 	/** Ids no aggregator matched: a work item, not a log line. */
 	unmatchedIds: z$1.array(z$1.string()).optional(),
+	/** Bedrock profile ids whose foundation id a covered listing omitted: neither sighted nor missed. */
+	frozenProfileIds: z$1.array(z$1.string()).optional(),
 	changes: DiscoveryRunChanges.optional(),
 	/** Convergence passes the run made; the cap being hit is worth seeing. */
 	passes: z$1.number().int().nonnegative().optional(),
@@ -2436,6 +2442,21 @@ z$1.object({
 		onBehalfOfUserId: z$1.string().optional()
 	}).optional()
 });
+const GENERATION_JOB_KINDS = ["video"];
+const GENERATION_JOB_STATES = [
+	"pending",
+	"running",
+	"storing",
+	"succeeded",
+	"failed",
+	"blocked",
+	"cancelled"
+];
+const GENERATION_JOB_SOURCES = [
+	"api",
+	"studio",
+	"agent"
+];
 /**
 * SRE Agent Trio - Shared Types
 *
@@ -2866,6 +2887,47 @@ const AGENT_QUEST_MANIFEST = {
 	}
 };
 /**
+* Click-time template resolution for briefcase prompts. Pure and DOM-free so it
+* is unit-testable and reusable on any surface.
+*/
+const PLACEHOLDER_RE = /\{\{(\w+)\}\}/g;
+/**
+* Replace every `{{key}}` in `promptText` with the matching context value.
+*
+* Invariants (see the briefcase blueprint's Test Patterns):
+*  - SINGLE PASS: each placeholder is resolved exactly once against the ORIGINAL
+*    template - a value that itself contains `{{x}}` is never re-substituted.
+*  - Unknown placeholders are left untouched.
+*  - null/undefined values are skipped (the placeholder is left untouched - no
+*    literal "null"/"undefined" leaks into the prompt).
+*  - The FUNCTION form of replace is used so `$&`, `$1`, `$$` etc. in a value
+*    are inserted literally rather than interpreted as replacement patterns.
+*/
+function replacePromptVariables(promptText, context) {
+	const ctx = context;
+	return promptText.replace(PLACEHOLDER_RE, (match, key) => {
+		const value = ctx[key];
+		if (value === null || value === void 0) return match;
+		return String(value);
+	});
+}
+/**
+* Build a fresh substitution context from the signed-in user, the selected org,
+* and the current clock. `now` is injectable for deterministic tests.
+*/
+function buildPromptContext(user, organizationName, now = /* @__PURE__ */ new Date()) {
+	return {
+		organization: organizationName ?? void 0,
+		userName: user?.name ?? void 0,
+		userEmail: user?.email ?? void 0,
+		userRole: user?.role ?? void 0,
+		currentDateTime: now.toISOString(),
+		currentDate: now.toISOString().slice(0, 10),
+		currentTime: now.toISOString().slice(11, 19),
+		currentYear: String(now.getUTCFullYear())
+	};
+}
+/**
 * Input headroom the chat path holds back on top of a request's reserved output.
 * safeInputWindow (ChatCompletionProcess) subtracts it, so a text entry whose output
 * reserve leaves less than this has no room for a prompt at all.
@@ -3029,7 +3091,8 @@ const BRIEFCASE_DISALLOWED_TOOLS = [
 	"blog_draft"
 ];
 const BriefcaseRequiredToolsSchema = z$1.array(b4mLLMTools.refine((t) => !BRIEFCASE_DISALLOWED_TOOLS.includes(t), "This tool is not permitted in a briefcase prompt")).max(16);
-z$1.string().regex(/^[a-f0-9]{24}$/i, "Invalid prompt id");
+/** A 24-char hex Mongo ObjectId string (for by-id refetch and personal CRUD). */
+const BriefcasePromptIdSchema = z$1.string().regex(/^[a-f0-9]{24}$/i, "Invalid prompt id");
 /** Shared cap for every free-text prompt body a caller can supply. Exported so the
 * caller-prompt caps on the chat request, the invoke params and the CLI tool import it
 * rather than each restating the literal. */
@@ -3056,813 +3119,1152 @@ const PromptBatchQuerySchema = z$1.object({
 });
 z$1.object({ queries: z$1.array(PromptBatchQuerySchema).min(1).max(32).refine((qs) => new Set(qs.map((q) => q.key)).size === qs.length, { message: "Batch query keys must be unique" }) });
 /**
-* Request schema for POST /api/chat - the simplified external chat surface.
-*
-* Shared between the Next.js API handler (apps/client/pages/api/chat.ts, which
-* validates req.body with this exact object) and the OpenAPI registry
-* (b4m-core/common/src/openapi), so the published contract cannot drift from
-* what the handler actually accepts. The model is optional here and resolved
-* server-side from admin settings when omitted.
-*
-* Public-API rule: no `.catch()` / top-level `.transform()`. Both silently mutate
-* caller input (fail-quiet) and are opaque to zod-to-openapi. `historyCount` uses
-* `.default()` (fail loud on a bad value); unknown tool ids are filtered in the
-* handler (see filterKnownTools) instead of by a schema transform. This keeps the
-* schema fully OpenAPI-representable with no doc projection needed.
+* The default catalog layout: one group per seeded system category (the `type`
+* discriminator set by the briefcase seed migration) plus the caller's personal
+* prompts. Shared by the web launcher panel and the CLI's MCP prompts surface so
+* both list the same catalog. `as const` lets a consumer derive the key union
+* (e.g. for a label map) instead of restating it.
 */
-const SimplifiedChatRequestSchema = z$1.object({
-	sessionId: z$1.string().nullish(),
-	newConversation: z$1.boolean().optional(),
-	message: z$1.string(),
-	organizationId: z$1.string().optional(),
-	model: z$1.string().optional(),
-	temperature: z$1.number().min(0).max(2).optional(),
-	max_tokens: z$1.number().positive().optional(),
-	maxTokens: z$1.number().positive().optional(),
-	maxOutputTokens: z$1.number().positive().optional(),
-	stream: z$1.boolean().prefault(false),
-	historyCount: z$1.number().positive().default(10),
-	fileIds: z$1.array(z$1.string()).prefault([]),
-	wait: z$1.boolean().prefault(false),
-	enableTools: z$1.boolean().prefault(false),
-	toolMode: z$1.enum(["fast", "smart"]).optional(),
-	tools: z$1.array(z$1.string()).optional().describe("Explicit tool ids to offer the model. A non-empty array enables tools on its own; no companion `toolMode` or `enableTools` is required. Merged with the auto-selected set under `toolMode: \"smart\"`, and ignored under `toolMode: \"fast\"`. This list ADDS to what is offered rather than restricting it - the server still offers tools of its own (for example knowledge retrieval when the session has reachable documents). Unrecognized ids are dropped rather than rejecting the request; the response reports the surviving set as `tools.effectiveTools` and the ids that are not tools in this deployment as `tools.unrecognizedTools`, since no endpoint enumerates the valid ids. `unrecognizedTools` is reported under every `toolMode` - it describes the ids, not what the mode did with them - so under `toolMode: \"fast\"` an id can be absent from `effectiveTools` (the mode discarded it) without being unrecognized. Both reported lists are deduplicated, and `unrecognizedTools` names at most the first 10 distinct ids."),
-	enableQuestMaster: z$1.boolean().optional(),
-	enableMementos: z$1.boolean().optional(),
-	enableAgents: z$1.boolean().optional(),
-	promptMode: z$1.enum([
-		"raw",
-		"grounded",
-		"surface"
-	]).optional(),
-	skip_auto_offers: z$1.boolean().optional().describe("Suppress tools the server would otherwise attach on its own for this session (the knowledge-base search offer, in-app view navigation, blog drafting/editing/publishing, skill invocation, and every tool from a connected MCP server). Native tools you request explicitly in `tools` are unaffected, but an MCP server tool cannot be named through this field, so with this flag set a caller with an MCP server connected sees none of its tools regardless of `tools`. One system-prompt block goes with them: withholding in-app view navigation also drops the view-registry block that exists only to describe it. No other prompt content changes. This does not switch off retrieval: a session with forced knowledge retrieval still retrieves, and documents already attached to the session are still placed in the prompt directly. Any promptMode suppresses these too, so false has no effect alongside one."),
-	includePromptDetails: z$1.boolean().optional(),
-	includeSystemPrompt: z$1.boolean().optional(),
-	systemPrompt: z$1.string().max(PROMPT_TEXT_MAX).optional().describe("System-prompt text for this request only, never persisted. Rendered as a defended block appended after every other system-prompt source, with prose instructing the model to defer to organization, session and data-lake guidance. Over the cap is a 422, never truncated.")
+const BRIEFCASE_CATALOG_QUERIES = [
+	{
+		key: "general",
+		type: "general"
+	},
+	{
+		key: "writing",
+		type: "writing"
+	},
+	{
+		key: "learning",
+		type: "learning"
+	},
+	{
+		key: "personal",
+		personal: true
+	}
+];
+const AnonymousSessionIdSchema = z$1.object({
+	/** SHA256(userId|orgId|dailySalt|date) - cannot be reversed */
+	hash: z$1.string(),
+	/** YYYY-MM-DD for salt lookup during deletion */
+	dateKey: z$1.string()
 });
-/**
-* Async ACK returned on the default (wait:false) path of POST /api/chat. The
-* `type`/`errorCode` pair below is the same classifier the `wait: true` body and
-* the polled quest (`GET /api/v1/quests/{id}`) carry, so it is modelled once here -
-* the rest of those two bodies is NOT described by this schema. The
-* handler assembles the ack body inline (apps/client/pages/api/chat.ts), so
-* this schema MUST stay in sync with that `res.json({...})` shape.
-*/
-const ChatAckSchema = z$1.object({
-	id: z$1.string(),
-	status: z$1.string(),
-	message_received: z$1.boolean(),
-	timestamp: z$1.string(),
-	model: z$1.string(),
-	sessionId: z$1.string().optional(),
-	message: z$1.string().optional(),
-	type: z$1.enum(CHAT_HISTORY_ITEM_TYPES).optional(),
-	errorCode: z$1.enum(QUEST_ERROR_CODES).optional(),
-	tools: z$1.object({
-		toolMode: z$1.enum(["fast", "smart"]).optional(),
-		autoSelectedTools: z$1.array(z$1.string()).optional(),
-		effectiveTools: z$1.array(z$1.string()),
-		unrecognizedTools: z$1.array(z$1.string()).optional()
-	}).optional(),
-	tracking_info: z$1.object({
-		quest_id: z$1.string(),
-		check_status_url: z$1.string(),
-		poll_url: z$1.string().optional()
-	})
+const SpanContextSchema = z$1.object({
+	/** gen_ai.trace_id */
+	traceId: z$1.string(),
+	/** gen_ai.span_id */
+	spanId: z$1.string()
 });
-/**
-* The quest a `wait: false` caller polls at `GET /api/v1/quests/{id}` - the outcome
-* of the turn the ACK above only acknowledged.
-*
-* Deliberately the OUTCOME SUBSET, not the whole quest: it models only what decides
-* whether the turn succeeded. The full response of that endpoint is
-* QuestPollResponseSchema (schemas/quest.ts), which extends this schema and is
-* the 200 body of the `getQuest` contract.
-*
-* A failed turn is still `status: 'done'` with the failure text in `reply`, so
-* `reply` alone cannot tell an answer from a failure - `type` and `errorCode` are
-* what separate a CLASSIFIED failure. A run that died with partial content is not
-* one of those: `terminalRecoveryFor` (questTimeoutRecovery.ts) keeps the surviving
-* content, so it polls back as `type: 'message'`. What marks it unfinished is
-* `promptMeta.finishReason` - RUN_TIMED_OUT_FINISH_REASON or
-* RUN_ABANDONED_FINISH_REASON (utils/stopReasons.ts) - plus a notice appended to
-* the reply.
-*/
-const PolledFallbackInfoSchema = FallbackInfoSchema.pick({
-	primaryModel: true,
-	primaryModelName: true,
-	fallbackModel: true,
-	fallbackModelName: true,
-	reason: true
+const OperationSchema = z$1.object({
+	name: z$1.enum([
+		"chat_completion",
+		"agent_invoke",
+		"tool_execute"
+	]),
+	finishReason: z$1.enum([
+		"stop",
+		"length",
+		"tool_use",
+		"content_filter",
+		"error"
+	]).optional()
 });
-const ChatQuestPollResultSchema = z$1.object({
-	id: z$1.string(),
-	status: z$1.enum([
-		"pending",
-		"stopped",
-		"running",
-		"done"
-	]).optional(),
-	type: z$1.enum(CHAT_HISTORY_ITEM_TYPES).optional(),
-	errorCode: z$1.enum(QUEST_ERROR_CODES).optional(),
-	reply: z$1.string().nullable().optional(),
-	replies: z$1.array(z$1.string()).optional(),
-	fallbackInfo: PolledFallbackInfoSchema.optional()
+const ModelTelemetrySchema = z$1.object({
+	/** gen_ai.request.model */
+	modelId: z$1.string(),
+	provider: z$1.enum([
+		"anthropic",
+		"openai",
+		"bedrock",
+		"google",
+		"xai",
+		"ollama",
+		"moonshot",
+		"deepseek"
+	]),
+	fallbackUsed: z$1.boolean(),
+	fallbackReason: z$1.string().optional(),
+	originalModelId: z$1.string().optional(),
+	usedThinking: z$1.boolean(),
+	/** Extended thinking tokens */
+	thinkingTokensUsed: z$1.number().optional(),
+	usedTools: z$1.boolean()
 });
-/**
-* Reusable JSON error envelope (plain; the OpenAPI layer annotates it).
-*
-* Must stay in sync with the published `ErrorResponse` component
-* (../openapi/schemas.ts) - `openapi/errorEnvelopeParity.test.ts` pins the two
-* together, and apps/client's errorHandler test uses this shape as the stand-in for
-* the component, which is generate-time only and cannot be imported at runtime.
-*/
-const ApiErrorSchema = z$1.object({
-	error: z$1.string(),
-	request_id: z$1.string().optional(),
+const SystemPromptDetailSchema = z$1.object({
+	source: z$1.enum([
+		"hardcoded",
+		"admin",
+		"user",
+		"project",
+		"session",
+		"org",
+		"caller"
+	]),
+	/** e.g., "date_context", "tool_guidance" */
+	name: z$1.string(),
+	tokenCount: z$1.number(),
+	wasIncluded: z$1.boolean(),
+	exclusionReason: z$1.enum([
+		"duplicate",
+		"disabled",
+		"token_limit"
+	]).optional()
+});
+const SystemPromptsTelemetrySchema = z$1.object({
+	prompts: z$1.array(SystemPromptDetailSchema),
+	totalTokens: z$1.number(),
+	duplicateCount: z$1.number()
+});
+const FeatureContributionSchema = z$1.object({
+	/** e.g., "mementos", "quest_master", "deep_research" */
+	featureName: z$1.string(),
+	messagesAdded: z$1.number(),
+	tokenCount: z$1.number(),
+	executionTimeMs: z$1.number(),
+	success: z$1.boolean(),
+	errorType: z$1.string().optional()
+});
+const FeaturesTelemetrySchema = z$1.object({ contributions: z$1.array(FeatureContributionSchema) });
+const TokensBySourceSchema = z$1.object({
+	systemPrompts: z$1.number(),
+	conversationHistory: z$1.number(),
+	mementos: z$1.number(),
+	fabFiles: z$1.number(),
+	urlContent: z$1.number(),
+	toolSchemas: z$1.number(),
+	userPrompt: z$1.number(),
 	/**
-	* Deprecated, sunset 2026-12-01. The `name` of whatever was thrown - our own error
-	* classes usually, a library/driver class name on an unhandled 500 - added to every
-	* body by apps/client's errorHandler. Documented here so the runtime and the spec
-	* agree while it is still served; do not build on it. See CONVENTIONS.md section 1.
+	* Lake-sourced content injected this turn (forced retrieval + the lake-memory hot card), split out
+	* of `systemPrompts`. Optional and absent means UNKNOWN, never zero - telemetry captured before
+	* this bucket existed has no value to report and must not be read as "no lake content". Mirrors
+	* PromptMetaTokensBySourceSchema in promptMeta.ts.
 	*/
-	name: z$1.string().optional()
+	lakeRetrieval: z$1.number().optional()
 });
-/**
-* Error envelope for the 422 a credit-metered endpoint returns for two unrelated
-* reasons: "your body is invalid" and "you cannot afford this". `errorCode` is
-* what separates them - `insufficientCreditsError` (see insufficientCredits.ts)
-* tags the credit case, so its absence means an ordinary validation failure.
-*
-* Derived from `ApiErrorSchema` rather than re-declaring `error`/`request_id`:
-* both of those 422s are *thrown*, so errorHandler serves the body and adds
-* `name`. Extending is what keeps that documented here (and what drops it again
-* on the sunset date) instead of leaving a bespoke copy behind to drift.
-*/
-const InsufficientCreditsErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal("insufficient_credits").optional() });
-/** 503 when this deployment has no usable key for a provider the request needs (data-lake search, voice). */
-const ProviderNotConfiguredErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal("provider_not_configured").optional() });
-/**
-* Error envelope for the 403 apiKeyAuth (apps/client/server/middlewares/apiKeyAuth.ts)
-* throws when an API key lacks a route's scopes. It names what the ROUTE requires,
-* never what the key holds, so a caller knows which scope to mint a key with.
-* Values are `ApiKeyScope` strings; plain `z.string()` because the enum's module is
-* not import-safe for the install-only openapi job (see the import note above).
-*/
-const ScopeForbiddenErrorSchema = ApiErrorSchema.extend({
-	required_scopes: z$1.array(z$1.string()).optional().describe("API key scopes this route accepts. Holding any one of them satisfies it."),
-	also_required_scopes: z$1.array(z$1.string()).optional().describe("API key scopes this route also requires. Every one must be held, on top of `required_scopes`.")
+z$1.object({
+	/** gen_ai.usage.input_tokens */
+	inputTokens: z$1.number(),
+	/** gen_ai.usage.output_tokens */
+	outputTokens: z$1.number(),
+	contextWindowLimit: z$1.number(),
+	utilizationPercentage: z$1.number(),
+	reservedOutputTokens: z$1.number(),
+	overflowDetected: z$1.boolean(),
+	overflowAmount: z$1.number().optional(),
+	/** Token breakdown by source */
+	tokensBySource: TokensBySourceSchema
 });
-const supportedVoiceGenerationVendor = z.enum(["openai", "elevenlabs"]);
-const DEFAULT_TTS_PROVIDER = "openai";
-const voiceOutputFormatSchema = z.enum([
-	"mp3",
-	"wav",
-	"opus",
-	"aac",
-	"flac",
-	"pcm"
-]);
-const TTS_ABSOLUTE_MAX_INPUT_CHARS = Math.max(...Object.values({
-	openai: 4096,
-	elevenlabs: 1e4
-}));
-const ttsLanguageCodeSchema = z.string().regex(/^[a-z]{2}$/, "languageCode must be a lowercase ISO 639-1 code, e.g. \"en\" or \"ja\"");
-const ttsRequestSchema = z.object({
-	text: z.string().min(1).max(TTS_ABSOLUTE_MAX_INPUT_CHARS),
-	provider: supportedVoiceGenerationVendor.optional(),
-	model: z.string().optional(),
-	voice: z.string().optional(),
-	format: voiceOutputFormatSchema.optional(),
-	stability: z.number().min(0).max(1).optional(),
-	similarityBoost: z.number().min(0).max(1).optional(),
-	languageCode: ttsLanguageCodeSchema.optional(),
-	...generatedAudioRequestFields
+const CacheTelemetrySchema = z$1.object({
+	/** Anthropic cache_read_input_tokens */
+	cacheReadTokens: z$1.number(),
+	/** Anthropic cache_creation_input_tokens */
+	cacheWriteTokens: z$1.number(),
+	/** 0-100% */
+	cacheHitRate: z$1.number(),
+	costSavingsPercent: z$1.number().optional()
 });
-/**
-* JSON body of `POST /api/ai/tts` for `encoding: 'base64'`: the shared generated-audio
-* body plus the TTS fields. `provider`/`fallbackFrom` appear only when the requested
-* provider was unavailable and another one stood in.
-*/
-const ttsBase64ResponseSchema = extendGeneratedAudioResponseSchema({
-	format: voiceOutputFormatSchema,
-	/** The provider that actually produced the audio, present only on a fallback. */
-	provider: supportedVoiceGenerationVendor.optional(),
-	/** The originally requested provider that could not serve the request. */
-	fallbackFrom: supportedVoiceGenerationVendor.optional()
+const CostsTelemetrySchema = z$1.object({
+	inputCostUsd: z$1.number(),
+	outputCostUsd: z$1.number(),
+	totalCostUsd: z$1.number(),
+	creditsUsed: z$1.number()
 });
-/**
-* Error body for `POST /api/ai/tts`, shared by the 401, 422, 429 and 502; the 413
-* has a shape of its own (`ttsResponseTooLargeSchema`). `errorCode` is present only
-* on the conditions that carry a classifier; an ordinary validation 422 has none.
-*
-* Extends `ApiErrorSchema` because what decides whether a body carries the fields
-* errorHandler adds - `request_id`, and `name` until its 2026-12-01 sunset - is
-* whether the body was THROWN, not which status it wears, and three of these four
-* statuses are reachable both ways:
-*
-* - 401: thrown by apiKeyAuth on a rejected key; written by `auth` when no
-*   credential was presented at all, and by the handler for
-*   `provider_not_configured` and for an upstream credential rejection
-*   (`provider_rejected`, from an upstream 401 or 403).
-* - 422: thrown by request validation and by the char-limit / format guards;
-*   written by the handler for `insufficient_credits` and for every upstream 4xx
-*   that is neither a credential rejection nor a 429.
-* - 429: thrown by apiKeyRateLimit; written by the handler on an upstream 429.
-* - 502: only ever written.
-*
-* So those two are genuinely optional here, and splitting this per status would be
-* wrong for the first three. The 502 does advertise both without ever sending them;
-* that is not worth a fourth error schema on one route, and `request_id` missing from
-* this handler's written bodies is a gap in the handler rather than something to
-* enshrine in a schema.
-*/
-const ttsErrorResponseSchema = ApiErrorSchema.extend({
-	provider: supportedVoiceGenerationVendor.optional(),
-	errorCode: z.enum([
-		"insufficient_credits",
-		"provider_not_configured",
-		"provider_rejected"
-	]).optional()
+const TruncationTelemetrySchema = z$1.object({
+	wasTruncated: z$1.boolean(),
+	originalMessageCount: z$1.number(),
+	finalMessageCount: z$1.number(),
+	truncatedMessageCount: z$1.number(),
+	truncationMethod: z$1.enum([
+		"priority",
+		"token-budget",
+		"history-limit",
+		"context-overflow"
+	]).optional(),
+	truncationPercentage: z$1.number()
 });
-/**
-* TTS 413 body: `generatedAudioTooLargeSchema` plus the provider. The handler never
-* sends the `saved`/`fabFileId`/`fileUrl` fields (a saved copy's `fileUrl` is now
-* served as the oversized-audio URL); they stay so a client still parses a server
-* that predates the offload.
-*
-* Not derived from `ApiErrorSchema`: every 413 on this route is written, never
-* thrown, so `name` is genuinely absent rather than optional - a stronger claim than
-* `ttsErrorResponseSchema` can make for its own statuses, see the note there (a
-* provider 413 is folded onto a 422 by documentedStatusForUpstream4xx). An oversized
-* *request* body is another 413 that never reaches this schema at all - Next's own
-* body parser answers it in plain text before the router runs.
-*/
-const ttsResponseTooLargeSchema = generatedAudioTooLargeSchema.extend({
-	provider: supportedVoiceGenerationVendor,
-	saved: z.literal(true).optional(),
-	fabFileId: z.string().optional(),
-	fileUrl: z.string().optional()
+const ToolErrorCategorySchema = z$1.enum([
+	"timeout",
+	"rate_limit",
+	"auth_error",
+	"validation_error",
+	"network_error",
+	"internal_error"
+]);
+const ToolTelemetrySchema = z$1.object({
+	toolName: z$1.string(),
+	/** MCP vs native tool */
+	isMcpTool: z$1.boolean(),
+	/** For MCP tools */
+	mcpServerName: z$1.string().optional(),
+	invocationCount: z$1.number(),
+	successCount: z$1.number(),
+	failureCount: z$1.number(),
+	totalDurationMs: z$1.number(),
+	maxDurationMs: z$1.number(),
+	/** Retry tracking */
+	retryCount: z$1.number(),
+	/** Max 200 chars */
+	lastError: z$1.string().max(200).optional(),
+	errorCategories: z$1.array(ToolErrorCategorySchema).optional(),
+	/**
+	* Content-size metrics for tools that extract text (currently web_fetch, issue #452).
+	* Zero-PII integer counts, so kept at both basic and enhanced capture levels.
+	*/
+	/** Count of unique truncated citables at the tool's size cap (citables dedupe by url,
+	*  so same-url refetches within a completion collapse to one - see WebFetchContentTelemetry). */
+	truncatedInvocationCount: z$1.number().optional(),
+	/** Largest single extracted (post-cap) content length across invocations. */
+	maxExtractedChars: z$1.number().optional(),
+	/** Sum of extracted (post-cap) content length across invocations. */
+	totalExtractedChars: z$1.number().optional()
 });
-z.enum(["openai"]);
-/**
-* Supported sound-effects generation vendors. Currently only ElevenLabs.
-* New vendors are added here and in the `aiSoundService` factory.
-*/
-const supportedSoundGenerationVendor = z.enum(["elevenlabs"]);
-/**
-* Inbound request body for `POST /api/ai/sound-effects`.
-*
-* `durationSeconds` and `promptInfluence` bounds mirror the ElevenLabs
-* sound-generation limits (0.5-30s for the default eleven_text_to_sound_v2
-* model, prompt influence 0-1). `format` is the provider-specific output
-* encoding token (e.g. `mp3_44100_128`).
-*/
-const soundEffectsRequestSchema = z.object({
-	provider: supportedSoundGenerationVendor.default("elevenlabs"),
-	text: z.string().min(1).max(1e3),
-	durationSeconds: z.number().min(.5).max(30).optional(),
-	promptInfluence: z.number().min(0).max(1).optional(),
-	format: z.string().optional(),
-	...generatedAudioRequestFields
+const SubagentTelemetrySchema = z$1.object({
+	agentName: z$1.string(),
+	delegationCount: z$1.number(),
+	successCount: z$1.number(),
+	failureCount: z$1.number(),
+	timeoutCount: z$1.number(),
+	totalDurationMs: z$1.number(),
+	totalTokensUsed: z$1.number(),
+	thoroughness: z$1.enum([
+		"quick",
+		"medium",
+		"very_thorough"
+	]).optional()
 });
-/**
-* Supported background-music generation vendors. Currently only ElevenLabs.
-* New vendors are added here and in the `aiMusicService` factory.
-*/
-const supportedMusicGenerationVendor = z.enum(["elevenlabs"]);
-/**
-* Supported ElevenLabs music models. Scoped to `music_v1` for now; `music_v2` is
-* a deliberate follow-up (see the parent issue). Adding it here is the only
-* change the request surface needs to accept it.
-*/
-const supportedMusicModel = z.enum(["music_v1"]);
-/**
-* Inbound request body for `POST /api/ai/music`.
-*
-* `lengthMs` upper bound is capped below the ElevenLabs Music API ceiling to fit
-* the serving function's time budget (see MAX_MUSIC_LENGTH_MS). It carries a
-* default rather than being optional so the billed
-* length is always known up front (the reserve/settle path needs a deterministic
-* cost before generation) and the route can force that exact length on the
-* provider. `format` is the provider-specific output encoding token (e.g.
-* `mp3_44100_128`).
-*/
-const musicRequestSchema = z.object({
-	provider: supportedMusicGenerationVendor.default("elevenlabs"),
-	prompt: z.string().min(1).max(2e3),
-	lengthMs: z.number().int().min(3e3).max(12e4).default(1e4),
-	forceInstrumental: z.boolean().optional(),
-	modelId: supportedMusicModel.default("music_v1"),
-	format: z.string().optional(),
-	...generatedAudioRequestFields
+const LatencyPercentilesSchema = z$1.object({
+	p50Ms: z$1.number(),
+	p95Ms: z$1.number(),
+	p99Ms: z$1.number()
 });
-const GenerationCallbackUrlSchema = z$1.url({
-	protocol: /^https$/,
-	error: "callbackUrl must be an https URL"
-}).max(2048).describe("Optional https URL that receives one signed POST when the job settles (success or failure). Requires API-key authentication and a callback signing secret on that key. The body is the GET /api/v1/quests/{id} response. Verify it with the `X-Webhook-Signature-256` header: `sha256=` + hex HMAC-SHA256 of `<X-Webhook-Timestamp>.<raw body>` keyed with the signing secret. Polling keeps working either way.");
-z$1.enum([
-	"pending",
-	"dispatched",
-	"delivered",
-	"failed"
+const PerformanceTelemetrySchema = z$1.object({
+	totalResponseTimeMs: z$1.number(),
+	firstTokenTimeMs: z$1.number().optional(),
+	/**
+	* Elapsed ms until the first chunk of any kind, hidden thinking included. Paired with
+	* firstTokenTimeMs so computeAnomalies can tell a never-rendered turn (streamed, nothing
+	* visible) from one that never streamed at all - see ttfvtState in @bike4mind/common.
+	*/
+	firstChunkTimeMs: z$1.number().optional(),
+	contextRetrievalMs: z$1.number().optional(),
+	modelInferenceMs: z$1.number().optional(),
+	toolExecutionMs: z$1.number().optional(),
+	/** Latency percentiles for trend analysis */
+	latencyPercentiles: LatencyPercentilesSchema.optional()
+});
+const AnomalySeveritySchema = z$1.enum([
+	"critical",
+	"high",
+	"medium",
+	"low"
 ]);
-/**
-* The 400 clause every queued-generation contract declares for a rejected `callbackUrl`; must stay
-* in sync with the rejections in apps/client/server/generationCallback/armGenerationCallback.ts.
-*/
-const GENERATION_CALLBACK_REJECTED_DESCRIPTION = "`callbackUrl` was rejected: the request is not API-key authenticated, the key has no callback signing secret, the URL resolves to a private address, or the deployment does not deliver callbacks.";
-VIDEO_SIZE_CONSTRAINTS.SORA.durations;
-VIDEO_SIZE_CONSTRAINTS.SORA.sizes;
-z$1.object({
-	/** Text description of the video to generate */
-	prompt: z$1.string().min(1).max(1e4),
-	/** Model to use for generation */
-	model: z$1.enum(VideoModels).prefault("sora-2"),
-	/** Video duration in seconds: 4, 8, or 12 */
-	seconds: z$1.union([
-		z$1.literal(4),
-		z$1.literal(8),
-		z$1.literal(12)
-	]).prefault(4),
-	/** Video resolution */
-	size: z$1.enum([
-		"720x1280",
-		"1280x720",
-		"1024x1792",
-		"1792x1024"
-	]).prefault(VIDEO_SIZE_CONSTRAINTS.SORA.defaultSize),
-	/** Optional user identifier for abuse tracking */
-	user: z$1.string().optional()
+const PrimaryAnomalySchema = z$1.enum([
+	"none",
+	"context_overflow",
+	"high_utilization",
+	"high_truncation",
+	"tool_failure",
+	"subagent_timeout",
+	"slow_response",
+	"multiple"
+]);
+const AnomaliesTelemetrySchema = z$1.object({
+	contextOverflow: z$1.boolean(),
+	/** >= 90% */
+	highUtilization: z$1.boolean(),
+	/** >= 95% */
+	criticalUtilization: z$1.boolean(),
+	/** >= 50% */
+	highTruncation: z$1.boolean(),
+	/** >= 75% */
+	criticalTruncation: z$1.boolean(),
+	/** >= 3 failures */
+	toolFailureSpike: z$1.boolean(),
+	/** > 30s */
+	toolTimeout: z$1.boolean(),
+	/** > 5min */
+	subagentTimeout: z$1.boolean(),
+	/** > 10s */
+	slowFirstToken: z$1.boolean(),
+	/** > 60s */
+	slowTotalResponse: z$1.boolean(),
+	/** 0-100 */
+	anomalyScore: z$1.number().min(0).max(100),
+	/** Severity mapping */
+	severity: AnomalySeveritySchema,
+	/** Pattern-based dedup key, e.g., "tool_failure_claude-3-5-sonnet_delegate-to-agent" */
+	dedupKey: z$1.string(),
+	primaryAnomaly: PrimaryAnomalySchema
 });
-z$1.object({
-	/** Unique identifier for the video generation job */
-	id: z$1.string(),
-	/** Current status of the job */
-	status: z$1.enum([
-		"queued",
-		"in_progress",
-		"completed",
-		"failed"
+const RequestMetadataSchema = z$1.object({
+	queryComplexity: z$1.enum([
+		"simple",
+		"contextual",
+		"complex"
 	]),
-	/** Error message if the job failed */
-	error: z$1.object({
-		message: z$1.string(),
-		code: z$1.string().optional()
-	}).optional(),
-	/** Timestamp when the job was created */
-	created_at: z$1.number().optional()
+	historyMessageCount: z$1.number(),
+	attachedFileCount: z$1.number(),
+	mementoCount: z$1.number(),
+	enabledFeatures: z$1.array(z$1.string())
+});
+const ContextWindowTelemetryWithOptionalSourceSchema = z$1.object({
+	/** gen_ai.usage.input_tokens */
+	inputTokens: z$1.number(),
+	/** gen_ai.usage.output_tokens */
+	outputTokens: z$1.number(),
+	contextWindowLimit: z$1.number(),
+	utilizationPercentage: z$1.number(),
+	reservedOutputTokens: z$1.number(),
+	overflowDetected: z$1.boolean(),
+	overflowAmount: z$1.number().optional(),
+	/** Token breakdown by source (enhanced only) */
+	tokensBySource: TokensBySourceSchema.optional()
+});
+const ContextTelemetrySchema = z$1.object({
+	schemaVersion: z$1.enum([
+		"1.0",
+		"1.1",
+		"1.2"
+	]),
+	/** ISO 8601 */
+	timestamp: z$1.string(),
+	/** Self-monitoring: time to capture telemetry */
+	captureOverheadMs: z$1.number(),
+	/** Capture level: basic or enhanced */
+	captureLevel: z$1.enum(["basic", "enhanced"]).optional(),
+	anonymousSessionId: AnonymousSessionIdSchema,
+	spanContext: SpanContextSchema.optional(),
+	operation: OperationSchema,
+	model: ModelTelemetrySchema,
+	systemPrompts: SystemPromptsTelemetrySchema.optional(),
+	features: FeaturesTelemetrySchema.optional(),
+	contextWindow: ContextWindowTelemetryWithOptionalSourceSchema,
+	cache: CacheTelemetrySchema.optional(),
+	costs: CostsTelemetrySchema,
+	truncation: TruncationTelemetrySchema.optional(),
+	tools: z$1.array(ToolTelemetrySchema).optional(),
+	subagents: z$1.array(SubagentTelemetrySchema).optional(),
+	performance: PerformanceTelemetrySchema,
+	anomalies: AnomaliesTelemetrySchema,
+	requestMetadata: RequestMetadataSchema.optional(),
+	captureErrors: z$1.array(z$1.string()).optional()
 });
 z$1.object({
-	/** Unique identifier for the video */
-	id: z$1.string(),
-	/** Status should be 'completed' */
-	status: z$1.literal("completed"),
-	/** URL to download the video (temporary, expires after a period) */
-	video_url: z$1.url().optional(),
-	/** Video duration in seconds */
-	duration: z$1.number().optional(),
-	/** Video resolution */
-	resolution: z$1.string().optional()
+	avgResponseTimeMs: z$1.number(),
+	p95ResponseTimeMs: z$1.number(),
+	avgUtilization: z$1.number(),
+	utilizationRange: z$1.object({
+		low: z$1.number(),
+		high: z$1.number()
+	}),
+	sampleCount: z$1.number(),
+	windowDays: z$1.number()
 });
+z$1.enum([
+	"no_action",
+	"monitor",
+	"investigate_soon",
+	"immediate_action"
+]);
 /**
-* Schema for video generation API request body
+* Request schema for POST /api/chat - the simplified external chat surface.
+*
+* Shared between the Next.js API handler (apps/client/pages/api/chat.ts, which
+* validates req.body with this exact object) and the OpenAPI registry
+* (b4m-core/common/src/openapi), so the published contract cannot drift from
+* what the handler actually accepts. The model is optional here and resolved
+* server-side from admin settings when omitted.
+*
+* Public-API rule: no `.catch()` / top-level `.transform()`. Both silently mutate
+* caller input (fail-quiet) and are opaque to zod-to-openapi. `historyCount` uses
+* `.default()` (fail loud on a bad value); unknown tool ids are filtered in the
+* handler (see filterKnownTools) instead of by a schema transform. This keeps the
+* schema fully OpenAPI-representable with no doc projection needed.
 */
-const GenerateVideoRequestBodySchema = z$1.object({
-	prompt: z$1.string().min(1),
-	model: z$1.enum(VideoModels).optional().prefault("sora-2"),
-	seconds: z$1.union([
-		z$1.literal(4),
-		z$1.literal(8),
-		z$1.literal(12)
-	]).optional().prefault(4),
-	size: z$1.enum([
-		"720x1280",
-		"1280x720",
-		"1024x1792",
-		"1792x1024"
-	]).optional().prefault(VIDEO_SIZE_CONSTRAINTS.SORA.defaultSize),
-	sessionId: z$1.string().optional(),
-	sessionName: z$1.string().optional(),
-	questId: z$1.string().optional(),
-	projectId: z$1.string().optional(),
-	organizationId: z$1.string().nullable().optional(),
-	callbackUrl: GenerationCallbackUrlSchema.optional()
+const SimplifiedChatRequestSchema = z$1.object({
+	sessionId: z$1.string().nullish(),
+	newConversation: z$1.boolean().optional(),
+	message: z$1.string(),
+	organizationId: z$1.string().optional(),
+	model: z$1.string().optional(),
+	temperature: z$1.number().min(0).max(2).optional(),
+	max_tokens: z$1.number().positive().optional(),
+	maxTokens: z$1.number().positive().optional(),
+	maxOutputTokens: z$1.number().positive().optional(),
+	stream: z$1.boolean().prefault(false),
+	historyCount: z$1.number().positive().default(10),
+	fileIds: z$1.array(z$1.string()).prefault([]),
+	wait: z$1.boolean().prefault(false),
+	enableTools: z$1.boolean().prefault(false),
+	toolMode: z$1.enum(["fast", "smart"]).optional(),
+	tools: z$1.array(z$1.string()).optional().describe("Explicit tool ids to offer the model. A non-empty array enables tools on its own; no companion `toolMode` or `enableTools` is required. Merged with the auto-selected set under `toolMode: \"smart\"`, and ignored under `toolMode: \"fast\"`. This list ADDS to what is offered rather than restricting it - the server still offers tools of its own (for example knowledge retrieval when the session has reachable documents). Unrecognized ids are dropped rather than rejecting the request; the response reports the surviving set as `tools.effectiveTools` and the ids that are not tools in this deployment as `tools.unrecognizedTools`, since no endpoint enumerates the valid ids. `unrecognizedTools` is reported under every `toolMode` - it describes the ids, not what the mode did with them - so under `toolMode: \"fast\"` an id can be absent from `effectiveTools` (the mode discarded it) without being unrecognized. Both reported lists are deduplicated, and `unrecognizedTools` names at most the first 10 distinct ids."),
+	enableQuestMaster: z$1.boolean().optional(),
+	enableMementos: z$1.boolean().optional(),
+	enableAgents: z$1.boolean().optional(),
+	promptMode: z$1.enum([
+		"raw",
+		"grounded",
+		"surface"
+	]).optional(),
+	skip_auto_offers: z$1.boolean().optional().describe("Suppress tools the server would otherwise attach on its own for this session (the knowledge-base search offer, in-app view navigation, blog drafting/editing/publishing, skill invocation, and every tool from a connected MCP server). Native tools you request explicitly in `tools` are unaffected, but an MCP server tool cannot be named through this field, so with this flag set a caller with an MCP server connected sees none of its tools regardless of `tools`. One system-prompt block goes with them: withholding in-app view navigation also drops the view-registry block that exists only to describe it. No other prompt content changes. This does not switch off retrieval: a session with forced knowledge retrieval still retrieves, and documents already attached to the session are still placed in the prompt directly. Any promptMode suppresses these too, so false has no effect alongside one."),
+	includePromptDetails: z$1.boolean().optional(),
+	includeSystemPrompt: z$1.boolean().optional(),
+	systemPrompt: z$1.string().max(PROMPT_TEXT_MAX).optional().describe("System-prompt text for this request only, never persisted. Rendered as a defended block appended after every other system-prompt source, with prose instructing the model to defer to organization, session and data-lake guidance. Over the cap is a 422, never truncated.")
 });
-GenerateVideoRequestBodySchema.extend({ sessionId: z$1.string() });
 /**
-* Canonical agent execution status tuple. Shared between the database model
-* (`AgentExecutionModel`), the client store (`useAgentExecutionStore`), and
-* wire schemas (`ChildExecutionSnapshotSchema`, etc.) so the value space can't
-* drift across boundaries, and so the Zod schemas can type `status` as
-* `z.enum(AGENT_EXECUTION_STATUSES)` instead of `z.string()`.
+* Async ACK returned on the default (wait:false) path of POST /api/chat. The
+* `type`/`errorCode` pair below is the same classifier the `wait: true` body and
+* the polled quest (`GET /api/v1/quests/{id}`) carry, so it is modelled once here.
+* The rest of the `wait: true` body is ChatWaitResponseSchema below. The
+* handler assembles the ack body inline (apps/client/pages/api/chat.ts), so
+* this schema MUST stay in sync with that `res.json({...})` shape.
 */
-const AGENT_EXECUTION_STATUSES = [
-	"pending",
-	"running",
-	"continuing",
-	"awaiting_permission",
-	"awaiting_subagent",
-	"awaiting_dag_children",
-	"paused",
-	"completed",
-	"failed",
-	"aborted"
-];
+const ChatAckSchema = z$1.object({
+	id: z$1.string(),
+	status: z$1.string(),
+	message_received: z$1.boolean(),
+	timestamp: z$1.string(),
+	model: z$1.string(),
+	sessionId: z$1.string().optional(),
+	message: z$1.string().optional(),
+	type: z$1.enum(CHAT_HISTORY_ITEM_TYPES).optional(),
+	errorCode: z$1.enum(QUEST_ERROR_CODES).optional(),
+	tools: z$1.object({
+		toolMode: z$1.enum(["fast", "smart"]).optional(),
+		autoSelectedTools: z$1.array(z$1.string()).optional(),
+		effectiveTools: z$1.array(z$1.string()),
+		unrecognizedTools: z$1.array(z$1.string()).optional()
+	}).optional(),
+	tracking_info: z$1.object({
+		quest_id: z$1.string(),
+		check_status_url: z$1.string(),
+		poll_url: z$1.string().optional()
+	})
+});
+const ToolPayloadSchema = z$1.object({
+	type: z$1.string(),
+	payload: z$1.unknown()
+});
 /**
-* Why a session summarization happened, stamped on `ISession.summaryTrigger`. Single source for the
-* places that each used to spell this list out: the Session zod schema (schemas/actions.ts), the
-* entity type (types/entities/SessionTypes.ts), the Mongoose path (packages/database SessionModel)
-* and the session.summarize event payload (apps/client server/utils/eventBus.ts). They drifted -
-* the Mongoose enum said 'milestone'/'growth' for two values nothing produces - and a drift there
-* is invisible on the update path, because BaseModel's findOneAndUpdate writes without
-* runValidators.
+* The completed-turn body POST /api/chat returns with `wait: true`. Like the ACK it is
+* assembled inline in apps/client/pages/api/chat.ts and MUST stay in sync with that
+* `res.json({...})` shape.
+*/
+const ChatWaitResponseSchema = ChatAckSchema.extend({
+	type: z$1.enum(CHAT_HISTORY_ITEM_TYPES),
+	response: z$1.string().nullable(),
+	responses: z$1.array(z$1.string()),
+	toolPayloads: z$1.array(ToolPayloadSchema),
+	createdAt: z$1.union([z$1.string().datetime(), z$1.date()]),
+	promptDetails: z$1.array(SystemPromptDetailSchema).optional(),
+	promptText: z$1.string().optional(),
+	performance: z$1.object({
+		total_ms: z$1.number(),
+		phases: z$1.record(z$1.string(), z$1.number()),
+		pipeline_phases: z$1.record(z$1.string(), z$1.number()).optional()
+	})
+});
+/**
+* The quest a `wait: false` caller polls at `GET /api/v1/quests/{id}` - the outcome
+* of the turn the ACK above only acknowledged.
 *
-* Those surfaces now name PERSISTED_SESSION_SUMMARY_TRIGGERS below, not the full union: a stored
-* field may only carry a reason a run HAPPENED. 'throttling' is the exception that forced the
-* split - shouldSummarizeSession (b4m-core/services ChatCompletionFeatures) returns it as the
-* reason it DECLINED to summarize, so it describes no run and belongs to a decision, not a
-* document. It is typed by SummarizationDecision there, not by the session field.
+* Deliberately the OUTCOME SUBSET, not the whole quest: it models only what decides
+* whether the turn succeeded. The full response of that endpoint is
+* QuestPollResponseSchema (schemas/quest.ts), which extends this schema and is
+* the 200 body of the `getQuest` contract.
 *
-* 'manual' means someone asked for one notebook's summary. The admin sweep
-* (apps/workers/src/events/spider.ts) summarizes every un-summarized notebook of the admin who ran it in one
-* billed pass, so it stamps 'spider' instead: without that, one deliberate click and a whole sweep
-* are indistinguishable when someone investigates unexpected summarization spend.
-*/
-/**
-* The triggers a document may actually carry - every reason a summarization HAPPENED. The event
-* payload and createSessionParametersSchema both name this list rather than the full union below,
-* so 'throttling' cannot be published, cannot be stored, and therefore cannot reach a copy path.
-* Add a new reason-it-happened here, not to SESSION_SUMMARY_TRIGGERS, and every one of those
-* boundaries picks it up.
+* A failed turn is still `status: 'done'` with the failure text in `reply`, so
+* `reply` alone cannot tell an answer from a failure - `type` and `errorCode` are
+* what separate a CLASSIFIED failure. A run that died with partial content is not
+* one of those: `terminalRecoveryFor` (questTimeoutRecovery.ts) keeps the surviving
+* content, so it polls back as `type: 'message'`. What marks it unfinished is
+* `promptMeta.finishReason` - RUN_TIMED_OUT_FINISH_REASON or
+* RUN_ABANDONED_FINISH_REASON (utils/stopReasons.ts) - plus a notice appended to
+* the reply.
 */
-const PERSISTED_SESSION_SUMMARY_TRIGGERS = [
-	"manual",
-	"project",
-	"earlyMilestone",
-	"contentGrowth",
-	"spider"
-];
-[...PERSISTED_SESSION_SUMMARY_TRIGGERS];
+const PolledFallbackInfoSchema = FallbackInfoSchema.pick({
+	primaryModel: true,
+	primaryModelName: true,
+	fallbackModel: true,
+	fallbackModelName: true,
+	reason: true
+});
+const ChatQuestPollResultSchema = z$1.object({
+	id: z$1.string(),
+	status: z$1.enum([
+		"pending",
+		"stopped",
+		"running",
+		"done"
+	]).optional(),
+	type: z$1.enum(CHAT_HISTORY_ITEM_TYPES).optional(),
+	errorCode: z$1.enum(QUEST_ERROR_CODES).optional(),
+	reply: z$1.string().nullable().optional(),
+	replies: z$1.array(z$1.string()).optional(),
+	fallbackInfo: PolledFallbackInfoSchema.optional()
+});
 /**
-* Operator allow-list for the client-authored Mongo filter carried on a `subscribe_query` frame.
-*
-* The WS data-subscribe handler forwards that filter to `Model.find` and persists it on the
-* QuerySubscription the separate subscriber-fanout service replays, so an unconstrained
-* `$`-prefixed key lets any authenticated socket ask the database to run server-side JavaScript
-* (`$where`, `$expr` + `$function`) or an unbounded `$regex` - either of which pins a pooled
-* connection for as long as it runs.
+* Reusable JSON error envelope (plain; the OpenAPI layer annotates it).
 *
-* Live subscriptions only ever need equality, membership and range matching, so anything outside
-* this list is REFUSED rather than stripped: silently dropping an operator would quietly widen the
-* document set the caller ends up subscribed to.
+* Must stay in sync with the published `ErrorResponse` component
+* (../openapi/schemas.ts) - `openapi/errorEnvelopeParity.test.ts` pins the two
+* together, and apps/client's errorHandler test uses this shape as the stand-in for
+* the component, which is generate-time only and cannot be imported at runtime.
+*/
+const ApiErrorSchema = z$1.object({
+	error: z$1.string(),
+	request_id: z$1.string().optional(),
+	/**
+	* Deprecated, sunset 2026-12-01. The `name` of whatever was thrown - our own error
+	* classes usually, a library/driver class name on an unhandled 500 - added to every
+	* body by apps/client's errorHandler. Documented here so the runtime and the spec
+	* agree while it is still served; do not build on it. See CONVENTIONS.md section 1.
+	*/
+	name: z$1.string().optional()
+});
+/**
+* Error envelope for the 422 a credit-metered endpoint returns for two unrelated
+* reasons: "your body is invalid" and "you cannot afford this". `errorCode` is
+* what separates them - `insufficientCreditsError` (see insufficientCredits.ts)
+* tags the credit case, so its absence means an ordinary validation failure.
 *
-* The scan is deliberately structural rather than a model of Mongo's grammar - it flags any
-* `$`-prefixed key anywhere in the tree that isn't allow-listed. It can therefore accept an
-* allow-listed operator in a position Mongo would treat as a literal sub-document field name, but
-* that is inert; what matters is that no disallowed operator can reach the driver.
+* Derived from `ApiErrorSchema` rather than re-declaring `error`/`request_id`:
+* both of those 422s are *thrown*, so errorHandler serves the body and adds
+* `name`. Extending is what keeps that documented here (and what drops it again
+* on the sunset date) instead of leaving a bespoke copy behind to drift.
 */
-/** Combinators whose operands are themselves filters. */
-const SUBSCRIPTION_FILTER_LOGICAL_OPERATORS = [
-	"$and",
-	"$or",
-	"$nor",
-	"$not"
-];
-/** Value-level operators a subscription filter may use. */
-const SUBSCRIPTION_FILTER_VALUE_OPERATORS = [
-	"$eq",
-	"$ne",
-	"$gt",
-	"$gte",
-	"$lt",
-	"$lte",
-	"$in",
-	"$nin",
-	"$exists",
-	"$type",
-	"$size",
-	"$all",
-	"$elemMatch"
-];
-const ALLOWED_OPERATORS = /* @__PURE__ */ new Set([...SUBSCRIPTION_FILTER_LOGICAL_OPERATORS, ...SUBSCRIPTION_FILTER_VALUE_OPERATORS]);
+const InsufficientCreditsErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal("insufficient_credits").optional() });
+/** 503 when this deployment has no usable key for a provider the request needs (data-lake search, voice). */
+const ProviderNotConfiguredErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal("provider_not_configured").optional() });
 /**
-* Returns a dotted path for every part of `filter` a subscription may not send: a disallowed
-* `$`-prefixed key, a `RegExp` operand, or nesting past {@link SUBSCRIPTION_FILTER_MAX_DEPTH}.
-* An empty array means the filter is safe to forward to the database.
+* Error envelope for the 403 apiKeyAuth (apps/client/server/middlewares/apiKeyAuth.ts)
+* throws when an API key lacks a route's scopes. It names what the ROUTE requires,
+* never what the key holds, so a caller knows which scope to mint a key with.
+* Values are `ApiKeyScope` strings; plain `z.string()` because the enum's module is
+* not import-safe for the install-only openapi job (see the import note above).
 */
-function findDisallowedSubscriptionFilterKeys(filter) {
-	const violations = [];
-	const walk = (node, path, depth) => {
-		if (depth > 12) {
-			violations.push(`${path} (nested deeper than 12)`);
-			return;
-		}
-		if (node instanceof RegExp) {
-			violations.push(`${path} (regular expression)`);
-			return;
-		}
-		if (Array.isArray(node)) {
-			node.forEach((entry, i) => walk(entry, `${path}[${i}]`, depth + 1));
-			return;
-		}
-		if (node === null || typeof node !== "object") return;
-		for (const [key, value] of Object.entries(node)) {
-			const childPath = path ? `${path}.${key}` : key;
-			if (key.startsWith("$") && !ALLOWED_OPERATORS.has(key)) {
-				violations.push(childPath);
-				continue;
-			}
-			walk(value, childPath, depth + 1);
-		}
-	};
-	walk(filter, "", 0);
-	return violations;
-}
-const DataSubscribeRequestAction = z$1.object({
-	action: z$1.literal("subscribe_query"),
-	accessToken: z$1.string().optional(),
-	subscriptionId: z$1.string(),
-	collectionName: z$1.string(),
-	query: z$1.looseObject({}).superRefine((filter, ctx) => {
-		for (const key of findDisallowedSubscriptionFilterKeys(filter)) ctx.addIssue({
-			code: "custom",
-			message: `Disallowed subscription filter: ${key}`
-		});
-	}),
-	fields: z$1.record(z$1.string(), z$1.union([z$1.boolean(), z$1.number()])),
-	fetchInitialData: z$1.boolean().prefault(true).optional(),
-	clientId: z$1.string().optional()
-});
-const DataUnsubscribeRequestAction = z$1.object({
-	action: z$1.literal("unsubscribe_query"),
-	accessToken: z$1.string().optional(),
-	subscriptionId: z$1.string()
+const ScopeForbiddenErrorSchema = ApiErrorSchema.extend({
+	required_scopes: z$1.array(z$1.string()).optional().describe("API key scopes this route accepts. Holding any one of them satisfies it."),
+	also_required_scopes: z$1.array(z$1.string()).optional().describe("API key scopes this route also requires. Every one must be held, on top of `required_scopes`.")
 });
-const HeartbeatAction = z$1.object({ action: z$1.literal("heartbeat") });
-const VoiceSessionSendTranscriptAction = z$1.object({
-	action: z$1.literal("voice_session_send_transcript"),
-	userId: z$1.string(),
-	sessionId: z$1.string(),
-	transcript: z$1.string(),
-	type: z$1.enum(["input", "response"]),
-	conversationItemId: z$1.string(),
-	timestamp: z$1.coerce.date().optional()
+const supportedVoiceGenerationVendor = z.enum(["openai", "elevenlabs"]);
+const DEFAULT_TTS_PROVIDER = "openai";
+const voiceOutputFormatSchema = z.enum([
+	"mp3",
+	"wav",
+	"opus",
+	"aac",
+	"flac",
+	"pcm"
+]);
+const TTS_ABSOLUTE_MAX_INPUT_CHARS = Math.max(...Object.values({
+	openai: 4096,
+	elevenlabs: 1e4
+}));
+const ttsLanguageCodeSchema = z.string().regex(/^[a-z]{2}$/, "languageCode must be a lowercase ISO 639-1 code, e.g. \"en\" or \"ja\"");
+const ttsRequestSchema = z.object({
+	text: z.string().min(1).max(TTS_ABSOLUTE_MAX_INPUT_CHARS),
+	provider: supportedVoiceGenerationVendor.optional(),
+	model: z.string().optional(),
+	voice: z.string().optional(),
+	format: voiceOutputFormatSchema.optional(),
+	stability: z.number().min(0).max(1).optional(),
+	similarityBoost: z.number().min(0).max(1).optional(),
+	languageCode: ttsLanguageCodeSchema.optional(),
+	...generatedAudioRequestFields
 });
 /**
-* CLI Completion request over WebSocket (bypasses CloudFront 20s timeout)
+* JSON body of `POST /api/ai/tts` for `encoding: 'base64'`: the shared generated-audio
+* body plus the TTS fields. `provider`/`fallbackFrom` appear only when the requested
+* provider was unavailable and another one stood in.
 */
-const CliCompletionRequestAction = z$1.object({
-	action: z$1.literal("cli_completion_request"),
-	accessToken: z$1.string(),
-	requestId: z$1.uuid(),
-	model: z$1.string(),
-	messages: z$1.array(z$1.object({
-		role: z$1.enum([
-			"user",
-			"assistant",
-			"system"
-		]),
-		content: z$1.union([z$1.string(), z$1.array(z$1.unknown())]),
-		cache: z$1.boolean().optional()
-	})),
-	options: z$1.object({
-		temperature: z$1.number().optional(),
-		maxTokens: z$1.number().optional(),
-		stream: z$1.boolean().optional(),
-		tools: z$1.array(z$1.unknown()).optional(),
-		response_format: z$1.discriminatedUnion("type", [z$1.object({ type: z$1.literal("text") }), z$1.object({
-			type: z$1.literal("json_schema"),
-			json_schema: z$1.object({
-				name: z$1.string(),
-				description: z$1.string().optional(),
-				schema: z$1.record(z$1.string(), z$1.any()),
-				strict: z$1.boolean().optional().default(true)
-			})
-		})]).optional()
-	}).optional()
+const ttsBase64ResponseSchema = extendGeneratedAudioResponseSchema({
+	format: voiceOutputFormatSchema,
+	/** The provider that actually produced the audio, present only on a fallback. */
+	provider: supportedVoiceGenerationVendor.optional(),
+	/** The originally requested provider that could not serve the request. */
+	fallbackFrom: supportedVoiceGenerationVendor.optional()
 });
 /**
-* CLI Tool execution request over WebSocket
-*/
-const CliToolRequestAction = z$1.object({
-	action: z$1.literal("cli_tool_request"),
-	accessToken: z$1.string(),
-	requestId: z$1.uuid(),
-	toolName: z$1.string(),
-	input: z$1.record(z$1.string(), z$1.unknown())
-});
-const VoiceSessionEndedAction = z$1.object({
-	action: z$1.literal("voice_session_ended"),
-	userId: z$1.string(),
-	model: z$1.string(),
-	sessionId: z$1.string(),
-	usage: z$1.object({
-		audioInputTokens: z$1.number().min(0),
-		audioCachedInputTokens: z$1.number().min(0),
-		audioOutputTokens: z$1.number().min(0),
-		textInputTokens: z$1.number().min(0),
-		textCachedInputTokens: z$1.number().min(0),
-		textOutputTokens: z$1.number().min(0)
-	})
-});
-const DataSubscriptionUpdateAction = z$1.object({
-	action: z$1.literal("data_update"),
-	subscriptionId: z$1.string(),
-	collectionName: z$1.string(),
-	operationType: z$1.string(),
-	clientId: z$1.string().optional(),
-	data: z$1.looseObject({
-		_id: z$1.string(),
-		id: z$1.string()
-	})
+* Error body for `POST /api/ai/tts`, shared by the 401, 422, 429 and 502; the 413
+* has a shape of its own (`ttsResponseTooLargeSchema`). `errorCode` is present only
+* on the conditions that carry a classifier; an ordinary validation 422 has none.
+*
+* Extends `ApiErrorSchema` because what decides whether a body carries the fields
+* errorHandler adds - `request_id`, and `name` until its 2026-12-01 sunset - is
+* whether the body was THROWN, not which status it wears, and three of these four
+* statuses are reachable both ways:
+*
+* - 401: thrown by apiKeyAuth on a rejected key; written by `auth` when no
+*   credential was presented at all, and by the handler for
+*   `provider_not_configured` and for an upstream credential rejection
+*   (`provider_rejected`, from an upstream 401 or 403).
+* - 422: thrown by request validation and by the char-limit / format guards;
+*   written by the handler for `insufficient_credits` and for every upstream 4xx
+*   that is neither a credential rejection nor a 429.
+* - 429: thrown by apiKeyRateLimit; written by the handler on an upstream 429.
+* - 502: only ever written.
+*
+* So those two are genuinely optional here, and splitting this per status would be
+* wrong for the first three. The 502 does advertise both without ever sending them;
+* that is not worth a fourth error schema on one route, and `request_id` missing from
+* this handler's written bodies is a gap in the handler rather than something to
+* enshrine in a schema.
+*/
+const ttsErrorResponseSchema = ApiErrorSchema.extend({
+	provider: supportedVoiceGenerationVendor.optional(),
+	errorCode: z.enum([
+		"insufficient_credits",
+		"provider_not_configured",
+		"provider_rejected"
+	]).optional()
 });
 /**
-* Server -> Client: a `subscribe_query` frame was refused (the operator allow-list, `fields`
-* validation) or its initial fetch was aborted (`maxTimeMS`). Neither failure throws an
-* UnauthorizedError/JsonWebTokenError, so withWebSocketContext's status code never reaches the
-* client as a frame - this is the only signal the caller gets that the subscription never took.
+* TTS 413 body: `generatedAudioTooLargeSchema` plus the provider. The handler never
+* sends the `saved`/`fabFileId`/`fileUrl` fields (a saved copy's `fileUrl` is now
+* served as the oversized-audio URL); they stay so a client still parses a server
+* that predates the offload.
+*
+* Not derived from `ApiErrorSchema`: every 413 on this route is written, never
+* thrown, so `name` is genuinely absent rather than optional - a stronger claim than
+* `ttsErrorResponseSchema` can make for its own statuses, see the note there (a
+* provider 413 is folded onto a 422 by documentedStatusForUpstream4xx). An oversized
+* *request* body is another 413 that never reaches this schema at all - Next's own
+* body parser answers it in plain text before the router runs.
 */
-const DataSubscribeErrorAction = z$1.object({
-	action: z$1.literal("data_subscribe_error"),
-	subscriptionId: z$1.string(),
-	error: z$1.string()
-});
-const LLMStatusUpdateAction = z$1.object({
-	action: z$1.literal("llm_status_update"),
-	status: z$1.string().nullable(),
-	clientId: z$1.string().optional()
-});
-const InboxRefetchAction = z$1.object({
-	action: z$1.literal("inbox_refetch"),
-	status: z$1.string(),
-	clientId: z$1.string().optional()
-});
-const InvitesRefetchAction = z$1.object({
-	action: z$1.literal("invites_refetch"),
-	status: z$1.string(),
-	clientId: z$1.string().optional()
-});
-const UpdateCurrentUserAction = z$1.object({
-	action: z$1.literal("update_current_user"),
-	clientId: z$1.string().optional(),
-	user: z$1.object({
-		id: z$1.string(),
-		username: z$1.string(),
-		name: z$1.string(),
-		email: z$1.string(),
-		groups: z$1.array(z$1.string()),
-		isAdmin: z$1.boolean(),
-		storageLimit: z$1.number(),
-		currentStorageSize: z$1.number()
-	}).partial()
-});
-const ResearchTaskStatusUpdateAction = z$1.object({
-	action: z$1.literal("research_task_status_update"),
-	taskId: z$1.string(),
-	status: z$1.string(),
-	currentStep: z$1.string(),
-	progress: z$1.number()
-});
-const NotebookCurationProgressUpdateAction = z$1.object({
-	action: z$1.literal("notebook_curation_progress"),
-	curationJobId: z$1.string(),
-	sessionId: z$1.string(),
-	status: z$1.enum([
-		"pending",
-		"loading",
-		"extracting",
-		"generating",
-		"storing",
-		"completed",
-		"failed"
-	]),
-	stage: z$1.enum([
-		"loading",
-		"extracting",
-		"generating",
-		"storing"
-	]).optional(),
-	percentage: z$1.number(),
-	message: z$1.string().optional(),
-	messagesProcessed: z$1.number().optional(),
-	totalMessages: z$1.number().optional(),
-	artifactsFound: z$1.number().optional(),
-	curatedFileId: z$1.string().optional(),
-	errorMessage: z$1.string().optional(),
-	tokensDeducted: z$1.number().optional(),
-	clientId: z$1.string().optional()
-});
-const QuestExportProgressAction = z$1.object({
-	action: z$1.literal("quest_export_progress"),
-	exportJobId: z$1.string(),
-	planId: z$1.string(),
-	status: z$1.enum([
-		"assembling",
-		"downloading_images",
-		"summarizing",
-		"zipping",
-		"completed",
-		"failed"
-	]),
-	progress: z$1.number(),
-	detail: z$1.string().optional(),
-	downloadUrl: z$1.string().optional(),
-	filename: z$1.string().optional(),
-	errorMessage: z$1.string().optional(),
-	droppedQuestCount: z$1.number().optional(),
-	clientId: z$1.string().optional()
-});
-const OrgFeedbackSummaryProgressAction = z$1.object({
-	action: z$1.literal("org_feedback_summary_progress"),
-	summaryJobId: z$1.string(),
-	organizationId: z$1.string(),
-	status: z$1.enum([
-		"processing",
-		"completed",
-		"failed"
-	]),
-	progress: z$1.number(),
-	errorMessage: z$1.string().optional(),
-	clientId: z$1.string().optional()
+const ttsResponseTooLargeSchema = generatedAudioTooLargeSchema.extend({
+	provider: supportedVoiceGenerationVendor,
+	saved: z.literal(true).optional(),
+	fabFileId: z.string().optional(),
+	fileUrl: z.string().optional()
 });
-const SpiderProgressUpdateAction = z$1.object({
-	action: z$1.literal("spider_progress"),
-	spiderJobId: z$1.string(),
-	notebooksProcessed: z$1.number(),
-	totalNotebooks: z$1.number(),
-	currentOperation: z$1.string(),
-	currentNotebookId: z$1.string().optional(),
-	currentNotebookName: z$1.string().optional(),
-	dryRun: z$1.boolean().optional(),
-	clientId: z$1.string().optional()
+const VIDEO_MODES = ["text_to_video", "image_to_video"];
+const ASPECT_RATIOS = [
+	"16:9",
+	"9:16",
+	"1:1",
+	"4:3",
+	"3:4",
+	"3:2",
+	"2:3",
+	"21:9"
+];
+const RESOLUTION_TIERS = [
+	"360p",
+	"480p",
+	"720p",
+	"1080p",
+	"4k"
+];
+const VideoModelIdSchema = z$1.enum([
+	"test-video",
+	"gemini-omni-1.1-flash",
+	"grok-imagine-video-1.5",
+	"veo-3.1-fast-generate-preview"
+]);
+z$1.object({
+	model: VideoModelIdSchema,
+	mode: z$1.enum(VIDEO_MODES),
+	prompt: z$1.string().trim().min(1).max(4e3),
+	durationSeconds: z$1.number().positive(),
+	aspectRatio: z$1.enum(ASPECT_RATIOS),
+	resolution: z$1.enum(RESOLUTION_TIERS),
+	inputImageFileId: z$1.string().min(1).optional(),
+	inputGeneratedImageKey: z$1.string().min(1).optional(),
+	audio: z$1.boolean().optional()
+});
+const VIDEO_VALIDATION_ERROR_CODES = [
+	"unsupported_duration",
+	"unsupported_aspect_ratio",
+	"unsupported_resolution",
+	"unsupported_mode",
+	"missing_input_image",
+	"unexpected_input_image",
+	"unsupported_audio_option"
+];
+/**
+* Supported sound-effects generation vendors. Currently only ElevenLabs.
+* New vendors are added here and in the `aiSoundService` factory.
+*/
+const supportedSoundGenerationVendor = z.enum(["elevenlabs"]);
+/**
+* Inbound request body for `POST /api/ai/sound-effects`.
+*
+* `durationSeconds` and `promptInfluence` bounds mirror the ElevenLabs
+* sound-generation limits (0.5-30s for the default eleven_text_to_sound_v2
+* model, prompt influence 0-1). `format` is the provider-specific output
+* encoding token (e.g. `mp3_44100_128`).
+*/
+const soundEffectsRequestSchema = z.object({
+	provider: supportedSoundGenerationVendor.default("elevenlabs"),
+	text: z.string().min(1).max(1e3),
+	durationSeconds: z.number().min(.5).max(30).optional(),
+	promptInfluence: z.number().min(0).max(1).optional(),
+	format: z.string().optional(),
+	...generatedAudioRequestFields
 });
-const SpiderCompleteAction = z$1.object({
-	action: z$1.literal("spider_complete"),
-	spiderJobId: z$1.string(),
-	totalNotebooks: z$1.number(),
-	stats: z$1.object({
-		messageCountsUpdated: z$1.number(),
-		notebooksCurated: z$1.number(),
-		notebooksSummarized: z$1.number(),
-		notebooksTagged: z$1.number(),
-		messagesEmbedded: z$1.number().optional(),
-		errors: z$1.number().optional(),
-		skipped: z$1.number().optional()
-	}),
-	dryRun: z$1.boolean().optional(),
-	clientId: z$1.string().optional()
+/**
+* Supported background-music generation vendors. Currently only ElevenLabs.
+* New vendors are added here and in the `aiMusicService` factory.
+*/
+const supportedMusicGenerationVendor = z.enum(["elevenlabs"]);
+/**
+* Supported ElevenLabs music models. Scoped to `music_v1` for now; `music_v2` is
+* a deliberate follow-up (see the parent issue). Adding it here is the only
+* change the request surface needs to accept it.
+*/
+const supportedMusicModel = z.enum(["music_v1"]);
+/**
+* Inbound request body for `POST /api/ai/music`.
+*
+* `lengthMs` upper bound is capped below the ElevenLabs Music API ceiling to fit
+* the serving function's time budget (see MAX_MUSIC_LENGTH_MS). It carries a
+* default rather than being optional so the billed
+* length is always known up front (the reserve/settle path needs a deterministic
+* cost before generation) and the route can force that exact length on the
+* provider. `format` is the provider-specific output encoding token (e.g.
+* `mp3_44100_128`).
+*/
+const musicRequestSchema = z.object({
+	provider: supportedMusicGenerationVendor.default("elevenlabs"),
+	prompt: z.string().min(1).max(2e3),
+	lengthMs: z.number().int().min(3e3).max(12e4).default(1e4),
+	forceInstrumental: z.boolean().optional(),
+	modelId: supportedMusicModel.default("music_v1"),
+	format: z.string().optional(),
+	...generatedAudioRequestFields
 });
-const SpiderErrorAction = z$1.object({
-	action: z$1.literal("spider_error"),
-	spiderJobId: z$1.string(),
-	error: z$1.string(),
-	notebooksProcessed: z$1.number().optional(),
-	totalNotebooks: z$1.number(),
-	dryRun: z$1.boolean().optional(),
+/**
+* Canonical agent execution status tuple. Shared between the database model
+* (`AgentExecutionModel`), the client store (`useAgentExecutionStore`), and
+* wire schemas (`ChildExecutionSnapshotSchema`, etc.) so the value space can't
+* drift across boundaries, and so the Zod schemas can type `status` as
+* `z.enum(AGENT_EXECUTION_STATUSES)` instead of `z.string()`.
+*/
+const AGENT_EXECUTION_STATUSES = [
+	"pending",
+	"running",
+	"continuing",
+	"awaiting_permission",
+	"awaiting_subagent",
+	"awaiting_dag_children",
+	"paused",
+	"completed",
+	"failed",
+	"aborted"
+];
+/**
+* Why a session summarization happened, stamped on `ISession.summaryTrigger`. Single source for the
+* places that each used to spell this list out: the Session zod schema (schemas/actions.ts), the
+* entity type (types/entities/SessionTypes.ts), the Mongoose path (packages/database SessionModel)
+* and the session.summarize event payload (apps/client server/utils/eventBus.ts). They drifted -
+* the Mongoose enum said 'milestone'/'growth' for two values nothing produces - and a drift there
+* is invisible on the update path, because BaseModel's findOneAndUpdate writes without
+* runValidators.
+*
+* Those surfaces now name PERSISTED_SESSION_SUMMARY_TRIGGERS below, not the full union: a stored
+* field may only carry a reason a run HAPPENED. 'throttling' is the exception that forced the
+* split - shouldSummarizeSession (b4m-core/services ChatCompletionFeatures) returns it as the
+* reason it DECLINED to summarize, so it describes no run and belongs to a decision, not a
+* document. It is typed by SummarizationDecision there, not by the session field.
+*
+* 'manual' means someone asked for one notebook's summary. The admin sweep
+* (apps/workers/src/events/spider.ts) summarizes every un-summarized notebook of the admin who ran it in one
+* billed pass, so it stamps 'spider' instead: without that, one deliberate click and a whole sweep
+* are indistinguishable when someone investigates unexpected summarization spend.
+*/
+/**
+* The triggers a document may actually carry - every reason a summarization HAPPENED. The event
+* payload and createSessionParametersSchema both name this list rather than the full union below,
+* so 'throttling' cannot be published, cannot be stored, and therefore cannot reach a copy path.
+* Add a new reason-it-happened here, not to SESSION_SUMMARY_TRIGGERS, and every one of those
+* boundaries picks it up.
+*/
+const PERSISTED_SESSION_SUMMARY_TRIGGERS = [
+	"manual",
+	"project",
+	"earlyMilestone",
+	"contentGrowth",
+	"spider"
+];
+[...PERSISTED_SESSION_SUMMARY_TRIGGERS];
+/**
+* Operator allow-list for the client-authored Mongo filter carried on a `subscribe_query` frame.
+*
+* The WS data-subscribe handler forwards that filter to `Model.find` and persists it on the
+* QuerySubscription the separate subscriber-fanout service replays, so an unconstrained
+* `$`-prefixed key lets any authenticated socket ask the database to run server-side JavaScript
+* (`$where`, `$expr` + `$function`) or an unbounded `$regex` - either of which pins a pooled
+* connection for as long as it runs.
+*
+* Live subscriptions only ever need equality, membership and range matching, so anything outside
+* this list is REFUSED rather than stripped: silently dropping an operator would quietly widen the
+* document set the caller ends up subscribed to.
+*
+* The scan is deliberately structural rather than a model of Mongo's grammar - it flags any
+* `$`-prefixed key anywhere in the tree that isn't allow-listed. It can therefore accept an
+* allow-listed operator in a position Mongo would treat as a literal sub-document field name, but
+* that is inert; what matters is that no disallowed operator can reach the driver.
+*/
+/** Combinators whose operands are themselves filters. */
+const SUBSCRIPTION_FILTER_LOGICAL_OPERATORS = [
+	"$and",
+	"$or",
+	"$nor",
+	"$not"
+];
+/** Value-level operators a subscription filter may use. */
+const SUBSCRIPTION_FILTER_VALUE_OPERATORS = [
+	"$eq",
+	"$ne",
+	"$gt",
+	"$gte",
+	"$lt",
+	"$lte",
+	"$in",
+	"$nin",
+	"$exists",
+	"$type",
+	"$size",
+	"$all",
+	"$elemMatch"
+];
+const ALLOWED_OPERATORS = /* @__PURE__ */ new Set([...SUBSCRIPTION_FILTER_LOGICAL_OPERATORS, ...SUBSCRIPTION_FILTER_VALUE_OPERATORS]);
+/**
+* Returns a dotted path for every part of `filter` a subscription may not send: a disallowed
+* `$`-prefixed key, a `RegExp` operand, or nesting past {@link SUBSCRIPTION_FILTER_MAX_DEPTH}.
+* An empty array means the filter is safe to forward to the database.
+*/
+function findDisallowedSubscriptionFilterKeys(filter) {
+	const violations = [];
+	const walk = (node, path, depth) => {
+		if (depth > 12) {
+			violations.push(`${path} (nested deeper than 12)`);
+			return;
+		}
+		if (node instanceof RegExp) {
+			violations.push(`${path} (regular expression)`);
+			return;
+		}
+		if (Array.isArray(node)) {
+			node.forEach((entry, i) => walk(entry, `${path}[${i}]`, depth + 1));
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		for (const [key, value] of Object.entries(node)) {
+			const childPath = path ? `${path}.${key}` : key;
+			if (key.startsWith("$") && !ALLOWED_OPERATORS.has(key)) {
+				violations.push(childPath);
+				continue;
+			}
+			walk(value, childPath, depth + 1);
+		}
+	};
+	walk(filter, "", 0);
+	return violations;
+}
+const DataSubscribeRequestAction = z$1.object({
+	action: z$1.literal("subscribe_query"),
+	accessToken: z$1.string().optional(),
+	subscriptionId: z$1.string(),
+	collectionName: z$1.string(),
+	query: z$1.looseObject({}).superRefine((filter, ctx) => {
+		for (const key of findDisallowedSubscriptionFilterKeys(filter)) ctx.addIssue({
+			code: "custom",
+			message: `Disallowed subscription filter: ${key}`
+		});
+	}),
+	fields: z$1.record(z$1.string(), z$1.union([z$1.boolean(), z$1.number()])),
+	fetchInitialData: z$1.boolean().prefault(true).optional(),
 	clientId: z$1.string().optional()
 });
-const PiHistoryProgressAction = z$1.object({
-	action: z$1.literal("pi_history_progress"),
-	analysisJobId: z$1.string(),
-	repoFullName: z$1.string(),
-	phase: z$1.enum([
-		"fetching_issues",
-		"fetching_prs",
-		"calculating_stats",
-		"building_profiles",
-		"extracting_keywords",
-		"saving"
-	]),
-	percentage: z$1.number(),
-	message: z$1.string(),
-	itemsProcessed: z$1.number().optional(),
-	totalItems: z$1.number().optional(),
-	clientId: z$1.string().optional()
+const DataUnsubscribeRequestAction = z$1.object({
+	action: z$1.literal("unsubscribe_query"),
+	accessToken: z$1.string().optional(),
+	subscriptionId: z$1.string()
 });
-const PiHistoryCompleteAction = z$1.object({
-	action: z$1.literal("pi_history_complete"),
-	analysisJobId: z$1.string(),
-	repoFullName: z$1.string(),
-	stats: z$1.object({
-		closedIssues: z$1.number(),
-		mergedPRs: z$1.number(),
-		contributors: z$1.number()
-	}),
-	clientId: z$1.string().optional()
+const HeartbeatAction = z$1.object({ action: z$1.literal("heartbeat") });
+const VoiceSessionSendTranscriptAction = z$1.object({
+	action: z$1.literal("voice_session_send_transcript"),
+	userId: z$1.string(),
+	sessionId: z$1.string(),
+	transcript: z$1.string(),
+	type: z$1.enum(["input", "response"]),
+	conversationItemId: z$1.string(),
+	timestamp: z$1.coerce.date().optional()
 });
-const PiHistoryErrorAction = z$1.object({
-	action: z$1.literal("pi_history_error"),
-	analysisJobId: z$1.string(),
-	repoFullName: z$1.string(),
-	error: z$1.string(),
-	phase: z$1.string(),
-	clientId: z$1.string().optional()
+/**
+* CLI Completion request over WebSocket (bypasses CloudFront 20s timeout)
+*/
+const CliCompletionRequestAction = z$1.object({
+	action: z$1.literal("cli_completion_request"),
+	accessToken: z$1.string(),
+	requestId: z$1.uuid(),
+	model: z$1.string(),
+	messages: z$1.array(z$1.object({
+		role: z$1.enum([
+			"user",
+			"assistant",
+			"system"
+		]),
+		content: z$1.union([z$1.string(), z$1.array(z$1.unknown())]),
+		cache: z$1.boolean().optional()
+	})),
+	options: z$1.object({
+		temperature: z$1.number().optional(),
+		maxTokens: z$1.number().optional(),
+		stream: z$1.boolean().optional(),
+		tools: z$1.array(z$1.unknown()).optional(),
+		response_format: z$1.discriminatedUnion("type", [z$1.object({ type: z$1.literal("text") }), z$1.object({
+			type: z$1.literal("json_schema"),
+			json_schema: z$1.object({
+				name: z$1.string(),
+				description: z$1.string().optional(),
+				schema: z$1.record(z$1.string(), z$1.any()),
+				strict: z$1.boolean().optional().default(true)
+			})
+		})]).optional()
+	}).optional()
 });
-const StreamedChatCompletionAction = z$1.object({
-	action: z$1.literal("streamed_chat_completion"),
+/**
+* CLI Tool execution request over WebSocket
+*/
+const CliToolRequestAction = z$1.object({
+	action: z$1.literal("cli_tool_request"),
+	accessToken: z$1.string(),
+	requestId: z$1.uuid(),
+	toolName: z$1.string(),
+	input: z$1.record(z$1.string(), z$1.unknown())
+});
+const VoiceSessionEndedAction = z$1.object({
+	action: z$1.literal("voice_session_ended"),
+	userId: z$1.string(),
+	model: z$1.string(),
+	sessionId: z$1.string(),
+	usage: z$1.object({
+		audioInputTokens: z$1.number().min(0),
+		audioCachedInputTokens: z$1.number().min(0),
+		audioOutputTokens: z$1.number().min(0),
+		textInputTokens: z$1.number().min(0),
+		textCachedInputTokens: z$1.number().min(0),
+		textOutputTokens: z$1.number().min(0)
+	})
+});
+const DataSubscriptionUpdateAction = z$1.object({
+	action: z$1.literal("data_update"),
+	subscriptionId: z$1.string(),
+	collectionName: z$1.string(),
+	operationType: z$1.string(),
 	clientId: z$1.string().optional(),
-	statusMessage: z$1.string().nullable().optional(),
+	data: z$1.looseObject({
+		_id: z$1.string(),
+		id: z$1.string()
+	})
+});
+/**
+* Server -> Client: a `subscribe_query` frame was refused (the operator allow-list, `fields`
+* validation) or its initial fetch was aborted (`maxTimeMS`). Neither failure throws an
+* UnauthorizedError/JsonWebTokenError, so withWebSocketContext's status code never reaches the
+* client as a frame - this is the only signal the caller gets that the subscription never took.
+*/
+const DataSubscribeErrorAction = z$1.object({
+	action: z$1.literal("data_subscribe_error"),
+	subscriptionId: z$1.string(),
+	error: z$1.string()
+});
+const LLMStatusUpdateAction = z$1.object({
+	action: z$1.literal("llm_status_update"),
+	status: z$1.string().nullable(),
+	clientId: z$1.string().optional()
+});
+const InboxRefetchAction = z$1.object({
+	action: z$1.literal("inbox_refetch"),
+	status: z$1.string(),
+	clientId: z$1.string().optional()
+});
+const InvitesRefetchAction = z$1.object({
+	action: z$1.literal("invites_refetch"),
+	status: z$1.string(),
+	clientId: z$1.string().optional()
+});
+const UpdateCurrentUserAction = z$1.object({
+	action: z$1.literal("update_current_user"),
+	clientId: z$1.string().optional(),
+	user: z$1.object({
+		id: z$1.string(),
+		username: z$1.string(),
+		name: z$1.string(),
+		email: z$1.string(),
+		groups: z$1.array(z$1.string()),
+		isAdmin: z$1.boolean(),
+		storageLimit: z$1.number(),
+		currentStorageSize: z$1.number()
+	}).partial()
+});
+const ResearchTaskStatusUpdateAction = z$1.object({
+	action: z$1.literal("research_task_status_update"),
+	taskId: z$1.string(),
+	status: z$1.string(),
+	currentStep: z$1.string(),
+	progress: z$1.number()
+});
+const NotebookCurationProgressUpdateAction = z$1.object({
+	action: z$1.literal("notebook_curation_progress"),
+	curationJobId: z$1.string(),
+	sessionId: z$1.string(),
+	status: z$1.enum([
+		"pending",
+		"loading",
+		"extracting",
+		"generating",
+		"storing",
+		"completed",
+		"failed"
+	]),
+	stage: z$1.enum([
+		"loading",
+		"extracting",
+		"generating",
+		"storing"
+	]).optional(),
+	percentage: z$1.number(),
+	message: z$1.string().optional(),
+	messagesProcessed: z$1.number().optional(),
+	totalMessages: z$1.number().optional(),
+	artifactsFound: z$1.number().optional(),
+	curatedFileId: z$1.string().optional(),
+	errorMessage: z$1.string().optional(),
+	tokensDeducted: z$1.number().optional(),
+	clientId: z$1.string().optional()
+});
+const QuestExportProgressAction = z$1.object({
+	action: z$1.literal("quest_export_progress"),
+	exportJobId: z$1.string(),
+	planId: z$1.string(),
+	status: z$1.enum([
+		"assembling",
+		"downloading_images",
+		"summarizing",
+		"zipping",
+		"completed",
+		"failed"
+	]),
+	progress: z$1.number(),
+	detail: z$1.string().optional(),
+	downloadUrl: z$1.string().optional(),
+	filename: z$1.string().optional(),
+	errorMessage: z$1.string().optional(),
+	droppedQuestCount: z$1.number().optional(),
+	clientId: z$1.string().optional()
+});
+const OrgFeedbackSummaryProgressAction = z$1.object({
+	action: z$1.literal("org_feedback_summary_progress"),
+	summaryJobId: z$1.string(),
+	organizationId: z$1.string(),
+	status: z$1.enum([
+		"processing",
+		"completed",
+		"failed"
+	]),
+	progress: z$1.number(),
+	errorMessage: z$1.string().optional(),
+	clientId: z$1.string().optional()
+});
+const SpiderProgressUpdateAction = z$1.object({
+	action: z$1.literal("spider_progress"),
+	spiderJobId: z$1.string(),
+	notebooksProcessed: z$1.number(),
+	totalNotebooks: z$1.number(),
+	currentOperation: z$1.string(),
+	currentNotebookId: z$1.string().optional(),
+	currentNotebookName: z$1.string().optional(),
+	dryRun: z$1.boolean().optional(),
+	clientId: z$1.string().optional()
+});
+const SpiderCompleteAction = z$1.object({
+	action: z$1.literal("spider_complete"),
+	spiderJobId: z$1.string(),
+	totalNotebooks: z$1.number(),
+	stats: z$1.object({
+		messageCountsUpdated: z$1.number(),
+		notebooksCurated: z$1.number(),
+		notebooksSummarized: z$1.number(),
+		notebooksTagged: z$1.number(),
+		messagesEmbedded: z$1.number().optional(),
+		errors: z$1.number().optional(),
+		skipped: z$1.number().optional()
+	}),
+	dryRun: z$1.boolean().optional(),
+	clientId: z$1.string().optional()
+});
+const SpiderErrorAction = z$1.object({
+	action: z$1.literal("spider_error"),
+	spiderJobId: z$1.string(),
+	error: z$1.string(),
+	notebooksProcessed: z$1.number().optional(),
+	totalNotebooks: z$1.number(),
+	dryRun: z$1.boolean().optional(),
+	clientId: z$1.string().optional()
+});
+const PiHistoryProgressAction = z$1.object({
+	action: z$1.literal("pi_history_progress"),
+	analysisJobId: z$1.string(),
+	repoFullName: z$1.string(),
+	phase: z$1.enum([
+		"fetching_issues",
+		"fetching_prs",
+		"calculating_stats",
+		"building_profiles",
+		"extracting_keywords",
+		"saving"
+	]),
+	percentage: z$1.number(),
+	message: z$1.string(),
+	itemsProcessed: z$1.number().optional(),
+	totalItems: z$1.number().optional(),
+	clientId: z$1.string().optional()
+});
+const PiHistoryCompleteAction = z$1.object({
+	action: z$1.literal("pi_history_complete"),
+	analysisJobId: z$1.string(),
+	repoFullName: z$1.string(),
+	stats: z$1.object({
+		closedIssues: z$1.number(),
+		mergedPRs: z$1.number(),
+		contributors: z$1.number()
+	}),
+	clientId: z$1.string().optional()
+});
+const PiHistoryErrorAction = z$1.object({
+	action: z$1.literal("pi_history_error"),
+	analysisJobId: z$1.string(),
+	repoFullName: z$1.string(),
+	error: z$1.string(),
+	phase: z$1.string(),
+	clientId: z$1.string().optional()
+});
+const GenerationJobUpdatedAction = z$1.object({
+	action: z$1.literal("generation_job_updated"),
+	job: z$1.object({
+		id: z$1.string(),
+		kind: z$1.enum(GENERATION_JOB_KINDS),
+		state: z$1.enum(GENERATION_JOB_STATES),
+		progress: z$1.number().min(0).max(1).optional(),
+		error: z$1.object({
+			code: z$1.string(),
+			message: z$1.string()
+		}).optional(),
+		output: z$1.object({
+			fileId: z$1.string().optional(),
+			contentType: z$1.string(),
+			durationSeconds: z$1.number()
+		}).optional()
+	})
+});
+const StreamedChatCompletionAction = z$1.object({
+	action: z$1.literal("streamed_chat_completion"),
+	clientId: z$1.string().optional(),
+	statusMessage: z$1.string().nullable().optional(),
 	quest: z$1.object({
 		id: z$1.string(),
 		sessionId: z$1.string(),
@@ -3870,6 +4272,7 @@ const StreamedChatCompletionAction = z$1.object({
 		replies: z$1.array(z$1.string()).optional(),
 		images: z$1.array(z$1.string()).optional(),
 		videos: z$1.array(z$1.string()).optional(),
+		videoJobIds: z$1.array(z$1.string()).optional(),
 		type: z$1.enum(CHAT_HISTORY_ITEM_TYPES),
 		status: z$1.enum([
 			"stopped",
@@ -4415,6 +4818,7 @@ const HearthEventAction = z$1.object({
 		}),
 		machine: hearthMachineBodySchema.optional(),
 		refs: hearthEventRefsSchema.prefault({}),
+		origin: hearthEventOriginSchema.optional(),
 		createdAt: z$1.string()
 	})
 });
@@ -4893,6 +5297,7 @@ const ReconnectResultAction = z$1.object({
 	action: z$1.literal("reconnect_result"),
 	found: z$1.boolean(),
 	executionId: z$1.string().optional(),
+	sessionId: z$1.string().optional(),
 	status: z$1.enum(AGENT_EXECUTION_STATUSES).optional(),
 	pendingPermission: z$1.object({
 		toolName: z$1.string(),
@@ -4930,6 +5335,7 @@ const OptiHashiRunUpdatedAction = z$1.object({
 	status: z$1.string()
 });
 z$1.discriminatedUnion("action", [
+	GenerationJobUpdatedAction,
 	DataSubscriptionUpdateAction,
 	DataSubscribeErrorAction,
 	InboxRefetchAction,
@@ -5226,7 +5632,7 @@ const CompletionRequestSchema = z$1.object({
 		stream: z$1.boolean().optional(),
 		tools: z$1.array(CompletionToolSchema).optional(),
 		response_format: ResponseFormatSchema.optional(),
-		reasoningEffort: CompletionReasoningEffortSchema.optional()
+		reasoningEffort: CompletionReasoningEffortSchema.optional().describe("Reasoning effort hint. Honoured only by the OpenAI (reasoning models only, and not alongside tools on some of them), Kimi (K3 only) and DeepSeek adapters; Kimi and DeepSeek map it onto their own scale. Silently ignored by every other adapter (Anthropic, Gemini, Bedrock, xAI, Ollama) and by non-reasoning models, so sending it there is a no-op.")
 	}).optional()
 });
 const CompletionUsageSchema = z$1.object({
@@ -6269,6 +6675,24 @@ const DATA_LAKES = [{
 	}
 })()];
 new Set(DATA_LAKES.map((l) => l.id));
+/**
+* Query parameters for a cursor-paginated public list (CONVENTIONS.md section 8).
+*
+* `limit` is `z.coerce` because query values arrive as strings; registerContract publishes it as an
+* integer. A non-numeric, zero, or over-cap value is a 422, never silently clamped.
+*/
+const PaginationQuerySchema = z$1.object({
+	limit: z$1.coerce.number().int().min(1).max(100).default(25),
+	cursor: z$1.string().min(1).optional()
+});
+/**
+* The response envelope every cursor-paginated public list returns. `next_cursor` is required and
+* `null` on the last page, so a caller loops on it rather than on the page length.
+*/
+const paginatedResponseSchema = (itemSchema) => z$1.object({
+	data: z$1.array(itemSchema),
+	next_cursor: z$1.string().nullable()
+});
 const SessionTagSchema = z$1.object({
 	name: z$1.string(),
 	strength: z$1.number()
@@ -6286,14 +6710,15 @@ const SessionUpdateRequestSchema = z$1.object({
 	tags: z$1.array(SessionTagSchema).optional(),
 	lastUsedModel: z$1.string().min(1).nullish().describe("Pin a specific model id, or omit/send null to leave the current pin unchanged. Sending null does NOT clear it."),
 	forceKnowledgeRetrieval: z$1.boolean().optional(),
-	lakeScope: z$1.array(z$1.string()).nullable().optional().describe("The data lakes this session grounds on, as lake tags (the `datalakeTag` of each lake from GET /api/data-lakes). Send a list to ground only on those lakes, `[]` to ground on no lake at all, or `null` to clear the choice so retrieval falls back to every lake you can reach. Omit to leave the current choice unchanged. Tags naming a lake you cannot reach are ignored at retrieval time rather than rejected here. Narrowing the scope does not by itself turn retrieval on: pair it with `forceKnowledgeRetrieval: true` for a session that is not already grounded. Conversely `[]` leaves a grounded session nothing to retrieve from, so its forced retrieval is skipped rather than run against every lake."),
+	lakeScope: z$1.array(z$1.string()).nullable().optional().describe("The data lakes this session grounds on, as lake tags (the `datalake_tag` of each lake from GET /api/v1/data-lakes). Send a list to ground only on those lakes, `[]` to ground on no lake at all, or `null` to clear the choice so retrieval falls back to every lake you can reach. Omit to leave the current choice unchanged. Tags naming a lake you cannot reach are ignored at retrieval time rather than rejected here. Narrowing the scope does not by itself turn retrieval on: pair it with `forceKnowledgeRetrieval: true` for a session that is not already grounded. Conversely `[]` leaves a grounded session nothing to retrieve from, so its forced retrieval is skipped rather than run against every lake."),
+	includeLibraryFiles: z$1.boolean().optional().describe("Whether the session grounds on your own library (files you own, or that are shared with you or your groups) alongside its lakes. `false` confines retrieval to lake content, including when every lake is in scope; the session's attached files still reach the model and stay searchable by its knowledge-base tools. Omit to leave it unchanged; while never set, the library is excluded only when a lake was picked for the session (Data Lakes mode or an explicit lake scope), not when lake tags were derived from an attached file. While `forceKnowledgeRetrieval` is `false` the library is included regardless; the stored value applies again once it is turned back on."),
 	propagateToProjects: z$1.boolean().optional().describe("Defaults to true when omitted. When knowledgeIds grows, the newly-added file ids are also appended to every project that contains this session, granting every member of that project access to those files. This propagation is append-only and cannot be undone through the UI - pass false if newly-attached files should not be shared with the project.")
 });
 /** Path parameter for session-scoped endpoints, e.g. GET/PUT /api/sessions/{id}. */
 const SessionIdParamSchema = z$1.object({ id: z$1.string().min(1) });
 /**
-* Practical response subset for PUT /api/sessions/{id} - the fields a caller needs to
-* confirm an update took effect. ISession (types/entities/SessionTypes.ts) carries many
+* Practical response subset for GET and PUT /api/sessions/{id} - the fields a caller needs to
+* read a session or confirm an update took effect. ISession (types/entities/SessionTypes.ts) carries many
 * more server-internal fields not documented as public API surface here.
 */
 const SessionResponseSchema = z$1.object({
@@ -6307,10 +6732,22 @@ const SessionResponseSchema = z$1.object({
 	forceKnowledgeRetrieval: z$1.boolean().optional(),
 	retrievalTags: z$1.array(z$1.string()).optional(),
 	lakeScopeExplicit: z$1.boolean().optional().describe("True when `retrievalTags` is a deliberate choice, so an empty list means \"no lake\" rather than \"any\"."),
+	includeLibraryFiles: z$1.boolean().optional().describe("Whether the session grounds on your own library alongside its lakes. Absent when never set."),
 	lastUsedModel: z$1.string().nullish(),
 	firstCreated: z$1.date(),
 	lastUpdated: z$1.date()
 });
+/** Request body for POST /api/v1/sessions/{id}/clone. */
+const SessionCloneRequestSchema = z$1.preprocess((body) => body === "" ? void 0 : body, z$1.object({ targetSurface: z$1.string().nullable().optional() }).default({}));
+/** Query for GET /api/v1/sessions: the pagination convention plus flat filters. */
+const ListSessionsQuerySchema = PaginationQuerySchema.extend({
+	search: z$1.string().min(1).max(200).optional().describe("Case-insensitive substring match on the session name, its summary, or a tag name."),
+	surface: z$1.string().min(1).optional().describe("Lists only sessions of this product surface. When omitted, only sessions with no surface are listed."),
+	origin: z$1.enum(SESSION_ORIGIN_CHANNELS).optional().describe("Lists only sessions created through this channel. `web` also matches sessions with no recorded origin.")
+});
+const ListSessionsResponseSchema = paginatedResponseSchema(SessionResponseSchema);
+/** Response for DELETE /api/sessions/{id}. */
+const SessionDeleteResponseSchema = z$1.object({ newLastNotebookId: z$1.string().nullable().describe("The caller's most recently updated remaining session, which the product UI opens next; null when none remains.") });
 /**
 * Request schema for POST /api/v1/sessions. Declares every client-settable field of
 * createSessionParametersSchema (b4m-core/services/src/sessionService/create.ts), which stays the
@@ -6321,7 +6758,7 @@ const SessionResponseSchema = z$1.object({
 const CreateSessionRequestSchema = z$1.object({
 	name: z$1.string(),
 	projectId: z$1.string().optional().describe("Adds the new session to this project."),
-	dataLakeId: z$1.string().nullish().describe("Seeds retrieval defaults from this data lake."),
+	dataLakeId: z$1.string().nullish().describe("Seeds retrieval defaults from this data lake and turns on forced retrieval. Get ids from `GET /api/v1/data-lakes`."),
 	preauthorizedLakeIds: z$1.unknown().optional().describe("Data lakes the caller manages, armed for this session. At most 10; requires management rights."),
 	knowledgeIds: z$1.array(z$1.string()).optional(),
 	artifactIds: z$1.array(z$1.string()).optional(),
@@ -6335,6 +6772,7 @@ const CreateSessionRequestSchema = z$1.object({
 	forceKnowledgeRetrieval: z$1.boolean().optional(),
 	retrievalTags: z$1.array(z$1.string()).optional(),
 	lakeScopeExplicit: z$1.boolean().optional(),
+	includeLibraryFiles: z$1.boolean().optional(),
 	corpusGroundingMode: z$1.enum(DATA_LAKE_GROUNDING_MODES).optional().describe("Honored only when a lake is named by `retrievalTags` without `dataLakeId`."),
 	retrievalExcludeFilenameMarkers: z$1.array(z$1.string()).optional(),
 	retrievalVectorizedOnly: z$1.boolean().optional(),
@@ -6590,6 +7028,125 @@ const SupportedEmbeddingModelSchema = z$1.union([
 	z$1.enum(OllamaEmbeddingModel)
 ]);
 /**
+* Absolute floors for the FILE/RAG corpus that forced retrieval scans, by embedding space.
+*
+* Backs the `forcedRetrievalMinSimilarityPct` default. An operator's explicit value still wins -
+* this is what "unset" resolves to, and the reason the setting cannot simply carry one static
+* default any more.
+*
+* ada-002 at 75 is the value production shipped and the only one with a production-lake history
+* behind it. 3-small at 58 is MEASURED, on a live 520-file / 21,327-chunk capture of the
+* `opti-knowledge` lake (1536 dims, 2026-09-18), swept against 30 positives authored from that
+* corpus's own passages plus screened negatives - so recall and false-positive rate come out of ONE
+* corpus snapshot rather than two. The negatives were screened by reading the served chunk TEXT,
+* which reclassified 44 of 89 as answerable; the two right-hand columns are that screen's two
+* defensible readings, counting a PARTIAL answer as answerable or as a false positive.
+*
+*      floor   recall   positives emptied   FP (45 strict neg)   FP (61 partial-as-neg)
+*      85:49   100.0%           0                 71.1%                  78.7%
+*      85:53   100.0%           0                 64.4%                  73.8%
+*      85:55    96.7%           1                 60.0%                  68.9%
+*      85:58    93.3%           2                 42.2%                  52.5%
+*      85:61    86.7%           4                 22.2%                  36.1%
+*      85:64    76.7%           7                 13.3%                  19.7%
+*      85:75    20.0%          24                  0.0%                   0.0%
+*
+* WHY 58 RATHER THAN THE SEPARATION OPTIMUM, WHICH IS 61-64. Recall here is measured on positives
+* authored FROM corpus passages, so each supporting document is the easiest possible match for its
+* own question, and this recall is an UPPER BOUND on recall against a real user's phrasing. The
+* false-positive rate, measured on screened negatives, carries no matching optimism. An optimistic
+* recall beside an honest false-positive rate biases the optimum HIGH, so the shipped floor is the
+* low end of the bracket rather than its peak.
+*
+* WHAT THE PREVIOUS 49 GOT WRONG, and it was not the magnitude. 49 emptied ZERO positives - it was
+* not buying recall protection, it simply was not cutting - while 71-79% of screened true negatives
+* still got something served. The entire range 0-53 costs no recall on this corpus, which the
+* 35-file capture 49 was fitted to could not show: its decoy column rested on 6 negatives.
+*
+* Recall above is of the ACCEPTED set, so it answers "did the floor cut the supporting document",
+* which is the floor's own question, and is NOT a claim the model saw it - the char budget and the
+* 256-chunk candidate pool cap are separate narrowings downstream of this gate.
+*
+* ada-002's 75 applied in this space would be an outage in all but name: 20% recall, 24 of 30
+* positives emptied outright. That is the per-space case above restated as a measurement.
+*
+* 3-large is deliberately absent despite having a measured band (0.2104-0.5197): the choice between
+* it and 3-small is recorded as NOT SETTLED, and guessing a floor for a space nobody has run the
+* sweep against is what this module exists to stop. Voyage, Bedrock and the Ollama self-host
+* embedders are absent for the same reason - none has ever been measured, and the 0.75 they inherit
+* today was fitted to a model none of them is.
+*/
+const FORCED_RETRIEVAL_MIN_SIMILARITY_PCT_BY_SPACE = {
+	["text-embedding-ada-002"]: 75,
+	["text-embedding-3-small"]: 58
+};
+const ReleaseNoteCategorySchema = z$1.enum([
+	"new",
+	"improved",
+	"fixed"
+]);
+const ReleaseNoteItemSchema = z$1.object({
+	category: ReleaseNoteCategorySchema,
+	text: z$1.string().min(1),
+	importance: z$1.number().int().min(1).max(3),
+	sourcePrs: z$1.array(z$1.number().int().positive())
+});
+const ReleaseNoteStatusSchema = z$1.enum(["scheduled", "hidden"]);
+z$1.object({
+	releaseTag: z$1.string().min(1),
+	deployedSha: z$1.string().min(1),
+	deployedAt: z$1.coerce.date(),
+	headline: z$1.string(),
+	summary: z$1.string(),
+	items: z$1.array(ReleaseNoteItemSchema),
+	audience: z$1.literal("public"),
+	status: ReleaseNoteStatusSchema,
+	publishAt: z$1.coerce.date(),
+	editedAt: z$1.coerce.date().nullable(),
+	schemaVersion: z$1.number().int()
+});
+const ReleaseNotesJobPrSchema = z$1.object({
+	number: z$1.number().int().positive(),
+	title: z$1.string(),
+	labels: z$1.array(z$1.string()),
+	customerNote: z$1.string().optional(),
+	excerpt: z$1.string()
+});
+z$1.object({
+	kind: z$1.literal("release-notes"),
+	schemaVersion: z$1.number().int(),
+	releaseTag: z$1.string().min(1),
+	releaseUrl: z$1.string().regex(/^https:\/\/[^\s<>|]+$/),
+	previousTag: z$1.string().nullable(),
+	deployedSha: z$1.string().min(1),
+	deployedAt: z$1.coerce.date(),
+	prs: z$1.array(ReleaseNotesJobPrSchema)
+});
+const ReleaseNotesConfigSchema = z$1.object({
+	enabled: z$1.boolean().default(false),
+	modelId: z$1.string().default("gpt-4o-mini"),
+	embargoHours: z$1.number().min(0).max(168).default(12),
+	denylist: z$1.array(z$1.string()).default([]),
+	slackTeamId: z$1.string().optional(),
+	slackChannelId: z$1.string().optional()
+});
+/**
+* A release note as GET /api/v1/whats-new serves it. An allowlist: provenance (sourcePrs, deployedSha),
+* workflow state (status, editedAt) and storage fields never reach the public wire.
+*/
+const PublicReleaseNoteSchema = z$1.object({
+	id: z$1.string(),
+	release_tag: z$1.string(),
+	headline: z$1.string(),
+	summary: z$1.string(),
+	published_at: z$1.string(),
+	items: z$1.array(z$1.object({
+		category: ReleaseNoteCategorySchema,
+		text: z$1.string(),
+		importance: z$1.number().int().min(1).max(3)
+	}))
+});
+/**
 * The measured per-space floors, rendered for an admin-facing description (e.g. "75 for
 * text-embedding-ada-002, 58 for text-embedding-3-small").
 *
@@ -6597,10 +7154,7 @@ const SupportedEmbeddingModelSchema = z$1.union([
 * against a production lake, and a description that restates the table is a wrong number shown to
 * operators the moment it drifts, with nothing failing.
 */
-const forcedRetrievalFloorsBySpaceSummary = Object.entries({
-	["text-embedding-ada-002"]: 75,
-	["text-embedding-3-small"]: 58
-}).map(([space, pct]) => `${pct} for ${space}`).join(", ");
+const forcedRetrievalFloorsBySpaceSummary = Object.entries(FORCED_RETRIEVAL_MIN_SIMILARITY_PCT_BY_SPACE).map(([space, pct]) => `${pct} for ${space}`).join(", ");
 /**
 * Default text for the artifact-emission system prompt. Single source of truth used BOTH as the
 * `ArtifactEmissionPrompt` admin setting's default AND as the runtime fallback in
@@ -6827,6 +7381,7 @@ z$1.enum([
 	"EnforceLakeReadGrants",
 	"EnableDataLakeDrivePoll",
 	"EnableDataLakeGitHub",
+	"EnableDataLakeGitHubReconcile",
 	"EnforceLakeAdmission",
 	"EnforceLakeOriginOnIngest",
 	"EnableBriefcase",
@@ -6970,6 +7525,7 @@ z$1.enum([
 	"whatsNewAutomationEnabled",
 	"whatsNewConfig",
 	"whatsNewSyncConfig",
+	"releaseNotesConfig",
 	"enableAgentProactiveMessages",
 	"EnableEnhancedDateTime",
 	"EnableHistoricalFeatures",
@@ -7006,6 +7562,7 @@ z$1.enum([
 	"apiRateLimitProPerMin",
 	"overwatchRollupSync",
 	"orchestrationDefaults",
+	"videoGeneration",
 	"enableModelDiscovery",
 	"modelDiscoveryMode",
 	"modelDiscoveryAutoEnable",
@@ -7252,6 +7809,7 @@ const RapidReplySettingsSchema = z$1.object({
 		lastUpdated: /* @__PURE__ */ new Date()
 	})
 });
+const VideoGenerationSettingsSchema = z$1.object({ enabledModels: z$1.record(z$1.string(), z$1.boolean()).prefault({}) });
 /**
 * Canonical repository and branch the What's New generator reads from.
 *
@@ -8899,6 +9457,16 @@ const settingsMap = {
 		order: 96,
 		dependsOn: "EnableDataLakes"
 	}),
+	EnableDataLakeGitHubReconcile: makeBooleanSetting({
+		key: "EnableDataLakeGitHubReconcile",
+		name: "Data Lakes: GitHub scheduled reconcile",
+		defaultValue: false,
+		description: "Server-side gate for the scheduled check that compares each connected GitHub repository's default-branch HEAD with the last synced commit and queues a sync when they differ, so a missed or dropped push webhook still reaches the lake. Off by default - pushes still sync through the webhook and the Re-sync button; turn this on to also reconcile on a schedule.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 96,
+		dependsOn: "EnableDataLakeGitHub"
+	}),
 	EnforceLakeAdmission: makeBooleanSetting({
 		key: "EnforceLakeAdmission",
 		name: "Data Lakes: Enforce the admission contract",
@@ -10652,6 +11220,15 @@ const settingsMap = {
 		order: 102,
 		schema: WhatsNewSyncConfigSchema
 	}),
+	releaseNotesConfig: makeObjectSetting({
+		key: "releaseNotesConfig",
+		name: "Release Notes Configuration",
+		defaultValue: ReleaseNotesConfigSchema.parse({}),
+		description: "Customer-facing release notes generated from each production release. Disabled by default. Sets the model, the embargo before a note becomes visible, a denylist of terms that must never appear, and the Slack channel that gets the pre-publish preview.",
+		category: "Admin",
+		order: 103,
+		schema: ReleaseNotesConfigSchema
+	}),
 	enableAgentProactiveMessages: makeBooleanSetting({
 		key: "enableAgentProactiveMessages",
 		name: "Enable Agent Proactive Messages",
@@ -11004,6 +11581,16 @@ const settingsMap = {
 		order: 140,
 		schema: OrchestrationDefaultsSchema
 	}),
+	videoGeneration: makeObjectSetting({
+		key: "videoGeneration",
+		userReadable: true,
+		name: "Video Generation",
+		defaultValue: VideoGenerationSettingsSchema.parse({}),
+		description: "Enable or disable individual video generation models. Models without an override use their built-in default.",
+		category: "AI",
+		order: 145,
+		schema: VideoGenerationSettingsSchema
+	}),
 	enableModelDiscovery: makeBooleanSetting({
 		key: "enableModelDiscovery",
 		name: "Enable Model Discovery",
@@ -11103,352 +11690,37 @@ const settingsMap = {
 	}),
 	prReportEgressAllowlist: makeObjectSetting({
 		key: "prReportEgressAllowlist",
-		name: "PR Report Egress Allowlist",
-		defaultValue: { hosts: ["hooks.slack.com"] },
-		description: "Hosts the PR digest may post to, checked against the webhook URL its own hostname. FAILS CLOSED: an empty list rejects every send rather than degrading to allow-any, because the post body carries PR titles, author logins and the staffing implied by the role rosters. Slack incoming webhooks live at hooks.slack.com, so that is the default.",
-		category: "Slack",
-		order: 144,
-		schema: z$1.object({ hosts: z$1.array(z$1.string()).default([]) })
-	})
-};
-/**
-* Experimental setting keys the client reads but that intentionally live OUTSIDE
-* the `EXPERIMENTAL` group, so the group rule below can't pick them up:
-*  - `EnableContextTelemetry` - category `Admin` (rendered in the telemetry card),
-*    read as an experimental admin gate.
-*
-* Exported so the guard test asserts against this exact list rather than keeping a
-* second hand-copied array (which would re-introduce two-place drift).
-*/
-const experimentalNonGroupSettingKeys = ["EnableContextTelemetry"];
-(() => {
-	const groupKeys = Object.values(settingsMap).filter((s) => s.group === API_SERVICE_GROUPS.EXPERIMENTAL.id).map((s) => s.key);
-	return Array.from(/* @__PURE__ */ new Set([...groupKeys, ...experimentalNonGroupSettingKeys]));
-})();
-z$1.preprocess((val) => {
-	if (typeof val === "string") {
-		if (val.toLowerCase() === "true") return true;
-		if (val.toLowerCase() === "false") return false;
-	}
-	return val;
-}, z$1.boolean());
-const AnonymousSessionIdSchema = z$1.object({
-	/** SHA256(userId|orgId|dailySalt|date) - cannot be reversed */
-	hash: z$1.string(),
-	/** YYYY-MM-DD for salt lookup during deletion */
-	dateKey: z$1.string()
-});
-const SpanContextSchema = z$1.object({
-	/** gen_ai.trace_id */
-	traceId: z$1.string(),
-	/** gen_ai.span_id */
-	spanId: z$1.string()
-});
-const OperationSchema = z$1.object({
-	name: z$1.enum([
-		"chat_completion",
-		"agent_invoke",
-		"tool_execute"
-	]),
-	finishReason: z$1.enum([
-		"stop",
-		"length",
-		"tool_use",
-		"content_filter",
-		"error"
-	]).optional()
-});
-const ModelTelemetrySchema = z$1.object({
-	/** gen_ai.request.model */
-	modelId: z$1.string(),
-	provider: z$1.enum([
-		"anthropic",
-		"openai",
-		"bedrock",
-		"google",
-		"xai",
-		"ollama",
-		"moonshot",
-		"deepseek"
-	]),
-	fallbackUsed: z$1.boolean(),
-	fallbackReason: z$1.string().optional(),
-	originalModelId: z$1.string().optional(),
-	usedThinking: z$1.boolean(),
-	/** Extended thinking tokens */
-	thinkingTokensUsed: z$1.number().optional(),
-	usedTools: z$1.boolean()
-});
-const SystemPromptDetailSchema = z$1.object({
-	source: z$1.enum([
-		"hardcoded",
-		"admin",
-		"user",
-		"project",
-		"session",
-		"org",
-		"caller"
-	]),
-	/** e.g., "date_context", "tool_guidance" */
-	name: z$1.string(),
-	tokenCount: z$1.number(),
-	wasIncluded: z$1.boolean(),
-	exclusionReason: z$1.enum([
-		"duplicate",
-		"disabled",
-		"token_limit"
-	]).optional()
-});
-const SystemPromptsTelemetrySchema = z$1.object({
-	prompts: z$1.array(SystemPromptDetailSchema),
-	totalTokens: z$1.number(),
-	duplicateCount: z$1.number()
-});
-const FeatureContributionSchema = z$1.object({
-	/** e.g., "mementos", "quest_master", "deep_research" */
-	featureName: z$1.string(),
-	messagesAdded: z$1.number(),
-	tokenCount: z$1.number(),
-	executionTimeMs: z$1.number(),
-	success: z$1.boolean(),
-	errorType: z$1.string().optional()
-});
-const FeaturesTelemetrySchema = z$1.object({ contributions: z$1.array(FeatureContributionSchema) });
-const TokensBySourceSchema = z$1.object({
-	systemPrompts: z$1.number(),
-	conversationHistory: z$1.number(),
-	mementos: z$1.number(),
-	fabFiles: z$1.number(),
-	urlContent: z$1.number(),
-	toolSchemas: z$1.number(),
-	userPrompt: z$1.number(),
-	/**
-	* Lake-sourced content injected this turn (forced retrieval + the lake-memory hot card), split out
-	* of `systemPrompts`. Optional and absent means UNKNOWN, never zero - telemetry captured before
-	* this bucket existed has no value to report and must not be read as "no lake content". Mirrors
-	* PromptMetaTokensBySourceSchema in promptMeta.ts.
-	*/
-	lakeRetrieval: z$1.number().optional()
-});
-z$1.object({
-	/** gen_ai.usage.input_tokens */
-	inputTokens: z$1.number(),
-	/** gen_ai.usage.output_tokens */
-	outputTokens: z$1.number(),
-	contextWindowLimit: z$1.number(),
-	utilizationPercentage: z$1.number(),
-	reservedOutputTokens: z$1.number(),
-	overflowDetected: z$1.boolean(),
-	overflowAmount: z$1.number().optional(),
-	/** Token breakdown by source */
-	tokensBySource: TokensBySourceSchema
-});
-const CacheTelemetrySchema = z$1.object({
-	/** Anthropic cache_read_input_tokens */
-	cacheReadTokens: z$1.number(),
-	/** Anthropic cache_creation_input_tokens */
-	cacheWriteTokens: z$1.number(),
-	/** 0-100% */
-	cacheHitRate: z$1.number(),
-	costSavingsPercent: z$1.number().optional()
-});
-const CostsTelemetrySchema = z$1.object({
-	inputCostUsd: z$1.number(),
-	outputCostUsd: z$1.number(),
-	totalCostUsd: z$1.number(),
-	creditsUsed: z$1.number()
-});
-const TruncationTelemetrySchema = z$1.object({
-	wasTruncated: z$1.boolean(),
-	originalMessageCount: z$1.number(),
-	finalMessageCount: z$1.number(),
-	truncatedMessageCount: z$1.number(),
-	truncationMethod: z$1.enum([
-		"priority",
-		"token-budget",
-		"history-limit",
-		"context-overflow"
-	]).optional(),
-	truncationPercentage: z$1.number()
-});
-const ToolErrorCategorySchema = z$1.enum([
-	"timeout",
-	"rate_limit",
-	"auth_error",
-	"validation_error",
-	"network_error",
-	"internal_error"
-]);
-const ToolTelemetrySchema = z$1.object({
-	toolName: z$1.string(),
-	/** MCP vs native tool */
-	isMcpTool: z$1.boolean(),
-	/** For MCP tools */
-	mcpServerName: z$1.string().optional(),
-	invocationCount: z$1.number(),
-	successCount: z$1.number(),
-	failureCount: z$1.number(),
-	totalDurationMs: z$1.number(),
-	maxDurationMs: z$1.number(),
-	/** Retry tracking */
-	retryCount: z$1.number(),
-	/** Max 200 chars */
-	lastError: z$1.string().max(200).optional(),
-	errorCategories: z$1.array(ToolErrorCategorySchema).optional(),
-	/**
-	* Content-size metrics for tools that extract text (currently web_fetch, issue #452).
-	* Zero-PII integer counts, so kept at both basic and enhanced capture levels.
-	*/
-	/** Count of unique truncated citables at the tool's size cap (citables dedupe by url,
-	*  so same-url refetches within a completion collapse to one - see WebFetchContentTelemetry). */
-	truncatedInvocationCount: z$1.number().optional(),
-	/** Largest single extracted (post-cap) content length across invocations. */
-	maxExtractedChars: z$1.number().optional(),
-	/** Sum of extracted (post-cap) content length across invocations. */
-	totalExtractedChars: z$1.number().optional()
-});
-const SubagentTelemetrySchema = z$1.object({
-	agentName: z$1.string(),
-	delegationCount: z$1.number(),
-	successCount: z$1.number(),
-	failureCount: z$1.number(),
-	timeoutCount: z$1.number(),
-	totalDurationMs: z$1.number(),
-	totalTokensUsed: z$1.number(),
-	thoroughness: z$1.enum([
-		"quick",
-		"medium",
-		"very_thorough"
-	]).optional()
-});
-const LatencyPercentilesSchema = z$1.object({
-	p50Ms: z$1.number(),
-	p95Ms: z$1.number(),
-	p99Ms: z$1.number()
-});
-const PerformanceTelemetrySchema = z$1.object({
-	totalResponseTimeMs: z$1.number(),
-	firstTokenTimeMs: z$1.number().optional(),
-	contextRetrievalMs: z$1.number().optional(),
-	modelInferenceMs: z$1.number().optional(),
-	toolExecutionMs: z$1.number().optional(),
-	/** Latency percentiles for trend analysis */
-	latencyPercentiles: LatencyPercentilesSchema.optional()
-});
-const AnomalySeveritySchema = z$1.enum([
-	"critical",
-	"high",
-	"medium",
-	"low"
-]);
-const PrimaryAnomalySchema = z$1.enum([
-	"none",
-	"context_overflow",
-	"high_utilization",
-	"high_truncation",
-	"tool_failure",
-	"subagent_timeout",
-	"slow_response",
-	"multiple"
-]);
-const AnomaliesTelemetrySchema = z$1.object({
-	contextOverflow: z$1.boolean(),
-	/** >= 90% */
-	highUtilization: z$1.boolean(),
-	/** >= 95% */
-	criticalUtilization: z$1.boolean(),
-	/** >= 50% */
-	highTruncation: z$1.boolean(),
-	/** >= 75% */
-	criticalTruncation: z$1.boolean(),
-	/** >= 3 failures */
-	toolFailureSpike: z$1.boolean(),
-	/** > 30s */
-	toolTimeout: z$1.boolean(),
-	/** > 5min */
-	subagentTimeout: z$1.boolean(),
-	/** > 10s */
-	slowFirstToken: z$1.boolean(),
-	/** > 60s */
-	slowTotalResponse: z$1.boolean(),
-	/** 0-100 */
-	anomalyScore: z$1.number().min(0).max(100),
-	/** Severity mapping */
-	severity: AnomalySeveritySchema,
-	/** Pattern-based dedup key, e.g., "tool_failure_claude-3-5-sonnet_delegate-to-agent" */
-	dedupKey: z$1.string(),
-	primaryAnomaly: PrimaryAnomalySchema
-});
-const RequestMetadataSchema = z$1.object({
-	queryComplexity: z$1.enum([
-		"simple",
-		"contextual",
-		"complex"
-	]),
-	historyMessageCount: z$1.number(),
-	attachedFileCount: z$1.number(),
-	mementoCount: z$1.number(),
-	enabledFeatures: z$1.array(z$1.string())
-});
-const ContextWindowTelemetryWithOptionalSourceSchema = z$1.object({
-	/** gen_ai.usage.input_tokens */
-	inputTokens: z$1.number(),
-	/** gen_ai.usage.output_tokens */
-	outputTokens: z$1.number(),
-	contextWindowLimit: z$1.number(),
-	utilizationPercentage: z$1.number(),
-	reservedOutputTokens: z$1.number(),
-	overflowDetected: z$1.boolean(),
-	overflowAmount: z$1.number().optional(),
-	/** Token breakdown by source (enhanced only) */
-	tokensBySource: TokensBySourceSchema.optional()
-});
-const ContextTelemetrySchema = z$1.object({
-	schemaVersion: z$1.enum([
-		"1.0",
-		"1.1",
-		"1.2"
-	]),
-	/** ISO 8601 */
-	timestamp: z$1.string(),
-	/** Self-monitoring: time to capture telemetry */
-	captureOverheadMs: z$1.number(),
-	/** Capture level: basic or enhanced */
-	captureLevel: z$1.enum(["basic", "enhanced"]).optional(),
-	anonymousSessionId: AnonymousSessionIdSchema,
-	spanContext: SpanContextSchema.optional(),
-	operation: OperationSchema,
-	model: ModelTelemetrySchema,
-	systemPrompts: SystemPromptsTelemetrySchema.optional(),
-	features: FeaturesTelemetrySchema.optional(),
-	contextWindow: ContextWindowTelemetryWithOptionalSourceSchema,
-	cache: CacheTelemetrySchema.optional(),
-	costs: CostsTelemetrySchema,
-	truncation: TruncationTelemetrySchema.optional(),
-	tools: z$1.array(ToolTelemetrySchema).optional(),
-	subagents: z$1.array(SubagentTelemetrySchema).optional(),
-	performance: PerformanceTelemetrySchema,
-	anomalies: AnomaliesTelemetrySchema,
-	requestMetadata: RequestMetadataSchema.optional(),
-	captureErrors: z$1.array(z$1.string()).optional()
-});
-z$1.object({
-	avgResponseTimeMs: z$1.number(),
-	p95ResponseTimeMs: z$1.number(),
-	avgUtilization: z$1.number(),
-	utilizationRange: z$1.object({
-		low: z$1.number(),
-		high: z$1.number()
-	}),
-	sampleCount: z$1.number(),
-	windowDays: z$1.number()
-});
-z$1.enum([
-	"no_action",
-	"monitor",
-	"investigate_soon",
-	"immediate_action"
-]);
+		name: "PR Report Egress Allowlist",
+		defaultValue: { hosts: ["hooks.slack.com"] },
+		description: "Hosts the PR digest may post to, checked against the webhook URL its own hostname. FAILS CLOSED: an empty list rejects every send rather than degrading to allow-any, because the post body carries PR titles, author logins and the staffing implied by the role rosters. Slack incoming webhooks live at hooks.slack.com, so that is the default.",
+		category: "Slack",
+		order: 144,
+		schema: z$1.object({ hosts: z$1.array(z$1.string()).default([]) })
+	})
+};
+/**
+* Experimental setting keys the client reads but that intentionally live OUTSIDE
+* the `EXPERIMENTAL` group, so the group rule below can't pick them up:
+*  - `EnableContextTelemetry` - category `Admin` (rendered in the telemetry card),
+*    read as an experimental admin gate.
+*
+* Exported so the guard test asserts against this exact list rather than keeping a
+* second hand-copied array (which would re-introduce two-place drift).
+*/
+const experimentalNonGroupSettingKeys = ["EnableContextTelemetry"];
+(() => {
+	const groupKeys = Object.values(settingsMap).filter((s) => s.group === API_SERVICE_GROUPS.EXPERIMENTAL.id).map((s) => s.key);
+	return Array.from(/* @__PURE__ */ new Set([...groupKeys, ...experimentalNonGroupSettingKeys]));
+})();
+z$1.preprocess((val) => {
+	if (typeof val === "string") {
+		if (val.toLowerCase() === "true") return true;
+		if (val.toLowerCase() === "false") return false;
+	}
+	return val;
+}, z$1.boolean());
+/** Splits on the marker tokens, keeping them in the result so a scan can track nesting depth. */
+const THINK_TAG_TOKENS = /(<think>|<\/think>)/g;
 /**
 * Zero-width space spliced into a defanged marker. It is invisible wherever the text is
 * rendered, so escaping never changes what the reader sees - only what the parser matches.
@@ -11513,6 +11785,52 @@ function createThinkMarkerEscaper() {
 	};
 }
 /**
+* The visible remainder of one reply slot, with hidden reasoning removed.
+*
+* This is the rule the chat transcript renders by - `extractReplies` in
+* apps/client/shared/replyUtils.ts calls straight into it, so the two cannot drift.
+* Anything deriving "did the user see something yet" (latency metrics in particular) must
+* use this and not a looser non-empty check: a metric built on a looser rule reports text
+* as seen while the UI is still hiding it.
+*
+* Thinking is removed span by span rather than by keeping the tail after the last close
+* marker. A turn that answers, calls a tool and then thinks again reopens its thinking
+* inside the slot that already holds the partial answer (the provider restarts its
+* content-block indices - see appendStreamedChunk), so a tail rule would drop text the user
+* has already watched stream in. An unclosed trailing marker hides everything after it, so a
+* reopened block does not render its raw marker while it streams.
+*
+* Markers are tracked by nesting depth rather than matched pairwise, because reasoning text
+* is provider-authored and can itself contain marker-shaped substrings (a model reasoning
+* about the `<think>` protocol, say). A naive non-greedy pair match on
+* `<think>outer<think>inner</think>tail</think>answer` would strip only the innermost pair
+* and let `tail` leak into the transcript; walking depth instead keeps everything between an
+* open and its matching close hidden regardless of what markers appear in between, and an
+* unmatched trailing `</think>` (depth already zero) is treated as ordinary text rather than
+* closing something that was never open.
+*
+* Interior whitespace is preserved: callers concatenate slots with no separator, so trimming
+* every slot would weld a heading onto the table beneath it.
+*/
+function visibleReplyText(part) {
+	if (!part || !part.trim()) return "";
+	let depth = 0;
+	let visible = "";
+	for (const token of part.split(THINK_TAG_TOKENS)) if (token === "<think>") depth += 1;
+	else if (token === "</think>") if (depth > 0) depth -= 1;
+	else visible += token;
+	else if (depth === 0) visible += token;
+	return visible.trim() ? visible : "";
+}
+/**
+* Joins visible reply slots into one string. Each slot is a separate content block, so a slot that
+* does not end in a newline gets a paragraph break; with a bare join a closing code fence would
+* land on the same line as the next slot's text and never close.
+*/
+function joinReplySlots(parts) {
+	return parts.reduce((joined, part) => !joined || joined.endsWith("\n") ? joined + part : `${joined}\n\n${part}`, "");
+}
+/**
 * Reply choices: the discrete next steps a reply offers, rendered as numbered buttons.
 *
 * The model ends a reply with a fenced `choices` block; the server strips it with
@@ -11532,6 +11850,173 @@ const REPLY_CHOICES_INVALID_REASONS = [
 	"unterminated",
 	"think_unclosed"
 ];
+const ABSENT = { status: "absent" };
+const invalid = (reason) => ({
+	status: "invalid",
+	reason
+});
+const FENCE_OPEN_LINE = /^[ \t]*(`{3,}|~{3,})(.*)$/;
+const FENCE_CLOSE_LINE = /^[ \t]*(`{3,}|~{3,})[ \t]*$/;
+/**
+* Offset where a slot's visible answer starts: just past its last top-level `</think>`, 0 when it
+* has none, or null while a `<think>` is still open. Depth-tracked to match visibleReplyText in
+* ./streamVisibility.ts, so a marker-shaped string inside reasoning cannot end it early.
+*/
+function answerStart(reply) {
+	let depth = 0;
+	let start = 0;
+	for (const marker of reply.matchAll(/<\/?think>/g)) if (marker[0] === "<think>") depth += 1;
+	else if (depth > 0) {
+		depth -= 1;
+		if (depth === 0) start = (marker.index ?? 0) + marker[0].length;
+	}
+	return depth === 0 ? start : null;
+}
+/**
+* The last top-level ```choices fence in `text`, walking fences line by line (CommonMark rules: a
+* fence closes on a bare line of the same character at least as long), so a choices sample nested
+* inside a longer outer fence is content rather than a block.
+*/
+function findLastChoicesFence(text) {
+	let last = null;
+	let open = null;
+	let lineStart = 0;
+	while (lineStart <= text.length) {
+		const newline = text.indexOf("\n", lineStart);
+		const lineEnd = newline === -1 ? text.length : newline;
+		const line = text.slice(lineStart, lineEnd).replace(/\r$/, "");
+		if (!open) {
+			const match = line.match(FENCE_OPEN_LINE);
+			if (match && !(match[1][0] === "`" && match[2].includes("`"))) open = {
+				start: lineStart,
+				bodyStart: newline === -1 ? text.length : newline + 1,
+				marker: match[1],
+				isChoices: match[1] === "```" && match[2].trim().toLowerCase() === "choices"
+			};
+		} else {
+			const match = line.match(FENCE_CLOSE_LINE);
+			if (match && match[1][0] === open.marker[0] && match[1].length >= open.marker.length) {
+				if (open.isChoices) last = {
+					start: open.start,
+					end: lineEnd,
+					body: text.slice(open.bodyStart, lineStart)
+				};
+				open = null;
+			}
+		}
+		if (newline === -1) break;
+		lineStart = newline + 1;
+	}
+	if (open?.isChoices) last = {
+		start: open.start,
+		end: null,
+		body: text.slice(open.bodyStart)
+	};
+	return last;
+}
+/**
+* Strips the last ```choices block from a reply's visible answer and validates its options.
+*
+* Only the text after the slot's last `</think>` is eligible, so a block the model drafted while
+* reasoning is never read, and the reasoning prefix is returned byte-for-byte. Nothing visible is
+* deleted: prose the model added after the block's closing fence is kept, with only the block
+* removed. A block still open at the end (truncated, or streaming) is hidden through to the end.
+* Any invalid option rejects the whole block, because dropping one would shift the numbering away
+* from the prose.
+*/
+function extractChoicesBlock(reply) {
+	const unchanged = {
+		text: reply,
+		choices: null,
+		found: false,
+		outcome: ABSENT
+	};
+	const start = answerStart(reply);
+	if (start === null) return findLastChoicesFence(reply) ? {
+		...unchanged,
+		outcome: invalid("think_unclosed")
+	} : unchanged;
+	const answer = reply.slice(start);
+	const fence = findLastChoicesFence(answer);
+	if (!fence) return unchanged;
+	const before = answer.slice(0, fence.start).trimEnd();
+	const after = fence.end === null ? "" : answer.slice(fence.end).replace(/^(?:[ \t]*\r?\n)+/, "");
+	const kept = after.trim() ? before ? `${before}\n\n${after}` : after : before;
+	const parsed = fence.end === null ? { reason: "unterminated" } : parseChoiceOptions(fence.body);
+	const text = reply.slice(0, start) + kept;
+	return "options" in parsed ? {
+		text,
+		choices: parsed.options,
+		found: true,
+		outcome: { status: "parsed" }
+	} : {
+		text,
+		choices: null,
+		found: true,
+		outcome: invalid(parsed.reason)
+	};
+}
+/**
+* {@link extractChoicesBlock} over the reply slots. Every slot's block is stripped (a pre-tool-call
+* answer must not leak raw JSON), but only the last slot with visible text - the final answer -
+* supplies the options, so an abandoned earlier draft block can never offer buttons.
+*/
+function stripChoicesFromReplies(replies) {
+	const stripped = replies.map((slot) => visibleReplyText(slot) ? extractChoicesBlock(slot).text : slot);
+	let answerIndex = replies.length - 1;
+	while (answerIndex >= 0 && !visibleReplyText(replies[answerIndex])) answerIndex -= 1;
+	if (answerIndex < 0) return {
+		replies: stripped,
+		choices: null,
+		found: false,
+		outcome: ABSENT
+	};
+	const { choices, found, outcome } = extractChoicesBlock(replies[answerIndex]);
+	return {
+		replies: stripped,
+		choices,
+		found,
+		outcome
+	};
+}
+/**
+* The visible answer text of a quest, derived from its reply slots (choices stripped, `<think>`
+* hidden) with the scalar `reply` as the fallback when no slot has visible text. `joinSlots` joins
+* the visible slots: a bare join by default, matching the scalar the server persists, and a
+* paragraph join for a reader that renders the text as markdown (see streamVisibility.ts), since a
+* bare join glues a slot's closing code fence to the next slot's text.
+*/
+function questReplyText(quest, joinSlots = (slots) => slots.join("")) {
+	return joinSlots(stripChoicesFromReplies(quest.replies ?? []).replies.map((slot) => visibleReplyText(slot)).filter(Boolean)) || (quest.reply ?? null);
+}
+function parseChoiceOptions(body) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body.trim());
+	} catch {
+		return { reason: "json" };
+	}
+	const raw = Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.options) ? parsed.options : null;
+	if (!raw) return { reason: "shape" };
+	const options = [];
+	const seenLabels = /* @__PURE__ */ new Set();
+	for (const item of raw.slice(0, 4)) {
+		if (!item || typeof item !== "object") return { reason: "shape" };
+		const { label, description } = item;
+		if (typeof label !== "string" || typeof description !== "string") return { reason: "shape" };
+		const cleanLabel = label.trim();
+		const cleanDescription = description.trim();
+		if (!cleanLabel || cleanLabel.length > 40) return { reason: "label_length" };
+		if (!cleanDescription || cleanDescription.length > 300) return { reason: "description_length" };
+		if (seenLabels.has(cleanLabel)) return { reason: "duplicate_label" };
+		seenLabels.add(cleanLabel);
+		options.push({
+			label: cleanLabel,
+			description: cleanDescription
+		});
+	}
+	return options.length >= 2 ? { options } : { reason: "too_few" };
+}
 [
 	"# Reply choices",
 	"",
@@ -11749,6 +12234,7 @@ const PromptMetaPerformanceSchema = z$1.object({
 	firstTokenTime: z$1.number().optional(),
 	/** Elapsed ms until the first chunk of any kind, including a hidden thinking block. */
 	firstChunkTime: z$1.number().optional(),
+	/** @deprecated Read/write the quest-level clientFirstTokenTime instead. */
 	clientFirstTokenTime: z$1.number().optional(),
 	streamingPerformance: z$1.object({
 		chunkCount: z$1.number().optional(),
@@ -12273,11 +12759,10 @@ const RetrievalSummarySchema = z$1.object({
 	* an archived or quota-limited lake) adds an enum value here rather than a description.
 	*
 	* 'access' is the only reason today: the caller could see the lake exists (their org membership,
-	* the lake's public listing, or having created it; for a lake named by identity, also administering
-	* its org; an admin may see any lake) but they hold neither its own gate/entitlement nor an
-	* ownership or grant exception for it. A lake the caller could not see is never counted, so the
-	* count cannot confirm that a guessed lake tag exists. The account-wide count still bounds on
-	* membership only.
+	* the lake's public listing, or having created it; administering its org; an admin may see any
+	* lake) but they hold neither its own gate/entitlement nor an ownership or grant exception for
+	* it. A lake the caller could not see is never counted, so the count cannot confirm that a
+	* guessed lake tag exists.
 	*
 	* A session-preauthorized lake (unionPreauthorizedLakeAccess) that is ALSO gate-dropped from
 	* this account-wide count is corrected, not merely narrow: the seed's targeted measurement
@@ -12705,6 +13190,7 @@ const CORE_TOOL_SIDE_EFFECTS = {
 	edit_image: "external",
 	music_generation: "external",
 	audio_generation: "external",
+	video_generation: "external",
 	excel_generation: "external",
 	create_data_lake: "external",
 	save_content_to_data_lake: "external",
@@ -12745,15 +13231,13 @@ const EXTERNAL_REGISTRY_SIDE_EFFECTS = {
 	notebook_status: "none",
 	share_curated_file: "external",
 	notebook_new: "external",
-	confirm_pending_action: "external",
 	cancel_pending_action: "external",
 	mission_status: "none",
 	optihashi_decompose: "local",
 	optihashi_solve: "local",
 	send_slack_message: "external",
 	coordinate_task: "external",
-	code_execute: "external",
-	video_generation: "external"
+	code_execute: "external"
 };
 ({
 	...CORE_TOOL_SIDE_EFFECTS,
@@ -13369,24 +13853,6 @@ z.object({
 	})
 });
 /**
-* Query parameters for a cursor-paginated public list (CONVENTIONS.md section 8).
-*
-* `limit` is `z.coerce` because query values arrive as strings; registerContract publishes it as an
-* integer. A non-numeric, zero, or over-cap value is a 422, never silently clamped.
-*/
-const PaginationQuerySchema = z$1.object({
-	limit: z$1.coerce.number().int().min(1).max(100).default(25),
-	cursor: z$1.string().min(1).optional()
-});
-/**
-* The response envelope every cursor-paginated public list returns. `next_cursor` is required and
-* `null` on the last page, so a caller loops on it rather than on the page length.
-*/
-const paginatedResponseSchema = (itemSchema) => z$1.object({
-	data: z$1.array(itemSchema),
-	next_cursor: z$1.string().nullable()
-});
-/**
 * Wire schemas for the public `/api/v1/data-lakes/*` contracts
 * (api-contract/contracts/dataLakes.contract.ts). Deliberately narrower than the SPA's data-lake
 * payloads: a field published here can be added to later but never removed, so only what an
@@ -13399,6 +13865,11 @@ const DataLakeResourceSchema = z$1.object({
 	id: z$1.string(),
 	name: z$1.string(),
 	slug: z$1.string(),
+	/**
+	* The value to pass in a session's `lakeScope`. Not derivable from `slug` + `organization_id`: a
+	* lake moved into an org keeps the `datalake:<slug>` tag it was created with.
+	*/
+	datalake_tag: z$1.string(),
 	description: z$1.string().nullable(),
 	organization_id: z$1.string().nullable(),
 	is_public: z$1.boolean(),
@@ -13464,6 +13935,108 @@ const DataLakeSearchResponseSchema = z$1.object({
 		paused_files: z$1.number().int().nonnegative()
 	})
 });
+const ProjectResourceSchema = z$1.object({
+	id: z$1.string(),
+	name: z$1.string(),
+	description: z$1.string(),
+	session_ids: z$1.array(z$1.string()).describe("Sessions grouped in the project. Anyone the project is shared with can read them."),
+	file_ids: z$1.array(z$1.string()).describe("Files grouped in the project. Anyone the project is shared with can read them."),
+	created_at: z$1.string().nullable().describe("ISO 8601 timestamp."),
+	updated_at: z$1.string().nullable().describe("ISO 8601 timestamp.")
+});
+const ListProjectsResponseSchema = paginatedResponseSchema(ProjectResourceSchema);
+/**
+* `id` is a plain string on purpose: a malformed id must answer 404 (CONVENTIONS.md status table),
+* and a path-param schema failure would answer 422.
+*/
+const ProjectIdParamSchema = z$1.object({ id: z$1.string().min(1) });
+/**
+* Strict, so a camelCase `sessionIds`/`fileIds` (the SPA route's spelling) is a 422 rather than
+* silently dropped, which would create a project without the content the caller meant to attach.
+*/
+const CreateProjectRequestSchema = z$1.object({
+	name: z$1.string().min(1).describe("Unique among your live projects."),
+	description: z$1.string().min(1),
+	session_ids: z$1.array(z$1.string().min(1)).max(500).optional().describe("Sessions to group in the project. Each must be readable by the caller."),
+	file_ids: z$1.array(z$1.string().min(1)).max(500).optional().describe("Files to group in the project. Each must be readable by the caller.")
+}).strict();
+/**
+* The public projection of `ModelInfo` served by `GET /api/v1/models`.
+*
+* Deliberately narrower than `ModelInfo`: every field here is one an integrator can pin, so
+* internal catalog fields (`adapterFamily`, `dispatchProfile`, `rank`, `pricing`, `logoFile`)
+* stay off the wire. The legacy `GET /api/models` keeps serving the full internal type to the
+* SPA and CLI. Wire fields are snake_case (CONVENTIONS.md section 2).
+*/
+const PublicImageSizingSchema = z$1.discriminatedUnion("kind", [
+	z$1.object({
+		kind: z$1.literal("presets"),
+		presets: z$1.array(z$1.string()).describe("Accepted `size` values, as `WxH`."),
+		default_size: z$1.string()
+	}),
+	z$1.object({
+		kind: z$1.literal("constrained"),
+		presets: z$1.array(z$1.string()).describe("Suggested `size` values; any `WxH` meeting `constraints` is accepted."),
+		default_size: z$1.string(),
+		auto_size: z$1.string().describe("The `size` value that lets the provider choose."),
+		constraints: z$1.object({
+			max_edge: z$1.number().int(),
+			min_total_pixels: z$1.number().int(),
+			max_total_pixels: z$1.number().int(),
+			edge_multiple: z$1.number().int().describe("Both edges must be a multiple of this."),
+			max_aspect_ratio: z$1.number().describe("Longest edge divided by shortest edge.")
+		})
+	}),
+	z$1.object({
+		kind: z$1.literal("dimensions"),
+		presets: z$1.array(z$1.string()),
+		default_size: z$1.string(),
+		min_width: z$1.number().int(),
+		max_width: z$1.number().int(),
+		min_height: z$1.number().int(),
+		max_height: z$1.number().int(),
+		step: z$1.number().int().describe("`width` and `height` are rounded to the nearest multiple of this.")
+	}),
+	z$1.object({ kind: z$1.literal("aspect_ratio").describe("Takes an `aspect_ratio` such as `16:9`, not a `size`.") }),
+	z$1.object({
+		kind: z$1.literal("input_image").describe("Sized by the input image; takes no `size`."),
+		aspect_ratio: z$1.boolean().describe("Whether an `aspect_ratio` override is honoured.")
+	}),
+	z$1.object({ kind: z$1.literal("fixed").describe("The provider takes no size at all.") })
+]);
+const PublicImageCapabilitiesSchema = z$1.object({
+	sizing: PublicImageSizingSchema,
+	supports: z$1.object({
+		transparent_background: z$1.boolean().describe("`background: 'transparent'` yields real alpha."),
+		seed: z$1.boolean(),
+		qualities: z$1.array(OpenAIImageQualitySchema).describe("Accepted `quality` tiers; empty when none is taken."),
+		max_images: z$1.number().int().describe("Most images one request may ask for via `n`."),
+		max_reference_images: z$1.number().int().describe("Most `referenceImageFabFileIds` honoured; 0 when the model takes none."),
+		edit: z$1.boolean().describe("Accepted by `POST /api/v1/image-edits`."),
+		requires_input_image: z$1.boolean()
+	})
+});
+const ListModelsResponseSchema = paginatedResponseSchema(z$1.object({
+	id: z$1.string().describe("Pass as `model` on the generation endpoints."),
+	name: z$1.string(),
+	type: z$1.enum([
+		"text",
+		"image",
+		"speech-to-text",
+		"video"
+	]),
+	backend: z$1.enum(ModelBackend).describe("The provider that serves the model."),
+	description: z$1.string().nullable(),
+	context_window: z$1.number().int().describe("Input context, in tokens."),
+	max_output_tokens: z$1.number().int(),
+	supports_streaming: z$1.boolean(),
+	supports_thinking: z$1.boolean(),
+	supports_tools: z$1.boolean(),
+	supports_vision: z$1.boolean(),
+	deprecation_date: z$1.string().nullable().describe("`YYYY-MM-DD`; null when no retirement is scheduled."),
+	replaced_by: z$1.string().nullable().describe("The id of the recommended successor, when there is one."),
+	image: PublicImageCapabilitiesSchema.nullable().describe("Size rules and supported parameters. Present on image models only; null for every other type.")
+}));
 z$1.string().regex(/^[a-f0-9]{24}$/i, "Invalid template id");
 /**
 * The bound model. Reuses the legacy-remap preprocess so a template saved under
@@ -13625,6 +14198,21 @@ z$1.object({
 	}))
 });
 [...OPENAI_IMAGE_MODELS, ...GEMINI_IMAGE_MODELS];
+const GenerationCallbackUrlSchema = z$1.url({
+	protocol: /^https$/,
+	error: "callbackUrl must be an https URL"
+}).max(2048).describe("Optional https URL that receives one signed POST when the job settles (success or failure). Requires API-key authentication and a callback signing secret on that key. The body is the GET /api/v1/quests/{id} response. Verify it with the `X-Webhook-Signature-256` header: `sha256=` + hex HMAC-SHA256 of `<X-Webhook-Timestamp>.<raw body>` keyed with the signing secret. Polling keeps working either way.");
+z$1.enum([
+	"pending",
+	"dispatched",
+	"delivered",
+	"failed"
+]);
+/**
+* The 400 clause every queued-generation contract declares for a rejected `callbackUrl`; must stay
+* in sync with the rejections in apps/client/server/generationCallback/armGenerationCallback.ts.
+*/
+const GENERATION_CALLBACK_REJECTED_DESCRIPTION = "`callbackUrl` was rejected: the request is not API-key authenticated, the key has no callback signing secret, the URL resolves to a private address, or the deployment does not deliver callbacks.";
 const DashboardParamsSchema = z$1.object({
 	dashboardDataSources: z$1.array(z$1.object({
 		sourceName: z$1.string(),
@@ -13958,24 +14546,108 @@ const GenerateImageResponseSchema = z$1.object({
 	promptWasEnhanced: z$1.boolean(),
 	intent: PromptIntentSchema
 });
-/**
-* Response shape for the public video endpoint (`generateVideo`,
-* api-contract/contracts/videoGeneration.contract.ts). The request schema lives in
-* `../schemas/sora` next to the service-side ones it extends.
-*
-* Mirrors `ImageQuestSchema` (imageApi.ts): the ACK body IS the quest document,
-* returned before the queued render has run. A render that fails afterwards polls
-* back as `type: 'error'` with the reason in `reply` - hence the chat poll
-* vocabulary for `type` / `errorCode`.
-*/
-const VideoQuestSchema = ChatQuestPollResultSchema.extend({
-	sessionId: z$1.string(),
-	videos: z$1.array(z$1.string()).optional()
+const VIDEO_GENERATION_API_ERROR_CODES = [
+	...VIDEO_VALIDATION_ERROR_CODES,
+	"invalid_request",
+	"model_disabled",
+	"model_unavailable",
+	"insufficient_credits",
+	"input_image_not_found",
+	"idempotency_key_reused",
+	"invalid_idempotency_key"
+];
+const VIDEO_JOB_PUBLIC_ERROR_CODES = [
+	"content_blocked",
+	"provider_timeout",
+	"provider_error",
+	"region_unavailable",
+	"output_too_large",
+	"input_image_not_found",
+	"cancelled"
+];
+const VideoGenerationErrorResponseSchema = ApiErrorSchema.extend({ errorCode: z$1.enum(VIDEO_GENERATION_API_ERROR_CODES).optional() });
+const CreateVideoGenerationBodySchema = z$1.strictObject({
+	model: z$1.string().min(1).describe("A model id from GET /api/v1/video-models."),
+	prompt: z$1.string().min(1).max(4e3),
+	mode: z$1.enum(VIDEO_MODES).optional().describe("Defaults to image_to_video when input_image_file_id is set, else text_to_video."),
+	duration_seconds: z$1.number().positive().optional().describe("Defaults to the model's default duration."),
+	aspect_ratio: z$1.enum(ASPECT_RATIOS).optional(),
+	resolution: z$1.enum(RESOLUTION_TIERS).optional(),
+	input_image_file_id: z$1.string().min(1).optional().describe("An image file you own, for image_to_video."),
+	audio: z$1.boolean().optional()
+});
+const VideoGenerationSchema = z$1.object({
+	id: z$1.string(),
+	object: z$1.literal("video_generation"),
+	state: z$1.enum(GENERATION_JOB_STATES),
+	model: z$1.string(),
+	mode: z$1.enum(VIDEO_MODES),
+	prompt: z$1.string(),
+	duration_seconds: z$1.number(),
+	aspect_ratio: z$1.enum(ASPECT_RATIOS),
+	resolution: z$1.enum(RESOLUTION_TIERS),
+	source: z$1.enum(GENERATION_JOB_SOURCES),
+	progress: z$1.number().min(0).max(1).nullable(),
+	error: z$1.object({
+		code: z$1.enum(VIDEO_JOB_PUBLIC_ERROR_CODES),
+		message: z$1.string()
+	}).nullable(),
+	output: z$1.object({
+		availability: z$1.enum([
+			"ready",
+			"pending_scan",
+			"unavailable"
+		]).describe("`ready`: url is set. `pending_scan`: the saved file is still being scanned; re-fetch the job until it changes (self-hosted installs can stay here for up to ~30 minutes). `unavailable`: the file was blocked by the scan or deleted and url will never be set; stop polling."),
+		url: z$1.string().nullable().describe("Signed download URL, valid until expires_at; re-fetch the job for a fresh one. Set only when availability is `ready`, otherwise null."),
+		expires_at: z$1.string().nullable().describe("ISO 8601. When url stops working; null whenever url is."),
+		content_type: z$1.string(),
+		duration_seconds: z$1.number(),
+		file_id: z$1.string().nullable().describe("The Files entry, or null when the clip was stored outside Files.")
+	}).nullable(),
+	credits: z$1.object({
+		reserved: z$1.number().nullable(),
+		settled: z$1.number().nullable()
+	}),
+	created_at: z$1.string(),
+	updated_at: z$1.string()
+});
+const VideoModelSchema = z$1.object({
+	id: z$1.string(),
+	object: z$1.literal("video_model"),
+	display_name: z$1.string(),
+	provider: z$1.string(),
+	modes: z$1.array(z$1.enum(VIDEO_MODES)),
+	duration: z$1.union([z$1.object({
+		kind: z$1.literal("range"),
+		min: z$1.number(),
+		max: z$1.number(),
+		step: z$1.number()
+	}), z$1.object({
+		kind: z$1.literal("discrete"),
+		values: z$1.array(z$1.number())
+	})]),
+	aspect_ratios: z$1.array(z$1.enum(ASPECT_RATIOS)),
+	resolutions: z$1.array(z$1.enum(RESOLUTION_TIERS)),
+	defaults: z$1.object({
+		duration_seconds: z$1.number(),
+		aspect_ratio: z$1.enum(ASPECT_RATIOS),
+		resolution: z$1.enum(RESOLUTION_TIERS)
+	}),
+	audio: z$1.enum([
+		"always",
+		"optional",
+		"none"
+	]),
+	credits_per_second: z$1.record(z$1.string(), z$1.number()).nullable().describe("Credits per second of output by resolution; null for per-clip priced models."),
+	deprecation_date: z$1.string().nullable()
 });
-const GenerateVideoResponseSchema = z$1.object({
-	quest: VideoQuestSchema,
-	session: z$1.object({ id: z$1.string() })
+const ListVideoModelsResponseSchema = z$1.object({ models: z$1.array(VideoModelSchema) });
+const ListVideoGenerationsQuerySchema = PaginationQuerySchema.extend({
+	state: z$1.enum(GENERATION_JOB_STATES).optional(),
+	source: z$1.enum(GENERATION_JOB_SOURCES).optional()
 });
+const ListVideoGenerationsResponseSchema = paginatedResponseSchema(VideoGenerationSchema);
+const VideoGenerationIdParamSchema = z$1.object({ id: z$1.string().min(1) });
 /**
 * Wire schemas for the public `/api/v1/voice/*` contracts (api-contract/contracts/voice.contract.ts).
 * The legacy `/api/voice/v2/*` paths serve the same handlers, so these shapes are also what the SPA
@@ -14067,8 +14739,8 @@ defineEndpoint({
 	emitsRateLimitHeaders: true,
 	responses: {
 		200: {
-			description: "Message accepted - NOT a completed turn. The default (async) path returns this queued ACK; the outcome arrives on `GET /api/v1/quests/{id}` (see the `sendChatMessage200PollResult` schema). With `wait: true` the body additionally carries the completed reply (`response`/`responses`), `toolPayloads`, `createdAt`, and `performance` timings - fields not modelled here yet; the synchronous response shape is a follow-up. A turn that FAILS still resolves with `200`, never a 4xx, on both that `wait: true` body and the polled quest (`GET /api/v1/quests/{id}`) - the prose explaining why lands in `reply`/`response` like any other answer, so the reply text alone cannot tell a failure from an answer. `type` is the field that can: both surfaces carry it unconditionally, so match on `type: \"error\"` first - it covers credit exhaustion, a provider timeout or overload, and an in-process aborted turn; a real answer carries the turn's actual completion type instead (`\"message\"` for an ordinary reply). Two related states do NOT set `type: \"error\"`: a user-cancelled turn resolves as `status: \"stopped\"` with `type` left at `\"message\"`, and a recovered stuck quest that still has renderable content resolves as a success (`status: \"done\"`, no error) by design, to avoid destroying content to report a failure. `errorCode` then names the failure reason, but only for the billing failures that have one - `\"insufficient_credits\"` today; it is absent on every other `type: \"error\"` turn, so never use its absence to infer success. On a real answer `errorCode` is absent from the `wait: true` body. The body also carries `sessionId`, the notebook the turn was recorded in - for an API-key caller that sent none (or any caller sending `newConversation: true`), that is the freshly created notebook's id; pass it back as the request's `sessionId` to continue. Contrast the tts/music/soundEffects contracts, which reject synchronously with a 422 carrying the same `errorCode` vocabulary.",
-			schema: ChatAckSchema,
+			description: "Message accepted - NOT a completed turn. The default (async) path returns this queued ACK; the outcome arrives on `GET /api/v1/quests/{id}` (see the `sendChatMessage200PollResult` schema). With `wait: true` the body is instead the completed turn: the ACK fields plus the reply (`response`/`responses`), `toolPayloads`, `createdAt`, `performance` timings and, when requested, `promptDetails`/`promptText`. A turn that FAILS still resolves with `200`, never a 4xx, on both that `wait: true` body and the polled quest (`GET /api/v1/quests/{id}`) - the prose explaining why lands in `reply`/`response` like any other answer, so the reply text alone cannot tell a failure from an answer. `type` is the field that can: both surfaces carry it unconditionally, so match on `type: \"error\"` first - it covers credit exhaustion, a provider timeout or overload, and an in-process aborted turn; a real answer carries the turn's actual completion type instead (`\"message\"` for an ordinary reply). Two related states do NOT set `type: \"error\"`: a user-cancelled turn resolves as `status: \"stopped\"` with `type` left at `\"message\"`, and a recovered stuck quest that still has renderable content resolves as a success (`status: \"done\"`, no error) by design, to avoid destroying content to report a failure. `errorCode` then names the failure reason, but only for the billing failures that have one - `\"insufficient_credits\"` today; it is absent on every other `type: \"error\"` turn, so never use its absence to infer success. On a real answer `errorCode` is absent from the `wait: true` body. The body also carries `sessionId`, the notebook the turn was recorded in - for an API-key caller that sent none (or any caller sending `newConversation: true`), that is the freshly created notebook's id; pass it back as the request's `sessionId` to continue. Contrast the tts/music/soundEffects contracts, which reject synchronously with a 422 carrying the same `errorCode` vocabulary.",
+			schema: z$1.union([ChatWaitResponseSchema, ChatAckSchema]),
 			pollResult: {
 				schema: ChatQuestPollResultSchema,
 				description: "Outcome fields of the quest polled at `GET /api/v1/quests/{id}` after this ACK. A finished turn that failed is `status: \"done\"` with `type: \"error\"` and the failure text in `reply`, so a caller reading `reply` alone cannot tell a failure from an answer - check `type` first, and also treat a terminal `status: \"stopped\"` (a missing session, a user-cancelled turn) as failure even though it never sets `type`. `errorCode` is an optional refinement of `type: \"error\"`, present only for a classified billing failure; credit exhaustion arrives here as `insufficient_credits`, the same vocabulary the synchronous 422s on `/api/ai/music`, `/api/ai/sound-effects` and `/api/ai/tts` use. `QUEST_ERROR_CODES` publishes a second member, `spend_cap_exceeded`, but no current throw site on this endpoint raises it as a quest errorCode: its only one, the embed chat route's pre-flight 422, fires outside the process try/catch that would classify it onto the quest. Most `type: \"error\"` turns - an abort, a provider timeout or overload - have NO `errorCode`; its absence does not mean success, only that the failure is unclassified. A recovered stuck quest that still has renderable content is not a failure at all: it keeps `type: \"message\"` even though it did not finish, so a caller gets the content rather than an error. `fallbackInfo` is present only when the requested model failed and another model produced the reply: `fallbackModel` answered, `primaryModel` is what was asked for, and `reason` is the error from the first failed attempt on the requested model. The poll body carries further fields not modelled here, including `images`, `files`, `toolPayloads`, `promptMeta`, and the attachment report (`attachmentNotices`/`attachmentDelivery`) - only the outcome subset is modelled here.",
@@ -14142,39 +14814,143 @@ defineEndpoint({
 		429: {
 			description: "Per-user rate limit exceeded.",
 			schema: ApiErrorSchema
-		},
-		502: {
-			description: "The executor could not be dispatched. The run did not start, so a retry is safe.",
-			schema: ApiErrorSchema
+		},
+		502: {
+			description: "The executor could not be dispatched. The run did not start, so a retry is safe.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			session_id: "<sessionId>",
+			message: "Audit this data set and summarize what stands out."
+		}
+	}
+});
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/agent-executions/{id}",
+	operationId: "getAgentExecution",
+	summary: "Get an agent execution",
+	description: "Returns the status, reasoning trace, and (once terminal) the final answer of a run started by `POST /api/v1/agent-executions`. `steps` grows while the run is in flight, so polling this endpoint is also how a REST caller follows the loop. Safe (GET) requests on this route are exempt from the per-day API-key quota: a poll consumes no daily slot, and only the per-minute burst limit applies.",
+	tags: ["AI"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:chat", "ai:generate"],
+	pathParams: AgentExecutionIdParamSchema,
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "The execution, its trace, and its answer if it has finished.",
+			schema: AgentExecutionStatusResponseSchema
+		},
+		404: {
+			description: "No execution with that id is visible to the caller.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {}
+	}
+});
+defineEndpoint({
+	method: "put",
+	path: "/api/sessions/{id}",
+	operationId: "updateSession",
+	summary: "Update a session",
+	description: "Updates a session (called a \"notebook\" in the product UI): its name, attached knowledge files, tags, or retrieval settings. Set `knowledgeIds` and `forceKnowledgeRetrieval: true` together to enable grounded retrieval for `POST /api/chat` against this session - retrieval is gated by these session fields, not by the chat request. `lakeScope` narrows that retrieval to a chosen set of data lakes; omit it to leave the current choice unchanged, or send `null` to clear it so retrieval reaches every lake you can access. `includeLibraryFiles` sets whether the session grounds on your own library alongside its lakes; `false` confines it to lake content even when every lake is in scope (files attached to the session still reach the model and its knowledge-base tools), and is set aside (library included) while `forceKnowledgeRetrieval` is `false`. Authenticate with an API key (`b4m_live_`) or a JWT. Warning: adding to `knowledgeIds` shares those files with every member of every project containing this session by default (see `propagateToProjects`), and that sharing cannot be undone through the UI.",
+	tags: ["Sessions"],
+	auth: "apiKeyOrJwt",
+	scopes: ["notebooks:write"],
+	pathParams: SessionIdParamSchema,
+	request: SessionUpdateRequestSchema,
+	emitsRateLimitHeaders: true,
+	requestExample: {
+		knowledgeIds: ["<fabFileId>"],
+		forceKnowledgeRetrieval: true
+	},
+	responses: {
+		200: {
+			description: "The updated session.",
+			schema: SessionResponseSchema
+		},
+		404: {
+			description: "No session exists with the given id.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			knowledgeIds: ["<fabFileId>"],
+			forceKnowledgeRetrieval: true
+		}
+	}
+});
+defineEndpoint({
+	method: "get",
+	path: "/api/sessions/{id}",
+	operationId: "getSession",
+	summary: "Get a session",
+	description: "Reads a session you own or that was shared with you (called a \"notebook\" in the product UI): its name, attached knowledge files, tags, and retrieval settings. Use it to confirm what a `PUT` on the same path stored. A session not visible to you, or one that was deleted, is `404`. An API key needs `notebooks:read` or `notebooks:write`.",
+	tags: ["Sessions"],
+	auth: "apiKeyOrJwt",
+	scopes: ["notebooks:read", "notebooks:write"],
+	pathParams: SessionIdParamSchema,
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "The session.",
+			schema: SessionResponseSchema
+		},
+		404: {
+			description: "No session with that id is visible to the caller.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
 		}
 	},
 	codeSample: {
 		authToken: "b4m_live_<key>",
-		streaming: false,
-		body: {
-			session_id: "<sessionId>",
-			message: "Audit this data set and summarize what stands out."
-		}
+		streaming: false
 	}
 });
 defineEndpoint({
-	method: "get",
-	path: "/api/v1/agent-executions/{id}",
-	operationId: "getAgentExecution",
-	summary: "Get an agent execution",
-	description: "Returns the status, reasoning trace, and (once terminal) the final answer of a run started by `POST /api/v1/agent-executions`. `steps` grows while the run is in flight, so polling this endpoint is also how a REST caller follows the loop. Safe (GET) requests on this route are exempt from the per-day API-key quota: a poll consumes no daily slot, and only the per-minute burst limit applies.",
-	tags: ["AI"],
+	method: "delete",
+	path: "/api/sessions/{id}",
+	operationId: "deleteSession",
+	summary: "Delete a session",
+	description: "Deletes one of your sessions (called a \"notebook\" in the product UI). This cannot be undone through the API. Files you uploaded into the session are deleted with it; files other people uploaded into it are kept, and every access grant this session gave out on a file is revoked. A session you do not own, or one already deleted, is `404`. A `409` means a concurrent change touched one of those files mid-delete; nothing was deleted, so retry. An API key needs `notebooks:write`.",
+	tags: ["Sessions"],
 	auth: "apiKeyOrJwt",
-	scopes: ["ai:chat", "ai:generate"],
-	pathParams: AgentExecutionIdParamSchema,
+	scopes: ["notebooks:write"],
+	pathParams: SessionIdParamSchema,
 	emitsRateLimitHeaders: true,
 	responses: {
 		200: {
-			description: "The execution, its trace, and its answer if it has finished.",
-			schema: AgentExecutionStatusResponseSchema
+			description: "The session was deleted.",
+			schema: SessionDeleteResponseSchema
 		},
 		404: {
-			description: "No execution with that id is visible to the caller.",
+			description: "No session with that id is visible to the caller.",
+			schema: ApiErrorSchema
+		},
+		409: {
+			description: "A concurrent change touched a file this session shares; nothing was deleted. Retry.",
 			schema: ApiErrorSchema
 		},
 		429: {
@@ -14184,43 +14960,51 @@ defineEndpoint({
 	},
 	codeSample: {
 		authToken: "b4m_live_<key>",
-		streaming: false,
-		body: {}
+		streaming: false
 	}
 });
 defineEndpoint({
-	method: "put",
-	path: "/api/sessions/{id}",
-	operationId: "updateSession",
-	summary: "Update a session",
-	description: "Updates a session (called a \"notebook\" in the product UI): its name, attached knowledge files, tags, or retrieval settings. Set `knowledgeIds` and `forceKnowledgeRetrieval: true` together to enable grounded retrieval for `POST /api/chat` against this session - retrieval is gated by these session fields, not by the chat request. `lakeScope` narrows that retrieval to a chosen set of data lakes; omit it to leave the current choice unchanged, or send `null` to clear it so retrieval reaches every lake you can access. Authenticate with an API key (`b4m_live_`) or a JWT. Warning: adding to `knowledgeIds` shares those files with every member of every project containing this session by default (see `propagateToProjects`), and that sharing cannot be undone through the UI.",
+	method: "post",
+	path: "/api/v1/sessions/{id}/clone",
+	operationId: "cloneSession",
+	summary: "Clone a session",
+	description: "Clones a session (called a \"notebook\" in the product UI), including its messages and attachments. Omit `targetSurface` to inherit the source workspace, send `null` for the main notebook list, or send a surface id for another workspace. An API key needs `notebooks:write`.",
 	tags: ["Sessions"],
 	auth: "apiKeyOrJwt",
 	scopes: ["notebooks:write"],
 	pathParams: SessionIdParamSchema,
-	request: SessionUpdateRequestSchema,
+	request: SessionCloneRequestSchema,
+	requestBodyRequired: false,
+	validationErrorStatus: 400,
 	emitsRateLimitHeaders: true,
-	requestExample: {
-		knowledgeIds: ["<fabFileId>"],
-		forceKnowledgeRetrieval: true
-	},
+	requestExample: {},
 	responses: {
 		200: {
-			description: "The updated session.",
+			description: "The cloned session.",
 			schema: SessionResponseSchema
 		},
+		400: {
+			description: "The session id is missing or `targetSurface` is malformed.",
+			schema: ApiErrorSchema
+		},
+		403: {
+			description: "The API key lacks `notebooks:write` or the caller is not allowed to clone sessions.",
+			schema: ScopeForbiddenErrorSchema
+		},
 		404: {
-			description: "No session exists with the given id.",
+			description: "No session with that id is visible to the caller.",
 			schema: ApiErrorSchema
+		},
+		429: {
+			description: "The clone limit of 10 requests per minute per caller was exceeded.",
+			schema: ApiErrorSchema,
+			headers: { "Retry-After": "Seconds until the caller can retry." }
 		}
 	},
 	codeSample: {
 		authToken: "b4m_live_<key>",
 		streaming: false,
-		body: {
-			knowledgeIds: ["<fabFileId>"],
-			forceKnowledgeRetrieval: true
-		}
+		body: {}
 	}
 });
 defineEndpoint({
@@ -14255,6 +15039,10 @@ defineEndpoint({
 			description: "Missing or invalid JWT (an API key is rejected here).",
 			schema: ApiErrorSchema
 		},
+		403: {
+			description: "Valid JWT, but the account is suspended or has a dispute pending.",
+			schema: ApiErrorSchema
+		},
 		429: {
 			description: "Rate limit exceeded (100 requests/hour per user for this endpoint).",
 			schema: ApiErrorSchema
@@ -14651,6 +15439,80 @@ defineEndpoint({
 		body: {}
 	}
 });
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/models",
+	operationId: "listModels",
+	summary: "List models",
+	description: "Lists the models the caller can use right now - the platform catalog filtered to the providers the caller has a key for, their own or the platform's. Use it to choose a `model` by capability before calling a generation endpoint: `context_window` and `max_output_tokens` for text models, and for image models the `image` block, which lists the accepted `size` values (or the rule they must meet) and whether `background`, `seed`, `quality`, `n` and reference images are honoured. The list is cached for up to a minute per caller. Cursor-paginated (see the pagination convention): pass `next_cursor` back as `cursor` until it is `null`. Authenticate with an API key (`b4m_live_`) carrying `ai:chat` or `ai:generate`, or a JWT.",
+	tags: ["Models"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:chat", "ai:generate"],
+	queryParams: PaginationQuerySchema,
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "One page of models, ordered by `id`.",
+			schema: ListModelsResponseSchema,
+			example: {
+				data: [{
+					id: "gpt-image-1",
+					name: "GPT Image 1",
+					type: "image",
+					backend: "openai",
+					description: null,
+					context_window: 0,
+					max_output_tokens: 0,
+					supports_streaming: false,
+					supports_thinking: false,
+					supports_tools: false,
+					supports_vision: false,
+					deprecation_date: null,
+					replaced_by: null,
+					image: {
+						sizing: {
+							kind: "presets",
+							presets: [
+								"1024x1024",
+								"1024x1536",
+								"1536x1024"
+							],
+							default_size: "1024x1024"
+						},
+						supports: {
+							transparent_background: true,
+							seed: false,
+							qualities: [
+								"low",
+								"medium",
+								"high",
+								"auto"
+							],
+							max_images: 10,
+							max_reference_images: 4,
+							edit: true,
+							requires_input_image: false
+						}
+					}
+				}],
+				next_cursor: null
+			}
+		},
+		422: {
+			description: "`limit` is out of range, or `cursor` is malformed or was issued by a different endpoint. A cursor is opaque: pass back exactly the `next_cursor` you were given.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {}
+	}
+});
 /** Shared by generateImage and editImage: both hand off to the same quest poll. */
 const imageQuestPollResult = {
 	schema: ImageQuestSchema,
@@ -14668,7 +15530,7 @@ defineEndpoint({
 	path: "/api/v1/image-generations",
 	operationId: "generateImage",
 	summary: "Generate an image",
-	description: "Queues an image generation and returns immediately with the quest that will carry the result - no image yet, and the call never blocks on the render. Poll `GET /api/v1/quests/{id}` until `status` is `\"done\"` (see the `generateImage200PollResult` schema). Omit `sessionId` to create a new session. The prompt is resolved against the session history first, so a follow-up such as \"make it darker\" binds to the previous image; `enhancedPrompt` reports the prompt actually sent to the model. Send `prompt_resolution: \"literal\"` to skip that step and have the prompt sent as written (apart from truncation to the model's prompt limit). `referenceImageFabFileIds` passes up to 4 already-uploaded images as style anchors, after the input image taken from `fabFileIds`. Only gpt-image models accept them: sending any with another model is rejected with a 400 rather than ignored. Which `size` values a model accepts, and whether it honours `background`, `seed`, `quality`, `n` and reference images, is listed per model in the `image` block of `GET /api/models`. Credits are checked when the render runs, so insufficient credits arrive on the polled quest rather than as a 422. `POST /api/ai/generate-image` is a legacy alias of this endpoint. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nOptional `callbackUrl`: an https URL that receives a signed POST when the quest settles (success, failure, or a stop; a failed render is `type: \"error\"` in the body, same as the poll). The body is the `GET /api/v1/quests/{id}` response. Headers: `X-Webhook-Event-ID` (the same on every attempt for one settlement; delivery is at-least-once, so dedupe on it, and a retried quest settles again under a new one), `X-Webhook-Delivery-ID` (unique per attempt), `X-Webhook-Timestamp` (unix seconds), `X-Webhook-Signature-256` (`sha256=` + hex HMAC-SHA256 of `<timestamp>.<raw body>` keyed with the API key's callback signing secret), and `X-Event-Type: quest.settled`. Delivery makes up to 5 attempts, retrying on a 5xx, 408, 429, timeout or network error - never on any other 4xx, and redirects are not followed; your endpoint must answer 2xx within 10 seconds. Requires API-key authentication and a signing secret on that key (returned once at key creation, or via `POST /api/user-api-keys/{id}/callback-secret`). A `callbackUrl` is rejected with a 400 when the request is not API-key authenticated, the key has no signing secret, the URL resolves to a private address, or the deployment does not deliver callbacks; a URL that is not https fails request validation with a 422. Polling still works whether or not `callbackUrl` is set.",
+	description: "Queues an image generation and returns immediately with the quest that will carry the result - no image yet, and the call never blocks on the render. Poll `GET /api/v1/quests/{id}` until `status` is `\"done\"` (see the `generateImage200PollResult` schema). Omit `sessionId` to create a new session. The prompt is resolved against the session history first, so a follow-up such as \"make it darker\" binds to the previous image; `enhancedPrompt` reports the prompt actually sent to the model. Send `prompt_resolution: \"literal\"` to skip that step and have the prompt sent as written (apart from truncation to the model's prompt limit). `referenceImageFabFileIds` passes up to 4 already-uploaded images as style anchors, after the input image taken from `fabFileIds`. Only gpt-image models accept them: sending any with another model is rejected with a 400 rather than ignored. Which `size` values a model accepts, and whether it honours `background`, `seed`, `quality`, `n` and reference images, is listed per model in the `image` block of `GET /api/v1/models`. Credits are checked when the render runs, so insufficient credits arrive on the polled quest rather than as a 422. `POST /api/ai/generate-image` is a legacy alias of this endpoint. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nOptional `callbackUrl`: an https URL that receives a signed POST when the quest settles (success, failure, or a stop; a failed render is `type: \"error\"` in the body, same as the poll). The body is the `GET /api/v1/quests/{id}` response. Headers: `X-Webhook-Event-ID` (the same on every attempt for one settlement; delivery is at-least-once, so dedupe on it, and a retried quest settles again under a new one), `X-Webhook-Delivery-ID` (unique per attempt), `X-Webhook-Timestamp` (unix seconds), `X-Webhook-Signature-256` (`sha256=` + hex HMAC-SHA256 of `<timestamp>.<raw body>` keyed with the API key's callback signing secret), and `X-Event-Type: quest.settled`. Delivery makes up to 5 attempts, retrying on a 5xx, 408, 429, timeout or network error - never on any other 4xx, and redirects are not followed; your endpoint must answer 2xx within 10 seconds. Requires API-key authentication and a signing secret on that key (returned once at key creation, or via `POST /api/user-api-keys/{id}/callback-secret`). A `callbackUrl` is rejected with a 400 when the request is not API-key authenticated, the key has no signing secret, the URL resolves to a private address, or the deployment does not deliver callbacks; a URL that is not https fails request validation with a 422. Polling still works whether or not `callbackUrl` is set.",
 	tags: ["Images"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:generate"],
@@ -14953,7 +15815,7 @@ defineEndpoint({
 	path: "/api/v1/sessions",
 	operationId: "createSession",
 	summary: "Create a session",
-	description: "Creates a session (called a \"notebook\" in the product UI). Pass the returned `id` as `session_id` to `POST /api/chat`, then poll `GET /api/v1/quests/{id}` for the reply. An API key needs `notebooks:write` for this call, so a chat round trip needs that scope as well as `ai:chat`. Unknown body fields are ignored. Naming a data lake with `dataLakeId` seeds the session with that lake's retrieval defaults.",
+	description: "Creates a session (called a \"notebook\" in the product UI). Pass the returned `id` as `sessionId` to `POST /api/chat`, then poll `GET /api/v1/quests/{id}` for the reply. An API key needs `notebooks:write` for this call, so a chat round trip needs that scope as well as `ai:chat`. Unknown body fields are ignored. Naming a data lake with `dataLakeId` (ids come from `GET /api/v1/data-lakes`) seeds the session with that lake's retrieval defaults and turns on forced retrieval.",
 	tags: ["Sessions"],
 	auth: "apiKeyOrJwt",
 	scopes: ["notebooks:write"],
@@ -14984,6 +15846,68 @@ defineEndpoint({
 		body: { name: "Quarterly analysis" }
 	}
 });
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/sessions",
+	operationId: "listSessions",
+	summary: "List sessions",
+	description: "Lists the sessions you own (called \"notebooks\" in the product UI), newest first. Sessions shared with you are not included; read one of those by id with `GET /api/sessions/{id}`. Each item has the same shape `GET /api/sessions/{id}` returns. Cursor-paginated (see the pagination convention): pass `next_cursor` back as `cursor` until it is `null`. Changing `search`, `surface` or `origin` starts a new listing, so drop the cursor when you do. An API key needs `notebooks:read` or `notebooks:write`.",
+	tags: ["Sessions"],
+	auth: "apiKeyOrJwt",
+	scopes: ["notebooks:read", "notebooks:write"],
+	queryParams: ListSessionsQuerySchema,
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "One page of sessions, newest first by `id`.",
+			schema: ListSessionsResponseSchema
+		},
+		403: {
+			description: "The API key holds neither `notebooks:read` nor `notebooks:write`.",
+			schema: ScopeForbiddenErrorSchema
+		},
+		422: {
+			description: "`limit` is out of range, a filter is malformed, or `cursor` is malformed or was issued by a different endpoint. A cursor is opaque: pass back exactly the `next_cursor` you were given.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false
+	}
+});
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/whats-new",
+	operationId: "listWhatsNew",
+	summary: "List release notes",
+	description: "Lists published release notes, newest first. Public: no credentials are needed, and the response is cacheable for up to about 15 minutes (5 fresh plus 10 stale-while-revalidate), so a newly published or withdrawn note can take that long to show. A deployment that proxies an upstream feed stacks its own caching on the upstream's, so there it can take about 31 minutes. Cursor-paginated (see the pagination convention): pass `next_cursor` back as `cursor` until it is `null`. Rate limited per client IP.",
+	tags: ["Release notes"],
+	auth: "public",
+	queryParams: PaginationQuerySchema,
+	responses: {
+		200: {
+			description: "One page of published release notes, newest first by `published_at`.",
+			schema: paginatedResponseSchema(PublicReleaseNoteSchema)
+		},
+		422: {
+			description: "`limit` is out of range, or `cursor` is malformed or was issued by a different endpoint. A cursor is opaque: pass back exactly the `next_cursor` you were given. On a deployment that proxies an upstream feed, a cursor issued by that upstream which can no longer be served there ends the list (200 with empty `data`) rather than returning 422.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-IP rate limit exceeded.",
+			schema: ApiErrorSchema
+		},
+		500: {
+			description: "Unexpected server error.",
+			schema: ApiErrorSchema
+		}
+	}
+});
 /**
 * The read/write/query API-key scope sets the data-lake doors accept (OR semantics), shared by the
 * SPA routes (`apps/client/server/dataLakes/dataLakeScopes.ts` re-exports these) and the public
@@ -15173,22 +16097,202 @@ defineEndpoint({
 	emitsRateLimitHeaders: true,
 	responses: {
 		200: {
-			description: "The file is no longer a member; the lake's updated totals.",
-			schema: DataLakeFileMembershipResponseSchema
-		},
-		403: {
-			description: WRITE_FORBIDDEN,
-			schema: ScopeForbiddenErrorSchema
-		},
-		404: {
-			description: "The lake is not visible to the caller, or the file is not a current member of it.",
-			schema: ApiErrorSchema
+			description: "The file is no longer a member; the lake's updated totals.",
+			schema: DataLakeFileMembershipResponseSchema
+		},
+		403: {
+			description: WRITE_FORBIDDEN,
+			schema: ScopeForbiddenErrorSchema
+		},
+		404: {
+			description: "The lake is not visible to the caller, or the file is not a current member of it.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/v1/data-lakes/{id}/search",
+	operationId: "searchDataLake",
+	summary: "Search a data lake",
+	description: "Semantic (vector) search over one lake: the query is embedded with the model the corpus was indexed with and the top `top_k` passages at or above `min_score` are returned. Only members of this lake are searched - never the caller's other files. `tags` narrows to files carrying any of the listed tags. Files still being indexed or paused are withheld rather than searched stale: `partial_results` is then true and `retrieval_unavailable` counts them (poll `GET /api/v1/data-lakes/{id}/files/{file_id}` for a specific file). The query embedding is billed as credits. Limited to 10 searches per minute per caller, shared with the product UI.",
+	tags: ["Data Lakes"],
+	auth: "apiKeyOrJwt",
+	scopes: DATA_LAKE_QUERY_API_KEY_SCOPES,
+	pathParams: DataLakeIdParamSchema,
+	request: DataLakeSearchRequestSchema,
+	requestExample: {
+		query: "What is our refund policy for annual plans?",
+		top_k: 5
+	},
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "The ranked passages and what, if anything, was withheld.",
+			schema: DataLakeSearchResponseSchema
+		},
+		400: {
+			description: "The API key bills an organization that no longer exists, or one its owner is no longer a member of.",
+			schema: ApiErrorSchema
+		},
+		403: {
+			description: `The API key lacks \`datalake:query\`, ${FEATURE_DISABLED_NOTE}.`,
+			schema: ScopeForbiddenErrorSchema
+		},
+		404: {
+			description: `${NOT_VISIBLE_LAKE} A lake the caller can read but is not entitled to search is reported the same way, as is a lake that is not \`active\` yet (a draft lake is readable but not yet searchable).`,
+			schema: ApiErrorSchema
+		},
+		422: {
+			description: "Request body failed validation, or the caller cannot afford the query embedding - the latter is tagged `errorCode: \"insufficient_credits\"` (the balance is short, or the org member credit cap is exhausted).",
+			schema: InsufficientCreditsErrorSchema
+		},
+		429: {
+			description: "Search rate limit (10 per minute) or per-user API rate limit exceeded.",
+			schema: ApiErrorSchema
+		},
+		503: {
+			description: "No usable key is configured on this deployment for the embedding provider the query needs (`errorCode: \"provider_not_configured\"`).",
+			schema: ProviderNotConfiguredErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			query: "What is our refund policy for annual plans?",
+			top_k: 5
+		}
+	}
+});
+const exampleJob = {
+	id: EXAMPLE_RESOURCE_ID,
+	object: "video_generation",
+	state: "pending",
+	model: "grok-imagine-video-1.5",
+	mode: "text_to_video",
+	prompt: "A slow dolly shot of a red lighthouse at dusk",
+	duration_seconds: 6,
+	aspect_ratio: "16:9",
+	resolution: "480p",
+	source: "api",
+	progress: null,
+	error: null,
+	output: null,
+	credits: {
+		reserved: 960,
+		settled: null
+	},
+	created_at: "2026-10-06T00:00:00.000Z",
+	updated_at: "2026-10-06T00:00:00.000Z"
+};
+const scopeForbidden = {
+	description: "The API key lacks the `ai:generate` scope.",
+	schema: ScopeForbiddenErrorSchema
+};
+const notFound = {
+	description: "No video generation with that id was requested by the caller (a malformed id is also a 404).",
+	schema: ApiErrorSchema
+};
+const rateLimited = {
+	description: "Per-user rate limit exceeded.",
+	schema: ApiErrorSchema
+};
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/video-models",
+	operationId: "listVideoModels",
+	summary: "List the video models you can use",
+	description: "Returns the video models that are enabled, available in this deployment and have a usable provider key for the caller, with their capabilities and per-second credit price. Validate requests against these capabilities: an unsupported duration, aspect ratio or resolution is a 422, never silently adjusted.",
+	tags: ["Videos"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:generate"],
+	responses: {
+		200: {
+			description: "The usable models.",
+			schema: ListVideoModelsResponseSchema
+		},
+		403: scopeForbidden,
+		429: rateLimited
+	},
+	emitsRateLimitHeaders: true,
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {}
+	}
+});
+defineEndpoint({
+	method: "post",
+	path: "/api/v1/video-generations",
+	operationId: "createVideoGeneration",
+	summary: "Start a video generation",
+	description: "Queues a video generation and returns `202` with the job. Poll `GET /api/v1/video-generations/{id}` until `state` is `succeeded`, `failed`, `blocked` or `cancelled`. On success, `output.availability` says whether the clip can be downloaded: `ready` means `output.url` is a signed download URL valid for 15 minutes (re-fetch the job for a fresh one); `pending_scan` means the saved file is still being scanned, so keep re-fetching the job (self-hosted installs can stay here for up to ~30 minutes); `unavailable` means the file was blocked or deleted and `output.url` will never be set, so stop polling. Credits for the requested duration are reserved up front and settled on completion; a failed or cancelled job is not charged. A `blocked` job is not charged either, unless the provider generated the clip before rejecting it and billed it: then the requested duration is charged and `credits.settled` shows it. Send an `Idempotency-Key` header (1-255 printable ASCII characters) to make retries safe: a repeat with the same key and body returns the original job, and the same key with a different body is a 422 `idempotency_key_reused`. Omitted fields take the model defaults from `GET /api/v1/video-models`.",
+	tags: ["Videos"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:generate"],
+	request: CreateVideoGenerationBodySchema,
+	requestExample: {
+		model: "grok-imagine-video-1.5",
+		prompt: "A slow dolly shot of a red lighthouse at dusk"
+	},
+	responses: {
+		202: {
+			description: "Accepted; the job is queued (or replayed for a repeated Idempotency-Key).",
+			schema: VideoGenerationSchema,
+			example: exampleJob
+		},
+		403: scopeForbidden,
+		404: {
+			description: "`input_image_file_id` does not name an image you own (`errorCode: input_image_not_found`).",
+			schema: VideoGenerationErrorResponseSchema
+		},
+		422: {
+			description: "The request cannot run: a body or capability violation (`errorCode` names it, e.g. `unsupported_duration`), an unknown or unavailable model (`model_unavailable`), a model your administrator disabled (`model_disabled`), too few credits (`insufficient_credits`), or an Idempotency-Key problem (`invalid_idempotency_key`, `idempotency_key_reused`).",
+			schema: VideoGenerationErrorResponseSchema
+		},
+		429: rateLimited
+	},
+	emitsRateLimitHeaders: true,
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {
+			model: "grok-imagine-video-1.5",
+			prompt: "A slow dolly shot of a red lighthouse at dusk"
+		}
+	}
+});
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/video-generations/{id}",
+	operationId: "getVideoGeneration",
+	summary: "Get a video generation",
+	description: "Returns one job you requested. Each read signs a fresh `output.url` (valid 15 minutes, see `expires_at`).",
+	tags: ["Videos"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:generate"],
+	pathParams: VideoGenerationIdParamSchema,
+	responses: {
+		200: {
+			description: "The job.",
+			schema: VideoGenerationSchema,
+			example: exampleJob
 		},
-		429: {
-			description: "Per-user rate limit exceeded.",
-			schema: ApiErrorSchema
-		}
+		403: scopeForbidden,
+		404: notFound,
+		429: rateLimited
 	},
+	emitsRateLimitHeaders: true,
 	codeSample: {
 		authToken: "b4m_live_<key>",
 		streaming: false,
@@ -15196,105 +16300,59 @@ defineEndpoint({
 	}
 });
 defineEndpoint({
-	method: "post",
-	path: "/api/v1/data-lakes/{id}/search",
-	operationId: "searchDataLake",
-	summary: "Search a data lake",
-	description: "Semantic (vector) search over one lake: the query is embedded with the model the corpus was indexed with and the top `top_k` passages at or above `min_score` are returned. Only members of this lake are searched - never the caller's other files. `tags` narrows to files carrying any of the listed tags. Files still being indexed or paused are withheld rather than searched stale: `partial_results` is then true and `retrieval_unavailable` counts them (poll `GET /api/v1/data-lakes/{id}/files/{file_id}` for a specific file). The query embedding is billed as credits. Limited to 10 searches per minute per caller, shared with the product UI.",
-	tags: ["Data Lakes"],
+	method: "get",
+	path: "/api/v1/video-generations",
+	operationId: "listVideoGenerations",
+	summary: "List your video generations",
+	description: "Your jobs, newest first, optionally filtered by `state` and `source`. Cursor-paginated (see the pagination convention): pass `next_cursor` back as `cursor` until it is `null`.",
+	tags: ["Videos"],
 	auth: "apiKeyOrJwt",
-	scopes: DATA_LAKE_QUERY_API_KEY_SCOPES,
-	pathParams: DataLakeIdParamSchema,
-	request: DataLakeSearchRequestSchema,
-	requestExample: {
-		query: "What is our refund policy for annual plans?",
-		top_k: 5
-	},
-	emitsRateLimitHeaders: true,
+	scopes: ["ai:generate"],
+	queryParams: ListVideoGenerationsQuerySchema,
 	responses: {
 		200: {
-			description: "The ranked passages and what, if anything, was withheld.",
-			schema: DataLakeSearchResponseSchema
-		},
-		403: {
-			description: `The API key lacks \`datalake:query\`, ${FEATURE_DISABLED_NOTE}.`,
-			schema: ScopeForbiddenErrorSchema
-		},
-		404: {
-			description: `${NOT_VISIBLE_LAKE} A lake the caller can read but is not entitled to search is reported the same way, as is a lake that is not \`active\` yet (a draft lake is readable but not yet searchable).`,
-			schema: ApiErrorSchema
+			description: "A page of jobs.",
+			schema: ListVideoGenerationsResponseSchema
 		},
+		403: scopeForbidden,
 		422: {
-			description: "Request body failed validation, or the caller cannot afford the query embedding - the latter is tagged `errorCode: \"insufficient_credits\"` (the balance is short, or the org member credit cap is exhausted).",
-			schema: InsufficientCreditsErrorSchema
-		},
-		429: {
-			description: "Search rate limit (10 per minute) or per-user API rate limit exceeded.",
+			description: "A malformed `cursor`, `limit`, `state` or `source`.",
 			schema: ApiErrorSchema
 		},
-		503: {
-			description: "No usable key is configured on this deployment for the embedding provider the query needs (`errorCode: \"provider_not_configured\"`).",
-			schema: ProviderNotConfiguredErrorSchema
-		}
+		429: rateLimited
 	},
+	emitsRateLimitHeaders: true,
 	codeSample: {
 		authToken: "b4m_live_<key>",
 		streaming: false,
-		body: {
-			query: "What is our refund policy for annual plans?",
-			top_k: 5
-		}
+		body: {}
 	}
 });
 defineEndpoint({
 	method: "post",
-	path: "/api/v1/video-generations",
-	operationId: "generateVideo",
-	summary: "Generate a video",
-	description: "Queues a Sora video generation and returns immediately with the quest that will carry the result - no video yet, and the call never blocks on the render. Poll `GET /api/v1/quests/{id}` until `status` is `\"done\"` (see the `generateVideo200PollResult` schema). Omit `sessionId` to create a new session. Credits are checked when the render runs, so insufficient credits arrive on the polled quest rather than as a 422. `POST /api/ai/generate-video` is a legacy alias of this endpoint. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nOptional `callbackUrl`: an https URL that receives a signed POST when the quest settles (success, failure, or a stop; a failed render is `type: \"error\"` in the body, same as the poll). The body is the `GET /api/v1/quests/{id}` response. Headers: `X-Webhook-Event-ID` (the same on every attempt for one settlement; delivery is at-least-once, so dedupe on it, and a retried quest settles again under a new one), `X-Webhook-Delivery-ID` (unique per attempt), `X-Webhook-Timestamp` (unix seconds), `X-Webhook-Signature-256` (`sha256=` + hex HMAC-SHA256 of `<timestamp>.<raw body>` keyed with the API key's callback signing secret), and `X-Event-Type: quest.settled`. Delivery makes up to 5 attempts, retrying on a 5xx, 408, 429, timeout or network error - never on any other 4xx, and redirects are not followed; your endpoint must answer 2xx within 10 seconds. Requires API-key authentication and a signing secret on that key (returned once at key creation, or via `POST /api/user-api-keys/{id}/callback-secret`). A `callbackUrl` is rejected with a 400 when the request is not API-key authenticated, the key has no signing secret, the URL resolves to a private address, or the deployment does not deliver callbacks; a URL that is not https fails request validation with a 422. Polling still works whether or not `callbackUrl` is set.",
+	path: "/api/v1/video-generations/{id}/cancel",
+	operationId: "cancelVideoGeneration",
+	summary: "Cancel a video generation",
+	description: "Requests cancellation and returns the job. A `pending` or `running` job moves to `cancelled` shortly after and its reserved credits are returned. A job already `storing` or finished is returned unchanged (the provider has already produced, and charged for, the video).",
 	tags: ["Videos"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:generate"],
-	request: GenerateVideoRequestBodySchema,
-	requestExample: {
-		prompt: "a drone shot over a foggy pine forest at sunrise",
-		model: "sora-2",
-		seconds: 4
-	},
+	pathParams: VideoGenerationIdParamSchema,
 	responses: {
 		200: {
-			description: "Generation queued - NOT a finished render. `quest` has no videos yet; its outcome arrives on `GET /api/v1/quests/{id}`.",
-			schema: GenerateVideoResponseSchema,
-			pollResult: {
-				schema: VideoQuestSchema,
-				description: "The quest polled at `GET /api/v1/quests/{id}` after this ACK. The render is finished once `status` is `\"done\"`: on success `videos` holds the rendered videos; a render that FAILED is `type: \"error\"` with the reason in `reply`, never a 4xx. That covers credit exhaustion (tagged `errorCode: \"insufficient_credits\"`, the same vocabulary as the synchronous 422s on the audio endpoints) and a provider error. Check `type` before reading `videos`; `errorCode` is absent on unclassified failures, so its absence does not mean success.",
-				example: {
-					id: EXAMPLE_RESOURCE_ID,
-					sessionId: EXAMPLE_SESSION_ID,
-					status: "done",
-					type: "message",
-					videos: ["3f6c1a52-9d1e-4b7a-8c2f-5e0d4a9b1c7e.mp4"]
-				}
-			}
-		},
-		400: {
-			description: `The ${GENERATION_CALLBACK_REJECTED_DESCRIPTION}`,
-			schema: ApiErrorSchema
+			description: "The job after the cancel request.",
+			schema: VideoGenerationSchema,
+			example: exampleJob
 		},
-		404: {
-			description: "The session, or the quest being retried, does not exist or is not accessible to the caller. A nonexistent billing `organizationId` is `404` only for an admin caller; for anyone else, an invalid or inaccessible `organizationId` is `403` instead.",
-			schema: ApiErrorSchema
-		}
+		403: scopeForbidden,
+		404: notFound,
+		429: rateLimited
 	},
 	emitsRateLimitHeaders: true,
 	codeSample: {
 		authToken: "b4m_live_<key>",
 		streaming: false,
-		body: {
-			prompt: "a drone shot over a foggy pine forest at sunrise",
-			model: "sora-2",
-			seconds: 4
-		}
+		body: {}
 	}
 });
 /**
@@ -15433,12 +16491,136 @@ defineEndpoint({
 		}
 	},
 	emitsRateLimitHeaders: true,
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false
+	}
+});
+/**
+* The integrator-facing subset of the project API. Each route is a `/api/v1` twin of an SPA route
+* under `/api/projects/*` and reuses its service logic; the SPA routes are unchanged. Update, delete
+* and every sub-resource (files, sessions, members, invites, system prompts) are deliberately not
+* published yet.
+*/
+const READ_SCOPES = ["projects:read", "projects:write"];
+const READ_FORBIDDEN = "The API key holds neither `projects:read` nor `projects:write`.";
+const MEMBERSHIP_NOTE = "A project's `file_ids` and `session_ids` are shared with it: anyone the project is shared with can read every file and session it groups.";
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/projects",
+	operationId: "listProjects",
+	summary: "List projects",
+	description: `Lists the projects the caller can read: projects they own and projects shared with them. ${MEMBERSHIP_NOTE} Cursor-paginated (see the pagination convention): pass \`next_cursor\` back as \`cursor\` until it is \`null\`.`,
+	tags: ["Projects"],
+	auth: "apiKeyOrJwt",
+	scopes: READ_SCOPES,
+	queryParams: PaginationQuerySchema,
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "One page of projects, ordered by `id`.",
+			schema: ListProjectsResponseSchema
+		},
+		403: {
+			description: READ_FORBIDDEN,
+			schema: ScopeForbiddenErrorSchema
+		},
+		422: {
+			description: "`limit` is out of range, or `cursor` is malformed or was issued by a different endpoint. A cursor is opaque: pass back exactly the `next_cursor` you were given.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {}
+	}
+});
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/projects/{id}",
+	operationId: "getProject",
+	summary: "Get a project",
+	description: `Returns one project the caller can read. ${MEMBERSHIP_NOTE}`,
+	tags: ["Projects"],
+	auth: "apiKeyOrJwt",
+	scopes: READ_SCOPES,
+	pathParams: ProjectIdParamSchema,
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "The project.",
+			schema: ProjectResourceSchema
+		},
+		403: {
+			description: READ_FORBIDDEN,
+			schema: ScopeForbiddenErrorSchema
+		},
+		404: {
+			description: "No project with that id is visible to the caller. A project that exists but is not yours to read, a deleted project and a malformed id are all reported as 404, so project ids cannot be probed through this endpoint.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
 	codeSample: {
 		authToken: "b4m_live_<key>",
 		streaming: false,
 		body: {}
 	}
 });
+const CREATE_EXAMPLE = {
+	name: "Market research",
+	description: "Sources and notes for the Q3 market analysis.",
+	session_ids: [EXAMPLE_SESSION_ID],
+	file_ids: [EXAMPLE_FILE_ID]
+};
+defineEndpoint({
+	method: "post",
+	path: "/api/v1/projects",
+	operationId: "createProject",
+	summary: "Create a project",
+	description: `Creates a project owned by the caller, optionally grouping existing sessions and files in it. Every listed session and file must be readable by the caller. ${MEMBERSHIP_NOTE} Sharing the project later shares them too. Unknown body fields are rejected.`,
+	tags: ["Projects"],
+	auth: "apiKeyOrJwt",
+	scopes: ["projects:write"],
+	request: CreateProjectRequestSchema,
+	requestExample: CREATE_EXAMPLE,
+	emitsRateLimitHeaders: true,
+	responses: {
+		201: {
+			description: "The created project.",
+			schema: ProjectResourceSchema
+		},
+		400: {
+			description: "A listed session or file does not exist or is not readable by the caller, or the body is not valid JSON. Nothing is created.",
+			schema: ApiErrorSchema
+		},
+		403: {
+			description: "The API key lacks `projects:write`.",
+			schema: ScopeForbiddenErrorSchema
+		},
+		422: {
+			description: "Request body failed validation, or you already have a live project with this `name`.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: CREATE_EXAMPLE
+	}
+});
 /**
 * The fence language the model writes to place an inline map of search-result places in a reply.
 *
@@ -16337,6 +17519,7 @@ z$1.object({
 	createdAt: z$1.union([z$1.string(), z$1.date()]).optional(),
 	updatedAt: z$1.union([z$1.string(), z$1.date()]).optional()
 });
+new RegExp(`[аеорсхуіјѕԁһӏαονικρτυ]`, "g");
 const OPENER_STICKY = /<artifact/iy;
 const WHITESPACE$1 = /\s/;
 function isSpace(ch) {
@@ -16594,6 +17777,34 @@ function stripDeliveredArtifactBlocks(text, deliveredMarkup) {
 	}
 	return out + text.slice(cursor);
 }
+/**
+* The local token estimate counts every non-OpenAI model with tiktoken's cl100k_base, because tiktoken
+* has no other vendor's encoding (see TiktokenTokenizer in @bike4mind/utils). Claude's tokenizers spend
+* more tokens on the same text, so the raw count under-states Claude input. These multipliers scale it
+* back up to the model's own tokenizer.
+*
+* Measured 2026-10-01 against Bedrock input-token usage on 8 KB prose, markdown, TypeScript and JSON
+* samples. Each multiplier is the smallest ratio across those samples, rounded down, so a scaled estimate
+* stays a lower bound: it cannot over-reserve credits or reject a turn that actually fits.
+*/
+const CLAUDE_4_7_PLUS_MULTIPLIER = 1.5;
+const CLAUDE_4_5_MULTIPLIER = 1.09;
+const CLAUDE_FAMILY_VERSION = /(?:^|\.)claude-(?:opus|sonnet|haiku)-(\d+)(?:-(\d{1,2}))?(?=$|[-:])/;
+/**
+* Factor to scale a cl100k_base token count by for `modelId`. 1 for anything unmeasured: non-Claude
+* models, Claude before 4.5 (retired on Bedrock, could not be measured), and Fable (Bedrock rejects it
+* under the account's data-retention mode). Claude releases after 5.5 inherit the newest factor on the
+* assumption they keep its tokenizer; [BILLING_DRIFT] flags it if one does not.
+*/
+function tokenEstimateMultiplier(modelId) {
+	const match = modelId?.match(CLAUDE_FAMILY_VERSION);
+	if (!match) return 1;
+	const major = Number(match[1]);
+	const minor = Number(match[2] ?? 0);
+	if (major > 4 || major === 4 && minor >= 7) return CLAUDE_4_7_PLUS_MULTIPLIER;
+	if (major === 4 && minor >= 5) return CLAUDE_4_5_MULTIPLIER;
+	return 1;
+}
 [...IMAGE_SIZE_CONSTRAINTS.DALL_E_2.sizes, ...IMAGE_SIZE_CONSTRAINTS.DALL_E_3.sizes];
 /** Generation was cut off against the output-token ceiling. */
 const TRUNCATED_FINISH_REASON = "max_tokens";
@@ -16766,6 +17977,17 @@ z$1.array(triggerWordSchema).max(20, "Up to 20 trigger words allowed.").transfor
 	}
 	return out;
 });
+/**
+* Extension sets for files a quest tool drops onto `quest.images` (image_generation,
+* edit_image, music_generation, audio_generation, excel_generation, ...). Single source of
+* truth shared by the web renderer (PromptReplies.classifyGeneratedFiles) and the API file
+* classifier (server/utils/generatedFiles), so the two never drift on how a generated file
+* renders. Browser-safe (regex literals only) - importable from either build.
+*/
+const GENERATED_IMAGE_EXTENSION_RE = /\.(png|jpe?g|webp|gif|svg|bmp|avif)$/i;
+const GENERATED_KEY_UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+new RegExp(`^${GENERATED_KEY_UUID}\\.[a-z]+$`, "i");
+new RegExp(`^${GENERATED_KEY_UUID}\\.(?:png|jpe?g|webp|gif)$`);
 IMAGE_SIZE_CONSTRAINTS.BFL.minWidth, IMAGE_SIZE_CONSTRAINTS.BFL.maxWidth, IMAGE_SIZE_CONSTRAINTS.BFL.stepSize;
 const WHITESPACE = /\s/;
 const EQUALS_OPS = [
@@ -16864,7 +18086,7 @@ Array.from(new Set([
 	{
 		id: "opti.scheduling.problem",
 		section: "opti",
-		label: "Problem Editor",
+		label: "Scheduling Problem",
 		description: "Define and preview scheduling problems — job-shop matrix encoding",
 		navigationType: "action",
 		target: "scheduling.problem",
@@ -16881,7 +18103,7 @@ Array.from(new Set([
 	{
 		id: "opti.scheduling.solvers",
 		section: "opti",
-		label: "Solver Selection",
+		label: "Scheduling Solvers",
 		description: "Configure which solvers to race across a range of optimization strategies",
 		navigationType: "action",
 		target: "scheduling.solvers",
@@ -16957,6 +18179,37 @@ Array.from(new Set([
 			"path"
 		]
 	},
+	{
+		id: "opti.routing.problem",
+		section: "opti",
+		label: "Routing Problem",
+		description: "Define and preview routing problems: stops, vehicles, distances",
+		navigationType: "action",
+		target: "routing.problem",
+		keywords: [
+			"routing problem",
+			"stops",
+			"depot",
+			"vehicles",
+			"distances",
+			"route editor"
+		]
+	},
+	{
+		id: "opti.routing.solvers",
+		section: "opti",
+		label: "Routing Solvers",
+		description: "Choose which solvers to race on the routing problem",
+		navigationType: "action",
+		target: "routing.solvers",
+		keywords: [
+			"routing solvers",
+			"TSP solvers",
+			"route solvers",
+			"configure solvers",
+			"solver race"
+		]
+	},
 	{
 		id: "opti.packing",
 		section: "opti",
@@ -16973,6 +18226,37 @@ Array.from(new Set([
 			"space"
 		]
 	},
+	{
+		id: "opti.packing.problem",
+		section: "opti",
+		label: "Packing Problem",
+		description: "Define and preview packing problems: items, bins, capacities",
+		navigationType: "action",
+		target: "packing.problem",
+		keywords: [
+			"packing problem",
+			"items",
+			"bins",
+			"capacity",
+			"knapsack editor",
+			"container"
+		]
+	},
+	{
+		id: "opti.packing.solvers",
+		section: "opti",
+		label: "Packing Solvers",
+		description: "Choose which solvers to race on the packing problem",
+		navigationType: "action",
+		target: "packing.solvers",
+		keywords: [
+			"packing solvers",
+			"bin packing solvers",
+			"knapsack solvers",
+			"configure solvers",
+			"solver race"
+		]
+	},
 	{
 		id: "opti.network",
 		section: "opti",
@@ -16989,6 +18273,37 @@ Array.from(new Set([
 			"graph"
 		]
 	},
+	{
+		id: "opti.network.problem",
+		section: "opti",
+		label: "Network Problem",
+		description: "Define and preview network design problems: nodes, edges, facilities",
+		navigationType: "action",
+		target: "network.problem",
+		keywords: [
+			"network problem",
+			"nodes",
+			"edges",
+			"facilities",
+			"supply chain editor",
+			"graph"
+		]
+	},
+	{
+		id: "opti.network.solvers",
+		section: "opti",
+		label: "Network Solvers",
+		description: "Choose which solvers to race on the network design problem",
+		navigationType: "action",
+		target: "network.solvers",
+		keywords: [
+			"network solvers",
+			"flow solvers",
+			"facility solvers",
+			"configure solvers",
+			"solver race"
+		]
+	},
 	{
 		id: "opti.selection",
 		section: "opti",
@@ -17005,6 +18320,37 @@ Array.from(new Set([
 			"choose"
 		]
 	},
+	{
+		id: "opti.selection.problem",
+		section: "opti",
+		label: "Selection Problem",
+		description: "Define and preview selection problems: candidates, values, constraints",
+		navigationType: "action",
+		target: "selection.problem",
+		keywords: [
+			"selection problem",
+			"candidates",
+			"portfolio editor",
+			"subset",
+			"values",
+			"constraints"
+		]
+	},
+	{
+		id: "opti.selection.solvers",
+		section: "opti",
+		label: "Selection Solvers",
+		description: "Choose which solvers to race on the selection problem",
+		navigationType: "action",
+		target: "selection.solvers",
+		keywords: [
+			"selection solvers",
+			"portfolio solvers",
+			"subset solvers",
+			"configure solvers",
+			"solver race"
+		]
+	},
 	{
 		id: "opti.economic",
 		section: "opti",
@@ -17021,6 +18367,37 @@ Array.from(new Set([
 			"cost"
 		]
 	},
+	{
+		id: "opti.economic.problem",
+		section: "opti",
+		label: "Economic Problem",
+		description: "Define and preview economic problems: resources, prices, budgets",
+		navigationType: "action",
+		target: "economic.problem",
+		keywords: [
+			"economic problem",
+			"resources",
+			"prices",
+			"budget editor",
+			"allocation",
+			"costs"
+		]
+	},
+	{
+		id: "opti.economic.solvers",
+		section: "opti",
+		label: "Economic Solvers",
+		description: "Choose which solvers to race on the economic problem",
+		navigationType: "action",
+		target: "economic.solvers",
+		keywords: [
+			"economic solvers",
+			"allocation solvers",
+			"pricing solvers",
+			"configure solvers",
+			"solver race"
+		]
+	},
 	{
 		id: "opti.assignment",
 		section: "opti",
@@ -17037,6 +18414,37 @@ Array.from(new Set([
 			"assign"
 		]
 	},
+	{
+		id: "opti.assignment.problem",
+		section: "opti",
+		label: "Assignment Problem",
+		description: "Define and preview assignment problems: agents, tasks, cost matrix",
+		navigationType: "action",
+		target: "assignment.problem",
+		keywords: [
+			"assignment problem",
+			"agents",
+			"tasks",
+			"cost matrix",
+			"matching editor",
+			"workers"
+		]
+	},
+	{
+		id: "opti.assignment.solvers",
+		section: "opti",
+		label: "Assignment Solvers",
+		description: "Choose which solvers to race on the assignment problem",
+		navigationType: "action",
+		target: "assignment.solvers",
+		keywords: [
+			"assignment solvers",
+			"matching solvers",
+			"workforce solvers",
+			"configure solvers",
+			"solver race"
+		]
+	},
 	{
 		id: "opti.partitioning",
 		section: "opti",
@@ -17053,6 +18461,37 @@ Array.from(new Set([
 			"split"
 		]
 	},
+	{
+		id: "opti.partitioning.problem",
+		section: "opti",
+		label: "Partitioning Problem",
+		description: "Define and preview partitioning problems: graph, parts, balance",
+		navigationType: "action",
+		target: "partitioning.problem",
+		keywords: [
+			"partitioning problem",
+			"graph",
+			"parts",
+			"balance",
+			"cluster editor",
+			"partition editor"
+		]
+	},
+	{
+		id: "opti.partitioning.solvers",
+		section: "opti",
+		label: "Partitioning Solvers",
+		description: "Choose which solvers to race on the partitioning problem",
+		navigationType: "action",
+		target: "partitioning.solvers",
+		keywords: [
+			"partitioning solvers",
+			"clustering solvers",
+			"balancing solvers",
+			"configure solvers",
+			"solver race"
+		]
+	},
 	{
 		id: "admin.users",
 		section: "admin",
@@ -18736,6 +20175,7 @@ const CliConfigSchema = z$1.object({
 		* editing the config file directly.
 		*/
 		promptVariant: z$1.enum(["current", "minimal"]).optional().prefault("current"),
+		showThoughts: z$1.boolean().optional(),
 		subagentHistoryTtlMs: z$1.number().optional()
 	}),
 	tools: z$1.object({
@@ -19847,4 +21287,4 @@ var ConfigStore = class {
 	}
 };
 //#endregion
-export { hasDeliverablePinnedArtifact as $, DEGENERATE_FINISH_REASON as A, REVIEW_GATE_STATUS_VALUES as B, ARTIFACT_REMOVED_PLACEHOLDER as C, CREDIT_DEDUCT_TRANSACTION_TYPES as D, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as E, NotFoundError as F, WORK_ITEM_STATUSES as G, SUBQUEST_STATUS_VALUES as H, OllamaEmbeddingModel as I, filterToolArtifactMarkup as J, createThinkMarkerEscaper as K, OpenAIEmbeddingModel as L, MODEL_INFO_FIELD_GROUP_OF as M, McpServerName as N, ChatModels as O, ModelBackend as P, googleMapsSearchUrl as Q, PROMPT_TEXT_MAX as R, ARTIFACT_DELIVERED_PLACEHOLDER as S, BedrockEmbeddingModel as T, SupportedFabFileMimeTypes as U, SEARCH_RESULT_CARDS_LANGUAGE as V, VoyageAIEmbeddingModel as W, getMcpProviderMetadata as X, generatedAudioResponseSchema as Y, getQuestErrorCode as Z, requireApiUrl as _, actorKindMarker as _t, htmlErrorTitle as a, secureParameters as at, AGENT_QUEST_MANIFEST as b, APP_NAME as bt, loadContextFiles as c, stripDeliveredArtifactBlocks as ct, isReadOnlyTool as d, ttsBase64ResponseSchema as dt, isEarlyStop as et, ApiEndpointUnconfiguredError as f, ttsRequestSchema as ft, parseApiUrl as g, actorColorIndex as gt, getEnvironmentName as h, ACTOR_COLOR_SLOTS as ht, isValidSessionId as i, obfuscateApiKey as it, LOCATION_MAP_LANGUAGE as j, DEFAULT_TTS_PROVIDER as k, canTrustTool as l, stripToolArtifactMarkup as lt, getCreditsUrl as m, withRetry as mt, logger as n, isRetryableError as nt, htmlFirstH1 as o, signImageUrl as ot, LOCAL_DEV_URL as p, ttsResponseTooLargeSchema as pt, escapeThinkMarkers as q, SESSION_ID_PATTERN as r, isUserInitiatedAbort as rt, extractCompactInstructions as s, splitEquals as st, ConfigStore as t, isPlaceholderImageSigningSecret as tt, getToolCategory as u, supportedVoiceGenerationVendor as ut, resolveApiEndpoint as v, actorKindSchema as vt, ApiKeyType as w, AGENT_QUEST_MCP_URI as x, WEBSITE_URL as xt, AGENT_QUEST_ID as y, selfClaimedActorKindSchema as yt, PermissionDeniedError as z };
+export { escapeThinkMarkers as $, ChatModels as A, delegationPayloadSchema as At, NotFoundError as B, ARTIFACT_REMOVED_PLACEHOLDER as C, ttsResponseTooLargeSchema as Ct, BriefcasePromptIdSchema as D, actorColorIndex as Dt, BedrockEmbeddingModel as E, DELEGATION_PAYLOAD_SCHEMA_NAME as Et, ImagePromptResolutionSchema as F, REVIEW_GATE_STATUS_VALUES as G, OpenAIEmbeddingModel as H, LOCATION_MAP_LANGUAGE as I, SupportedFabFileMimeTypes as J, SEARCH_RESULT_CARDS_LANGUAGE as K, MODEL_INFO_FIELD_GROUP_OF as L, DEGENERATE_FINISH_REASON as M, APP_NAME as Mt, GENERATED_IMAGE_EXTENSION_RE as N, WEBSITE_URL as Nt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as O, actorKindMarker as Ot, ImageModels as P, createThinkMarkerEscaper as Q, McpServerName as R, ARTIFACT_DELIVERED_PLACEHOLDER as S, ttsRequestSchema as St, BRIEFCASE_CATALOG_QUERIES as T, ACTOR_COLOR_SLOTS as Tt, PROMPT_TEXT_MAX as U, OllamaEmbeddingModel as V, PermissionDeniedError as W, WORK_ITEM_STATUSES as X, VoyageAIEmbeddingModel as Y, buildPromptContext as Z, requireApiUrl as _, stripDeliveredArtifactBlocks as _t, htmlErrorTitle as a, hasDeliverablePinnedArtifact as at, AGENT_QUEST_MANIFEST as b, tokenEstimateMultiplier as bt, loadContextFiles as c, isRetryableError as ct, isReadOnlyTool as d, obfuscateApiKey as dt, filterToolArtifactMarkup as et, ApiEndpointUnconfiguredError as f, questReplyText as ft, parseApiUrl as g, splitEquals as gt, getEnvironmentName as h, signImageUrl as ht, isValidSessionId as i, googleMapsSearchUrl as it, DEFAULT_TTS_PROVIDER as j, selfClaimedActorKindSchema as jt, CREDIT_DEDUCT_TRANSACTION_TYPES as k, actorKindSchema as kt, canTrustTool as l, isUserInitiatedAbort as lt, getCreditsUrl as m, secureParameters as mt, logger as n, getMcpProviderMetadata as nt, htmlFirstH1 as o, isEarlyStop as ot, LOCAL_DEV_URL as p, replacePromptVariables as pt, SUBQUEST_STATUS_VALUES as q, SESSION_ID_PATTERN as r, getQuestErrorCode as rt, extractCompactInstructions as s, isPlaceholderImageSigningSecret as st, ConfigStore as t, generatedAudioResponseSchema as tt, getToolCategory as u, joinReplySlots as ut, resolveApiEndpoint as v, stripToolArtifactMarkup as vt, ApiKeyType as w, withRetry as wt, AGENT_QUEST_MCP_URI as x, ttsBase64ResponseSchema as xt, AGENT_QUEST_ID as y, supportedVoiceGenerationVendor as yt, ModelBackend as z };