@bike4mind/cli 3.0.0 → 3.2.0

package/dist/{ConfigStore-51UaP9pJ.mjs → ConfigStore-v0wgf0_j.mjs}

@@ -250,6 +250,19 @@ const StorageLimitErrorInfoSchema = z$1.object({
 	requested_bytes: z$1.number().nonnegative().describe("Size of the refused upload, in bytes."),
 	owner: z$1.enum(["user", "org"]).describe("Whose limit was hit: `user` or `org`. Always `user` for `file_too_large`, a platform-wide cap.")
 });
+/**
+* The refusal a caller gets when the limit belongs to someone else (an update-share editor growing
+* another user's file): the code and whose limit, without that owner's byte counts.
+*/
+const RedactedStorageLimitErrorInfoSchema = StorageLimitErrorInfoSchema.pick({
+	errorCode: true,
+	owner: true
+}).extend({
+	used_bytes: z$1.never().optional(),
+	limit_bytes: z$1.never().optional(),
+	requested_bytes: z$1.never().optional()
+});
+z$1.union([StorageLimitErrorInfoSchema, RedactedStorageLimitErrorInfoSchema]);
 function isZodError(err) {
 	return Boolean(err && (err instanceof ZodError || err.name === "ZodError"));
 }
@@ -269,6 +282,7 @@ var PermissionDeniedError = class extends Error {
 };
 const UNKNOWN_MODEL_ERROR_CODE = "unknown_model";
 const BILLING_ORGANIZATION_MISMATCH_ERROR_CODE = "billing_organization_mismatch";
+const REQUEST_TIMEOUT_ERROR_CODE = "request_timeout";
 const GROUP_TYPE_CATALOG = Object.freeze([
 	{
 		key: "sales",
@@ -777,6 +791,20 @@ const shareableDocumentSchema = z$1.object({
 	users: z$1.array(userShareSchema),
 	groups: z$1.array(groupShareSchema)
 });
+/** Bedrock's `[<scope>.]anthropic.` id prefix (any region or `global`), as regex source. Shared with isClaudeModelId. */
+const BEDROCK_ANTHROPIC_PREFIX = "(?:(?:[a-z-]+\\.)?anthropic\\.)?";
+const CLAUDE_MODEL_ID = new RegExp(`^${BEDROCK_ANTHROPIC_PREFIX}claude-(opus|sonnet|haiku|fable|mythos)-(\\d+)(?:-(\\d{1,2}))?(?=$|[:@[]|-(?:\\d{8}(?!\\d)|[a-z]))`);
+/** Family and version of a Claude id (native, Bedrock-scoped, dated or aliased); null for any other shape. */
+function parseClaudeModelId(modelId) {
+	const match = CLAUDE_MODEL_ID.exec(modelId);
+	if (!match) return null;
+	const [, family, major, minor] = match;
+	return {
+		family,
+		major: Number(major),
+		minor: minor === void 0 ? null : Number(minor)
+	};
+}
 /**
 * Model backends
 */
@@ -1032,6 +1060,7 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 }({});
 const CHAT_MODELS = Object.values(ChatModels);
 const supportedChatModels = z$1.enum(ChatModels);
+new RegExp(`^${BEDROCK_ANTHROPIC_PREFIX}claude-`);
 /**
 * Models that support OpenAI's `reasoning_effort` request parameter.
 * o1-preview and o1-mini do NOT support reasoning_effort.
@@ -3126,8 +3155,22 @@ z.object({
 	/** Set for job-backed generations; the save is idempotent per job. */
 	jobId: z.string().optional(),
 	prompt: z.string(),
+	/**
+	* Storing caps `prompt` at a prefix of what was generated (sourceMetadata rides every metadata-only
+	* listing). Written on every save, true when it was cut. Absent only on files saved before it existed:
+	* read it through isStoredPromptPossiblyTruncated, which covers those.
+	*/
+	promptTruncated: z.boolean().optional(),
 	lyrics: z.string().optional(),
-	durationSeconds: z.number().positive().optional()
+	durationSeconds: z.number().positive().optional(),
+	/** Speech: the requested voice; absent when the provider default was used or another provider stood in. */
+	voice: z.string().optional(),
+	/** Speech: the output format. */
+	format: z.string().optional(),
+	/** Speech: the requested language; absent when the provider auto-detected it. */
+	languageCode: z.string().optional(),
+	/** Sound effects: how closely the provider followed the prompt, 0-1. */
+	promptInfluence: z.number().min(0).max(1).optional()
 });
 /**
 * Why a generated file was not kept in the user's files. Never fatal: the output was already produced and
@@ -3613,6 +3656,199 @@ z$1.enum([
 	"investigate_soon",
 	"immediate_action"
 ]);
+const CompletionReasoningEffortSchema = z$1.enum([
+	"none",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+]);
+/**
+* Tool schema matching ICompletionOptionTools.toolSchema. The Zod surface only
+* covers wire-format fields (toolFn is server-side). Replaces the historical
+* z.array(z.any()) so client-side bugs (typos in name, missing type) surface
+* at parse time instead of failing silently inside the backend.
+*/
+const CompletionCustomToolSchema = z$1.object({
+	toolSchema: z$1.object({
+		name: z$1.string(),
+		description: z$1.string(),
+		parameters: z$1.object({
+			type: z$1.literal("object"),
+			properties: z$1.record(z$1.string(), z$1.any()).optional(),
+			additionalProperties: z$1.boolean().optional(),
+			required: z$1.array(z$1.string()).optional()
+		}).passthrough(),
+		strict: z$1.boolean().optional(),
+		defer_loading: z$1.boolean().optional().describe("Keep this definition out of the model context until the tool search server tool (or a `tool_reference`) loads it. Honoured only on models served by the direct Anthropic API whose `supports_tool_search` is true; on every other model (including Bedrock-served Claude, for now) it is ignored and the tool is sent as usual. At least one tool, or a `serverTool` entry, must stay non-deferred (`errorCode: \"all_tools_deferred\"`)."),
+		cache_control: z$1.unknown().optional().describe("Accepted for validation only and not forwarded. Rejected on a deferred tool (`errorCode: \"deferred_tool_cache_control\"`).")
+	}),
+	_isMcpTool: z$1.boolean().optional()
+});
+/** Anthropic's tool search server tools; `name` is fixed by `type`. */
+const ToolSearchServerToolSchema = z$1.discriminatedUnion("type", [z$1.object({
+	type: z$1.literal("tool_search_tool_regex_20251119"),
+	name: z$1.literal("tool_search_tool_regex")
+}), z$1.object({
+	type: z$1.literal("tool_search_tool_bm25_20251119"),
+	name: z$1.literal("tool_search_tool_bm25")
+})]);
+const CompletionServerToolSchema = z$1.object({ serverTool: ToolSearchServerToolSchema.describe("A provider-run tool, sent to the provider as `{ type, name }`. Only the Anthropic tool search tools exist today, and only on models served by the direct Anthropic API whose `supports_tool_search` is true; any other model, Bedrock-served Claude included, is refused with `errorCode: \"tool_search_unsupported\"` rather than run without it.") });
+/** One `tools[]` entry: a caller-defined tool, or a provider-run server tool. */
+const CompletionToolSchema = z$1.union([CompletionCustomToolSchema, CompletionServerToolSchema]);
+/**
+* The `errorCode`s of the completions 400s for tool search requests (CONVENTIONS.md section 1).
+* Assigned in services/cliCompletionsToolSearch.ts.
+*/
+const COMPLETION_TOOL_ERROR_CODES = [
+	"tool_search_unsupported",
+	"all_tools_deferred",
+	"deferred_tool_cache_control",
+	"unknown_tool_reference"
+];
+/**
+* JSON Schema definition for structured output. The `schema` field is a full
+* JSON Schema document (we don't try to validate JSON Schema with Zod - that's
+* the caller's contract with the model). `strict: true` is the default, matching
+* OpenAI's strict-mode subset semantics.
+*/
+const ResponseFormatSchema = z$1.discriminatedUnion("type", [z$1.object({ type: z$1.literal("text") }), z$1.object({
+	type: z$1.literal("json_schema"),
+	json_schema: z$1.object({
+		name: z$1.string(),
+		description: z$1.string().optional(),
+		schema: z$1.record(z$1.string(), z$1.any()),
+		strict: z$1.boolean().optional().default(true)
+	})
+})]);
+/**
+* Wire-format message for /api/ai/v1/completions. The optional `cache: true`
+* flag is honored by Anthropic (translated to `cache_control: { type: 'ephemeral' }`
+* with the appropriate beta header) and silently ignored by other providers.
+*/
+const CompletionMessageSchema = z$1.object({
+	role: z$1.enum([
+		"user",
+		"assistant",
+		"system"
+	]),
+	content: z$1.union([z$1.string(), z$1.array(z$1.any())]),
+	cache: z$1.boolean().optional()
+});
+/**
+* Schema for CLI LLM completion requests
+* Shared between Next.js API route (dev) and Lambda function (production)
+*
+* `response_format`, `stream`, `tools`, `temperature`, and `max_tokens` are all
+* accepted at the top level (OpenAI-compatible, matching how every major LLM
+* SDK shapes a completion request) AND nested under `options` (legacy shape).
+* Use `normalizeCompletionRequest()` to collapse both surfaces into the
+* canonical `options.<field>` location before downstream consumption.
+*/
+const CompletionRequestSchema = z$1.object({
+	model: z$1.string().max(256),
+	messages: z$1.array(CompletionMessageSchema),
+	response_format: ResponseFormatSchema.optional(),
+	stream: z$1.boolean().optional(),
+	tools: z$1.array(CompletionToolSchema).optional(),
+	temperature: z$1.number().optional(),
+	max_tokens: z$1.number().optional(),
+	options: z$1.object({
+		temperature: z$1.number().optional(),
+		maxTokens: z$1.number().optional(),
+		stream: z$1.boolean().optional(),
+		tools: z$1.array(CompletionToolSchema).optional(),
+		response_format: ResponseFormatSchema.optional(),
+		reasoningEffort: CompletionReasoningEffortSchema.optional().describe("Reasoning effort hint. Honoured by the OpenAI (reasoning models only, and not alongside tools on some of them), Kimi (K3 only), DeepSeek and Anthropic Claude (direct and Bedrock) adapters; each maps it onto its own scale. On Claude, `none` turns thinking off where the model allows it (otherwise it runs at the lowest effort), so short `max_tokens` replies stream visible text from the start; `minimal` maps to `low`. When `thinking.enabled` is also set on a Claude model, thinking stays on and this sets its effort instead, with `none` and `minimal` mapping to `low`. Claude models that reason inside `max_tokens` never have that ceiling raised, and on older Claude models any level above `none` turns thinking on (it is off by default there), forces temperature to 1 and drops top_p, and a thinking budget that cannot fit under `max_tokens` is skipped. On the direct Anthropic API, a json_schema `response_format` with no tools is served by a forced tool on models that support forced tool use, and that tool cannot run alongside thinking, so there only `none` is honoured; models served by native structured outputs honour every level. Silently ignored by every other adapter (Gemini, xAI, Ollama) and by non-reasoning models, so sending it there is a no-op."),
+		thinking: z$1.object({
+			enabled: z$1.boolean(),
+			budget_tokens: z$1.number().int().min(1024).optional()
+		}).optional().describe("Ask a model that can think to think on this turn. On Claude, `reasoningEffort` then sets how much it thinks, and `budget_tokens` (default 16000, minimum 1024) sizes thinking on older Claude models. Ignored by models that cannot think, and on the direct Anthropic API when a json_schema `response_format` is served by a forced tool, which cannot run alongside thinking.")
+	}).optional()
+});
+const CompletionUsageSchema = z$1.object({
+	inputTokens: z$1.number().optional(),
+	outputTokens: z$1.number().optional(),
+	reasoningTokens: z$1.number().optional().describe("Reasoning/thinking tokens the provider reported. A subset of outputTokens, not additive and not billed on top. Absent when the provider or adapter reports no count."),
+	cacheReadInputTokens: z$1.number().optional(),
+	cacheCreationInputTokens: z$1.number().optional()
+});
+const CompletionMetaEventSchema = z$1.object({
+	type: z$1.literal("meta"),
+	requestId: z$1.string()
+});
+const CompletionContentEventSchema = z$1.object({
+	type: z$1.enum(["content", "tool_use"]),
+	text: z$1.string(),
+	tools: z$1.array(z$1.object({
+		name: z$1.string(),
+		arguments: z$1.string().optional(),
+		id: z$1.string().optional()
+	})).optional(),
+	usage: CompletionUsageSchema.optional(),
+	credits: z$1.object({
+		used: z$1.number().optional(),
+		usdCost: z$1.number().optional()
+	}).optional(),
+	responseFormatMode: z$1.enum([
+		"native",
+		"tool_use",
+		"best-effort"
+	]).optional(),
+	stopReason: z$1.string().optional(),
+	thinking: z$1.array(z$1.any()).optional(),
+	toolStarted: z$1.object({
+		name: z$1.string(),
+		id: z$1.string().optional()
+	}).optional()
+});
+/**
+* Classifiers the completions `error` frame may carry: the persisted quest codes plus the two
+* provider codes. A separate tuple because QUEST_ERROR_CODES is stored on quests and must not widen.
+*/
+const COMPLETION_SSE_ERROR_CODES = [
+	...QUEST_ERROR_CODES,
+	"provider_error",
+	"provider_rejected",
+	"content_blocked"
+];
+/**
+* The in-band terminal failure frame, sent only once the stream has opened. Failures found before
+* the provider call (auth, scope, validation, rate limit, model, credits) are JSON errors with a
+* real status instead; see completions.contract.ts.
+*
+* `code` is the machine-readable classifier: a billing code when settlement runs out mid-generation,
+* `provider_rejected` / `provider_error` when the model provider fails, `content_blocked` when the
+* model's safety classifier declined the request. Optional; callers must never match on the prose
+* `message`.
+*
+* The field is `code` rather than the conventions' `errorCode` because this frame shipped that way
+* and is a published wire shape.
+*/
+const CompletionSseErrorEventSchema = z$1.object({
+	type: z$1.literal("error"),
+	message: z$1.string(),
+	requestId: z$1.string().optional(),
+	code: z$1.enum(COMPLETION_SSE_ERROR_CODES).optional()
+});
+/**
+* A provider content block the caller must echo back verbatim, in stream order, in the assistant
+* `messages` content of the next request: today the Anthropic tool search `server_tool_use` and
+* `tool_search_tool_result` blocks. Never executed by the caller and never answered with a tool_result.
+*/
+const CompletionProviderBlockEventSchema = z$1.object({
+	type: z$1.literal("provider_block"),
+	provider: z$1.literal("anthropic"),
+	block: z$1.record(z$1.string(), z$1.unknown())
+});
+/** One `data:` event in the `text/event-stream` completions response. */
+const CompletionStreamEventSchema = z$1.union([
+	CompletionMetaEventSchema,
+	CompletionContentEventSchema,
+	CompletionProviderBlockEventSchema,
+	CompletionSseErrorEventSchema
+]);
 /** Splits on the marker tokens, keeping them in the result so a scan can track nesting depth. */
 const THINK_TAG_TOKENS = /(<think>|<\/think>)/g;
 /**
@@ -3750,8 +3986,8 @@ const invalid = (reason) => ({
 	status: "invalid",
 	reason
 });
-const FENCE_OPEN_LINE = /^[ \t]*(`{3,}|~{3,})(.*)$/;
-const FENCE_CLOSE_LINE = /^[ \t]*(`{3,}|~{3,})[ \t]*$/;
+const FENCE_OPEN_LINE$1 = /^[ \t]*(`{3,}|~{3,})(.*)$/;
+const FENCE_CLOSE_LINE$1 = /^[ \t]*(`{3,}|~{3,})[ \t]*$/;
 /**
 * Offset where a slot's visible answer starts: just past its last top-level `</think>`, 0 when it
 * has none, or null while a `<think>` is still open. Depth-tracked to match visibleReplyText in
@@ -3781,7 +4017,7 @@ function findLastChoicesFence(text) {
 		const lineEnd = newline === -1 ? text.length : newline;
 		const line = text.slice(lineStart, lineEnd).replace(/\r$/, "");
 		if (!open) {
-			const match = line.match(FENCE_OPEN_LINE);
+			const match = line.match(FENCE_OPEN_LINE$1);
 			if (match && !(match[1][0] === "`" && match[2].includes("`"))) open = {
 				start: lineStart,
 				bodyStart: newline === -1 ? text.length : newline + 1,
@@ -3789,7 +4025,7 @@ function findLastChoicesFence(text) {
 				isChoices: match[1] === "```" && match[2].trim().toLowerCase() === "choices"
 			};
 		} else {
-			const match = line.match(FENCE_CLOSE_LINE);
+			const match = line.match(FENCE_CLOSE_LINE$1);
 			if (match && match[1][0] === open.marker[0] && match[1].length >= open.marker.length) {
 				if (open.isChoices) last = {
 					start: open.start,
@@ -4796,6 +5032,13 @@ z$1.object({
 		reason: z$1.enum(REPLY_CHOICES_INVALID_REASONS).optional()
 	}).optional(),
 	/**
+	* Set when finalize stripped a tool call the model wrote into its reply as text instead of
+	* calling it (see ../utils/narratedToolCalls.ts). The call never ran; `toolNames` are the
+	* offered tools it named. Absent when nothing was stripped. Consumers read this rather than
+	* matching the reply text, which no longer carries the call.
+	*/
+	narratedToolCall: z$1.object({ toolNames: z$1.array(z$1.string()) }).optional(),
+	/**
 	* Set when an emitted artifact looks voluntarily abbreviated - placeholder comments in
 	* place of real code, or calls into functions that were never defined. The complement to
 	* `finishReason === 'max_tokens'`: truncation is a hard stop the provider reports, elision
@@ -5016,6 +5259,17 @@ const ApiErrorSchema = z$1.object({
 */
 const InsufficientCreditsErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.enum(QUEST_ERROR_CODES).optional() });
 /**
+* 504 for a `wait: true` turn that ran past the request deadline. The turn is already settled
+* (timed out, unused credits refunded) when this is sent; `quest_id` is the quest to poll and
+* `sessionId` is the notebook the turn was recorded in, so a caller that sent no `sessionId` can
+* continue the conversation it just started (same field name as the ACK and the `wait: true` body).
+*/
+const ChatWaitTimeoutErrorSchema = ApiErrorSchema.extend({
+	errorCode: z$1.literal(REQUEST_TIMEOUT_ERROR_CODE),
+	quest_id: z$1.string(),
+	sessionId: z$1.string().optional()
+});
+/**
 * 400 for an upload refused on size or quota. The typed members are optional because the same 400 also
 * covers errors that carry none (an unsupported file type); when `errorCode` is present all five arrive
 * together, which the endpoint's 400 description states for integrators.
@@ -5023,8 +5277,11 @@ const InsufficientCreditsErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.en
 const StorageLimitErrorSchema = ApiErrorSchema.extend(StorageLimitErrorInfoSchema.partial().shape);
 /** 503 when this deployment has no usable key for a provider the request needs (data-lake search, voice). */
 const ProviderNotConfiguredErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal("provider_not_configured").optional() });
-/** 400 for a `model` the caller cannot use; `errorCode` is absent on the other 400s (e.g. malformed JSON). */
-const UnknownModelErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal(UNKNOWN_MODEL_ERROR_CODE).optional() });
+/**
+* 400 for a `model` the caller cannot use, or a refused tool search request; `errorCode` is absent on the
+* other 400s (e.g. malformed JSON).
+*/
+const CompletionsBadRequestErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.enum([UNKNOWN_MODEL_ERROR_CODE, ...COMPLETION_TOOL_ERROR_CODES]).optional() });
 /**
 * Error envelope for the 403 apiKeyAuth (apps/client/server/middlewares/apiKeyAuth.ts)
 * throws when an API key lacks a route's scopes. It names what the ROUTE requires,
@@ -5205,6 +5462,16 @@ const MUSIC_VALIDATION_ERROR_CODES = [
 	"lyrics_with_instrumental",
 	"lyrics_too_long"
 ];
+/**
+* Building blocks for entity response schemas held to an entity's key list (see
+* selfUserResponseSchema in ./user.ts for the full rationale). A passthrough value is
+* `z.unknown()`: the boundary enforces WHICH keys leave the server, not their types, so a
+* legacy value on a long-lived Mongo document can never 500 a read.
+*/
+const passthroughField = z$2.unknown().optional();
+function passthroughShape(fields) {
+	return Object.fromEntries(Object.keys(fields).map((field) => [field, passthroughField]));
+}
 z$2.enum([
 	"",
 	"TFG",
@@ -5352,10 +5619,6 @@ const SELF_VIEW_PASSTHROUGH_FIELDS = {
 	currentCredits: true,
 	lastCreditsPurchasedAt: true
 };
-const passthroughField = z$2.unknown().optional();
-function passthroughShape(fields) {
-	return Object.fromEntries(Object.keys(fields).map((field) => [field, passthroughField]));
-}
 /** A redacted integration object: only the named non-secret subfields survive. */
 function redactedSubdocument(fields) {
 	return z$2.object(passthroughShape(Object.fromEntries(fields.map((field) => [field, true])))).nullable().optional();
@@ -5942,34 +6205,95 @@ function parseCidr(raw) {
 		prefix: Number(value.slice(slash + 1))
 	};
 }
-function cidrContains(cidr, address) {
-	const target = addressBytes(address);
-	if (!target || target.version !== cidr.version) return false;
-	for (let bit = 0; bit < cidr.prefix; bit++) {
+/**
+* Networks a private-network opt-in never reaches, whatever the operator lists, self-host included.
+* One list for both sides: the settings validator refuses any range that overlaps an entry, and the
+* fetch path (`buildNeverAdmitted` in fab-pipeline's pinnedFetch.ts) refuses these at connect time.
+* IPv4 entries also cover their IPv4-mapped IPv6 forms (`::ffff:0:0/96`) on both sides.
+*/
+const NEVER_ADMITTED_NETWORKS = [
+	{
+		cidr: "0.0.0.0/8",
+		label: "this network"
+	},
+	{
+		cidr: "127.0.0.0/8",
+		label: "loopback"
+	},
+	{
+		cidr: "169.254.0.0/16",
+		label: "link-local, including cloud metadata"
+	},
+	{
+		cidr: "100.100.100.200/32",
+		label: "cloud metadata"
+	},
+	{
+		cidr: "fd00:ec2::254/128",
+		label: "cloud metadata"
+	},
+	{
+		cidr: "64:ff9b::a9fe:a9fe/128",
+		label: "cloud metadata"
+	},
+	{
+		cidr: "::/128",
+		label: "unspecified"
+	},
+	{
+		cidr: "::1/128",
+		label: "loopback"
+	},
+	{
+		cidr: "fe80::/10",
+		label: "link-local"
+	}
+];
+const IPV4_MAPPED_PREFIX = [
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	255,
+	255
+];
+/** An IPv4 CIDR in its IPv4-mapped IPv6 form; other CIDRs unchanged. */
+function asIpv6(cidr) {
+	if (cidr.version === 6) return cidr;
+	return {
+		version: 6,
+		bytes: [...IPV4_MAPPED_PREFIX, ...cidr.bytes],
+		prefix: cidr.prefix + 96
+	};
+}
+function cidrsOverlap(a, b) {
+	const [left, right] = a.version === b.version ? [a, b] : [asIpv6(a), asIpv6(b)];
+	const prefix = Math.min(left.prefix, right.prefix);
+	for (let bit = 0; bit < prefix; bit++) {
 		const byte = bit >> 3;
 		const mask = 128 >> (bit & 7);
-		if (((cidr.bytes[byte] ?? 0) & mask) !== ((target.bytes[byte] ?? 0) & mask)) return false;
+		if (((left.bytes[byte] ?? 0) & mask) !== ((right.bytes[byte] ?? 0) & mask)) return false;
 	}
 	return true;
 }
-/**
-* Cloud instance-metadata endpoints, plus the IPv4 one in its IPv4-mapped and NAT64 IPv6 forms.
-* Never reachable through `customMcpAllowPrivateNetworks`, self-host included.
-*/
-const CLOUD_METADATA_ADDRESSES = [
-	"169.254.169.254",
-	"fd00:ec2::254",
-	"::ffff:169.254.169.254",
-	"64:ff9b::169.254.169.254"
-];
+const NEVER_ADMITTED_PARSED = NEVER_ADMITTED_NETWORKS.map((entry) => ({
+	...entry,
+	parsed: parseCidr(entry.cidr)
+}));
 /** Why `raw` may not be allowed as a private network, or null when it may. */
 function customMcpPrivateCidrProblem(raw) {
 	const cidr = parseCidr(raw);
 	if (!cidr) return "Must be a CIDR such as 10.0.0.0/8 or fd12:3456::/32";
 	const minPrefix = CUSTOM_MCP_MIN_CIDR_PREFIX[cidr.version];
 	if (cidr.prefix < minPrefix) return `IPv${cidr.version} ranges must be /${minPrefix} or narrower`;
-	const metadata = CLOUD_METADATA_ADDRESSES.find((address) => cidrContains(cidr, address));
-	if (metadata) return `Range covers the cloud metadata address ${metadata}`;
+	const blocked = NEVER_ADMITTED_PARSED.find((entry) => cidrsOverlap(cidr, entry.parsed));
+	if (blocked) return `Range overlaps ${blocked.cidr} (${blocked.label}), which is never reachable`;
 	return null;
 }
 const CustomMcpPrivateCidrSchema = z$1.string().trim().toLowerCase().superRefine((value, ctx) => {
@@ -6973,8 +7297,8 @@ const CustomMcpPolicySchema = z$1.object({
 const CustomMcpBlockedHostsSchema = z$1.object({ hosts: McpHostPatternListSchema.default([]) });
 /**
 * Self-host only; hosted deployments never reach private networks regardless of this value. Each
-* CIDR is strictly parsed, at least /8 (IPv4) or /16 (IPv6), and never covers a cloud metadata
-* address (see customMcpHosts.ts).
+* CIDR is strictly parsed, at least /8 (IPv4) or /16 (IPv6), and never overlaps a network the fetch
+* path refuses anyway (NEVER_ADMITTED_NETWORKS in customMcpHosts.ts).
 */
 const CustomMcpAllowPrivateNetworksSchema = z$1.object({
 	cidrs: z$1.array(CustomMcpPrivateCidrSchema).max(100).default([]),
@@ -11686,16 +12010,8 @@ const CliCompletionRequestAction = z$1.object({
 		temperature: z$1.number().optional(),
 		maxTokens: z$1.number().optional(),
 		stream: z$1.boolean().optional(),
-		tools: z$1.array(z$1.unknown()).optional(),
-		response_format: z$1.discriminatedUnion("type", [z$1.object({ type: z$1.literal("text") }), z$1.object({
-			type: z$1.literal("json_schema"),
-			json_schema: z$1.object({
-				name: z$1.string(),
-				description: z$1.string().optional(),
-				schema: z$1.record(z$1.string(), z$1.any()),
-				strict: z$1.boolean().optional().default(true)
-			})
-		})]).optional()
+		tools: z$1.array(CompletionToolSchema).optional(),
+		response_format: ResponseFormatSchema.optional()
 	}).optional()
 });
 /**
@@ -12184,7 +12500,7 @@ const VoiceCreditsExhaustedAction = z$1.object({
 const CliCompletionChunkAction = z$1.object({
 	action: z$1.literal("cli_completion_chunk"),
 	requestId: z$1.string(),
-	chunk: z$1.object({
+	chunk: z$1.union([z$1.object({
 		type: z$1.enum(["content", "tool_use"]),
 		text: z$1.string(),
 		toolStarted: z$1.object({
@@ -12197,7 +12513,7 @@ const CliCompletionChunkAction = z$1.object({
 			outputTokens: z$1.number().optional()
 		}).optional(),
 		thinking: z$1.array(z$1.unknown()).optional()
-	})
+	}), CompletionProviderBlockEventSchema])
 });
 /**
 * CLI Completion stream finished successfully
@@ -12214,7 +12530,9 @@ const CliCompletionErrorAction = z$1.object({
 	requestId: z$1.string(),
 	error: z$1.string(),
 	/** Seconds until the caller's rate-limit window reopens; present only on a rate-limit refusal. */
-	retryAfter: z$1.number().optional()
+	retryAfter: z$1.number().optional(),
+	/** Machine-readable reason on a request the caller must fix (a 4xx), e.g. `tool_search_unsupported`. */
+	errorCode: z$1.string().optional()
 });
 /**
 * CLI Tool execution response over WebSocket
@@ -12860,7 +13178,17 @@ const AgentProgressAction = z$1.object({
 	executionId: z$1.string(),
 	status: z$1.string().optional(),
 	creditsUsed: z$1.number().optional(),
-	iteration: z$1.number().optional()
+	iteration: z$1.number().optional(),
+	questId: z$1.string().optional(),
+	generationJobs: z$1.array(z$1.object({
+		id: z$1.string(),
+		kind: z$1.enum(GENERATION_JOB_KINDS)
+	})).optional(),
+	pendingAction: z$1.object({
+		tool: z$1.string(),
+		params: z$1.record(z$1.string(), z$1.unknown()),
+		ts: z$1.number()
+	}).optional()
 });
 const AgentCompletedAction = z$1.object({
 	action: z$1.literal("completed"),
@@ -13324,165 +13652,6 @@ const AgentExecutionStatusResponseSchema = z$1.object({
 });
 /** Path parameter for `GET /api/v1/agent-executions/{id}`. */
 const AgentExecutionIdParamSchema = z$1.object({ id: z$1.string().min(1) });
-const CompletionReasoningEffortSchema = z$1.enum([
-	"none",
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh"
-]);
-/**
-* Tool schema matching ICompletionOptionTools.toolSchema. The Zod surface only
-* covers wire-format fields (toolFn is server-side). Replaces the historical
-* z.array(z.any()) so client-side bugs (typos in name, missing type) surface
-* at parse time instead of failing silently inside the backend.
-*/
-const CompletionToolSchema = z$1.object({
-	toolSchema: z$1.object({
-		name: z$1.string(),
-		description: z$1.string(),
-		parameters: z$1.object({
-			type: z$1.literal("object"),
-			properties: z$1.record(z$1.string(), z$1.any()).optional(),
-			additionalProperties: z$1.boolean().optional(),
-			required: z$1.array(z$1.string()).optional()
-		}).passthrough(),
-		strict: z$1.boolean().optional()
-	}),
-	_isMcpTool: z$1.boolean().optional()
-});
-/**
-* JSON Schema definition for structured output. The `schema` field is a full
-* JSON Schema document (we don't try to validate JSON Schema with Zod - that's
-* the caller's contract with the model). `strict: true` is the default, matching
-* OpenAI's strict-mode subset semantics.
-*/
-const ResponseFormatSchema = z$1.discriminatedUnion("type", [z$1.object({ type: z$1.literal("text") }), z$1.object({
-	type: z$1.literal("json_schema"),
-	json_schema: z$1.object({
-		name: z$1.string(),
-		description: z$1.string().optional(),
-		schema: z$1.record(z$1.string(), z$1.any()),
-		strict: z$1.boolean().optional().default(true)
-	})
-})]);
-/**
-* Wire-format message for /api/ai/v1/completions. The optional `cache: true`
-* flag is honored by Anthropic (translated to `cache_control: { type: 'ephemeral' }`
-* with the appropriate beta header) and silently ignored by other providers.
-*/
-const CompletionMessageSchema = z$1.object({
-	role: z$1.enum([
-		"user",
-		"assistant",
-		"system"
-	]),
-	content: z$1.union([z$1.string(), z$1.array(z$1.any())]),
-	cache: z$1.boolean().optional()
-});
-/**
-* Schema for CLI LLM completion requests
-* Shared between Next.js API route (dev) and Lambda function (production)
-*
-* `response_format`, `stream`, `tools`, `temperature`, and `max_tokens` are all
-* accepted at the top level (OpenAI-compatible, matching how every major LLM
-* SDK shapes a completion request) AND nested under `options` (legacy shape).
-* Use `normalizeCompletionRequest()` to collapse both surfaces into the
-* canonical `options.<field>` location before downstream consumption.
-*/
-const CompletionRequestSchema = z$1.object({
-	model: z$1.string().max(256),
-	messages: z$1.array(CompletionMessageSchema),
-	response_format: ResponseFormatSchema.optional(),
-	stream: z$1.boolean().optional(),
-	tools: z$1.array(CompletionToolSchema).optional(),
-	temperature: z$1.number().optional(),
-	max_tokens: z$1.number().optional(),
-	options: z$1.object({
-		temperature: z$1.number().optional(),
-		maxTokens: z$1.number().optional(),
-		stream: z$1.boolean().optional(),
-		tools: z$1.array(CompletionToolSchema).optional(),
-		response_format: ResponseFormatSchema.optional(),
-		reasoningEffort: CompletionReasoningEffortSchema.optional().describe("Reasoning effort hint. Honoured by the OpenAI (reasoning models only, and not alongside tools on some of them), Kimi (K3 only), DeepSeek and Anthropic Claude (direct and Bedrock) adapters; each maps it onto its own scale. On Claude, `none` turns thinking off where the model allows it (otherwise it runs at the lowest effort), so short `max_tokens` replies stream visible text from the start; `minimal` maps to `low`. When `thinking.enabled` is also set on a Claude model, thinking stays on and this sets its effort instead, with `none` and `minimal` mapping to `low`. Claude models that reason inside `max_tokens` never have that ceiling raised, and on older Claude models any level above `none` turns thinking on (it is off by default there), forces temperature to 1 and drops top_p, and a thinking budget that cannot fit under `max_tokens` is skipped. On the direct Anthropic API, a json_schema `response_format` with no tools is served by a forced tool on models that support forced tool use, and that tool cannot run alongside thinking, so there only `none` is honoured; models served by native structured outputs honour every level. Silently ignored by every other adapter (Gemini, xAI, Ollama) and by non-reasoning models, so sending it there is a no-op."),
-		thinking: z$1.object({
-			enabled: z$1.boolean(),
-			budget_tokens: z$1.number().int().min(1024).optional()
-		}).optional().describe("Ask a model that can think to think on this turn. On Claude, `reasoningEffort` then sets how much it thinks, and `budget_tokens` (default 16000, minimum 1024) sizes thinking on older Claude models. Ignored by models that cannot think, and on the direct Anthropic API when a json_schema `response_format` is served by a forced tool, which cannot run alongside thinking.")
-	}).optional()
-});
-const CompletionUsageSchema = z$1.object({
-	inputTokens: z$1.number().optional(),
-	outputTokens: z$1.number().optional(),
-	reasoningTokens: z$1.number().optional().describe("Reasoning/thinking tokens the provider reported. A subset of outputTokens, not additive and not billed on top. Absent when the provider or adapter reports no count."),
-	cacheReadInputTokens: z$1.number().optional(),
-	cacheCreationInputTokens: z$1.number().optional()
-});
-const CompletionMetaEventSchema = z$1.object({
-	type: z$1.literal("meta"),
-	requestId: z$1.string()
-});
-const CompletionContentEventSchema = z$1.object({
-	type: z$1.enum(["content", "tool_use"]),
-	text: z$1.string(),
-	tools: z$1.array(z$1.object({
-		name: z$1.string(),
-		arguments: z$1.string().optional(),
-		id: z$1.string().optional()
-	})).optional(),
-	usage: CompletionUsageSchema.optional(),
-	credits: z$1.object({
-		used: z$1.number().optional(),
-		usdCost: z$1.number().optional()
-	}).optional(),
-	responseFormatMode: z$1.enum([
-		"native",
-		"tool_use",
-		"best-effort"
-	]).optional(),
-	stopReason: z$1.string().optional(),
-	thinking: z$1.array(z$1.any()).optional(),
-	toolStarted: z$1.object({
-		name: z$1.string(),
-		id: z$1.string().optional()
-	}).optional()
-});
-/**
-* Classifiers the completions `error` frame may carry: the persisted quest codes plus the two
-* provider codes. A separate tuple because QUEST_ERROR_CODES is stored on quests and must not widen.
-*/
-const COMPLETION_SSE_ERROR_CODES = [
-	...QUEST_ERROR_CODES,
-	"provider_error",
-	"provider_rejected",
-	"content_blocked"
-];
-/**
-* The in-band terminal failure frame, sent only once the stream has opened. Failures found before
-* the provider call (auth, scope, validation, rate limit, model, credits) are JSON errors with a
-* real status instead; see completions.contract.ts.
-*
-* `code` is the machine-readable classifier: a billing code when settlement runs out mid-generation,
-* `provider_rejected` / `provider_error` when the model provider fails, `content_blocked` when the
-* model's safety classifier declined the request. Optional; callers must never match on the prose
-* `message`.
-*
-* The field is `code` rather than the conventions' `errorCode` because this frame shipped that way
-* and is a published wire shape.
-*/
-const CompletionSseErrorEventSchema = z$1.object({
-	type: z$1.literal("error"),
-	message: z$1.string(),
-	requestId: z$1.string().optional(),
-	code: z$1.enum(COMPLETION_SSE_ERROR_CODES).optional()
-});
-/** One `data:` event in the `text/event-stream` completions response. */
-const CompletionStreamEventSchema = z$1.union([
-	CompletionMetaEventSchema,
-	CompletionContentEventSchema,
-	CompletionSseErrorEventSchema
-]);
 /**
 * Server-side tool execution schemas for POST /api/ai/v1/tools.
 *
@@ -14808,6 +14977,93 @@ const CreateSessionRequestSchema = z$1.object({
 	tags: z$1.array(SessionTagSchema).optional(),
 	lastUsedModel: z$1.string().nullish()
 });
+z$2.object(passthroughShape({
+	id: true,
+	createdAt: true,
+	updatedAt: true,
+	name: true,
+	description: true,
+	type: true,
+	organizationId: true
+})).extend({
+	memberIds: z$2.array(z$2.string()),
+	memberCount: z$2.number()
+});
+z$2.object(passthroughShape({
+	id: true,
+	createdAt: true,
+	updatedAt: true,
+	deletedAt: true,
+	sessionId: true,
+	conversationItemId: true,
+	openaiMessageId: true,
+	claudeMessageId: true,
+	type: true,
+	timestamp: true,
+	prompt: true,
+	fabFileIds: true,
+	agentIds: true,
+	reply: true,
+	replies: true,
+	structuredReplies: true,
+	toolResults: true,
+	questMasterReply: true,
+	images: true,
+	videos: true,
+	videoJobIds: true,
+	generationJobs: true,
+	agentVideoClipsClaimed: true,
+	agentMusicTracksClaimed: true,
+	oob: true,
+	promptMeta: true,
+	status: true,
+	creditsUsed: true,
+	errorCode: true,
+	questMasterPlanId: true,
+	agentExecutionId: true,
+	correctsQuestId: true,
+	clientFirstTokenTime: true,
+	routingSource: true,
+	pinned: true,
+	researchModeResults: true,
+	deepResearchState: true,
+	fallbackInfo: true,
+	promptEnhancement: true,
+	pendingAction: true,
+	attachmentNotices: true,
+	attachmentDelivery: true,
+	navigationIntents: true,
+	suggestedChoices: true,
+	attachmentList: true,
+	uiSideEffects: true,
+	jupyterNotebook: true
+}));
+const questMasterPlanResponseSchema = z$2.object(passthroughShape({
+	id: true,
+	createdAt: true,
+	updatedAt: true,
+	notebookId: true,
+	goal: true,
+	quests: true,
+	userId: true,
+	visibility: true,
+	state: true,
+	lastAccessedAt: true,
+	sessionHistory: true,
+	metrics: true,
+	tags: true,
+	priority: true,
+	parentPlanId: true,
+	sharedWith: true,
+	handoff: true,
+	blockers: true,
+	decisions: true
+}));
+z$2.array(questMasterPlanResponseSchema);
+z$2.object({
+	success: z$2.literal(true),
+	plan: questMasterPlanResponseSchema
+}).extend({ metrics: passthroughField });
 z$1.preprocess((val) => {
 	if (typeof val === "string") {
 		if (val.toLowerCase() === "true") return true;
@@ -16114,8 +16370,8 @@ const ListModelsResponseSchema = paginatedResponseSchema(z$1.object({
 	reasons_within_output_budget: z$1.boolean().describe("Whether reasoning tokens are spent inside `max_output_tokens` on every turn. When true, a small `max_tokens` can be used up by reasoning alone and return an empty reply, so leave room above the answer you expect."),
 	reasoning_efforts: z$1.array(CompletionReasoningEffortSchema).describe("The `reasoningEffort` levels this model acts on, lowest first; empty when it ignores the option. `none` is listed only where it turns reasoning off. Each level is mapped to the nearest one the provider offers. A listed level can still be dropped on one request: some OpenAI models drop it on tool turns, and Claude models with a fixed thinking budget drop it when `max_tokens` leaves no room for the budget plus the answer."),
 	supports_tools: z$1.boolean(),
-	supports_tool_search: z$1.boolean().describe("Whether the model accepts the tool search server tool and `defer_loading: true` on tool definitions, so a large tool catalog is searched on demand instead of loaded into context up front. Describes the model only: `/api/ai/v1/completions` does not accept these yet."),
-	supports_tool_changes: z$1.boolean().describe("Whether a system-role message can carry `tool_addition` and `tool_removal` blocks, which add or remove a declared tool mid-conversation. Describes the model only: `/api/ai/v1/completions` does not accept these blocks yet."),
+	supports_tool_search: z$1.boolean().describe("Whether the model accepts the tool search server tool and `defer_loading: true` on tool definitions, so a large tool catalog is searched on demand instead of loaded into context up front. Describes the model: `/api/ai/v1/completions` honours it only for models whose `backend` is `anthropic`. A `bedrock` model with this flag set is not served with tool search there yet: a `serverTool` entry is refused with `errorCode: \"tool_search_unsupported\"` and `defer_loading` is ignored."),
+	supports_tool_changes: z$1.boolean().describe("Whether a system-role message can carry `tool_addition` and `tool_removal` blocks, which add or remove a declared tool mid-conversation. Describes the model only: `/api/ai/v1/completions` does not accept these blocks yet, and will accept them first for models whose `backend` is `anthropic`."),
 	supports_vision: z$1.boolean(),
 	deprecation_date: z$1.string().nullable().describe("`YYYY-MM-DD`; null when no retirement is scheduled."),
 	replaced_by: z$1.string().nullable().describe("The id of the recommended successor, when there is one."),
@@ -16509,7 +16765,12 @@ z$1.object({
 	* Session-creation input, not a completion parameter, so it is applied only when `sessionId`
 	* is absent; ignored when an existing session is resolved.
 	*/
-	agentIds: z$1.array(z$1.string()).optional()
+	agentIds: z$1.array(z$1.string()).optional(),
+	/**
+	* The subset of `messageFileIds` the user scoped to this message only. Every other notebook-scope
+	* message attachment is pinned to the session so it stays in context on later turns.
+	*/
+	messageOnlyFileIds: z$1.array(z$1.string()).optional()
 });
 /**
 * Response shapes for the public image endpoints (`generateImage` / `editImage`,
@@ -16832,7 +17093,7 @@ defineEndpoint({
 	path: "/api/chat",
 	operationId: "sendChatMessage",
 	summary: "Send a chat message",
-	description: "Sends a message to the AI and creates a quest to process it. By default (async) the call returns immediately with a quest id; poll `GET /api/v1/quests/{id}` for the reply. Send `wait: true` to block until the reply is ready and receive it inline. A tool that produced machine-readable state reports it under `toolPayloads` - an array of `{ type, payload }` entries in emission order, alongside (never instead of) the prose reply - on the `wait: true` body and on the polled quest. A turn can FAIL after the ACK - reported on the polled quest as `type: \"error\"`, since the ACK was already sent. A terminal `status: \"stopped\"` (a missing session, a user-cancelled turn) is ALSO a failure even without `type: \"error\"` - it carries an explanatory string in `reply`/`replies` rather than an answer. `type` is the failure signal for the classified failure classes (an abort, a provider timeout, credit exhaustion); `errorCode` is an optional refinement present only when the failure is a classified billing reason. A recovered stuck quest is NOT in that list: one that still has renderable content resolves as a success by design. `QUEST_ERROR_CODES` has two members, but only `insufficient_credits` is raised as a quest errorCode by any current throw site on this endpoint - `spend_cap_exceeded` is thrown only by the embed chat route's pre-flight, which fires outside the process try/catch that would classify it onto a quest. A caller must treat `type: \"error\"` OR a terminal `status: \"stopped\"` as failure even when `errorCode` is absent, and must not read `reply` as an answer without checking those first. Authenticate with an API key (`b4m_live_`) or a JWT. Session resolution: pass `sessionId` to continue an existing notebook. An API-key caller that omits it gets a BRAND-NEW notebook rather than the notebook the human last had open, and `newConversation: true` forces a new notebook for any auth mode; both return the new id as `sessionId`, so the caller can continue the conversation by passing it back. A first-party JWT caller that omits `sessionId` keeps the last-opened-notebook fallback. Sending `sessionId` and `newConversation` together is a 422.",
+	description: "Sends a message to the AI and creates a quest to process it. By default (async) the call returns immediately with a quest id; poll `GET /api/v1/quests/{id}` for the reply. Send `wait: true` to block until the reply is ready and receive it inline. A `wait: true` turn is bounded at about 45 seconds: one that runs longer is ended (unused credits refunded) and answered with a 504 naming the quest in `quest_id`. Send long or tool-heavy turns (large attachments, tool calls) in the default async mode and poll instead. A tool that produced machine-readable state reports it under `toolPayloads` - an array of `{ type, payload }` entries in emission order, alongside (never instead of) the prose reply - on the `wait: true` body and on the polled quest. A turn can FAIL after the ACK - reported on the polled quest as `type: \"error\"`, since the ACK was already sent. A terminal `status: \"stopped\"` (a missing session, a user-cancelled turn) is ALSO a failure even without `type: \"error\"` - it carries an explanatory string in `reply`/`replies` rather than an answer. `type` is the failure signal for the classified failure classes (an abort, a provider timeout, credit exhaustion); `errorCode` is an optional refinement present only when the failure is a classified billing reason. A recovered stuck quest is NOT in that list: one that still has renderable content resolves as a success by design. `QUEST_ERROR_CODES` has two members, but only `insufficient_credits` is raised as a quest errorCode by any current throw site on this endpoint - `spend_cap_exceeded` is thrown only by the embed chat route's pre-flight, which fires outside the process try/catch that would classify it onto a quest. A caller must treat `type: \"error\"` OR a terminal `status: \"stopped\"` as failure even when `errorCode` is absent, and must not read `reply` as an answer without checking those first. Authenticate with an API key (`b4m_live_`) or a JWT. Session resolution: pass `sessionId` to continue an existing notebook. An API-key caller that omits it gets a BRAND-NEW notebook rather than the notebook the human last had open, and `newConversation: true` forces a new notebook for any auth mode; both return the new id as `sessionId`, so the caller can continue the conversation by passing it back. A first-party JWT caller that omits `sessionId` keeps the last-opened-notebook fallback. Sending `sessionId` and `newConversation` together is a 422.",
 	tags: ["AI"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:chat", "ai:generate"],
@@ -16873,6 +17134,10 @@ defineEndpoint({
 		429: {
 			description: "Per-user rate limit exceeded.",
 			schema: ApiErrorSchema
+		},
+		504: {
+			description: "A `wait: true` turn ran past the request deadline. The turn is already ended: its quest (`quest_id`) is settled as timed out with any partial reply kept, and unused reserved credits are refunded. Retry in async mode for a long turn.",
+			schema: ChatWaitTimeoutErrorSchema
 		}
 	},
 	codeSample: {
@@ -17172,7 +17437,7 @@ defineEndpoint({
 	path: "/api/ai/v1/completions",
 	operationId: "createCompletion",
 	summary: "Create a chat completion",
-	description: "OpenAI-compatible completion. A successful request is ALWAYS answered with an SSE stream (`text/event-stream`), regardless of the `stream` flag: a `meta` event, then `content`/`tool_use` events carrying `usage`/`credits`, terminated by `data: [DONE]`. The terminal event carries `stopReason`; treat `max_tokens` as a TRUNCATED reply rather than a complete one, and note that omitting `max_tokens` on the request lets the server size the output ceiling for the model (recommended for reasoning models, which spend thinking tokens inside that ceiling). A message `content` may be a string or an array of parts; image parts are accepted in OpenAI Chat (`image_url`), OpenAI Responses (`input_image`) or Anthropic (`image` with a `source`) form and are translated to whatever the target model speaks. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nERRORS. Everything checked before the model provider is called fails with a JSON error body and a real HTTP status, before any stream opens: a malformed or otherwise invalid request or an unknown `model` `400` (`errorCode: \"unknown_model\"` for the latter), a bad credential `401`, a key without a required scope `403` (with `required_scopes`), a body over 25 MB `413`, a body that fails schema validation `422`, insufficient credits `422` with `errorCode: \"insufficient_credits\"` (personal or org balance, or an org per-member credit cap), a rate limit `429` with `Retry-After`, and a catalogued model whose provider is not configured on this deployment `503` with `errorCode: \"provider_not_configured\"` (retryable). Once the stream has opened the status stays `200` and a failure arrives as one terminal in-band `error` event. Branch on that event's `code`, never on `message`, which is prose and may change: `insufficient_credits` (buy credits) when credits run out mid-generation, `provider_rejected` when the model provider refused our credentials, `content_blocked` when the model declined the request (do not retry it unchanged), and `provider_error` for any other provider failure. Treat `code` as optional.",
+	description: "OpenAI-compatible completion. A successful request is ALWAYS answered with an SSE stream (`text/event-stream`), regardless of the `stream` flag: a `meta` event, then `content`/`tool_use` events carrying `usage`/`credits`, terminated by `data: [DONE]`. The terminal event carries `stopReason`; treat `max_tokens` as a TRUNCATED reply rather than a complete one, and note that omitting `max_tokens` on the request lets the server size the output ceiling for the model (recommended for reasoning models, which spend thinking tokens inside that ceiling). A message `content` may be a string or an array of parts; image parts are accepted in OpenAI Chat (`image_url`), OpenAI Responses (`input_image`) or Anthropic (`image` with a `source`) form and are translated to whatever the target model speaks. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nTOOL SEARCH. On a model whose `GET /api/v1/models` row has `supports_tool_search: true` and `backend: \"anthropic\"`, a `tools` entry may set `toolSchema.defer_loading: true`, and a `{ \"serverTool\": { \"type\": \"tool_search_tool_regex_20251119\", \"name\": \"tool_search_tool_regex\" } }` (or the `bm25` pair) entry adds Anthropic's tool search, so deferred definitions load only when the model searches for them. The stream then carries `provider_block` events (`{ type, provider: \"anthropic\", block }`) for the server-run search; echo each block back verbatim, in order, in the assistant `messages` content of the next request, and never answer one with a `tool_result`. When the server-run search loop hits its iteration limit the stream ends with `stopReason: \"pause_turn\"`; continue by re-sending the conversation with that assistant turn's provider blocks echoed. A client-side search may return `{ \"type\": \"tool_reference\", \"tool_name\": \"...\" }` blocks inside a `tool_result`'s content. On every other model, Bedrock-served Claude included, `defer_loading` is ignored (every tool is sent as usual) and a server tool, a `tool_reference` or an echoed tool search block is refused with a `400` rather than run without it.\n\nERRORS. Everything checked before the model provider is called fails with a JSON error body and a real HTTP status, before any stream opens: a malformed or otherwise invalid request or an unknown `model` `400` (`errorCode: \"unknown_model\"` for the latter), a bad credential `401`, a key without a required scope `403` (with `required_scopes`), a body over 25 MB `413`, a body that fails schema validation `422`, insufficient credits `422` with `errorCode: \"insufficient_credits\"` (personal or org balance, or an org per-member credit cap), a rate limit `429` with `Retry-After`, and a catalogued model whose provider is not configured on this deployment `503` with `errorCode: \"provider_not_configured\"` (retryable). Once the stream has opened the status stays `200` and a failure arrives as one terminal in-band `error` event. Branch on that event's `code`, never on `message`, which is prose and may change: `insufficient_credits` (buy credits) when credits run out mid-generation, `provider_rejected` when the model provider refused our credentials, `content_blocked` when the model declined the request (do not retry it unchanged), and `provider_error` for any other provider failure. Treat `code` as optional.",
 	tags: ["AI"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:chat", "ai:generate"],
@@ -17206,8 +17471,8 @@ defineEndpoint({
 			}
 		},
 		400: {
-			description: "Malformed or otherwise invalid request (no `errorCode`), or a `model` the caller cannot use (`errorCode: \"unknown_model\"`): not in the catalog or not available to the caller. List valid ids with `GET /api/v1/models`.",
-			schema: UnknownModelErrorSchema
+			description: "Malformed or otherwise invalid request (no `errorCode`), or a `model` the caller cannot use (`errorCode: \"unknown_model\"`): not in the catalog or not available to the caller. List valid ids with `GET /api/v1/models`. Tool search requests are refused with: `tool_search_unsupported` (a server tool, `tool_reference` or echoed tool search block on a model that cannot serve tool search here), `all_tools_deferred` (every tool deferred and no server tool), `deferred_tool_cache_control` (`cache_control` on a deferred tool), `unknown_tool_reference` (a `tool_reference` naming a tool not in `tools`, or carrying no string `tool_name`).",
+			schema: CompletionsBadRequestErrorSchema
 		},
 		413: {
 			description: "Request body over 25 MB.",
@@ -21039,7 +21304,7 @@ function scanArtifactOpenTag(text, at, leading, memo) {
 		end: close + 1
 	};
 }
-const OPENER = /<artifact(?=\s)/gi;
+const OPENER$1 = /<artifact(?=\s)/gi;
 const LEADING_WS = /\s+/y;
 const CLOSER = /<\/artifact>/gi;
 const GT = />/g;
@@ -21054,9 +21319,9 @@ function scanArtifactTags(text, attrsMayCrossLines) {
 	const stop = attrsMayCrossLines ? GT : GT_OR_LINE_TERMINATOR;
 	const out = [];
 	let termAt = -1;
-	OPENER.lastIndex = 0;
+	OPENER$1.lastIndex = 0;
 	let opener;
-	while ((opener = OPENER.exec(text)) !== null) {
+	while ((opener = OPENER$1.exec(text)) !== null) {
 		LEADING_WS.lastIndex = opener.index + opener[0].length;
 		LEADING_WS.exec(text);
 		const attrsStart = LEADING_WS.lastIndex;
@@ -21076,7 +21341,7 @@ function scanArtifactTags(text, attrsMayCrossLines) {
 			attrs: text.slice(attrsStart, termAt),
 			body: text.slice(termAt + 1, closer.index)
 		});
-		OPENER.lastIndex = end;
+		OPENER$1.lastIndex = end;
 	}
 	return out;
 }
@@ -21244,7 +21509,11 @@ function stripDeliveredArtifactBlocks(text, deliveredMarkup) {
 */
 const CLAUDE_4_7_PLUS_MULTIPLIER = 1.5;
 const CLAUDE_4_5_MULTIPLIER = 1.09;
-const CLAUDE_FAMILY_VERSION = /(?:^|\.)claude-(?:opus|sonnet|haiku)-(\d+)(?:-(\d{1,2}))?(?=$|[-:])/;
+const MEASURED_FAMILIES = /* @__PURE__ */ new Set([
+	"opus",
+	"sonnet",
+	"haiku"
+]);
 /**
 * Factor to scale a cl100k_base token count by for `modelId`. 1 for anything unmeasured: non-Claude
 * models, Claude before 4.5 (retired on Bedrock, could not be measured), and Fable (Bedrock rejects it
@@ -21252,10 +21521,10 @@ const CLAUDE_FAMILY_VERSION = /(?:^|\.)claude-(?:opus|sonnet|haiku)-(\d+)(?:-(\d
 * assumption they keep its tokenizer; [BILLING_DRIFT] flags it if one does not.
 */
 function tokenEstimateMultiplier(modelId) {
-	const match = modelId?.match(CLAUDE_FAMILY_VERSION);
-	if (!match) return 1;
-	const major = Number(match[1]);
-	const minor = Number(match[2] ?? 0);
+	const parsed = modelId ? parseClaudeModelId(modelId) : null;
+	if (!parsed || !MEASURED_FAMILIES.has(parsed.family)) return 1;
+	const { major } = parsed;
+	const minor = parsed.minor ?? 0;
 	if (major > 4 || major === 4 && minor >= 7) return CLAUDE_4_7_PLUS_MULTIPLIER;
 	if (major === 4 && minor >= 5) return CLAUDE_4_5_MULTIPLIER;
 	return 1;
@@ -23650,111 +23919,273 @@ function getEnvironmentName(configApiConfig) {
 	return "Self-Hosted";
 }
 //#endregion
-//#region src/config/toolSafety.ts
+//#region src/tools/gateway/coreToolDescriptors.ts
+const CORE = { kind: "core" };
+const CLI = { kind: "cli" };
+const pureCompute = () => ({
+	source: CORE,
+	effect: "none",
+	approval: "auto_approve"
+});
+const sessionTool = () => ({
+	source: CLI,
+	effect: "session",
+	approval: "auto_approve"
+});
+const reader = (source = CORE, extra = {}) => ({
+	source,
+	effect: "read",
+	approval: "prompt_default",
+	...extra
+});
+const fileWriter = () => ({
+	source: CORE,
+	effect: "write",
+	approval: "prompt_always",
+	writePathArg: "path"
+});
+const lattice = () => ({
+	source: CORE,
+	effect: "none",
+	approval: "prompt_default"
+});
+/**
+* Descriptors for every tool the CLI builds itself or gets from @bike4mind/services:
+* generateCliTools, buildCliToolList and the subagent-injected tools. A tool missing here
+* resolves to the unknown fallback in toolCatalog.ts; coreToolCompleteness.test.ts
+* fails when a generated tool has no entry.
+*/
+const CORE_TOOL_DESCRIPTORS = new Map(Object.entries({
+	math_evaluate: pureCompute(),
+	current_datetime: pureCompute(),
+	dice_roll: pureCompute(),
+	prompt_enhancement: pureCompute(),
+	find_definition: {
+		source: CLI,
+		effect: "read",
+		approval: "auto_approve"
+	},
+	ask_user_question: {
+		source: CORE,
+		effect: "session",
+		approval: "auto_approve"
+	},
+	agent_delegate: sessionTool(),
+	check_agent_status: sessionTool(),
+	list_background_agents: sessionTool(),
+	cancel_background_agent: sessionTool(),
+	resume_agent: sessionTool(),
+	create_dynamic_agent: sessionTool(),
+	coordinate_task: sessionTool(),
+	decompose_task: sessionTool(),
+	shared_context_read: sessionTool(),
+	shared_context_write: sessionTool(),
+	write_todos: sessionTool(),
+	read_prior_todos: sessionTool(),
+	log_decision: sessionTool(),
+	track_blocker: sessionTool(),
+	resolve_blocker: sessionTool(),
+	request_review_gate: sessionTool(),
+	work_item_create: sessionTool(),
+	work_item_update: sessionTool(),
+	work_item_close: sessionTool(),
+	work_item_ready: sessionTool(),
+	work_item_graph: sessionTool(),
+	tool_search: sessionTool(),
+	create_file: fileWriter(),
+	edit_local_file: fileWriter(),
+	delete_file: fileWriter(),
+	edit_file: {
+		source: CORE,
+		effect: "write",
+		approval: "prompt_always"
+	},
+	bash_execute: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always",
+		openWorld: true,
+		commandArg: "command"
+	},
+	shell_execute: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always",
+		openWorld: true
+	},
+	write_shell_stdin: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always",
+		commandArg: "chars"
+	},
+	kill_background_shell: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always"
+	},
+	git_commit: {
+		source: CORE,
+		effect: "write",
+		approval: "prompt_always"
+	},
+	git_push: {
+		source: CORE,
+		effect: "write",
+		approval: "prompt_always",
+		openWorld: true
+	},
+	skill: {
+		source: CLI,
+		effect: "execute",
+		approval: "prompt_always"
+	},
+	weather_info: reader(CORE, { openWorld: true }),
+	web_search: reader(CORE, { openWorld: true }),
+	web_fetch: reader(CORE, { openWorld: true }),
+	deep_research: reader(CORE, { openWorld: true }),
+	check_shell_output: reader(),
+	list_background_shells: reader(),
+	file_read: reader(),
+	grep_search: reader(),
+	glob_files: reader(),
+	get_file_tree: reader(),
+	get_file_structure: reader(CLI),
+	recent_changes: reader(),
+	git_status: reader(),
+	git_diff: reader(),
+	git_log: reader(),
+	git_branch: reader(),
+	lattice_create_model: lattice(),
+	lattice_add_entity: lattice(),
+	lattice_set_value: lattice(),
+	lattice_create_rule: lattice(),
+	lattice_query: lattice(),
+	lattice_explain: lattice()
+}));
+//#endregion
+//#region src/tools/gateway/toolPolicy.ts
 /**
-* Tool safety categories determine when permission is required
+* Every policy decision about a tool, derived from its descriptor. `undefined` is a tool the
+* catalog could not resolve; it keeps the pre-descriptor fallback (prompt_default, read-only)
+* because feature-module and plugin tools do not register descriptors yet.
 */
-const ToolCategorySchema = z$1.enum([
-	"auto_approve",
-	"prompt_always",
-	"prompt_default"
+const UNKNOWN_TOOL_CATEGORY = "prompt_default";
+const READ_ONLY_EFFECTS = /* @__PURE__ */ new Set([
+	"none",
+	"session",
+	"read"
 ]);
-z$1.object({
-	categories: z$1.record(z$1.string(), ToolCategorySchema),
-	trustedTools: z$1.array(z$1.string())
-});
-/**
-* Default tool categories
-*
-* Categories:
-* - auto_approve: Safe tools that don't need permission (math, search, datetime)
-* - prompt_always: Dangerous tools that ALWAYS need permission, cannot be trusted (file edits, shell commands)
-* - prompt_default: Tools that prompt by default but users can trust them (file reads, searches)
-*/
-const DEFAULT_TOOL_CATEGORIES = {
-	math_evaluate: "auto_approve",
-	current_datetime: "auto_approve",
-	dice_roll: "auto_approve",
-	prompt_enhancement: "auto_approve",
-	find_definition: "auto_approve",
-	ask_user_question: "auto_approve",
-	weather_info: "prompt_default",
-	agent_delegate: "auto_approve",
-	check_agent_status: "auto_approve",
-	list_background_agents: "auto_approve",
-	cancel_background_agent: "auto_approve",
-	resume_agent: "auto_approve",
-	create_dynamic_agent: "auto_approve",
-	coordinate_task: "auto_approve",
-	decompose_task: "auto_approve",
-	shared_context_read: "auto_approve",
-	shared_context_write: "auto_approve",
-	write_todos: "auto_approve",
-	read_prior_todos: "auto_approve",
-	log_decision: "auto_approve",
-	track_blocker: "auto_approve",
-	resolve_blocker: "auto_approve",
-	request_review_gate: "auto_approve",
-	work_item_create: "auto_approve",
-	work_item_update: "auto_approve",
-	work_item_close: "auto_approve",
-	work_item_ready: "auto_approve",
-	work_item_graph: "auto_approve",
-	tool_search: "auto_approve",
-	edit_file: "prompt_always",
-	edit_local_file: "prompt_always",
-	create_file: "prompt_always",
-	delete_file: "prompt_always",
-	shell_execute: "prompt_always",
-	bash_execute: "prompt_always",
-	write_shell_stdin: "prompt_always",
-	kill_background_shell: "prompt_always",
-	git_commit: "prompt_always",
-	git_push: "prompt_always",
-	skill: "prompt_always",
-	web_search: "prompt_default",
-	check_shell_output: "prompt_default",
-	list_background_shells: "prompt_default",
-	web_fetch: "prompt_default",
-	deep_research: "prompt_default",
-	file_read: "prompt_default",
-	grep_search: "prompt_default",
-	glob_files: "prompt_default",
-	get_file_tree: "prompt_default",
-	get_file_structure: "prompt_default",
-	git_status: "prompt_default",
-	git_diff: "prompt_default",
-	git_log: "prompt_default",
-	git_branch: "prompt_default"
-};
 /**
-* Get the category for a tool
-* Returns 'prompt_default' if tool is not in the default categories
-*/
-function getToolCategory(toolName, customCategories) {
-	if (toolName.startsWith("agent_hook:") || toolName.startsWith("skill_hook:")) return "prompt_always";
-	if (customCategories && toolName in customCategories) return customCategories[toolName];
-	if (toolName in DEFAULT_TOOL_CATEGORIES) return DEFAULT_TOOL_CATEGORIES[toolName];
-	if (toolName.startsWith("mcp__")) return "prompt_always";
-	return "prompt_default";
+* How far a source's own declarations are believed. Core, cli and builtin-module tools ship in
+* this repo and are reviewed, so their descriptor is taken as written. A plugin is third-party
+* code the user installed and enabled: it can be trusted per tool after a prompt, but cannot
+* skip the first prompt or claim to be read-only. MCP tools and lifecycle hooks always prompt.
+*/
+function categoryCeiling(source) {
+	switch (source.kind) {
+		case "mcp":
+		case "hook": return "prompt_always";
+		case "plugin": return "prompt_default";
+		default: return;
+	}
+}
+function believesDeclaredEffect(source) {
+	return categoryCeiling(source) === void 0;
+}
+function toolCategory(descriptor) {
+	if (!descriptor) return UNKNOWN_TOOL_CATEGORY;
+	const ceiling = categoryCeiling(descriptor.source);
+	if (ceiling === "prompt_always") return ceiling;
+	if (ceiling === "prompt_default" && descriptor.approval === "auto_approve") return ceiling;
+	return descriptor.approval;
+}
+/** Whether a prompt_default trust decision can be persisted for the tool. */
+function canTrustTool(descriptor) {
+	return toolCategory(descriptor) !== "prompt_always";
+}
+/** Read-only tools run in plan mode and in parallel batches; the rest are blocked / sequential. */
+function isReadOnlyTool(descriptor) {
+	if (!descriptor) return true;
+	if (!believesDeclaredEffect(descriptor.source)) return false;
+	return READ_ONLY_EFFECTS.has(descriptor.effect);
+}
+/** The shell command text the risk gate classifies, when the tool has one in `args`. */
+function commandTextOf(descriptor, args) {
+	return stringArg(args, descriptor?.commandArg);
+}
+/** The path a file-writing tool will write, when the tool declares one and `args` carries it. */
+function writePathOf(descriptor, args) {
+	const writePath = stringArg(args, descriptor?.writePathArg);
+	return writePath ? writePath : void 0;
+}
+function stringArg(args, field) {
+	if (!field || args === null || typeof args !== "object") return void 0;
+	const value = args[field];
+	return typeof value === "string" ? value : void 0;
+}
+//#endregion
+//#region src/tools/gateway/toolCatalog.ts
+const MCP_PREFIX = "mcp__";
+const HOOK_PREFIXES = ["agent_hook:", "skill_hook:"];
+function isHookName(toolName) {
+	return HOOK_PREFIXES.some((prefix) => toolName.startsWith(prefix));
 }
 /**
-* Check if a tool can be trusted (not prompt_always)
-*/
-function canTrustTool(toolName, customCategories) {
-	return getToolCategory(toolName, customCategories) !== "prompt_always";
+* Resolve a tool name without a catalog instance: the core table, then the MCP namespace
+* (`mcp__<server>__<tool>`), then the lifecycle-hook namespaces. Undefined means unknown.
+* ToolCatalog.resolve falls back to this after its registered descriptors.
+*/
+function resolveStaticToolDescriptor(toolName) {
+	const core = CORE_TOOL_DESCRIPTORS.get(toolName);
+	if (core) return core;
+	if (toolName.startsWith(MCP_PREFIX)) return {
+		source: {
+			kind: "mcp",
+			server: toolName.slice(5).split("__")[0]
+		},
+		effect: "execute",
+		approval: "prompt_always"
+	};
+	if (isHookName(toolName)) return {
+		source: { kind: "hook" },
+		effect: "execute",
+		approval: "prompt_always"
+	};
 }
 /**
-* Check if a tool is read-only (safe for parallel execution).
-* Write tools (prompt_always category) must always be sequential.
-*
-* @param toolName - Name of the tool to check
-* @param customCategories - Optional custom category overrides
-* @returns true if the tool is read-only, false if it's a write tool
+* Name -> descriptor lookup for one CLI process or ACP stack. Entry points create one and hand
+* it to their PermissionManager, which the permission gateway and the agent's read-only
+* predicate read it through.
 */
-function isReadOnlyTool(toolName, customCategories) {
-	return getToolCategory(toolName, customCategories) !== "prompt_always";
-}
+var ToolCatalog = class {
+	constructor() {
+		this.registered = /* @__PURE__ */ new Map();
+	}
+	/**
+	* Add a descriptor for a tool the core table does not know. Core names and the MCP and hook
+	* namespaces are reserved: nothing can re-declare a core tool, or declare itself into a
+	* namespace whose descriptor comes from the name alone, with a lower tier.
+	*/
+	register(toolName, descriptor) {
+		if (toolName.startsWith(MCP_PREFIX) || isHookName(toolName)) throw new Error(`Tool name "${toolName}" is in a reserved namespace and cannot be registered`);
+		if (CORE_TOOL_DESCRIPTORS.has(toolName)) throw new Error(`Tool "${toolName}" is a core tool and already has a descriptor`);
+		if (this.registered.has(toolName)) throw new Error(`Tool "${toolName}" already has a registered descriptor`);
+		this.registered.set(toolName, descriptor);
+	}
+	resolve(toolName) {
+		return this.registered.get(toolName) ?? resolveStaticToolDescriptor(toolName);
+	}
+	category(toolName) {
+		return toolCategory(this.resolve(toolName));
+	}
+	canTrust(toolName) {
+		return canTrustTool(this.resolve(toolName));
+	}
+	isReadOnly(toolName) {
+		return isReadOnlyTool(this.resolve(toolName));
+	}
+};
 const PROJECT_CONTEXT_FILES = [
 	"CLAUDE.local.md",
 	"CLAUDE.md",
@@ -24495,7 +24926,7 @@ function mergeConfigs(global, project, local) {
 		enabled: merged.tools.enabled.filter((t) => !disabledSet.has(t))
 	};
 	const globalTrusted = new Set(global.trustedTools || []);
-	merged.trustedTools = (merged.trustedTools || []).filter((t) => globalTrusted.has(t) || canTrustTool(t) && !disabledSet.has(t));
+	merged.trustedTools = (merged.trustedTools || []).filter((t) => globalTrusted.has(t) || canTrustTool(resolveStaticToolDescriptor(t)) && !disabledSet.has(t));
 	return merged;
 }
 /**
@@ -25172,4 +25603,4 @@ var ConfigStore = class {
 	}
 };
 //#endregion
-export { SLUG_OWNED_BY_OTHER as $, BRIEFCASE_CATALOG_QUERIES as A, ttsBase64ResponseSchema as At, ImageModels as B, selfClaimedActorKindSchema as Bt, AGENT_QUEST_ID as C, secureParameters as Ct, ARTIFACT_REMOVED_PLACEHOLDER as D, stripToolArtifactMarkup as Dt, ARTIFACT_DELIVERED_PLACEHOLDER as E, stripDeliveredArtifactBlocks as Et, ChatModels as F, DELEGATION_PAYLOAD_SCHEMA_NAME as Ft, ModelBackend as G, LOCATION_MAP_LANGUAGE as H, WEBSITE_URL as Ht, CompletionReasoningEffortSchema as I, actorColorIndex as It, OpenAIEmbeddingModel as J, NotFoundError as K, DEFAULT_TTS_PROVIDER as L, actorKindMarker as Lt, BriefcasePromptIdSchema as M, ttsResponseTooLargeSchema as Mt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as N, withRetry as Nt, ApiKeyType as O, supportedVoiceGenerationVendor as Ot, CREDIT_DEDUCT_TRANSACTION_TYPES as P, ACTOR_COLOR_SLOTS as Pt, SEARCH_RESULT_CARDS_LANGUAGE as Q, DEGENERATE_FINISH_REASON as R, actorKindSchema as Rt, escapeArtifactBodyJson as S, replacePromptVariables as St, AGENT_QUEST_MCP_URI as T, splitEquals as Tt, MODEL_INFO_FIELD_GROUP_OF as U, ImagePromptResolutionSchema as V, APP_NAME as Vt, McpServerName as W, PermissionDeniedError as X, PROMPT_TEXT_MAX as Y, REVIEW_GATE_STATUS_VALUES as Z, logger as _, isRetryableError as _t, getToolCategory as a, assertAuthOriginMatchesApiKey as at, htmlErrorTitle as b, obfuscateApiKey as bt, getCreditsUrl as c, escapeThinkMarkers as ct, resolveApiEndpoint as d, getMcpProviderMetadata as dt, SUBQUEST_STATUS_VALUES as et, AuthenticatedApiClient as f, getQuestErrorCode as ft, parseApiUrl as g, isPlaceholderImageSigningSecret as gt, NotAuthenticatedError as h, isEarlyStop as ht, canTrustTool as i, WORK_ITEM_STATUSES as it, BedrockEmbeddingModel as j, ttsRequestSchema as jt, ArtifactTypeSchema as k, tokenEstimateMultiplier as kt, getEnvironmentName as l, filterToolArtifactMarkup as lt, LOCAL_DEV_URL as m, hasDeliverablePinnedArtifact as mt, extractCompactInstructions as n, VisibilitySchema as nt, isReadOnlyTool as o, buildPromptContext as ot, DeviceFlowClient as p, googleMapsSearchUrl as pt, OllamaEmbeddingModel as q, loadContextFiles as r, VoyageAIEmbeddingModel as rt, ApiEndpointUnconfiguredError as s, createThinkMarkerEscaper as st, ConfigStore as t, SupportedFabFileMimeTypes as tt, requireApiUrl as u, generatedAudioResponseSchema as ut, SESSION_ID_PATTERN as v, isUserInitiatedAbort as vt, AGENT_QUEST_MANIFEST as w, signImageUrl as wt, htmlFirstH1 as x, questReplyText as xt, isValidSessionId as y, joinReplySlots as yt, GENERATED_IMAGE_EXTENSION_RE as z, delegationPayloadSchema as zt };
+export { PermissionDeniedError as $, ApiKeyType as A, stripToolArtifactMarkup as At, DEFAULT_TTS_PROVIDER as B, actorKindMarker as Bt, htmlFirstH1 as C, obfuscateApiKey as Ct, AGENT_QUEST_MCP_URI as D, signImageUrl as Dt, AGENT_QUEST_MANIFEST as E, secureParameters as Et, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as F, ttsResponseTooLargeSchema as Ft, LOCATION_MAP_LANGUAGE as G, WEBSITE_URL as Gt, GENERATED_IMAGE_EXTENSION_RE as H, delegationPayloadSchema as Ht, CREDIT_DEDUCT_TRANSACTION_TYPES as I, withRetry as It, ModelBackend as J, MODEL_INFO_FIELD_GROUP_OF as K, ChatModels as L, ACTOR_COLOR_SLOTS as Lt, BRIEFCASE_CATALOG_QUERIES as M, tokenEstimateMultiplier as Mt, BedrockEmbeddingModel as N, ttsBase64ResponseSchema as Nt, ARTIFACT_DELIVERED_PLACEHOLDER as O, splitEquals as Ot, BriefcasePromptIdSchema as P, ttsRequestSchema as Pt, PROMPT_TEXT_MAX as Q, CompletionReasoningEffortSchema as R, DELEGATION_PAYLOAD_SCHEMA_NAME as Rt, htmlErrorTitle as S, joinReplySlots as St, AGENT_QUEST_ID as T, replacePromptVariables as Tt, ImageModels as U, selfClaimedActorKindSchema as Ut, DEGENERATE_FINISH_REASON as V, actorKindSchema as Vt, ImagePromptResolutionSchema as W, APP_NAME as Wt, OllamaEmbeddingModel as X, NotFoundError as Y, OpenAIEmbeddingModel as Z, NotAuthenticatedError as _, hasDeliverablePinnedArtifact as _t, commandTextOf as a, VisibilitySchema as at, SESSION_ID_PATTERN as b, isRetryableError as bt, writePathOf as c, assertAuthOriginMatchesApiKey as ct, getEnvironmentName as d, escapeThinkMarkers as dt, REVIEW_GATE_STATUS_VALUES as et, requireApiUrl as f, filterToolArtifactMarkup as ft, LOCAL_DEV_URL as g, googleMapsSearchUrl as gt, DeviceFlowClient as h, getQuestErrorCode as ht, ToolCatalog as i, SupportedFabFileMimeTypes as it, ArtifactTypeSchema as j, supportedVoiceGenerationVendor as jt, ARTIFACT_REMOVED_PLACEHOLDER as k, stripDeliveredArtifactBlocks as kt, ApiEndpointUnconfiguredError as l, buildPromptContext as lt, AuthenticatedApiClient as m, getMcpProviderMetadata as mt, extractCompactInstructions as n, SLUG_OWNED_BY_OTHER as nt, isReadOnlyTool as o, VoyageAIEmbeddingModel as ot, resolveApiEndpoint as p, generatedAudioResponseSchema as pt, McpServerName as q, loadContextFiles as r, SUBQUEST_STATUS_VALUES as rt, toolCategory as s, WORK_ITEM_STATUSES as st, ConfigStore as t, SEARCH_RESULT_CARDS_LANGUAGE as tt, getCreditsUrl as u, createThinkMarkerEscaper as ut, parseApiUrl as v, isEarlyStop as vt, escapeArtifactBodyJson as w, questReplyText as wt, isValidSessionId as x, isUserInitiatedAbort as xt, logger as y, isPlaceholderImageSigningSecret as yt, CreateArtifactRequestSchema as z, actorColorIndex as zt };