@bike4mind/cli 3.1.0 → 3.3.0

package/dist/{ConfigStore-RHqyXcSS.mjs → ConfigStore-DUATzLxB.mjs}

@@ -250,6 +250,19 @@ const StorageLimitErrorInfoSchema = z$1.object({
 	requested_bytes: z$1.number().nonnegative().describe("Size of the refused upload, in bytes."),
 	owner: z$1.enum(["user", "org"]).describe("Whose limit was hit: `user` or `org`. Always `user` for `file_too_large`, a platform-wide cap.")
 });
+/**
+* The refusal a caller gets when the limit belongs to someone else (an update-share editor growing
+* another user's file): the code and whose limit, without that owner's byte counts.
+*/
+const RedactedStorageLimitErrorInfoSchema = StorageLimitErrorInfoSchema.pick({
+	errorCode: true,
+	owner: true
+}).extend({
+	used_bytes: z$1.never().optional(),
+	limit_bytes: z$1.never().optional(),
+	requested_bytes: z$1.never().optional()
+});
+z$1.union([StorageLimitErrorInfoSchema, RedactedStorageLimitErrorInfoSchema]);
 function isZodError(err) {
 	return Boolean(err && (err instanceof ZodError || err.name === "ZodError"));
 }
@@ -950,6 +963,7 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 	ChatModels["GPT5_2_CHAT_LATEST"] = "gpt-5.2-chat-latest";
 	ChatModels["GPT5_4"] = "gpt-5.4";
 	ChatModels["GPT5_4_MINI"] = "gpt-5.4-mini";
+	ChatModels["GPT5_4_MINI_2026_03_17"] = "gpt-5.4-mini-2026-03-17";
 	ChatModels["GPT5_4_NANO"] = "gpt-5.4-nano";
 	ChatModels["GPT5_5"] = "gpt-5.5";
 	ChatModels["GPT5_6_SOL"] = "gpt-5.6-sol";
@@ -1045,8 +1059,8 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 	ChatModels["DEEPSEEK_V4_PRO"] = "deepseek-v4-pro";
 	return ChatModels;
 }({});
-const CHAT_MODELS = Object.values(ChatModels);
-const supportedChatModels = z$1.enum(ChatModels);
+const supportedChatModels = z$1.enum(ChatModels).exclude(["GPT5_4_MINI_2026_03_17"]);
+const CHAT_MODELS = [...supportedChatModels.options];
 new RegExp(`^${BEDROCK_ANTHROPIC_PREFIX}claude-`);
 /**
 * Models that support OpenAI's `reasoning_effort` request parameter.
@@ -1068,6 +1082,7 @@ const REASONING_SUPPORTED_MODELS = /* @__PURE__ */ new Set([
 	"gpt-5.2",
 	"gpt-5.4",
 	"gpt-5.4-mini",
+	"gpt-5.4-mini-2026-03-17",
 	"gpt-5.4-nano",
 	"gpt-5.6-sol",
 	"gpt-5.6-luna",
@@ -2893,6 +2908,105 @@ const WORK_ITEM_STATUSES = [
 	"blocked",
 	"closed"
 ];
+const AuditActorSchema = z$1.object({
+	kind: z$1.enum([
+		"user",
+		"apiKey",
+		"system",
+		"script"
+	]),
+	scope: z$1.enum(["platform", "organization"]),
+	userId: z$1.string().optional(),
+	apiKeyId: z$1.string().optional(),
+	email: z$1.string().optional(),
+	name: z$1.string(),
+	wasAdmin: z$1.boolean(),
+	impersonatedUserId: z$1.string().optional()
+});
+const AuditTargetSchema = z$1.object({
+	kind: z$1.enum([
+		"user",
+		"organization",
+		"settings",
+		"oauthClient",
+		"apiKey",
+		"system"
+	]),
+	id: z$1.string(),
+	displayName: z$1.string()
+});
+const AuditChangeSchema = z$1.object({
+	field: z$1.string(),
+	before: z$1.unknown(),
+	after: z$1.unknown()
+});
+const AuditContextSchema = z$1.object({
+	ip: z$1.string().optional(),
+	userAgent: z$1.string().optional(),
+	requestId: z$1.string().optional(),
+	source: z$1.enum([
+		"admin_ui",
+		"api_key",
+		"script",
+		"worker"
+	]),
+	route: z$1.string().optional()
+});
+const AdminAuditCategorySchema = z$1.enum([
+	"credits",
+	"access",
+	"identity",
+	"account",
+	"org",
+	"settings",
+	"support"
+]);
+const AdminAuditSeveritySchema = z$1.enum([
+	"info",
+	"notice",
+	"critical"
+]);
+z$1.object({
+	id: z$1.string(),
+	source: z$1.enum([
+		"admin",
+		"auth",
+		"apiKey",
+		"supportAccess"
+	]),
+	occurredAt: z$1.date(),
+	action: z$1.string(),
+	category: AdminAuditCategorySchema,
+	severity: AdminAuditSeveritySchema,
+	actor: AuditActorSchema,
+	target: AuditTargetSchema,
+	organizationId: z$1.string().optional(),
+	summary: z$1.string(),
+	reason: z$1.string().optional(),
+	changes: z$1.array(AuditChangeSchema).optional(),
+	details: z$1.record(z$1.string(), z$1.unknown()).optional(),
+	context: AuditContextSchema,
+	related: z$1.object({
+		creditTransactionId: z$1.string().optional(),
+		impersonationSessionId: z$1.string().optional()
+	}).optional(),
+	backfilled: z$1.boolean().optional()
+});
+z$1.object({
+	category: AdminAuditCategorySchema.optional(),
+	severity: AdminAuditSeveritySchema.optional(),
+	action: z$1.string().regex(/^[a-z_]+(\.[a-z_]+)+$/).optional(),
+	verb: z$1.string().regex(/^[a-z_]+$/).optional(),
+	actorUserId: z$1.string().min(1).optional(),
+	targetKind: AuditTargetSchema.shape.kind.optional(),
+	targetId: z$1.string().min(1).optional(),
+	source: AuditContextSchema.shape.source.optional(),
+	actorScope: AuditActorSchema.shape.scope.optional(),
+	from: z$1.iso.datetime().optional(),
+	to: z$1.iso.datetime().optional(),
+	requestId: z$1.string().min(1).optional(),
+	impersonationSessionId: z$1.string().min(1).optional()
+});
 let SupportedFabFileMimeTypes = /* @__PURE__ */ function(SupportedFabFileMimeTypes) {
 	SupportedFabFileMimeTypes["PDF"] = "application/pdf";
 	SupportedFabFileMimeTypes["DOCX"] = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
@@ -3121,6 +3235,21 @@ const CREDITS_PER_USD_COST = (() => {
 	console.warn(`[pricing] Env-configured margin/rate derive ${derived} credits per USD cost; using defaults`);
 	return Math.round(DEFAULT_PRICE_MARGIN / DEFAULT_USD_TO_CREDITS_RATE);
 })();
+const DEFAULT_PROVIDER_COST_PER_CREDIT_USD = 1 / Math.round(DEFAULT_PRICE_MARGIN / DEFAULT_USD_TO_CREDITS_RATE);
+/**
+* Lowest USD price a credit may be sold for: the provider cost one credit stands for, times the
+* markup - the same sale price usage is billed at - and never less than what a credit costs us at
+* the built-in rate. The admin `pricePerCredit` save (apps/client/pages/api/settings/update.ts)
+* refuses a price below it, and per-credit purchases re-check it at charge time
+* (apps/client/lib/credits/utils.ts).
+*/
+const MIN_PRICE_PER_CREDIT_USD = (() => {
+	const derived = PRICE_MARGIN / CREDITS_PER_USD_COST;
+	if (!Number.isFinite(derived)) return DEFAULT_USD_TO_CREDITS_RATE;
+	return Math.max(derived, DEFAULT_PROVIDER_COST_PER_CREDIT_USD);
+})();
+/** USD price per credit for display, without float noise (0.0006, not 0.0006000000000000001). */
+const formatUsdPerCredit = (usd) => `$${Number(usd.toPrecision(6))}`;
 z.enum([
 	"openai",
 	"test",
@@ -3643,6 +3772,220 @@ z$1.enum([
 	"investigate_soon",
 	"immediate_action"
 ]);
+/**
+* Largest legacy thinking budget (`budget_tokens`) a request may ask for. Anthropic rejects rather
+* than clamps an oversized budget, and the budget raises the max_tokens a turn is sent with, so it
+* is bounded both at the request schemas and where the adapter consumes it (buildThinkingParams).
+*/
+const MAX_THINKING_BUDGET_TOKENS = 32e3;
+const CompletionReasoningEffortSchema = z$1.enum([
+	"none",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+]);
+/**
+* Tool schema matching ICompletionOptionTools.toolSchema. The Zod surface only
+* covers wire-format fields (toolFn is server-side). Replaces the historical
+* z.array(z.any()) so client-side bugs (typos in name, missing type) surface
+* at parse time instead of failing silently inside the backend.
+*/
+const CompletionCustomToolSchema = z$1.object({
+	toolSchema: z$1.object({
+		name: z$1.string(),
+		description: z$1.string(),
+		parameters: z$1.object({
+			type: z$1.literal("object"),
+			properties: z$1.record(z$1.string(), z$1.any()).optional(),
+			additionalProperties: z$1.boolean().optional(),
+			required: z$1.array(z$1.string()).optional()
+		}).passthrough(),
+		strict: z$1.boolean().optional(),
+		defer_loading: z$1.boolean().optional().describe("Keep this definition out of the model context until the tool search server tool (or a `tool_reference`) loads it. Honoured only on models served by the direct Anthropic API whose `supports_tool_search` is true; on every other model (including Bedrock-served Claude, for now) it is ignored and the tool is sent as usual. At least one tool, or a `serverTool` entry, must stay non-deferred (`errorCode: \"all_tools_deferred\"`)."),
+		cache_control: z$1.unknown().optional().describe("Accepted for validation only and not forwarded. Rejected on a deferred tool (`errorCode: \"deferred_tool_cache_control\"`).")
+	}),
+	_isMcpTool: z$1.boolean().optional()
+});
+/** Anthropic's tool search server tools; `name` is fixed by `type`. */
+const ToolSearchServerToolSchema = z$1.discriminatedUnion("type", [z$1.object({
+	type: z$1.literal("tool_search_tool_regex_20251119"),
+	name: z$1.literal("tool_search_tool_regex")
+}), z$1.object({
+	type: z$1.literal("tool_search_tool_bm25_20251119"),
+	name: z$1.literal("tool_search_tool_bm25")
+})]);
+const CompletionServerToolSchema = z$1.object({ serverTool: ToolSearchServerToolSchema.describe("A provider-run tool, sent to the provider as `{ type, name }`. Only the Anthropic tool search tools exist today, and only on models served by the direct Anthropic API whose `supports_tool_search` is true; any other model, Bedrock-served Claude included, is refused with `errorCode: \"tool_search_unsupported\"` rather than run without it.") });
+/** One `tools[]` entry: a caller-defined tool, or a provider-run server tool. */
+const CompletionToolSchema = z$1.union([CompletionCustomToolSchema, CompletionServerToolSchema]);
+/**
+* The `errorCode`s of the completions 400s for tool search requests (CONVENTIONS.md section 1).
+* Assigned in services/cliCompletionsToolSearch.ts.
+*/
+const COMPLETION_TOOL_ERROR_CODES = [
+	"tool_search_unsupported",
+	"all_tools_deferred",
+	"deferred_tool_cache_control",
+	"unknown_tool_reference",
+	"tool_changes_unsupported",
+	"invalid_tool_change"
+];
+/**
+* One block of a mid-conversation tool change: a `system`-role message whose content holds only these.
+* Strict on purpose: the provider takes a name reference to a tool already in `tools`, never an inline
+* definition or an MCP reference.
+*/
+const ToolChangeBlockSchema = z$1.object({
+	type: z$1.enum(["tool_addition", "tool_removal"]),
+	tool: z$1.object({
+		type: z$1.literal("tool_reference"),
+		name: z$1.string().min(1)
+	}).strict()
+}).strict();
+z$1.array(ToolChangeBlockSchema).min(1);
+/**
+* JSON Schema definition for structured output. The `schema` field is a full
+* JSON Schema document (we don't try to validate JSON Schema with Zod - that's
+* the caller's contract with the model). `strict: true` is the default, matching
+* OpenAI's strict-mode subset semantics.
+*/
+const ResponseFormatSchema = z$1.discriminatedUnion("type", [z$1.object({ type: z$1.literal("text") }), z$1.object({
+	type: z$1.literal("json_schema"),
+	json_schema: z$1.object({
+		name: z$1.string(),
+		description: z$1.string().optional(),
+		schema: z$1.record(z$1.string(), z$1.any()),
+		strict: z$1.boolean().optional().default(true)
+	})
+})]);
+/**
+* Wire-format message for /api/ai/v1/completions. The optional `cache: true`
+* flag is honored by Anthropic (translated to `cache_control: { type: 'ephemeral' }`
+* with the appropriate beta header) and silently ignored by other providers.
+*/
+const CompletionMessageSchema = z$1.object({
+	role: z$1.enum([
+		"user",
+		"assistant",
+		"system"
+	]),
+	content: z$1.union([z$1.string(), z$1.array(z$1.any())]).describe("A string, or an array of content blocks. A `system` message may instead hold only `tool_addition` / `tool_removal` blocks (`{ type, tool: { type: \"tool_reference\", name } }`) to load or unload a tool named in `tools` mid-conversation without invalidating the prompt cache. It must follow a user turn or an assistant turn ending in a tool search result, and be the last message or precede an assistant turn. Only on models whose `supports_tool_changes` is true and that are served by the direct Anthropic API; otherwise refused with `errorCode: \"tool_changes_unsupported\"` (or `invalid_tool_change` / `unknown_tool_reference` when malformed)."),
+	cache: z$1.boolean().optional()
+});
+/**
+* Schema for CLI LLM completion requests
+* Shared between Next.js API route (dev) and Lambda function (production)
+*
+* `response_format`, `stream`, `tools`, `temperature`, and `max_tokens` are all
+* accepted at the top level (OpenAI-compatible, matching how every major LLM
+* SDK shapes a completion request) AND nested under `options` (legacy shape).
+* Use `normalizeCompletionRequest()` to collapse both surfaces into the
+* canonical `options.<field>` location before downstream consumption.
+*/
+const CompletionRequestSchema = z$1.object({
+	model: z$1.string().max(256),
+	messages: z$1.array(CompletionMessageSchema),
+	response_format: ResponseFormatSchema.optional(),
+	stream: z$1.boolean().optional(),
+	tools: z$1.array(CompletionToolSchema).optional(),
+	temperature: z$1.number().optional(),
+	max_tokens: z$1.number().optional(),
+	options: z$1.object({
+		temperature: z$1.number().optional(),
+		maxTokens: z$1.number().optional(),
+		stream: z$1.boolean().optional(),
+		tools: z$1.array(CompletionToolSchema).optional(),
+		response_format: ResponseFormatSchema.optional(),
+		reasoningEffort: CompletionReasoningEffortSchema.optional().describe("Reasoning effort hint. Honoured by the OpenAI (reasoning models only, and not alongside tools on some of them), Kimi (K3 only), DeepSeek and Anthropic Claude (direct and Bedrock) adapters; each maps it onto its own scale. On Claude, `none` turns thinking off where the model allows it (otherwise it runs at the lowest effort), so short `max_tokens` replies stream visible text from the start; `minimal` maps to `low`. When `thinking.enabled` is also set on a Claude model, thinking stays on and this sets its effort instead, with `none` and `minimal` mapping to `low`. Claude models that reason inside `max_tokens` never have that ceiling raised, and on older Claude models any level above `none` turns thinking on (it is off by default there), forces temperature to 1 and drops top_p, and a thinking budget that cannot fit under `max_tokens` is skipped. On the direct Anthropic API, a json_schema `response_format` with no tools is served by a forced tool on models that support forced tool use, and that tool cannot run alongside thinking, so there only `none` is honoured; models served by native structured outputs honour every level. Silently ignored by every other adapter (Gemini, xAI, Ollama) and by non-reasoning models, so sending it there is a no-op."),
+		thinking: z$1.object({
+			enabled: z$1.boolean(),
+			budget_tokens: z$1.number().int().min(1024).max(MAX_THINKING_BUDGET_TOKENS).optional()
+		}).optional().describe("Ask a model that can think to think on this turn. On Claude, `reasoningEffort` then sets how much it thinks, and `budget_tokens` (default 16000, minimum 1024, maximum 32000) sizes thinking on older Claude models. Ignored by models that cannot think, and on the direct Anthropic API when a json_schema `response_format` is served by a forced tool, which cannot run alongside thinking.")
+	}).optional()
+});
+const CompletionUsageSchema = z$1.object({
+	inputTokens: z$1.number().optional(),
+	outputTokens: z$1.number().optional(),
+	reasoningTokens: z$1.number().optional().describe("Reasoning/thinking tokens the provider reported. A subset of outputTokens, not additive and not billed on top. Absent when the provider or adapter reports no count."),
+	cacheReadInputTokens: z$1.number().optional(),
+	cacheCreationInputTokens: z$1.number().optional()
+});
+const CompletionMetaEventSchema = z$1.object({
+	type: z$1.literal("meta"),
+	requestId: z$1.string()
+});
+const CompletionContentEventSchema = z$1.object({
+	type: z$1.enum(["content", "tool_use"]),
+	text: z$1.string(),
+	tools: z$1.array(z$1.object({
+		name: z$1.string(),
+		arguments: z$1.string().optional(),
+		id: z$1.string().optional()
+	})).optional(),
+	usage: CompletionUsageSchema.optional(),
+	credits: z$1.object({
+		used: z$1.number().optional(),
+		usdCost: z$1.number().optional()
+	}).optional(),
+	responseFormatMode: z$1.enum([
+		"native",
+		"tool_use",
+		"best-effort"
+	]).optional(),
+	stopReason: z$1.string().optional(),
+	thinking: z$1.array(z$1.any()).optional(),
+	toolStarted: z$1.object({
+		name: z$1.string(),
+		id: z$1.string().optional()
+	}).optional()
+});
+/**
+* Classifiers the completions `error` frame may carry: the persisted quest codes plus the two
+* provider codes. A separate tuple because QUEST_ERROR_CODES is stored on quests and must not widen.
+*/
+const COMPLETION_SSE_ERROR_CODES = [
+	...QUEST_ERROR_CODES,
+	"provider_error",
+	"provider_rejected",
+	"content_blocked"
+];
+/**
+* The in-band terminal failure frame, sent only once the stream has opened. Failures found before
+* the provider call (auth, scope, validation, rate limit, model, credits) are JSON errors with a
+* real status instead; see completions.contract.ts.
+*
+* `code` is the machine-readable classifier: a billing code when settlement runs out mid-generation,
+* `provider_rejected` / `provider_error` when the model provider fails, `content_blocked` when the
+* model's safety classifier declined the request. Optional; callers must never match on the prose
+* `message`.
+*
+* The field is `code` rather than the conventions' `errorCode` because this frame shipped that way
+* and is a published wire shape.
+*/
+const CompletionSseErrorEventSchema = z$1.object({
+	type: z$1.literal("error"),
+	message: z$1.string(),
+	requestId: z$1.string().optional(),
+	code: z$1.enum(COMPLETION_SSE_ERROR_CODES).optional()
+});
+/**
+* A provider content block the caller must echo back verbatim, in stream order, in the assistant
+* `messages` content of the next request: today the Anthropic tool search `server_tool_use` and
+* `tool_search_tool_result` blocks. Never executed by the caller and never answered with a tool_result.
+*/
+const CompletionProviderBlockEventSchema = z$1.object({
+	type: z$1.literal("provider_block"),
+	provider: z$1.literal("anthropic"),
+	block: z$1.record(z$1.string(), z$1.unknown())
+});
+/** One `data:` event in the `text/event-stream` completions response. */
+const CompletionStreamEventSchema = z$1.union([
+	CompletionMetaEventSchema,
+	CompletionContentEventSchema,
+	CompletionProviderBlockEventSchema,
+	CompletionSseErrorEventSchema
+]);
 /** Splits on the marker tokens, keeping them in the result so a scan can track nesting depth. */
 const THINK_TAG_TOKENS = /(<think>|<\/think>)/g;
 /**
@@ -3712,7 +4055,7 @@ function createThinkMarkerEscaper() {
 * The visible remainder of one reply slot, with hidden reasoning removed.
 *
 * This is the rule the chat transcript renders by - `extractReplies` in
-* apps/client/shared/replyUtils.ts calls straight into it, so the two cannot drift.
+* packages/server-utils/src/shared/replyUtils.ts calls straight into it, so the two cannot drift.
 * Anything deriving "did the user see something yet" (latency metrics in particular) must
 * use this and not a looser non-empty check: a metric built on a looser rule reports text
 * as seen while the UI is still hiding it.
@@ -3780,8 +4123,8 @@ const invalid = (reason) => ({
 	status: "invalid",
 	reason
 });
-const FENCE_OPEN_LINE = /^[ \t]*(`{3,}|~{3,})(.*)$/;
-const FENCE_CLOSE_LINE = /^[ \t]*(`{3,}|~{3,})[ \t]*$/;
+const FENCE_OPEN_LINE$1 = /^[ \t]*(`{3,}|~{3,})(.*)$/;
+const FENCE_CLOSE_LINE$1 = /^[ \t]*(`{3,}|~{3,})[ \t]*$/;
 /**
 * Offset where a slot's visible answer starts: just past its last top-level `</think>`, 0 when it
 * has none, or null while a `<think>` is still open. Depth-tracked to match visibleReplyText in
@@ -3811,7 +4154,7 @@ function findLastChoicesFence(text) {
 		const lineEnd = newline === -1 ? text.length : newline;
 		const line = text.slice(lineStart, lineEnd).replace(/\r$/, "");
 		if (!open) {
-			const match = line.match(FENCE_OPEN_LINE);
+			const match = line.match(FENCE_OPEN_LINE$1);
 			if (match && !(match[1][0] === "`" && match[2].includes("`"))) open = {
 				start: lineStart,
 				bodyStart: newline === -1 ? text.length : newline + 1,
@@ -3819,7 +4162,7 @@ function findLastChoicesFence(text) {
 				isChoices: match[1] === "```" && match[2].trim().toLowerCase() === "choices"
 			};
 		} else {
-			const match = line.match(FENCE_CLOSE_LINE);
+			const match = line.match(FENCE_CLOSE_LINE$1);
 			if (match && match[1][0] === open.marker[0] && match[1].length >= open.marker.length) {
 				if (open.isChoices) last = {
 					start: open.start,
@@ -4826,6 +5169,13 @@ z$1.object({
 		reason: z$1.enum(REPLY_CHOICES_INVALID_REASONS).optional()
 	}).optional(),
 	/**
+	* Set when finalize stripped a tool call the model wrote into its reply as text instead of
+	* calling it (see ../utils/narratedToolCalls.ts). The call never ran; `toolNames` are the
+	* offered tools it named. Absent when nothing was stripped. Consumers read this rather than
+	* matching the reply text, which no longer carries the call.
+	*/
+	narratedToolCall: z$1.object({ toolNames: z$1.array(z$1.string()) }).optional(),
+	/**
 	* Set when an emitted artifact looks voluntarily abbreviated - placeholder comments in
 	* place of real code, or calls into functions that were never defined. The complement to
 	* `finishReason === 'max_tokens'`: truncation is a hard stop the provider reports, elision
@@ -5064,8 +5414,11 @@ const ChatWaitTimeoutErrorSchema = ApiErrorSchema.extend({
 const StorageLimitErrorSchema = ApiErrorSchema.extend(StorageLimitErrorInfoSchema.partial().shape);
 /** 503 when this deployment has no usable key for a provider the request needs (data-lake search, voice). */
 const ProviderNotConfiguredErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal("provider_not_configured").optional() });
-/** 400 for a `model` the caller cannot use; `errorCode` is absent on the other 400s (e.g. malformed JSON). */
-const UnknownModelErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal(UNKNOWN_MODEL_ERROR_CODE).optional() });
+/**
+* 400 for a `model` the caller cannot use, or a refused tool search request; `errorCode` is absent on the
+* other 400s (e.g. malformed JSON).
+*/
+const CompletionsBadRequestErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.enum([UNKNOWN_MODEL_ERROR_CODE, ...COMPLETION_TOOL_ERROR_CODES]).optional() });
 /**
 * Error envelope for the 403 apiKeyAuth (apps/client/server/middlewares/apiKeyAuth.ts)
 * throws when an API key lacks a route's scopes. It names what the ROUTE requires,
@@ -5106,6 +5459,7 @@ const ttsRequestSchema = z.object({
 	stability: z.number().min(0).max(1).optional(),
 	similarityBoost: z.number().min(0).max(1).optional(),
 	languageCode: ttsLanguageCodeSchema.optional(),
+	organization_id: z.string().trim().min(1).nullable().optional().describe("The organization to bill: one you belong to, or null for your personal credits. Omitted bills your personal credits, as this endpoint always has. An organization-billed API key always bills its own organization: omit this or set it to the key's organization; any other value, null included, is rejected with a 403 (`errorCode: billing_organization_mismatch`)."),
 	...generatedAudioRequestFields
 });
 /**
@@ -5121,6 +5475,21 @@ const ttsBase64ResponseSchema = extendGeneratedAudioResponseSchema({
 	fallbackFrom: supportedVoiceGenerationVendor.optional()
 });
 /**
+* The classifiers `POST /api/ai/tts` can emit - a narrowing of the platform-wide
+* `API_ERROR_CODES`, not a parallel vocabulary (CONVENTIONS.md section 1). The
+* `satisfies` fails the build if a code here is not in the shared union.
+*
+* `insufficient_credits` rides the 422 and means the same thing it does on
+* /api/ai/music and every other credit-metered endpoint. The two provider codes
+* are easy to invert: `provider_not_configured` means WE have no usable key,
+* `provider_rejected` means the provider REFUSED the key we sent.
+*/
+const TTS_ERROR_CODES = [
+	"insufficient_credits",
+	"provider_not_configured",
+	"provider_rejected"
+];
+/**
 * Error body for `POST /api/ai/tts`, shared by the 401, 422, 429 and 502; the 413
 * has a shape of its own (`ttsResponseTooLargeSchema`). `errorCode` is present only
 * on the conditions that carry a classifier; an ordinary validation 422 has none.
@@ -5146,13 +5515,11 @@ const ttsBase64ResponseSchema = extendGeneratedAudioResponseSchema({
 * this handler's written bodies is a gap in the handler rather than something to
 * enshrine in a schema.
 */
+/** 403 body: the `ai:generate` scope refusal (`required_scopes`), or a billing refusal. */
+const ttsForbiddenResponseSchema = BillingOrganizationForbiddenErrorSchema.extend({ provider: supportedVoiceGenerationVendor.optional() });
 const ttsErrorResponseSchema = ApiErrorSchema.extend({
 	provider: supportedVoiceGenerationVendor.optional(),
-	errorCode: z.enum([
-		"insufficient_credits",
-		"provider_not_configured",
-		"provider_rejected"
-	]).optional()
+	errorCode: z.enum(TTS_ERROR_CODES).optional()
 });
 /**
 * TTS 413 body: `generatedAudioTooLargeSchema` plus the provider. The handler never
@@ -5246,6 +5613,8 @@ const MUSIC_VALIDATION_ERROR_CODES = [
 	"lyrics_with_instrumental",
 	"lyrics_too_long"
 ];
+const SECONDS = String.raw`\d+(?:\.\d+)?`;
+String.raw`\[(?:${SECONDS}:${SECONDS}|:)\]`;
 /**
 * Building blocks for entity response schemas held to an entity's key list (see
 * selfUserResponseSchema in ./user.ts for the full rationale). A passthrough value is
@@ -5989,34 +6358,95 @@ function parseCidr(raw) {
 		prefix: Number(value.slice(slash + 1))
 	};
 }
-function cidrContains(cidr, address) {
-	const target = addressBytes(address);
-	if (!target || target.version !== cidr.version) return false;
-	for (let bit = 0; bit < cidr.prefix; bit++) {
+/**
+* Networks a private-network opt-in never reaches, whatever the operator lists, self-host included.
+* One list for both sides: the settings validator refuses any range that overlaps an entry, and the
+* fetch path (`buildNeverAdmitted` in fab-pipeline's pinnedFetch.ts) refuses these at connect time.
+* IPv4 entries also cover their IPv4-mapped IPv6 forms (`::ffff:0:0/96`) on both sides.
+*/
+const NEVER_ADMITTED_NETWORKS = [
+	{
+		cidr: "0.0.0.0/8",
+		label: "this network"
+	},
+	{
+		cidr: "127.0.0.0/8",
+		label: "loopback"
+	},
+	{
+		cidr: "169.254.0.0/16",
+		label: "link-local, including cloud metadata"
+	},
+	{
+		cidr: "100.100.100.200/32",
+		label: "cloud metadata"
+	},
+	{
+		cidr: "fd00:ec2::254/128",
+		label: "cloud metadata"
+	},
+	{
+		cidr: "64:ff9b::a9fe:a9fe/128",
+		label: "cloud metadata"
+	},
+	{
+		cidr: "::/128",
+		label: "unspecified"
+	},
+	{
+		cidr: "::1/128",
+		label: "loopback"
+	},
+	{
+		cidr: "fe80::/10",
+		label: "link-local"
+	}
+];
+const IPV4_MAPPED_PREFIX = [
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	0,
+	255,
+	255
+];
+/** An IPv4 CIDR in its IPv4-mapped IPv6 form; other CIDRs unchanged. */
+function asIpv6(cidr) {
+	if (cidr.version === 6) return cidr;
+	return {
+		version: 6,
+		bytes: [...IPV4_MAPPED_PREFIX, ...cidr.bytes],
+		prefix: cidr.prefix + 96
+	};
+}
+function cidrsOverlap(a, b) {
+	const [left, right] = a.version === b.version ? [a, b] : [asIpv6(a), asIpv6(b)];
+	const prefix = Math.min(left.prefix, right.prefix);
+	for (let bit = 0; bit < prefix; bit++) {
 		const byte = bit >> 3;
 		const mask = 128 >> (bit & 7);
-		if (((cidr.bytes[byte] ?? 0) & mask) !== ((target.bytes[byte] ?? 0) & mask)) return false;
+		if (((left.bytes[byte] ?? 0) & mask) !== ((right.bytes[byte] ?? 0) & mask)) return false;
 	}
 	return true;
 }
-/**
-* Cloud instance-metadata endpoints, plus the IPv4 one in its IPv4-mapped and NAT64 IPv6 forms.
-* Never reachable through `customMcpAllowPrivateNetworks`, self-host included.
-*/
-const CLOUD_METADATA_ADDRESSES = [
-	"169.254.169.254",
-	"fd00:ec2::254",
-	"::ffff:169.254.169.254",
-	"64:ff9b::169.254.169.254"
-];
+const NEVER_ADMITTED_PARSED = NEVER_ADMITTED_NETWORKS.map((entry) => ({
+	...entry,
+	parsed: parseCidr(entry.cidr)
+}));
 /** Why `raw` may not be allowed as a private network, or null when it may. */
 function customMcpPrivateCidrProblem(raw) {
 	const cidr = parseCidr(raw);
 	if (!cidr) return "Must be a CIDR such as 10.0.0.0/8 or fd12:3456::/32";
 	const minPrefix = CUSTOM_MCP_MIN_CIDR_PREFIX[cidr.version];
 	if (cidr.prefix < minPrefix) return `IPv${cidr.version} ranges must be /${minPrefix} or narrower`;
-	const metadata = CLOUD_METADATA_ADDRESSES.find((address) => cidrContains(cidr, address));
-	if (metadata) return `Range covers the cloud metadata address ${metadata}`;
+	const blocked = NEVER_ADMITTED_PARSED.find((entry) => cidrsOverlap(cidr, entry.parsed));
+	if (blocked) return `Range overlaps ${blocked.cidr} (${blocked.label}), which is never reachable`;
 	return null;
 }
 const CustomMcpPrivateCidrSchema = z$1.string().trim().toLowerCase().superRefine((value, ctx) => {
@@ -6427,8 +6857,11 @@ If the full deliverable genuinely will not fit, do NOT stub the difference. REDU
 * public "Help Center" data lake, so when the knowledge-base search tool is available the model
 * can GROUND its answer in the real docs; the prompt still forbids inventing UI paths it can't
 * verify (relevant when that tool isn't enabled for the session).
+*
+* Ships in open-core builds too, so it names only host surfaces, never an overlay feature. A quoted
+* name in a sentence about the sidebar must be a real sidenav row: SidenavNav.test.tsx enforces it.
 */
-const HELP_CENTER_PROMPT = `HELP CENTER: Bike4Mind has a built-in Help Center that documents how to use the app. Users reach it from the "Help Center" item in the left sidebar, the help (?) icons beside feature titles, or the ? keyboard shortcut. When the user is clearly asking how to DO something in Bike4Mind itself (navigation, settings, files, the data lake, OptiHashi, agents, projects, sharing, billing, etc.) — as opposed to asking you to perform a task — give a brief, helpful answer and point them to the Help Center for full, up-to-date steps. If a knowledge-base/help search tool is available, use it to ground your answer in the actual help docs first. Do NOT invent menu paths, button names, or features you are not sure exist; if unsure, say so and direct them to the Help Center rather than guessing.`;
+const HELP_CENTER_PROMPT = `HELP CENTER: Bike4Mind has a built-in Help Center that documents how to use the app. Users reach it from the Help Center button on the "Gears" page (open "Gears" in the left sidebar), the help (?) icons beside feature titles, or the ? keyboard shortcut. When the user is clearly asking how to DO something in Bike4Mind itself (navigation, settings, files, the data lake, agents, projects, sharing, billing, etc.) - as opposed to asking you to perform a task - give a brief, helpful answer and point them to the Help Center for full, up-to-date steps. If a knowledge-base/help search tool is available, use it to ground your answer in the actual help docs first. Do NOT invent menu paths, button names, or features you are not sure exist; if unsure, say so and direct them to the Help Center rather than guessing.`;
 /**
 * Default text for the abstention licence. Single source of truth used BOTH as the
 * `AbstentionPrompt` admin setting's default AND as the runtime fallback in ChatCompletionProcess -
@@ -6592,6 +7025,7 @@ z$1.enum([
 	"BedrockGuardrailId",
 	"BedrockGuardrailVersion",
 	"ImageModerationEnabled",
+	"ImageModerationReviewerEmails",
 	"tagLineMain",
 	"tagLineSub",
 	"defaultTags",
@@ -7020,8 +7454,8 @@ const CustomMcpPolicySchema = z$1.object({
 const CustomMcpBlockedHostsSchema = z$1.object({ hosts: McpHostPatternListSchema.default([]) });
 /**
 * Self-host only; hosted deployments never reach private networks regardless of this value. Each
-* CIDR is strictly parsed, at least /8 (IPv4) or /16 (IPv6), and never covers a cloud metadata
-* address (see customMcpHosts.ts).
+* CIDR is strictly parsed, at least /8 (IPv4) or /16 (IPv6), and never overlaps a network the fetch
+* path refuses anyway (NEVER_ADMITTED_NETWORKS in customMcpHosts.ts).
 */
 const CustomMcpAllowPrivateNetworksSchema = z$1.object({
 	cidrs: z$1.array(CustomMcpPrivateCidrSchema).max(100).default([]),
@@ -9091,6 +9525,14 @@ const settingsMap = {
 		description: "Whether to run generated images through content moderation (Rekognition) and block explicit content. Legal-safety control (#9776) — default ON.",
 		category: "AI Moderation"
 	}),
+	ImageModerationReviewerEmails: makeObjectSetting({
+		key: "ImageModerationReviewerEmails",
+		name: "Image Moderation Reviewer Emails",
+		defaultValue: [],
+		description: "Email addresses alerted when an image moderation incident needs review, one per line. The alert carries incident metadata and an admin link only, never the image or user content. Empty sends no alert.",
+		category: "AI Moderation",
+		schema: z$1.array(z$1.string())
+	}),
 	SkillMarketHighRiskTools: makeStringSetting({
 		key: "SkillMarketHighRiskTools",
 		name: "Skill Market High-Risk Tools",
@@ -9236,7 +9678,7 @@ const settingsMap = {
 		userReadable: true,
 		name: "Price Per Credit",
 		defaultValue: 50,
-		description: "The price per credit for purchasing credits.",
+		description: `The price in USD of one credit bought pay-as-you-go. Cannot be set below ${formatUsdPerCredit(MIN_PRICE_PER_CREDIT_USD)}, the per-credit sale price including markup.`,
 		category: "Users",
 		group: API_SERVICE_GROUPS.CREDITS.id,
 		order: 1
@@ -9668,7 +10110,7 @@ const settingsMap = {
 		userReadable: true,
 		name: "Default Free Credits",
 		defaultValue: 0,
-		description: `Credits granted to a user who registers WITHOUT an invite code (only applies when Allow Open Registration is ON). Granted after the user verifies their email, NOT at signup - an unverified throwaway account gets 0 credits (anti-spam). A free user can never spend more than this - their hard ceiling of real model cost is roughly credits / ${CREDITS_PER_USD_COST} USD.`,
+		description: "Base credits granted after email verification to a user who registers WITHOUT an invite code, including eligible partner signups when Allow Open Registration is OFF. Partner-rule credits are added on top of this amount. An unverified account receives no credits. A free user cannot spend beyond their total granted balance.",
 		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users"
 	}),
@@ -11493,6 +11935,17 @@ z$1.looseObject({
 	param: z$1.string().optional()
 });
 /**
+* The client-chosen billing organization on the v1 media request bodies (image generations and edits,
+* video and music generations). Blank is a 422 rather than an omission: billing must never fall
+* through to a different payer on an empty string. The server side of this contract is
+* resolveMediaBillingOrgId (apps/client/server/billing); keep these descriptions in step with it.
+*/
+const BillingOrganizationIdSchema = z$1.string().trim().min(1).nullable().optional().describe(`The organization to bill: one you belong to, or null for your personal credits. Omitted bills your home organization, or your personal credits if you have none. An organization-billed API key always bills its own organization: omit this or set it to the key's organization; any other value, null included, is rejected with a 403 (\`errorCode: ${BILLING_ORGANIZATION_MISMATCH_ERROR_CODE}\`).`);
+/** The billing-organization clause of a v1 media create route's 403 description. */
+const BILLING_ORGANIZATION_FORBIDDEN_DESCRIPTION = `the billing organization names one you do not belong to (or is not a valid id), or an organization-billed API key names any organization but its own (\`errorCode: ${BILLING_ORGANIZATION_MISMATCH_ERROR_CODE}\`).`;
+/** A v1 media create route's 400 for an org-billed key that no longer speaks for its organization. */
+const BILLING_ORGANIZATION_STALE_KEY_DESCRIPTION = "An organization-billed API key bills an organization that no longer exists, or one its owner is no longer a member of; re-mint the key.";
+/**
 * Supported sound-effects generation vendors. Currently only ElevenLabs.
 * New vendors are added here and in the `aiSoundService` factory.
 */
@@ -11511,6 +11964,7 @@ const soundEffectsRequestSchema = z.object({
 	durationSeconds: z.number().min(.5).max(30).optional(),
 	promptInfluence: z.number().min(0).max(1).optional(),
 	format: z.string().optional(),
+	organization_id: BillingOrganizationIdSchema,
 	...generatedAudioRequestFields
 });
 /**
@@ -11733,16 +12187,8 @@ const CliCompletionRequestAction = z$1.object({
 		temperature: z$1.number().optional(),
 		maxTokens: z$1.number().optional(),
 		stream: z$1.boolean().optional(),
-		tools: z$1.array(z$1.unknown()).optional(),
-		response_format: z$1.discriminatedUnion("type", [z$1.object({ type: z$1.literal("text") }), z$1.object({
-			type: z$1.literal("json_schema"),
-			json_schema: z$1.object({
-				name: z$1.string(),
-				description: z$1.string().optional(),
-				schema: z$1.record(z$1.string(), z$1.any()),
-				strict: z$1.boolean().optional().default(true)
-			})
-		})]).optional()
+		tools: z$1.array(CompletionToolSchema).optional(),
+		response_format: ResponseFormatSchema.optional()
 	}).optional()
 });
 /**
@@ -12231,7 +12677,7 @@ const VoiceCreditsExhaustedAction = z$1.object({
 const CliCompletionChunkAction = z$1.object({
 	action: z$1.literal("cli_completion_chunk"),
 	requestId: z$1.string(),
-	chunk: z$1.object({
+	chunk: z$1.union([z$1.object({
 		type: z$1.enum(["content", "tool_use"]),
 		text: z$1.string(),
 		toolStarted: z$1.object({
@@ -12244,7 +12690,7 @@ const CliCompletionChunkAction = z$1.object({
 			outputTokens: z$1.number().optional()
 		}).optional(),
 		thinking: z$1.array(z$1.unknown()).optional()
-	})
+	}), CompletionProviderBlockEventSchema])
 });
 /**
 * CLI Completion stream finished successfully
@@ -12261,7 +12707,9 @@ const CliCompletionErrorAction = z$1.object({
 	requestId: z$1.string(),
 	error: z$1.string(),
 	/** Seconds until the caller's rate-limit window reopens; present only on a rate-limit refusal. */
-	retryAfter: z$1.number().optional()
+	retryAfter: z$1.number().optional(),
+	/** Machine-readable reason on a request the caller must fix (a 4xx), e.g. `tool_search_unsupported`. */
+	errorCode: z$1.string().optional()
 });
 /**
 * CLI Tool execution response over WebSocket
@@ -12912,7 +13360,12 @@ const AgentProgressAction = z$1.object({
 	generationJobs: z$1.array(z$1.object({
 		id: z$1.string(),
 		kind: z$1.enum(GENERATION_JOB_KINDS)
-	})).optional()
+	})).optional(),
+	pendingAction: z$1.object({
+		tool: z$1.string(),
+		params: z$1.record(z$1.string(), z$1.unknown()),
+		ts: z$1.number()
+	}).optional()
 });
 const AgentCompletedAction = z$1.object({
 	action: z$1.literal("completed"),
@@ -13277,8 +13730,7 @@ const AgentExecutionStartRequestSchema = z$1.object({
 	max_tokens: z$1.number().int().positive().optional(),
 	thinking: z$1.object({
 		enabled: z$1.boolean(),
-		/** Bounded at 32000: Anthropic rejects rather than clamps an oversized budget. */
-		budget_tokens: z$1.number().int().positive().max(32e3).optional()
+		budget_tokens: z$1.number().int().positive().max(MAX_THINKING_BUDGET_TOKENS).optional()
 	}).optional(),
 	/** Per-message file attachments (fabFile ids), materialized into the first iteration. */
 	file_ids: z$1.array(z$1.string()).optional(),
@@ -13376,171 +13828,12 @@ const AgentExecutionStatusResponseSchema = z$1.object({
 });
 /** Path parameter for `GET /api/v1/agent-executions/{id}`. */
 const AgentExecutionIdParamSchema = z$1.object({ id: z$1.string().min(1) });
-const CompletionReasoningEffortSchema = z$1.enum([
-	"none",
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh"
-]);
-/**
-* Tool schema matching ICompletionOptionTools.toolSchema. The Zod surface only
-* covers wire-format fields (toolFn is server-side). Replaces the historical
-* z.array(z.any()) so client-side bugs (typos in name, missing type) surface
-* at parse time instead of failing silently inside the backend.
-*/
-const CompletionToolSchema = z$1.object({
-	toolSchema: z$1.object({
-		name: z$1.string(),
-		description: z$1.string(),
-		parameters: z$1.object({
-			type: z$1.literal("object"),
-			properties: z$1.record(z$1.string(), z$1.any()).optional(),
-			additionalProperties: z$1.boolean().optional(),
-			required: z$1.array(z$1.string()).optional()
-		}).passthrough(),
-		strict: z$1.boolean().optional()
-	}),
-	_isMcpTool: z$1.boolean().optional()
-});
-/**
-* JSON Schema definition for structured output. The `schema` field is a full
-* JSON Schema document (we don't try to validate JSON Schema with Zod - that's
-* the caller's contract with the model). `strict: true` is the default, matching
-* OpenAI's strict-mode subset semantics.
-*/
-const ResponseFormatSchema = z$1.discriminatedUnion("type", [z$1.object({ type: z$1.literal("text") }), z$1.object({
-	type: z$1.literal("json_schema"),
-	json_schema: z$1.object({
-		name: z$1.string(),
-		description: z$1.string().optional(),
-		schema: z$1.record(z$1.string(), z$1.any()),
-		strict: z$1.boolean().optional().default(true)
-	})
-})]);
-/**
-* Wire-format message for /api/ai/v1/completions. The optional `cache: true`
-* flag is honored by Anthropic (translated to `cache_control: { type: 'ephemeral' }`
-* with the appropriate beta header) and silently ignored by other providers.
-*/
-const CompletionMessageSchema = z$1.object({
-	role: z$1.enum([
-		"user",
-		"assistant",
-		"system"
-	]),
-	content: z$1.union([z$1.string(), z$1.array(z$1.any())]),
-	cache: z$1.boolean().optional()
-});
-/**
-* Schema for CLI LLM completion requests
-* Shared between Next.js API route (dev) and Lambda function (production)
-*
-* `response_format`, `stream`, `tools`, `temperature`, and `max_tokens` are all
-* accepted at the top level (OpenAI-compatible, matching how every major LLM
-* SDK shapes a completion request) AND nested under `options` (legacy shape).
-* Use `normalizeCompletionRequest()` to collapse both surfaces into the
-* canonical `options.<field>` location before downstream consumption.
-*/
-const CompletionRequestSchema = z$1.object({
-	model: z$1.string().max(256),
-	messages: z$1.array(CompletionMessageSchema),
-	response_format: ResponseFormatSchema.optional(),
-	stream: z$1.boolean().optional(),
-	tools: z$1.array(CompletionToolSchema).optional(),
-	temperature: z$1.number().optional(),
-	max_tokens: z$1.number().optional(),
-	options: z$1.object({
-		temperature: z$1.number().optional(),
-		maxTokens: z$1.number().optional(),
-		stream: z$1.boolean().optional(),
-		tools: z$1.array(CompletionToolSchema).optional(),
-		response_format: ResponseFormatSchema.optional(),
-		reasoningEffort: CompletionReasoningEffortSchema.optional().describe("Reasoning effort hint. Honoured by the OpenAI (reasoning models only, and not alongside tools on some of them), Kimi (K3 only), DeepSeek and Anthropic Claude (direct and Bedrock) adapters; each maps it onto its own scale. On Claude, `none` turns thinking off where the model allows it (otherwise it runs at the lowest effort), so short `max_tokens` replies stream visible text from the start; `minimal` maps to `low`. When `thinking.enabled` is also set on a Claude model, thinking stays on and this sets its effort instead, with `none` and `minimal` mapping to `low`. Claude models that reason inside `max_tokens` never have that ceiling raised, and on older Claude models any level above `none` turns thinking on (it is off by default there), forces temperature to 1 and drops top_p, and a thinking budget that cannot fit under `max_tokens` is skipped. On the direct Anthropic API, a json_schema `response_format` with no tools is served by a forced tool on models that support forced tool use, and that tool cannot run alongside thinking, so there only `none` is honoured; models served by native structured outputs honour every level. Silently ignored by every other adapter (Gemini, xAI, Ollama) and by non-reasoning models, so sending it there is a no-op."),
-		thinking: z$1.object({
-			enabled: z$1.boolean(),
-			budget_tokens: z$1.number().int().min(1024).optional()
-		}).optional().describe("Ask a model that can think to think on this turn. On Claude, `reasoningEffort` then sets how much it thinks, and `budget_tokens` (default 16000, minimum 1024) sizes thinking on older Claude models. Ignored by models that cannot think, and on the direct Anthropic API when a json_schema `response_format` is served by a forced tool, which cannot run alongside thinking.")
-	}).optional()
-});
-const CompletionUsageSchema = z$1.object({
-	inputTokens: z$1.number().optional(),
-	outputTokens: z$1.number().optional(),
-	reasoningTokens: z$1.number().optional().describe("Reasoning/thinking tokens the provider reported. A subset of outputTokens, not additive and not billed on top. Absent when the provider or adapter reports no count."),
-	cacheReadInputTokens: z$1.number().optional(),
-	cacheCreationInputTokens: z$1.number().optional()
-});
-const CompletionMetaEventSchema = z$1.object({
-	type: z$1.literal("meta"),
-	requestId: z$1.string()
-});
-const CompletionContentEventSchema = z$1.object({
-	type: z$1.enum(["content", "tool_use"]),
-	text: z$1.string(),
-	tools: z$1.array(z$1.object({
-		name: z$1.string(),
-		arguments: z$1.string().optional(),
-		id: z$1.string().optional()
-	})).optional(),
-	usage: CompletionUsageSchema.optional(),
-	credits: z$1.object({
-		used: z$1.number().optional(),
-		usdCost: z$1.number().optional()
-	}).optional(),
-	responseFormatMode: z$1.enum([
-		"native",
-		"tool_use",
-		"best-effort"
-	]).optional(),
-	stopReason: z$1.string().optional(),
-	thinking: z$1.array(z$1.any()).optional(),
-	toolStarted: z$1.object({
-		name: z$1.string(),
-		id: z$1.string().optional()
-	}).optional()
-});
-/**
-* Classifiers the completions `error` frame may carry: the persisted quest codes plus the two
-* provider codes. A separate tuple because QUEST_ERROR_CODES is stored on quests and must not widen.
-*/
-const COMPLETION_SSE_ERROR_CODES = [
-	...QUEST_ERROR_CODES,
-	"provider_error",
-	"provider_rejected",
-	"content_blocked"
-];
-/**
-* The in-band terminal failure frame, sent only once the stream has opened. Failures found before
-* the provider call (auth, scope, validation, rate limit, model, credits) are JSON errors with a
-* real status instead; see completions.contract.ts.
-*
-* `code` is the machine-readable classifier: a billing code when settlement runs out mid-generation,
-* `provider_rejected` / `provider_error` when the model provider fails, `content_blocked` when the
-* model's safety classifier declined the request. Optional; callers must never match on the prose
-* `message`.
-*
-* The field is `code` rather than the conventions' `errorCode` because this frame shipped that way
-* and is a published wire shape.
-*/
-const CompletionSseErrorEventSchema = z$1.object({
-	type: z$1.literal("error"),
-	message: z$1.string(),
-	requestId: z$1.string().optional(),
-	code: z$1.enum(COMPLETION_SSE_ERROR_CODES).optional()
-});
-/** One `data:` event in the `text/event-stream` completions response. */
-const CompletionStreamEventSchema = z$1.union([
-	CompletionMetaEventSchema,
-	CompletionContentEventSchema,
-	CompletionSseErrorEventSchema
-]);
 /**
 * Server-side tool execution schemas for POST /api/ai/v1/tools.
 *
 * Plain Zod (no `.openapi()`) so any runtime can import them; the OpenAPI layer
 * annotates them via the contract. The tool-name enum MUST stay in sync with
-* SUPPORTED_TOOLS in apps/client/server/cli/toolsHandler.shared.ts.
+* SUPPORTED_TOOLS in packages/server-utils/src/cli/toolsHandler.shared.ts.
 */
 const ToolExecutionRequestSchema = z$1.object({
 	toolName: z$1.enum([
@@ -14196,7 +14489,7 @@ const ChatCompletionCreateInputSchema = z$1.object({
 	stream: z$1.boolean().optional(),
 	thinking: z$1.object({
 		enabled: z$1.boolean(),
-		budget_tokens: z$1.number().optional()
+		budget_tokens: z$1.number().int().positive().max(MAX_THINKING_BUDGET_TOKENS).optional()
 	}).optional(),
 	messages: z$1.array(z$1.object({
 		role: z$1.enum([
@@ -14855,7 +15148,7 @@ const CreateSessionRequestSchema = z$1.object({
 	retrievalVectorizedOnly: z$1.boolean().optional(),
 	citationStyle: z$1.enum(["named", "indexed"]).optional(),
 	temperature: z$1.number().optional(),
-	maxToolCalls: z$1.number().int().positive().optional(),
+	maxToolCalls: z$1.number().int().positive().max(50).optional(),
 	autoNamePlaceholder: z$1.string().optional(),
 	tags: z$1.array(SessionTagSchema).optional(),
 	lastUsedModel: z$1.string().nullish()
@@ -14921,6 +15214,47 @@ z$2.object(passthroughShape({
 	uiSideEffects: true,
 	jupyterNotebook: true
 }));
+const ENV_VARIABLE_RESPONSE_FIELDS = { key: z$2.string() };
+const envVariableResponseSchema = z$2.preprocess((value) => Array.isArray(value) ? value.flatMap((item) => {
+	const key = item?.key;
+	return typeof key === "string" ? [{ key }] : [];
+}) : [], z$2.array(z$2.object(ENV_VARIABLE_RESPONSE_FIELDS)));
+const GITHUB_WEBHOOK_RESPONSE_FIELDS = {
+	routingToken: true,
+	subscribedEvents: true,
+	repos: true,
+	createdAt: true,
+	lastDeliveryAt: true
+};
+const metadataResponseSchema = z$2.object({
+	...passthroughShape({
+		githubLogin: true,
+		githubUserId: true,
+		scope: true,
+		connectedAt: true,
+		disconnectedAt: true,
+		selectedRepositories: true,
+		webhooks: true
+	}),
+	webhooks: z$2.object({ github: z$2.object(passthroughShape(GITHUB_WEBHOOK_RESPONSE_FIELDS)).nullish() }).nullish()
+});
+z$2.object({
+	...passthroughShape({
+		id: true,
+		createdAt: true,
+		updatedAt: true,
+		name: true,
+		userId: true,
+		envVariables: true,
+		tools: true,
+		toolSchemas: true,
+		toolSchemasFetchedAt: true,
+		enabled: true,
+		metadata: true
+	}),
+	envVariables: envVariableResponseSchema,
+	metadata: metadataResponseSchema.nullish()
+});
 const questMasterPlanResponseSchema = z$2.object(passthroughShape({
 	id: true,
 	createdAt: true,
@@ -14943,6 +15277,10 @@ const questMasterPlanResponseSchema = z$2.object(passthroughShape({
 	decisions: true
 }));
 z$2.array(questMasterPlanResponseSchema);
+z$2.object({
+	success: z$2.literal(true),
+	plan: questMasterPlanResponseSchema
+}).extend({ metrics: passthroughField });
 z$1.preprocess((val) => {
 	if (typeof val === "string") {
 		if (val.toLowerCase() === "true") return true;
@@ -15082,7 +15420,10 @@ const CreateFileUploadRequestSchema = z$1.object({
 	file_name: z$1.string().min(1),
 	/** Declared MIME type, e.g. `image/png`. Unsupported types are rejected with 400. */
 	mime_type: z$1.string().min(1),
-	/** Size in bytes of the file you will PUT. Checked against the upload limit and your storage quota. */
+	/**
+	* Size in bytes of the file you will PUT. Checked against the upload limit and your storage quota,
+	* and bound into `upload_url`: a PUT of any other length is refused.
+	*/
 	file_size: z$1.number().int().positive()
 });
 const FILE_MODERATION_STATUSES = [
@@ -16249,8 +16590,8 @@ const ListModelsResponseSchema = paginatedResponseSchema(z$1.object({
 	reasons_within_output_budget: z$1.boolean().describe("Whether reasoning tokens are spent inside `max_output_tokens` on every turn. When true, a small `max_tokens` can be used up by reasoning alone and return an empty reply, so leave room above the answer you expect."),
 	reasoning_efforts: z$1.array(CompletionReasoningEffortSchema).describe("The `reasoningEffort` levels this model acts on, lowest first; empty when it ignores the option. `none` is listed only where it turns reasoning off. Each level is mapped to the nearest one the provider offers. A listed level can still be dropped on one request: some OpenAI models drop it on tool turns, and Claude models with a fixed thinking budget drop it when `max_tokens` leaves no room for the budget plus the answer."),
 	supports_tools: z$1.boolean(),
-	supports_tool_search: z$1.boolean().describe("Whether the model accepts the tool search server tool and `defer_loading: true` on tool definitions, so a large tool catalog is searched on demand instead of loaded into context up front. Describes the model only: `/api/ai/v1/completions` does not accept these yet."),
-	supports_tool_changes: z$1.boolean().describe("Whether a system-role message can carry `tool_addition` and `tool_removal` blocks, which add or remove a declared tool mid-conversation. Describes the model only: `/api/ai/v1/completions` does not accept these blocks yet."),
+	supports_tool_search: z$1.boolean().describe("Whether the model accepts the tool search server tool and `defer_loading: true` on tool definitions, so a large tool catalog is searched on demand instead of loaded into context up front. Describes the model: `/api/ai/v1/completions` honours it only for models whose `backend` is `anthropic`. A `bedrock` model with this flag set is not served with tool search there yet: a `serverTool` entry is refused with `errorCode: \"tool_search_unsupported\"` and `defer_loading` is ignored."),
+	supports_tool_changes: z$1.boolean().describe("Whether a system-role message can carry `tool_addition` and `tool_removal` blocks, which add or remove a declared tool mid-conversation. Describes the model only: `/api/ai/v1/completions` does not accept these blocks yet, and will accept them first for models whose `backend` is `anthropic`."),
 	supports_vision: z$1.boolean(),
 	deprecation_date: z$1.string().nullable().describe("`YYYY-MM-DD`; null when no retirement is scheduled."),
 	replaced_by: z$1.string().nullable().describe("The id of the recommended successor, when there is one."),
@@ -16315,17 +16656,6 @@ const GENERATION_CALLBACK_DESCRIPTION = "Optional `callbackUrl`: an https URL th
 * in sync with the rejections in apps/client/server/generationCallback/armGenerationCallback.ts.
 */
 const GENERATION_CALLBACK_REJECTED_DESCRIPTION = "`callbackUrl` was rejected: the request is not API-key authenticated, the key has no callback signing secret, the URL resolves to a private address, or the deployment does not deliver callbacks.";
-/**
-* The client-chosen billing organization on the v1 media request bodies (image generations and edits,
-* video and music generations). Blank is a 422 rather than an omission: billing must never fall
-* through to a different payer on an empty string. The server side of this contract is
-* resolveMediaBillingOrgId (apps/client/server/billing); keep these descriptions in step with it.
-*/
-const BillingOrganizationIdSchema = z$1.string().trim().min(1).nullable().optional().describe(`The organization to bill: one you belong to, or null for your personal credits. Omitted bills your home organization, or your personal credits if you have none. An organization-billed API key always bills its own organization: omit this or set it to the key's organization; any other value, null included, is rejected with a 403 (\`errorCode: ${BILLING_ORGANIZATION_MISMATCH_ERROR_CODE}\`).`);
-/** The billing-organization clause of a v1 media create route's 403 description. */
-const BILLING_ORGANIZATION_FORBIDDEN_DESCRIPTION = `the billing organization names one you do not belong to (or is not a valid id), or an organization-billed API key names any organization but its own (\`errorCode: ${BILLING_ORGANIZATION_MISMATCH_ERROR_CODE}\`).`;
-/** A v1 media create route's 400 for an org-billed key that no longer speaks for its organization. */
-const BILLING_ORGANIZATION_STALE_KEY_DESCRIPTION = "An organization-billed API key bills an organization that no longer exists, or one its owner is no longer a member of; re-mint the key.";
 const DashboardParamsSchema = z$1.object({
 	dashboardDataSources: z$1.array(z$1.object({
 		sourceName: z$1.string(),
@@ -16366,7 +16696,7 @@ const PromptIntentSchema = z$1.enum(["fresh", "continuation"]);
 * (pages/api/v1/image-generations.ts); `literal` sends it unchanged apart from truncation to the model's prompt limit.
 */
 const ImagePromptResolutionSchema = z$1.enum(["auto", "literal"]);
-const GenerateImageRequestBodySchema = OpenAIImageGenerationInput.extend({
+const GenerateImageIvokeParamsSchema = OpenAIImageGenerationInput.extend({
 	sessionId: z$1.string(),
 	questId: z$1.string().optional(),
 	organizationId: z$1.string().nullable().optional(),
@@ -16399,13 +16729,21 @@ const GenerateImageRequestBodySchema = OpenAIImageGenerationInput.extend({
 		/** Resolver intent - drives the banner's framing (continuation = "context applied" vs fresh = "enhanced"). */
 		intent: PromptIntentSchema.optional()
 	}).optional()
-}).omit({
+});
+/**
+* snake_case alias of `organizationId` on the public image request bodies. The route maps it
+* (`resolveBillingOrgInput`) rather than the schema, which a public request schema may not
+* `.transform()`. Same rules as `organizationId`: null bills personal, blank is a 422.
+*/
+const BillingOrgIdAliasSchema = BillingOrganizationIdSchema.describe("Alias of `organizationId`, for callers used to the snake_case video and music bodies. Sending both with different values is a 422.");
+const GenerateImageRequestBodySchema = GenerateImageIvokeParamsSchema.omit({
 	intent: true,
 	promptEnhancement: true
 }).extend({
 	sessionId: z$1.string().optional(),
 	sessionName: z$1.string().optional(),
 	organizationId: BillingOrganizationIdSchema,
+	organization_id: BillingOrgIdAliasSchema,
 	callbackUrl: GenerationCallbackUrlSchema.optional(),
 	projectId: z$1.string().optional(),
 	prompt_resolution: ImagePromptResolutionSchema.optional().describe("How the prompt is treated before it reaches the image model. `\"auto\"` (the default) resolves it against the session history, so a follow-up such as \"make it darker\" is rewritten to carry the previous subject and the prior image is fed back as input. `\"literal\"` skips that step: the prompt is sent unchanged (apart from truncation to the model's prompt limit), `intent` is `\"fresh\"`, `promptWasEnhanced` is `false`, and a prior session image is carried forward only for models that cannot run without an input image. Use `\"literal\"` when the prompt is already self-contained, for example when an agent or pipeline builds it.")
@@ -16448,6 +16786,7 @@ const EditImageRequestBodySchema = OpenAIImageGenerationInput.extend({
 	sessionId: z$1.string(),
 	questId: z$1.string().optional(),
 	organizationId: BillingOrganizationIdSchema,
+	organization_id: BillingOrgIdAliasSchema,
 	aspect_ratio: z$1.string().optional(),
 	fabFileIds: z$1.array(z$1.string()).prefault([]),
 	/**
@@ -16482,8 +16821,8 @@ z$1.object({
 	imageConfig: GenerateImageToolCallSchema.optional(),
 	audioConfig: AudioGenerationToolCallSchema.optional(),
 	deepResearchConfig: z$1.object({
-		maxDepth: z$1.number().optional(),
-		duration: z$1.number().optional(),
+		maxDepth: z$1.number().int().min(1).max(10).optional(),
+		duration: z$1.number().positive().max(10).optional(),
 		searchers: z$1.array(z$1.any()).optional()
 	}).optional(),
 	fabFileIds: z$1.array(z$1.string()),
@@ -16644,7 +16983,12 @@ z$1.object({
 	* Session-creation input, not a completion parameter, so it is applied only when `sessionId`
 	* is absent; ignored when an existing session is resolved.
 	*/
-	agentIds: z$1.array(z$1.string()).optional()
+	agentIds: z$1.array(z$1.string()).optional(),
+	/**
+	* The subset of `messageFileIds` the user scoped to this message only. Every other notebook-scope
+	* message attachment is pinned to the session so it stays in context on later turns.
+	*/
+	messageOnlyFileIds: z$1.array(z$1.string()).optional()
 });
 /**
 * Response shapes for the public image endpoints (`generateImage` / `editImage`,
@@ -17311,7 +17655,7 @@ defineEndpoint({
 	path: "/api/ai/v1/completions",
 	operationId: "createCompletion",
 	summary: "Create a chat completion",
-	description: "OpenAI-compatible completion. A successful request is ALWAYS answered with an SSE stream (`text/event-stream`), regardless of the `stream` flag: a `meta` event, then `content`/`tool_use` events carrying `usage`/`credits`, terminated by `data: [DONE]`. The terminal event carries `stopReason`; treat `max_tokens` as a TRUNCATED reply rather than a complete one, and note that omitting `max_tokens` on the request lets the server size the output ceiling for the model (recommended for reasoning models, which spend thinking tokens inside that ceiling). A message `content` may be a string or an array of parts; image parts are accepted in OpenAI Chat (`image_url`), OpenAI Responses (`input_image`) or Anthropic (`image` with a `source`) form and are translated to whatever the target model speaks. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nERRORS. Everything checked before the model provider is called fails with a JSON error body and a real HTTP status, before any stream opens: a malformed or otherwise invalid request or an unknown `model` `400` (`errorCode: \"unknown_model\"` for the latter), a bad credential `401`, a key without a required scope `403` (with `required_scopes`), a body over 25 MB `413`, a body that fails schema validation `422`, insufficient credits `422` with `errorCode: \"insufficient_credits\"` (personal or org balance, or an org per-member credit cap), a rate limit `429` with `Retry-After`, and a catalogued model whose provider is not configured on this deployment `503` with `errorCode: \"provider_not_configured\"` (retryable). Once the stream has opened the status stays `200` and a failure arrives as one terminal in-band `error` event. Branch on that event's `code`, never on `message`, which is prose and may change: `insufficient_credits` (buy credits) when credits run out mid-generation, `provider_rejected` when the model provider refused our credentials, `content_blocked` when the model declined the request (do not retry it unchanged), and `provider_error` for any other provider failure. Treat `code` as optional.",
+	description: "OpenAI-compatible completion. A successful request is ALWAYS answered with an SSE stream (`text/event-stream`), regardless of the `stream` flag: a `meta` event, then `content`/`tool_use` events carrying `usage`/`credits`, terminated by `data: [DONE]`. The terminal event carries `stopReason`; treat `max_tokens` as a TRUNCATED reply rather than a complete one, and note that omitting `max_tokens` on the request lets the server size the output ceiling for the model (recommended for reasoning models, which spend thinking tokens inside that ceiling). A message `content` may be a string or an array of parts; image parts are accepted in OpenAI Chat (`image_url`), OpenAI Responses (`input_image`) or Anthropic (`image` with a `source`) form and are translated to whatever the target model speaks. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nTOOL SEARCH. On a model whose `GET /api/v1/models` row has `supports_tool_search: true` and `backend: \"anthropic\"`, a `tools` entry may set `toolSchema.defer_loading: true`, and a `{ \"serverTool\": { \"type\": \"tool_search_tool_regex_20251119\", \"name\": \"tool_search_tool_regex\" } }` (or the `bm25` pair) entry adds Anthropic's tool search, so deferred definitions load only when the model searches for them. The stream then carries `provider_block` events (`{ type, provider: \"anthropic\", block }`) for the server-run search; echo each block back verbatim, in order, in the assistant `messages` content of the next request, and never answer one with a `tool_result`. When the server-run search loop hits its iteration limit the stream ends with `stopReason: \"pause_turn\"`; continue by re-sending the conversation with that assistant turn's provider blocks echoed. A client-side search may return `{ \"type\": \"tool_reference\", \"tool_name\": \"...\" }` blocks inside a `tool_result`'s content. On every other model, Bedrock-served Claude included, `defer_loading` is ignored (every tool is sent as usual) and a server tool, a `tool_reference` or an echoed tool search block is refused with a `400` rather than run without it.\n\nERRORS. Everything checked before the model provider is called fails with a JSON error body and a real HTTP status, before any stream opens: a malformed or otherwise invalid request or an unknown `model` `400` (`errorCode: \"unknown_model\"` for the latter), a bad credential `401`, a key without a required scope `403` (with `required_scopes`), a body over 25 MB `413`, a body that fails schema validation `422`, insufficient credits `422` with `errorCode: \"insufficient_credits\"` (personal or org balance, or an org per-member credit cap), a rate limit `429` with `Retry-After`, and a catalogued model whose provider is not configured on this deployment `503` with `errorCode: \"provider_not_configured\"` (retryable). Once the stream has opened the status stays `200` and a failure arrives as one terminal in-band `error` event. Branch on that event's `code`, never on `message`, which is prose and may change: `insufficient_credits` (buy credits) when credits run out mid-generation, `provider_rejected` when the model provider refused our credentials, `content_blocked` when the model declined the request (do not retry it unchanged), and `provider_error` for any other provider failure. Treat `code` as optional.",
 	tags: ["AI"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:chat", "ai:generate"],
@@ -17345,8 +17689,8 @@ defineEndpoint({
 			}
 		},
 		400: {
-			description: "Malformed or otherwise invalid request (no `errorCode`), or a `model` the caller cannot use (`errorCode: \"unknown_model\"`): not in the catalog or not available to the caller. List valid ids with `GET /api/v1/models`.",
-			schema: UnknownModelErrorSchema
+			description: "Malformed or otherwise invalid request (no `errorCode`), or a `model` the caller cannot use (`errorCode: \"unknown_model\"`): not in the catalog or not available to the caller. List valid ids with `GET /api/v1/models`. Tool search requests are refused with: `tool_search_unsupported` (a server tool, `tool_reference` or echoed tool search block on a model that cannot serve tool search here), `all_tools_deferred` (every tool deferred and no server tool), `deferred_tool_cache_control` (`cache_control` on a deferred tool), `unknown_tool_reference` (a `tool_reference` naming a tool not in `tools`, or carrying no string `tool_name`). Mid-conversation tool changes are refused with: `tool_changes_unsupported` (a `tool_addition` / `tool_removal` system message on a model that cannot serve it here), `invalid_tool_change` (a malformed block, or one placed where the provider does not accept it), and `unknown_tool_reference` (a changed tool not in `tools`).",
+			schema: CompletionsBadRequestErrorSchema
 		},
 		413: {
 			description: "Request body over 25 MB.",
@@ -17442,7 +17786,7 @@ defineEndpoint({
 	path: "/api/ai/tts",
 	operationId: "synthesizeSpeech",
 	summary: "Synthesize speech from text",
-	description: "Generates speech from text using OpenAI or ElevenLabs. When the requested provider has no usable key (or the provider rejects it), another configured provider stands in and the substitution is reported via `provider`/`fallbackFrom` and the `X-B4M-Tts-Provider*` headers. Input length is capped per provider (OpenAI 4096 characters, ElevenLabs 10000), and an output `format` the chosen provider cannot produce is rejected with a 422 before any provider cost is incurred. " + GENERATED_AUDIO_DESCRIPTION,
+	description: "Generates speech from text using OpenAI or ElevenLabs. When the requested provider has no usable key (or the provider rejects it), another configured provider stands in and the substitution is reported via `provider`/`fallbackFrom` and the `X-B4M-Tts-Provider*` headers. Input length is capped per provider (OpenAI 4096 characters, ElevenLabs 10000), and an output `format` the chosen provider cannot produce is rejected with a 422 before any provider cost is incurred. `organization_id` picks the payer: an organization you belong to, or null for your personal credits; omitted bills your personal credits, as this endpoint always has. " + GENERATED_AUDIO_DESCRIPTION,
 	tags: ["Audio"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:generate"],
@@ -17485,6 +17829,18 @@ defineEndpoint({
 			description: "Missing/invalid credentials, no provider has a usable key (`provider_not_configured`), or the provider refused the key we sent and no alternate could stand in (`provider_rejected`).",
 			schema: ttsErrorResponseSchema
 		},
+		400: {
+			description: `The billing organization could not be resolved. ${BILLING_ORGANIZATION_STALE_KEY_DESCRIPTION}`,
+			schema: ttsErrorResponseSchema
+		},
+		403: {
+			description: `The API key lacks the \`ai:generate\` scope (\`required_scopes\` names it), or ${BILLING_ORGANIZATION_FORBIDDEN_DESCRIPTION}`,
+			schema: ttsForbiddenResponseSchema
+		},
+		404: {
+			description: "A nonexistent `organization_id`, for an admin caller; for anyone else it is `403`.",
+			schema: ttsErrorResponseSchema
+		},
 		422: {
 			description: "Request body failed validation, the text exceeds the provider character limit, the provider cannot produce the requested `format`, the provider rejected the request (e.g. an unknown voice), or the caller cannot afford the synthesis - the last of those is the only one tagged `errorCode: \"insufficient_credits\"`, so match on the classifier rather than the status to tell a billing failure from a bad request.",
 			schema: ttsErrorResponseSchema
@@ -17578,7 +17934,7 @@ defineEndpoint({
 	path: "/api/ai/sound-effects",
 	operationId: "generateSoundEffect",
 	summary: "Generate a sound effect",
-	description: "Generates a short sound effect from a text description. Omitting `durationSeconds` lets the provider pick the length (and bills at its default); `promptInfluence` trades prompt fidelity (1) against variation (0). Credits are reserved before generation and refunded if it fails. " + GENERATED_AUDIO_DESCRIPTION,
+	description: "Generates a short sound effect from a text description. Omitting `durationSeconds` lets the provider pick the length (and bills at its default); `promptInfluence` trades prompt fidelity (1) against variation (0). Credits are reserved before generation and refunded if it fails. `organization_id` picks the payer: an organization you belong to, or null for your personal credits; omitted bills your home organization (or personal credits if you have none). " + GENERATED_AUDIO_DESCRIPTION,
 	tags: ["Audio"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:generate"],
@@ -17604,7 +17960,15 @@ defineEndpoint({
 			tooLargeSchema: generatedAudioTooLargeSchema
 		}),
 		400: {
-			description: "The billing user or organization could not be resolved.",
+			description: `The billing user or organization could not be resolved. ${BILLING_ORGANIZATION_STALE_KEY_DESCRIPTION}`,
+			schema: ApiErrorSchema
+		},
+		403: {
+			description: `The API key lacks the \`ai:generate\` scope (\`required_scopes\` names it), or ${BILLING_ORGANIZATION_FORBIDDEN_DESCRIPTION}`,
+			schema: BillingOrganizationForbiddenErrorSchema
+		},
+		404: {
+			description: "A nonexistent `organization_id`, for an admin caller; for anyone else it is `403`.",
 			schema: ApiErrorSchema
 		},
 		422: {
@@ -17745,9 +18109,9 @@ defineEndpoint({
 					replaced_by: null,
 					image: null,
 					credits_per_1m_tokens: {
-						input: 6e3,
-						output: 3e4,
-						cached_input: 600
+						input: 4e3,
+						output: 2e4,
+						cached_input: 400
 					}
 				}, {
 					id: "gpt-image-1",
@@ -17829,7 +18193,7 @@ defineEndpoint({
 	path: "/api/v1/image-generations",
 	operationId: "generateImage",
 	summary: "Generate an image",
-	description: "Queues an image generation and returns immediately with the quest that will carry the result - no image yet, and the call never blocks on the render. Poll `GET /api/v1/quests/{id}` until `status` is `\"done\"` (see the `generateImage200PollResult` schema). Omit `sessionId` to create a new session. The prompt is resolved against the session history first, so a follow-up such as \"make it darker\" binds to the previous image; `enhancedPrompt` reports the prompt actually sent to the model. Send `prompt_resolution: \"literal\"` to skip that step and have the prompt sent as written (apart from truncation to the model's prompt limit). `referenceImageFabFileIds` passes up to 15 already-uploaded images as style anchors, after the input image taken from `fabFileIds`. Only gpt-image models accept them: sending any with another model is rejected with a 400 rather than ignored. Which `size` values a model accepts, and whether it honours `background`, `seed`, `quality`, `n` and reference images, is listed per model in the `image` block of `GET /api/v1/models`. Credits are checked when the render runs, so insufficient credits arrive on the polled quest rather than as a 422. `POST /api/ai/generate-image` is a legacy alias of this endpoint. Authenticate with an API key (`b4m_live_`) or a JWT.\n\n" + GENERATION_CALLBACK_DESCRIPTION,
+	description: "Queues an image generation and returns immediately with the quest that will carry the result - no image yet, and the call never blocks on the render. Poll `GET /api/v1/quests/{id}` until `status` is `\"done\"` (see the `generateImage200PollResult` schema). Omit `sessionId` to create a new session. The prompt is resolved against the session history first, so a follow-up such as \"make it darker\" binds to the previous image; `enhancedPrompt` reports the prompt actually sent to the model. Send `prompt_resolution: \"literal\"` to skip that step and have the prompt sent as written (apart from truncation to the model's prompt limit). `referenceImageFabFileIds` passes up to 15 already-uploaded images as style anchors, after the input image taken from `fabFileIds`. Only gpt-image models accept them: sending any with another model is rejected with a 400 rather than ignored. Which `size` values a model accepts, and whether it honours `background`, `seed`, `quality`, `n` and reference images, is listed per model in the `image` block of `GET /api/v1/models`. Credits are checked when the render runs, so insufficient credits arrive on the polled quest rather than as a 422. `organization_id` is accepted as an alias of `organizationId`, for callers used to the snake_case video and music bodies; `null` bills the personal account. `POST /api/ai/generate-image` is a legacy alias of this endpoint. Authenticate with an API key (`b4m_live_`) or a JWT.\n\n" + GENERATION_CALLBACK_DESCRIPTION,
 	tags: ["Images"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:generate"],
@@ -17856,6 +18220,10 @@ defineEndpoint({
 		404: {
 			description: "The session, or the quest being retried, does not exist or is not accessible to the caller. A nonexistent billing `organizationId` is `404` only for an admin caller; for anyone else, an invalid or inaccessible `organizationId` is `403` instead.",
 			schema: ApiErrorSchema
+		},
+		422: {
+			description: "The body is malformed, or it names the billing organization ambiguously. Both `organizationId` and `organization_id` sent with different values is a `422`; so is an empty or blank value for either (a blank is never treated as an omission, which would bill a different payer), and so is any other billing-org-shaped key such as `billing_org_id` or `payerOrgId`, which would otherwise be stripped and silently bill the caller's home organization.",
+			schema: ApiErrorSchema
 		}
 	},
 	emitsRateLimitHeaders: true,
@@ -17874,7 +18242,7 @@ defineEndpoint({
 	path: "/api/v1/image-edits",
 	operationId: "editImage",
 	summary: "Edit an image",
-	description: "Queues an edit of an existing image and returns the quest that will carry the result, before the render runs. Poll `GET /api/v1/quests/{id}` until `status` is `\"done\"` (see the `editImage200PollResult` schema). `image` is the URL of the source image; `fabFileIds` must name at least one file, and the first is the inpainting mask. `referenceImageFabFileIds` adds up to 15 style anchors after the source image, so the mask always applies to the source; only gpt-image models accept them, and sending any with another model is rejected with a 400 rather than ignored. Both id fields take ids from `POST /api/v1/files`: upload each file, poll `GET /api/v1/files/{id}` until `moderation_status` is `clean`, then pass its `id`. An id that is not yet `clean` fails the edit on the polled quest. `image` takes a URL rather than an id, so a source uploaded the same way is passed as its `download_url`, which must still be unexpired when the render runs. The edited image is not a file id: read it from `files[].url` on the polled quest, not from `GET /api/v1/files/{id}`. `seed` makes an edit reproducible on BFL (FLUX) models only; gpt-image and Gemini models ignore it. Credits are checked when the render runs, so insufficient credits arrive on the polled quest rather than as a 422. `POST /api/ai/edit-image` is a legacy alias of this endpoint. Authenticate with an API key (`b4m_live_`) or a JWT.\n\n" + GENERATION_CALLBACK_DESCRIPTION,
+	description: "Queues an edit of an existing image and returns the quest that will carry the result, before the render runs. Poll `GET /api/v1/quests/{id}` until `status` is `\"done\"` (see the `editImage200PollResult` schema). `image` is the URL of the source image; `fabFileIds` must name at least one file, and the first is the inpainting mask. `referenceImageFabFileIds` adds up to 15 style anchors after the source image, so the mask always applies to the source; only gpt-image models accept them, and sending any with another model is rejected with a 400 rather than ignored. Both id fields take ids from `POST /api/v1/files`: upload each file, poll `GET /api/v1/files/{id}` until `moderation_status` is `clean`, then pass its `id`. An id that is not yet `clean` fails the edit on the polled quest. `image` takes a URL rather than an id, so a source uploaded the same way is passed as its `download_url`, which must still be unexpired when the render runs. The edited image is not a file id: read it from `files[].url` on the polled quest, not from `GET /api/v1/files/{id}`. `seed` makes an edit reproducible on BFL (FLUX) models only; gpt-image and Gemini models ignore it. Credits are checked when the render runs, so insufficient credits arrive on the polled quest rather than as a 422. `organization_id` is accepted as an alias of `organizationId`, for callers used to the snake_case video and music bodies; `null` bills the personal account. `POST /api/ai/edit-image` is a legacy alias of this endpoint. Authenticate with an API key (`b4m_live_`) or a JWT.\n\n" + GENERATION_CALLBACK_DESCRIPTION,
 	tags: ["Images"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:generate"],
@@ -17903,6 +18271,10 @@ defineEndpoint({
 		404: {
 			description: "The session, or the quest being retried, does not exist or is not accessible to the caller. A nonexistent billing `organizationId` is `404` only for an admin caller; for anyone else, an invalid or inaccessible `organizationId` is `403` instead.",
 			schema: ApiErrorSchema
+		},
+		422: {
+			description: "The body is malformed, or it names the billing organization ambiguously. Both `organizationId` and `organization_id` sent with different values is a `422`; so is an empty or blank value for either (a blank is never treated as an omission, which would bill a different payer), and so is any other billing-org-shaped key such as `billing_org_id` or `payerOrgId`, which would otherwise be stripped and silently bill the caller's home organization.",
+			schema: ApiErrorSchema
 		}
 	},
 	emitsRateLimitHeaders: true,
@@ -17934,7 +18306,7 @@ defineEndpoint({
 	path: "/api/v1/files",
 	operationId: "createFileUpload",
 	summary: "Start a file upload",
-	description: "Registers a file and returns a presigned `upload_url`. Uploading is three steps: (1) call this endpoint with the file name, MIME type, and size in bytes; (2) `PUT` the raw bytes to `upload_url` before `upload_url_expires_at` - send no `Authorization` header, the URL signature is the credential, and do send a `Content-Type` matching `mime_type`; (3) poll `GET /api/v1/files/{id}` until `moderation_status` is `clean` (usually a few seconds after the PUT), then pass `id` wherever an endpoint takes a file id (for example `fabFileIds` and `referenceImageFabFileIds` on `POST /api/v1/image-edits`). Unsupported types, a size over the upload limit, or a size that would exceed your storage quota are rejected with 400 before any URL is issued. Authenticate with an API key (`b4m_live_`) carrying `files:write`, or a JWT.",
+	description: "Registers a file and returns a presigned `upload_url`. Uploading is three steps: (1) call this endpoint with the file name, MIME type, and size in bytes; (2) `PUT` the raw bytes to `upload_url` before `upload_url_expires_at` - send no `Authorization` header, the URL signature is the credential, and do send a `Content-Type` matching `mime_type`; the URL is bound to `file_size`, so the body must be exactly that many bytes or storage refuses it with 403; (3) poll `GET /api/v1/files/{id}` until `moderation_status` is `clean` (usually a few seconds after the PUT), then pass `id` wherever an endpoint takes a file id (for example `fabFileIds` and `referenceImageFabFileIds` on `POST /api/v1/image-edits`). Unsupported types, a size over the upload limit, or a size that would exceed your storage quota are rejected with 400 before any URL is issued. Authenticate with an API key (`b4m_live_`) carrying `files:write`, or a JWT.",
 	tags: ["Files"],
 	auth: "apiKeyOrJwt",
 	scopes: ["files:write"],
@@ -21088,6 +21460,11 @@ const INCIDENT_REVIEW_STATUSES = [
 	"reported"
 ];
 const INCIDENT_REPORT_CHANNELS = ["manual"];
+const INCIDENT_SURFACES = [
+	"generation",
+	"edit",
+	"upload"
+];
 const ModerationLabelHitSchema = z$1.object({
 	name: z$1.string(),
 	parentName: z$1.string(),
@@ -21101,6 +21478,7 @@ z$1.object({
 	fabFileId: z$1.string().optional(),
 	provider: z$1.string(),
 	model: z$1.string(),
+	surface: z$1.enum(INCIDENT_SURFACES).optional(),
 	labels: z$1.array(ModerationLabelHitSchema),
 	reviewStatus: z$1.enum(INCIDENT_REVIEW_STATUSES).optional(),
 	ncmecReportId: z$1.string().optional(),
@@ -21110,9 +21488,11 @@ z$1.object({
 	previousReviewStatus: z$1.literal("false_positive").optional(),
 	falsePositiveBy: z$1.string().optional(),
 	falsePositiveAt: z$1.union([z$1.string(), z$1.date()]).optional(),
+	alertedAt: z$1.union([z$1.string(), z$1.date()]).optional(),
 	createdAt: z$1.union([z$1.string(), z$1.date()]).optional(),
 	updatedAt: z$1.union([z$1.string(), z$1.date()]).optional()
 });
+z$1.string().email();
 new RegExp(`[аеорсхуіјѕԁһӏαονικρτυ]`, "g");
 const OPENER_STICKY = /<artifact/iy;
 const WHITESPACE$1 = /\s/;
@@ -21178,7 +21558,7 @@ function scanArtifactOpenTag(text, at, leading, memo) {
 		end: close + 1
 	};
 }
-const OPENER = /<artifact(?=\s)/gi;
+const OPENER$1 = /<artifact(?=\s)/gi;
 const LEADING_WS = /\s+/y;
 const CLOSER = /<\/artifact>/gi;
 const GT = />/g;
@@ -21193,9 +21573,9 @@ function scanArtifactTags(text, attrsMayCrossLines) {
 	const stop = attrsMayCrossLines ? GT : GT_OR_LINE_TERMINATOR;
 	const out = [];
 	let termAt = -1;
-	OPENER.lastIndex = 0;
+	OPENER$1.lastIndex = 0;
 	let opener;
-	while ((opener = OPENER.exec(text)) !== null) {
+	while ((opener = OPENER$1.exec(text)) !== null) {
 		LEADING_WS.lastIndex = opener.index + opener[0].length;
 		LEADING_WS.exec(text);
 		const attrsStart = LEADING_WS.lastIndex;
@@ -21215,7 +21595,7 @@ function scanArtifactTags(text, attrsMayCrossLines) {
 			attrs: text.slice(attrsStart, termAt),
 			body: text.slice(termAt + 1, closer.index)
 		});
-		OPENER.lastIndex = end;
+		OPENER$1.lastIndex = end;
 	}
 	return out;
 }
@@ -23793,111 +24173,283 @@ function getEnvironmentName(configApiConfig) {
 	return "Self-Hosted";
 }
 //#endregion
-//#region src/config/toolSafety.ts
+//#region src/tools/gateway/coreToolDescriptors.ts
+const CORE = { kind: "core" };
+const CLI = { kind: "cli" };
+const pureCompute = () => ({
+	source: CORE,
+	effect: "none",
+	approval: "auto_approve"
+});
+const sessionTool = () => ({
+	source: CLI,
+	effect: "session",
+	approval: "auto_approve"
+});
+const reader = (source = CORE, extra = {}) => ({
+	source,
+	effect: "read",
+	approval: "prompt_default",
+	...extra
+});
+const fileWriter = () => ({
+	source: CORE,
+	effect: "write",
+	approval: "prompt_always",
+	writePathArg: "path"
+});
+const lattice = () => ({
+	source: CORE,
+	effect: "none",
+	approval: "prompt_default"
+});
+/**
+* Descriptors for every tool the CLI builds itself or gets from @bike4mind/services:
+* generateCliTools, buildCliToolList and the subagent-injected tools. A tool missing here
+* resolves to the unknown fallback in toolCatalog.ts; coreToolCompleteness.test.ts
+* fails when a generated tool has no entry.
+*/
+const CORE_TOOL_DESCRIPTORS = new Map(Object.entries({
+	math_evaluate: pureCompute(),
+	current_datetime: pureCompute(),
+	dice_roll: pureCompute(),
+	prompt_enhancement: pureCompute(),
+	find_definition: {
+		source: CLI,
+		effect: "read",
+		approval: "auto_approve"
+	},
+	ask_user_question: {
+		source: CORE,
+		effect: "session",
+		approval: "auto_approve"
+	},
+	agent_delegate: sessionTool(),
+	check_agent_status: sessionTool(),
+	list_background_agents: sessionTool(),
+	cancel_background_agent: sessionTool(),
+	resume_agent: sessionTool(),
+	create_dynamic_agent: sessionTool(),
+	coordinate_task: sessionTool(),
+	decompose_task: sessionTool(),
+	shared_context_read: sessionTool(),
+	shared_context_write: sessionTool(),
+	write_todos: sessionTool(),
+	read_prior_todos: sessionTool(),
+	log_decision: sessionTool(),
+	track_blocker: sessionTool(),
+	resolve_blocker: sessionTool(),
+	request_review_gate: sessionTool(),
+	work_item_create: sessionTool(),
+	work_item_update: sessionTool(),
+	work_item_close: sessionTool(),
+	work_item_ready: sessionTool(),
+	work_item_graph: sessionTool(),
+	tool_search: sessionTool(),
+	create_file: fileWriter(),
+	edit_local_file: fileWriter(),
+	delete_file: fileWriter(),
+	edit_file: {
+		source: CORE,
+		effect: "write",
+		approval: "prompt_always"
+	},
+	bash_execute: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always",
+		openWorld: true,
+		commandArg: "command",
+		sandbox: "command"
+	},
+	shell_execute: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always",
+		openWorld: true
+	},
+	write_shell_stdin: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always",
+		commandArg: "chars"
+	},
+	kill_background_shell: {
+		source: CORE,
+		effect: "execute",
+		approval: "prompt_always"
+	},
+	git_commit: {
+		source: CORE,
+		effect: "write",
+		approval: "prompt_always"
+	},
+	git_push: {
+		source: CORE,
+		effect: "write",
+		approval: "prompt_always",
+		openWorld: true
+	},
+	skill: {
+		source: CLI,
+		effect: "execute",
+		approval: "prompt_always"
+	},
+	weather_info: reader(CORE, { openWorld: true }),
+	web_search: reader(CORE, { openWorld: true }),
+	web_fetch: reader(CORE, { openWorld: true }),
+	deep_research: reader(CORE, { openWorld: true }),
+	check_shell_output: reader(),
+	list_background_shells: reader(),
+	file_read: reader(),
+	grep_search: reader(),
+	glob_files: reader(),
+	get_file_tree: reader(),
+	get_file_structure: reader(CLI),
+	recent_changes: reader(),
+	git_status: reader(),
+	git_diff: reader(),
+	git_log: reader(),
+	git_branch: reader(),
+	lattice_create_model: lattice(),
+	lattice_add_entity: lattice(),
+	lattice_set_value: lattice(),
+	lattice_create_rule: lattice(),
+	lattice_query: lattice(),
+	lattice_explain: lattice()
+}));
+//#endregion
+//#region src/tools/gateway/toolPolicy.ts
 /**
-* Tool safety categories determine when permission is required
+* Every policy decision about a tool, derived from its descriptor. `undefined` is a tool the
+* catalog could not resolve; it keeps the pre-descriptor fallback (prompt_default, read-only)
+* because feature-module and plugin tools do not register descriptors yet.
 */
-const ToolCategorySchema = z$1.enum([
-	"auto_approve",
-	"prompt_always",
-	"prompt_default"
+const UNKNOWN_TOOL_CATEGORY = "prompt_default";
+const READ_ONLY_EFFECTS = /* @__PURE__ */ new Set([
+	"none",
+	"session",
+	"read"
 ]);
-z$1.object({
-	categories: z$1.record(z$1.string(), ToolCategorySchema),
-	trustedTools: z$1.array(z$1.string())
-});
 /**
-* Default tool categories
-*
-* Categories:
-* - auto_approve: Safe tools that don't need permission (math, search, datetime)
-* - prompt_always: Dangerous tools that ALWAYS need permission, cannot be trusted (file edits, shell commands)
-* - prompt_default: Tools that prompt by default but users can trust them (file reads, searches)
-*/
-const DEFAULT_TOOL_CATEGORIES = {
-	math_evaluate: "auto_approve",
-	current_datetime: "auto_approve",
-	dice_roll: "auto_approve",
-	prompt_enhancement: "auto_approve",
-	find_definition: "auto_approve",
-	ask_user_question: "auto_approve",
-	weather_info: "prompt_default",
-	agent_delegate: "auto_approve",
-	check_agent_status: "auto_approve",
-	list_background_agents: "auto_approve",
-	cancel_background_agent: "auto_approve",
-	resume_agent: "auto_approve",
-	create_dynamic_agent: "auto_approve",
-	coordinate_task: "auto_approve",
-	decompose_task: "auto_approve",
-	shared_context_read: "auto_approve",
-	shared_context_write: "auto_approve",
-	write_todos: "auto_approve",
-	read_prior_todos: "auto_approve",
-	log_decision: "auto_approve",
-	track_blocker: "auto_approve",
-	resolve_blocker: "auto_approve",
-	request_review_gate: "auto_approve",
-	work_item_create: "auto_approve",
-	work_item_update: "auto_approve",
-	work_item_close: "auto_approve",
-	work_item_ready: "auto_approve",
-	work_item_graph: "auto_approve",
-	tool_search: "auto_approve",
-	edit_file: "prompt_always",
-	edit_local_file: "prompt_always",
-	create_file: "prompt_always",
-	delete_file: "prompt_always",
-	shell_execute: "prompt_always",
-	bash_execute: "prompt_always",
-	write_shell_stdin: "prompt_always",
-	kill_background_shell: "prompt_always",
-	git_commit: "prompt_always",
-	git_push: "prompt_always",
-	skill: "prompt_always",
-	web_search: "prompt_default",
-	check_shell_output: "prompt_default",
-	list_background_shells: "prompt_default",
-	web_fetch: "prompt_default",
-	deep_research: "prompt_default",
-	file_read: "prompt_default",
-	grep_search: "prompt_default",
-	glob_files: "prompt_default",
-	get_file_tree: "prompt_default",
-	get_file_structure: "prompt_default",
-	git_status: "prompt_default",
-	git_diff: "prompt_default",
-	git_log: "prompt_default",
-	git_branch: "prompt_default"
-};
+* How far a source's own declarations are believed. Core, cli and builtin-module tools ship in
+* this repo and are reviewed, so their descriptor is taken as written. A plugin is third-party
+* code the user installed and enabled: it can be trusted per tool after a prompt, but cannot
+* skip the first prompt or claim to be read-only. MCP tools and lifecycle hooks always prompt.
+*/
+function categoryCeiling(source) {
+	switch (source.kind) {
+		case "mcp":
+		case "hook": return "prompt_always";
+		case "plugin": return "prompt_default";
+		default: return;
+	}
+}
+function believesDeclaredEffect(source) {
+	return categoryCeiling(source) === void 0;
+}
+function toolCategory(descriptor) {
+	if (!descriptor) return UNKNOWN_TOOL_CATEGORY;
+	const ceiling = categoryCeiling(descriptor.source);
+	if (ceiling === "prompt_always") return ceiling;
+	if (ceiling === "prompt_default" && descriptor.approval === "auto_approve") return ceiling;
+	return descriptor.approval;
+}
+/** Whether a prompt_default trust decision can be persisted for the tool. */
+function canTrustTool(descriptor) {
+	return toolCategory(descriptor) !== "prompt_always";
+}
+/** Read-only tools run in plan mode and in parallel batches; the rest are blocked / sequential. */
+function isReadOnlyTool(descriptor) {
+	if (!descriptor) return true;
+	if (!believesDeclaredEffect(descriptor.source)) return false;
+	return READ_ONLY_EFFECTS.has(descriptor.effect);
+}
+/** The shell command text the risk gate classifies, when the tool has one in `args`. */
+function commandTextOf(descriptor, args) {
+	return stringArg(args, descriptor?.commandArg);
+}
 /**
-* Get the category for a tool
-* Returns 'prompt_default' if tool is not in the default categories
+* The argument holding the command the OS sandbox wraps, or undefined when the tool is not
+* sandboxed. Only core tools may declare it: a sandboxed call can skip the prompt in
+* auto-allow mode, so a plugin or MCP descriptor must not be able to claim it.
 */
-function getToolCategory(toolName, customCategories) {
-	if (toolName.startsWith("agent_hook:") || toolName.startsWith("skill_hook:")) return "prompt_always";
-	if (customCategories && toolName in customCategories) return customCategories[toolName];
-	if (toolName in DEFAULT_TOOL_CATEGORIES) return DEFAULT_TOOL_CATEGORIES[toolName];
-	if (toolName.startsWith("mcp__")) return "prompt_always";
-	return "prompt_default";
+function sandboxedCommandArg(descriptor) {
+	if (descriptor?.sandbox !== "command" || descriptor.source.kind !== "core") return void 0;
+	return descriptor.commandArg;
+}
+/** The path a file-writing tool will write, when the tool declares one and `args` carries it. */
+function writePathOf(descriptor, args) {
+	const writePath = stringArg(args, descriptor?.writePathArg);
+	return writePath ? writePath : void 0;
+}
+function stringArg(args, field) {
+	if (!field || args === null || typeof args !== "object") return void 0;
+	const value = args[field];
+	return typeof value === "string" ? value : void 0;
+}
+//#endregion
+//#region src/tools/gateway/toolCatalog.ts
+const MCP_PREFIX = "mcp__";
+const HOOK_PREFIXES = ["agent_hook:", "skill_hook:"];
+function isHookName(toolName) {
+	return HOOK_PREFIXES.some((prefix) => toolName.startsWith(prefix));
 }
 /**
-* Check if a tool can be trusted (not prompt_always)
-*/
-function canTrustTool(toolName, customCategories) {
-	return getToolCategory(toolName, customCategories) !== "prompt_always";
+* Resolve a tool name without a catalog instance: the core table, then the MCP namespace
+* (`mcp__<server>__<tool>`), then the lifecycle-hook namespaces. Undefined means unknown.
+* ToolCatalog.resolve falls back to this after its registered descriptors.
+*/
+function resolveStaticToolDescriptor(toolName) {
+	const core = CORE_TOOL_DESCRIPTORS.get(toolName);
+	if (core) return core;
+	if (toolName.startsWith(MCP_PREFIX)) return {
+		source: {
+			kind: "mcp",
+			server: toolName.slice(5).split("__")[0]
+		},
+		effect: "execute",
+		approval: "prompt_always"
+	};
+	if (isHookName(toolName)) return {
+		source: { kind: "hook" },
+		effect: "execute",
+		approval: "prompt_always"
+	};
 }
 /**
-* Check if a tool is read-only (safe for parallel execution).
-* Write tools (prompt_always category) must always be sequential.
-*
-* @param toolName - Name of the tool to check
-* @param customCategories - Optional custom category overrides
-* @returns true if the tool is read-only, false if it's a write tool
+* Name -> descriptor lookup for one CLI process or ACP stack. Entry points create one and hand
+* it to their PermissionManager, which the permission gateway and the agent's read-only
+* predicate read it through.
 */
-function isReadOnlyTool(toolName, customCategories) {
-	return getToolCategory(toolName, customCategories) !== "prompt_always";
-}
+var ToolCatalog = class {
+	constructor() {
+		this.registered = /* @__PURE__ */ new Map();
+	}
+	/**
+	* Add a descriptor for a tool the core table does not know. Core names and the MCP and hook
+	* namespaces are reserved: nothing can re-declare a core tool, or declare itself into a
+	* namespace whose descriptor comes from the name alone, with a lower tier.
+	*/
+	register(toolName, descriptor) {
+		if (toolName.startsWith(MCP_PREFIX) || isHookName(toolName)) throw new Error(`Tool name "${toolName}" is in a reserved namespace and cannot be registered`);
+		if (CORE_TOOL_DESCRIPTORS.has(toolName)) throw new Error(`Tool "${toolName}" is a core tool and already has a descriptor`);
+		if (this.registered.has(toolName)) throw new Error(`Tool "${toolName}" already has a registered descriptor`);
+		this.registered.set(toolName, descriptor);
+	}
+	resolve(toolName) {
+		return this.registered.get(toolName) ?? resolveStaticToolDescriptor(toolName);
+	}
+	category(toolName) {
+		return toolCategory(this.resolve(toolName));
+	}
+	canTrust(toolName) {
+		return canTrustTool(this.resolve(toolName));
+	}
+	isReadOnly(toolName) {
+		return isReadOnlyTool(this.resolve(toolName));
+	}
+};
 const PROJECT_CONTEXT_FILES = [
 	"CLAUDE.local.md",
 	"CLAUDE.md",
@@ -24638,7 +25190,7 @@ function mergeConfigs(global, project, local) {
 		enabled: merged.tools.enabled.filter((t) => !disabledSet.has(t))
 	};
 	const globalTrusted = new Set(global.trustedTools || []);
-	merged.trustedTools = (merged.trustedTools || []).filter((t) => globalTrusted.has(t) || canTrustTool(t) && !disabledSet.has(t));
+	merged.trustedTools = (merged.trustedTools || []).filter((t) => globalTrusted.has(t) || canTrustTool(resolveStaticToolDescriptor(t)) && !disabledSet.has(t));
 	return merged;
 }
 /**
@@ -25315,4 +25867,4 @@ var ConfigStore = class {
 	}
 };
 //#endregion
-export { SEARCH_RESULT_CARDS_LANGUAGE as $, BRIEFCASE_CATALOG_QUERIES as A, tokenEstimateMultiplier as At, GENERATED_IMAGE_EXTENSION_RE as B, delegationPayloadSchema as Bt, AGENT_QUEST_ID as C, replacePromptVariables as Ct, ARTIFACT_REMOVED_PLACEHOLDER as D, stripDeliveredArtifactBlocks as Dt, ARTIFACT_DELIVERED_PLACEHOLDER as E, splitEquals as Et, ChatModels as F, ACTOR_COLOR_SLOTS as Ft, McpServerName as G, ImagePromptResolutionSchema as H, APP_NAME as Ht, CompletionReasoningEffortSchema as I, DELEGATION_PAYLOAD_SCHEMA_NAME as It, OllamaEmbeddingModel as J, ModelBackend as K, CreateArtifactRequestSchema as L, actorColorIndex as Lt, BriefcasePromptIdSchema as M, ttsRequestSchema as Mt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as N, ttsResponseTooLargeSchema as Nt, ApiKeyType as O, stripToolArtifactMarkup as Ot, CREDIT_DEDUCT_TRANSACTION_TYPES as P, withRetry as Pt, REVIEW_GATE_STATUS_VALUES as Q, DEFAULT_TTS_PROVIDER as R, actorKindMarker as Rt, escapeArtifactBodyJson as S, questReplyText as St, AGENT_QUEST_MCP_URI as T, signImageUrl as Tt, LOCATION_MAP_LANGUAGE as U, WEBSITE_URL as Ut, ImageModels as V, selfClaimedActorKindSchema as Vt, MODEL_INFO_FIELD_GROUP_OF as W, PROMPT_TEXT_MAX as X, OpenAIEmbeddingModel as Y, PermissionDeniedError as Z, logger as _, isPlaceholderImageSigningSecret as _t, getToolCategory as a, WORK_ITEM_STATUSES as at, htmlErrorTitle as b, joinReplySlots as bt, getCreditsUrl as c, createThinkMarkerEscaper as ct, resolveApiEndpoint as d, generatedAudioResponseSchema as dt, SLUG_OWNED_BY_OTHER as et, AuthenticatedApiClient as f, getMcpProviderMetadata as ft, parseApiUrl as g, isEarlyStop as gt, NotAuthenticatedError as h, hasDeliverablePinnedArtifact as ht, canTrustTool as i, VoyageAIEmbeddingModel as it, BedrockEmbeddingModel as j, ttsBase64ResponseSchema as jt, ArtifactTypeSchema as k, supportedVoiceGenerationVendor as kt, getEnvironmentName as l, escapeThinkMarkers as lt, LOCAL_DEV_URL as m, googleMapsSearchUrl as mt, extractCompactInstructions as n, SupportedFabFileMimeTypes as nt, isReadOnlyTool as o, assertAuthOriginMatchesApiKey as ot, DeviceFlowClient as p, getQuestErrorCode as pt, NotFoundError as q, loadContextFiles as r, VisibilitySchema as rt, ApiEndpointUnconfiguredError as s, buildPromptContext as st, ConfigStore as t, SUBQUEST_STATUS_VALUES as tt, requireApiUrl as u, filterToolArtifactMarkup as ut, SESSION_ID_PATTERN as v, isRetryableError as vt, AGENT_QUEST_MANIFEST as w, secureParameters as wt, htmlFirstH1 as x, obfuscateApiKey as xt, isValidSessionId as y, isUserInitiatedAbort as yt, DEGENERATE_FINISH_REASON as z, actorKindSchema as zt };
+export { PROMPT_TEXT_MAX as $, ARTIFACT_REMOVED_PLACEHOLDER as A, splitEquals as At, CreateArtifactRequestSchema as B, DELEGATION_PAYLOAD_SCHEMA_NAME as Bt, htmlErrorTitle as C, isUserInitiatedAbort as Ct, AGENT_QUEST_MANIFEST as D, replacePromptVariables as Dt, AGENT_QUEST_ID as E, questReplyText as Et, BriefcasePromptIdSchema as F, ttsBase64ResponseSchema as Ft, ImagePromptResolutionSchema as G, selfClaimedActorKindSchema as Gt, DEGENERATE_FINISH_REASON as H, actorKindMarker as Ht, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as I, ttsRequestSchema as It, McpServerName as J, LOCATION_MAP_LANGUAGE as K, APP_NAME as Kt, CREDIT_DEDUCT_TRANSACTION_TYPES as L, ttsResponseTooLargeSchema as Lt, ArtifactTypeSchema as M, stripToolArtifactMarkup as Mt, BRIEFCASE_CATALOG_QUERIES as N, supportedVoiceGenerationVendor as Nt, AGENT_QUEST_MCP_URI as O, secureParameters as Ot, BedrockEmbeddingModel as P, tokenEstimateMultiplier as Pt, OpenAIEmbeddingModel as Q, ChatModels as R, withRetry as Rt, isValidSessionId as S, isRetryableError as St, escapeArtifactBodyJson as T, obfuscateApiKey as Tt, GENERATED_IMAGE_EXTENSION_RE as U, actorKindSchema as Ut, DEFAULT_TTS_PROVIDER as V, actorColorIndex as Vt, ImageModels as W, delegationPayloadSchema as Wt, NotFoundError as X, ModelBackend as Y, OllamaEmbeddingModel as Z, LOCAL_DEV_URL as _, getQuestErrorCode as _t, commandTextOf as a, SupportedFabFileMimeTypes as at, logger as b, isEarlyStop as bt, toolCategory as c, VoyageAIEmbeddingModel as ct, getCreditsUrl as d, buildPromptContext as dt, PermissionDeniedError as et, getEnvironmentName as f, createThinkMarkerEscaper as ft, DeviceFlowClient as g, getMcpProviderMetadata as gt, AuthenticatedApiClient as h, generatedAudioResponseSchema as ht, ToolCatalog as i, SUBQUEST_STATUS_VALUES as it, ApiKeyType as j, stripDeliveredArtifactBlocks as jt, ARTIFACT_DELIVERED_PLACEHOLDER as k, signImageUrl as kt, writePathOf as l, WORK_ITEM_STATUSES as lt, resolveApiEndpoint as m, filterToolArtifactMarkup as mt, extractCompactInstructions as n, SEARCH_RESULT_CARDS_LANGUAGE as nt, isReadOnlyTool as o, UnprocessableEntityError as ot, requireApiUrl as p, escapeThinkMarkers as pt, MODEL_INFO_FIELD_GROUP_OF as q, WEBSITE_URL as qt, loadContextFiles as r, SLUG_OWNED_BY_OTHER as rt, sandboxedCommandArg as s, VisibilitySchema as st, ConfigStore as t, REVIEW_GATE_STATUS_VALUES as tt, ApiEndpointUnconfiguredError as u, assertAuthOriginMatchesApiKey as ut, NotAuthenticatedError as v, googleMapsSearchUrl as vt, htmlFirstH1 as w, joinReplySlots as wt, SESSION_ID_PATTERN as x, isPlaceholderImageSigningSecret as xt, parseApiUrl as y, hasDeliverablePinnedArtifact as yt, CompletionReasoningEffortSchema as z, ACTOR_COLOR_SLOTS as zt };