@bike4mind/cli 3.4.0 → 4.0.0

package/dist/{ConfigStore-CbVFLXMH.mjs → ConfigStore-BwqsQ0U9.mjs}

@@ -22,7 +22,7 @@ import { homedir as homedir$1 } from "node:os";
 const APP_NAME = process.env.APP_NAME || "";
 const WEBSITE_URL = process.env.WEBSITE_URL || "";
 //#endregion
-//#region ../../b4m-core/common/dist/skillMdSource-DL0mQJK_.mjs
+//#region ../../b4m-core/common/dist/skillMdSource-CNWRf6Lw.mjs
 /**
 * The marker an exported SKILL.md carries so Bike4Mind can recognize its own exports. The B4M
 * CLI/desktop loader (packages/cli CustomCommandStore) skips stamped files, and a future CLI sync
@@ -34,7 +34,7 @@ const WEBSITE_URL = process.env.WEBSITE_URL || "";
 const SKILL_MD_SOURCE_MARKER = "Bike4Mind-Source:";
 /** Opening `---<lang>` fence, the frontmatter text, then the closing `---` line. */
 const FRONTMATTER = /^---([^\r\n]*)\r?\n(?:([\s\S]*?)\r?\n)?---[ \t]*(?:\r?\n|$)/;
-const SOURCE_LINE = new RegExp(`^[ \\t]*#[ \\t]*${SKILL_MD_SOURCE_MARKER}[ \\t]*(\\S*)`);
+const SOURCE_LINE = new RegExp(`^[ \\t]*#[ \\t]*${SKILL_MD_SOURCE_MARKER}[ \\t]*(\\S+)`);
 /** Splits a SKILL.md into its raw frontmatter and the rest; null when there is no closed fence. */
 function splitSkillMdFrontmatter(text) {
 	if (text.charCodeAt(0) === 65279) text = text.slice(1);
@@ -791,6 +791,22 @@ const CHAT_HISTORY_ITEM_TYPES = [
 	"system",
 	"voice_transcript"
 ];
+/**
+* Why a turn's LLM call was retried. Timeouts we raise ourselves are classified ahead of
+* overload so they never read as a provider fault (older backends worded them "may be
+* overloaded"). Must stay in sync with classifyTurnRetryReason in @bike4mind/services.
+*/
+const TURN_RETRY_REASONS = [
+	"stream_idle_timeout",
+	"stream_truncated",
+	"request_timeout",
+	"rate_limit",
+	"overloaded",
+	"server_error",
+	"transport",
+	"tool_pairing",
+	"other"
+];
 /** Where a session was created. Absent on sessions that predate the field; render those as 'web'. */
 const SESSION_ORIGIN_CHANNELS = [
 	"web",
@@ -849,6 +865,12 @@ function parseClaudeModelId(modelId) {
 		minor: minor === void 0 ? null : Number(minor)
 	};
 }
+/** `opus-4-5` for `claude-opus-4-5-20251101` or `global.anthropic.claude-opus-4-5-...`; null otherwise. */
+function claudeFamilyVersion(modelId) {
+	const parsed = parseClaudeModelId(modelId);
+	if (!parsed) return null;
+	return parsed.minor === null ? `${parsed.family}-${parsed.major}` : `${parsed.family}-${parsed.major}-${parsed.minor}`;
+}
 /**
 * Model backends
 */
@@ -1022,6 +1044,7 @@ let ChatModels = /* @__PURE__ */ function(ChatModels) {
 	ChatModels["TINYLLAMA"] = "tinyllama";
 	ChatModels["DEEPSEEK_R1_BEDROCK"] = "us.deepseek.r1-v1:0";
 	ChatModels["DEEPSEEK_V3_1"] = "deepseek.v3-v1:0";
+	ChatModels["NOVA_PRO_BEDROCK"] = "us.amazon.nova-pro-v1:0";
 	ChatModels["TITAN_TEXT_G1_LITE"] = "amazon.titan-text-lite-v1";
 	ChatModels["TITAN_TEXT_G1_EXPRESS"] = "amazon.titan-text-express-v1";
 	ChatModels["CLAUDE_3_HAIKU_BEDROCK"] = "anthropic.claude-3-haiku-20240307-v1:0";
@@ -1149,6 +1172,173 @@ z$1.enum({
 	...ImageModels,
 	...SpeechToTextModels
 });
+let ApiKeyScope = /* @__PURE__ */ function(ApiKeyScope) {
+	ApiKeyScope["READ_NOTEBOOKS"] = "notebooks:read";
+	ApiKeyScope["WRITE_NOTEBOOKS"] = "notebooks:write";
+	ApiKeyScope["READ_FILES"] = "files:read";
+	ApiKeyScope["WRITE_FILES"] = "files:write";
+	ApiKeyScope["AI_GENERATE"] = "ai:generate";
+	/**
+	* Only the Decisions API (`POST /api/v1/decisions`, `GET /api/v1/decision-models`): typed questions answered
+	* with probabilities. `ai:generate` also opens these routes. Not confined, so like `me:read` it also passes
+	* scope-less routes; an image sent by `file_id` additionally needs `files:read`.
+	*/
+	ApiKeyScope["AI_DECIDE"] = "ai:decide";
+	ApiKeyScope["AI_CHAT"] = "ai:chat";
+	ApiKeyScope["READ_PROJECTS"] = "projects:read";
+	ApiKeyScope["WRITE_PROJECTS"] = "projects:write";
+	/** List and read the key owner's agents (and agents shared with them). */
+	ApiKeyScope["READ_AGENTS"] = "agents:read";
+	/**
+	* Create, update, delete and fund agents, manage their embed keys, and run the
+	* agent-authoring assistants (description/avatar/system-prompt/field generation),
+	* which spend the owner's credits on the agent's behalf.
+	*/
+	ApiKeyScope["WRITE_AGENTS"] = "agents:write";
+	/** Authorizes only the cc-bridge WS actions (cc_agent_register /
+	*  cc_agent_event / cc_agent_disconnect). Keys with this scope CANNOT
+	*  call chat/completions - a leaked bridge key has the narrow blast
+	*  radius of a sprite-spawning credential, not a billable AI key. */
+	ApiKeyScope["CC_BRIDGE"] = "cc-bridge:connect";
+	/**
+	* Read the key owner's OWN commercial state - tier, credit balance, entitlement
+	* keys - via `GET /api/v1/me`. Split from the AI scopes on purpose: a key minted
+	* to generate text has no business enumerating what its owner has paid for. It
+	* reaches only `GET /api/v1/me` and its balance-only subset `GET /api/v1/credits`
+	* (which the AI scopes also open, since spend needs a pre-flight check), so it
+	* carries the `:read` suffix that puts it in the New-Key modal's read-only preset.
+	*/
+	ApiKeyScope["ME_READ"] = "me:read";
+	ApiKeyScope["ADMIN"] = "admin:*";
+	ApiKeyScope["MARKETING_REPORTS_READ"] = "marketing-reports:read";
+	ApiKeyScope["MARKETING_REPORTS_WRITE"] = "marketing-reports:write";
+	/** Server-to-server ingest scope for Overwatch analytics. Admin-provisioned only - never shown in user-facing key creation UI. */
+	ApiKeyScope["OVERWATCH_INGEST_WRITE"] = "overwatch-ingest:write";
+	/** Authorizes only embedded-widget chat against the single agent the key is
+	*  bound to (`agentId`). Like CC_BRIDGE, a leaked embed key has a narrow blast
+	*  radius: it can talk to one agent from allow-listed origins, nothing else. */
+	ApiKeyScope["EMBED_CHAT"] = "embed:chat";
+	/** Read a Hearth channel list and replay its events. Read-only: it cannot
+	*  advance an actor cursor, because consuming events out from under a
+	*  legitimate agent reader is a denial of context, not a read. */
+	ApiKeyScope["HEARTH_READ"] = "hearth:read";
+	/** Append Hearth events, create channels, and advance actor cursors. */
+	ApiKeyScope["HEARTH_WRITE"] = "hearth:write";
+	/**
+	* Read OptiHashi problems, runs, and run artifacts. Deliberately split from
+	* {@link OPTIHASHI_COMPUTE}: a key that only inspects results is structurally
+	* unable to start a billable solve, so an agent-held key can be handed the
+	* read half alone. Like every scope, it authorizes but never entitles - the
+	* OptiHashi entitlement check still runs and can refuse on its own.
+	*/
+	ApiKeyScope["OPTIHASHI_READ"] = "optihashi:read";
+	/**
+	* Submit OptiHashi compute (solve/decompose/schedule) and cancel a run. This
+	* is the spend half of the OptiHashi pair: it commissions external compute
+	* that costs real money, so it is never implied by {@link OPTIHASHI_READ}.
+	*/
+	ApiKeyScope["OPTIHASHI_COMPUTE"] = "optihashi:compute";
+	/**
+	* Read data lakes and their contents: list/browse lakes (including keyword search over
+	* articles), read a lake's health, spend, batches, and access view. Split from
+	* {@link DATALAKE_WRITE} so a key handed to an agent can look at a lake without being able to
+	* change one. A retrieval query that spends LLM/search budget (semantic search, the RLM answer
+	* endpoint) needs {@link DATALAKE_QUERY} instead: this scope does not imply it, though a
+	* {@link DATALAKE_QUERY} key does gain this one (it has to, to reach the read-gated routes its
+	* own retrieval tools call back into).
+	*/
+	ApiKeyScope["DATALAKE_READ"] = "datalake:read";
+	/**
+	* Change what is IN a lake or how it behaves: create/update/archive a lake,
+	* attach, detach, retag, or purge its files, run converge/rechunk/research,
+	* and manage upload batches. Deliberately does NOT carry
+	* {@link DATALAKE_SHARE}: adding files to a lake is a different privilege
+	* from handing the lake to someone else.
+	*/
+	ApiKeyScope["DATALAKE_WRITE"] = "datalake:write";
+	/**
+	* Change WHO can reach a lake: its visibility and its ownership (and the
+	* grant/revoke door). Never implied by {@link DATALAKE_WRITE} - re-sharing a
+	* lake widens the blast radius of every document already in it, which is not
+	* what a key minted to keep a lake's files current asked for.
+	*/
+	ApiKeyScope["DATALAKE_SHARE"] = "datalake:share";
+	/**
+	* Run a retrieval query that spends LLM/search budget against a lake: semantic search and the
+	* RLM answer endpoint. Deliberately NOT suffixed `:read` - {@link DATALAKE_READ} feeds the
+	* New-Key modal's "Read-only" preset (`s.value.endsWith(':read')`), and a key an operator mints
+	* expecting that preset to be free must not auto-join a scope that commissions billable work.
+	* Mirrors {@link OPTIHASHI_COMPUTE}'s split from {@link OPTIHASHI_READ}. Never implied by
+	* {@link DATALAKE_READ} or {@link DATALAKE_WRITE} - spend on a lake is opt-in on its own. The
+	* implication runs the other way for gating purposes: a key holding only this scope also passes
+	* {@link DATALAKE_READ}'s gate, because the RLM answer endpoint's in-REPL tools call back into
+	* read-gated routes (e.g. GET /api/data-lakes/articles) with the caller's own credential.
+	*/
+	ApiKeyScope["DATALAKE_QUERY"] = "datalake:query";
+	/**
+	* Read the Overwatch analytics surface - the cross-product overview, product
+	* inventory and config, first-party metrics, product-stat history, funnel,
+	* and pipeline freshness. Exists so an agent can be handed a credential that
+	* can only *look*: it is deliberately NOT the read half of
+	* {@link OVERWATCH_INGEST_WRITE}, which is a per-product ingest credential
+	* bound to one `productId` and able to write that product's numbers. Handing
+	* an explorer the ingest key would let it fabricate the very stats it reports
+	* on, so the two are separate scopes rather than a read/write pair.
+	*
+	* Like every scope, it authorizes but never entitles - the Overwatch access
+	* check (`requestHasOverwatchAccess`: admin OR developer OR `overwatch:pro`)
+	* still runs against the key's owner and can refuse on its own. A key minted
+	* with this scope by a user who does not hold Overwatch access opens nothing.
+	* That check and the routes it guards live in the Overwatch overlay package;
+	* neither has an implementation in this repository, so nothing here verifies
+	* the claim - it is a property of the consumer, recorded for the reader.
+	*/
+	ApiKeyScope["OVERWATCH_READ"] = "overwatch:read";
+	/**
+	* CI-to-server ingest of Playwright runs for the admin /status page
+	* (`POST /api/qa/uploads`, `POST /api/qa/runs`). Admin-provisioned only,
+	* and confined like {@link OVERWATCH_INGEST_WRITE}: a leaked CI key reaches the
+	* two ingest routes and nothing else. The routes also require the key's owner
+	* to carry the `qa-ingest` user tag (QA_INGEST_USER_TAG in schemas/qa.ts).
+	*/
+	ApiKeyScope["QA_INGEST"] = "qa:ingest";
+	/**
+	* List and download the Claude Code plugin feed of an org's approved Skill Market listings
+	* (`/api/v1/skills/market/*`). Confined: the key ends up in plaintext in `~/.claude/settings.json`,
+	* so it must reach nothing else. Minted from the Skill Market's "Use in Claude Code" dialog.
+	*/
+	ApiKeyScope["SKILLS_READ"] = "skills:read";
+	/**
+	* Release-note automation: find a release note and set its video, and upload the What's New
+	* media for it. Admin-provisioned and confined so the job needs no `admin:*`
+	* key: it reaches only the routes that name it, and those still require a platform-admin owner.
+	*/
+	ApiKeyScope["RELEASE_NOTES_WRITE"] = "release-notes:write";
+	/**
+	* Read the key owner's own Bob results: single-site reads, two-site comparisons and
+	* re-checks, the recent-reports list, and how many runs are left. It starts nothing and
+	* spends nothing, so the `:read` suffix that puts it in the New-Key modal's Read-only
+	* preset is deliberate, and safe there because every read is scoped to the key's owner.
+	* Split from {@link BOB_RUN} so an agent can be handed the read half alone.
+	*
+	* Like every scope, it authorizes but never entitles. The Bob routes, and the gate that
+	* decides which of the two scopes each one accepts, live in the Bob overlay package and
+	* have no implementation in this repository, so nothing here verifies either claim.
+	*/
+	ApiKeyScope["BOB_READ"] = "bob:read";
+	/**
+	* Start a Bob site read, a two-site comparison or a re-check. This is the spend half of
+	* the Bob pair: it spends the key owner's credits and publishes a report as them, so it
+	* is never implied by {@link BOB_READ}, and it is deliberately unsuffixed so it stays out
+	* of the Read-only and Read & write presets, as {@link OPTIHASHI_COMPUTE} does. Nor does
+	* it imply {@link BOB_READ} at this repository's scope gate.
+	*
+	* Authorizes without entitling, like {@link BOB_READ}: the gate that enforces it lives in
+	* the Bob overlay package, with no implementation here.
+	*/
+	ApiKeyScope["BOB_RUN"] = "bob:run";
+	return ApiKeyScope;
+}({});
 Object.freeze({
 	requestsPerMinute: 60,
 	requestsPerDay: 1e3
@@ -1280,6 +1470,42 @@ const GenericCreditAddTransaction = BaseCreditTransaction.extend({
 	transactionId: z$1.string().optional()
 });
 /**
+* Built-in reasons for generic credit deductions; they seed the registry below.
+* A package that needs a new reason registers it with registerGenericDeductReason
+* rather than extending this list.
+*/
+const GenericDeductReasons = [
+	"dispute_clawback",
+	"refund_clawback",
+	"payment_failed_clawback",
+	"notebook_curation",
+	"manual",
+	"admin_adjustment",
+	"refund_adjustment",
+	"optihashi_reservation",
+	"optihashi_cost_chargeup",
+	"credit_expiry"
+];
+const GENERIC_DEDUCT_REASON_PATTERN = /^[a-z][a-z0-9_]*$/;
+const GENERIC_DEDUCT_REASON_REGISTRY_KEY = Symbol.for("b4m.credit.genericDeductReasons");
+let seededRegistry;
+function genericDeductReasonRegistry() {
+	const holder = globalThis;
+	let registry = holder[GENERIC_DEDUCT_REASON_REGISTRY_KEY];
+	if (!registry) {
+		registry = /* @__PURE__ */ new Set();
+		holder[GENERIC_DEDUCT_REASON_REGISTRY_KEY] = registry;
+	}
+	if (seededRegistry !== registry) {
+		for (const reason of GenericDeductReasons) registry.add(reason);
+		seededRegistry = registry;
+	}
+	return registry;
+}
+function isGenericDeductReason(value) {
+	return typeof value === "string" && GENERIC_DEDUCT_REASON_PATTERN.test(value) && genericDeductReasonRegistry().has(value);
+}
+/**
 * Generic credit deduction transaction for legacy data and flexible use cases
 * Represents any credit deduction that doesn't fit specific categories
 * (e.g., admin adjustments, legacy usage, manual deductions)
@@ -1291,20 +1517,10 @@ const GenericCreditDeductTransaction = BaseCreditTransaction.extend({
 	*/
 	userId: z$1.string().optional(),
 	/**
-	* Reason/source for the transaction. Use GenericDeductReasons for new callers.
+	* Reason/source for the transaction: a built-in GenericDeductReasons value or one added with
+	* registerGenericDeductReason.
 	*/
-	reason: z$1.enum([
-		"dispute_clawback",
-		"refund_clawback",
-		"payment_failed_clawback",
-		"notebook_curation",
-		"manual",
-		"admin_adjustment",
-		"refund_adjustment",
-		"optihashi_reservation",
-		"optihashi_cost_chargeup",
-		"credit_expiry"
-	]).optional(),
+	reason: z$1.custom(isGenericDeductReason, { error: (issue) => typeof issue.input === "string" ? "Unregistered generic deduct reason" : `Expected a generic deduct reason string, received ${issue.input === null ? "null" : typeof issue.input}` }).optional(),
 	/**
 	* Stripe dispute ID - set for dispute clawback transactions.
 	* Used for idempotency (unique sparse index prevents duplicate clawbacks).
@@ -1472,6 +1688,25 @@ const USAGE_EVENT_STATUSES = [
 	"refusal",
 	"degenerate"
 ];
+/** Where a UsageEvent's rates came from: a ModelPrice catalog row, or the adapter literal fallback. */
+const USAGE_PRICE_SOURCES = ["catalog", "literal"];
+/** USD per token for the pricing tier that priced a call (see AppliedRates in models.ts). */
+const UsageEventRates = z$1.object({
+	/** The pricing-map key (input-token threshold) of the tier applied. */
+	tierKey: z$1.number(),
+	input: z$1.number(),
+	output: z$1.number(),
+	cacheRead: z$1.number().optional(),
+	cacheWrite: z$1.number().optional()
+});
+/** One provider request of a multi-turn completion, with the tier it was priced on. */
+const UsageEventTurn = z$1.object({
+	inputTokens: z$1.number(),
+	outputTokens: z$1.number(),
+	cacheReadTokens: z$1.number().optional(),
+	cacheWriteTokens: z$1.number().optional(),
+	tierKey: z$1.number()
+});
 z$1.object({
 	id: z$1.string().optional(),
 	/** App-level correlation id: questId for chat/image/video, session/run id otherwise. */
@@ -1517,6 +1752,30 @@ z$1.object({
 	source: z$1.enum(COMPLETION_SOURCES).optional(),
 	/** API key that authed the call; present only for API-key-authed usage. */
 	apiKeyId: z$1.string().optional(),
+	/** 'catalog' when a ModelPrice row priced the call, 'literal' when the adapter literal did. */
+	priceSource: z$1.enum(USAGE_PRICE_SOURCES).optional(),
+	/** The ModelPrice row in force; set only when priceSource is 'catalog'. */
+	priceRowId: z$1.string().optional(),
+	/**
+	* Rates of the tier applied. A multi-turn row whose turns hit different tiers carries the
+	* tier of its largest turn; turnUsage has each turn's own tierKey, but not that tier's rates,
+	* so only a single-tier text charge is recomputable from its own fields. Provider-basis chat
+	* rows use providerInputTokens/providerOutputTokens plus the cache buckets. Local-estimate chat
+	* rows use input * (inputTokens - cachedInputTokens) + cacheRead * cachedInputTokens
+	* + output * outputTokens. Operational and CLI rows use disjoint input/cache buckets instead:
+	* input * inputTokens + cacheRead * cachedInputTokens + cacheWrite * cacheWriteTokens
+	* + output * outputTokens, even when settledBasis is 'local' or unset.
+	* Local-estimate chat rows are inexact when a fallback uses a different tokenEstimateMultiplier:
+	* inputTokens remains in the requested model's units. Tool spend on other models is not covered.
+	*/
+	rates: UsageEventRates.optional(),
+	/**
+	* Per-turn usage, written only when the completion settled over more than one provider
+	* request (tool loops bill turn by turn). Capped at USAGE_EVENT_TURN_USAGE_CAP entries.
+	*/
+	turnUsage: z$1.array(UsageEventTurn).optional(),
+	/** True when turnUsage was capped: its last entry is the sum of every turn from there on. */
+	turnUsageTruncated: z$1.boolean().optional(),
 	createdAt: z$1.date(),
 	updatedAt: z$1.date()
 });
@@ -1589,6 +1848,7 @@ const ADAPTER_FAMILIES = [
 	"bedrock-moonshot",
 	"bedrock-jurassic",
 	"bedrock-titan",
+	"bedrock-converse",
 	"gemini",
 	"xai",
 	"kimi",
@@ -1660,6 +1920,8 @@ const LIFECYCLE_STATUSES = [...[
 	"retired"
 ], "unlisted"];
 const LifecycleWrite = z$1.strictObject({
+	/** Absent on v1 rows means current; true folds the model without disabling it. */
+	isSuperseded: z$1.boolean().optional(),
 	status: z$1.enum(LIFECYCLE_STATUSES),
 	deprecationDate: CALENDAR_DATE.optional(),
 	retirementDate: CALENDAR_DATE.optional(),
@@ -1843,6 +2105,7 @@ const MODEL_INFO_FIELD_GROUP_OF = {
 	supportsTools: "modalities",
 	supportsImageVariation: "modalities",
 	supportsSafetyTolerance: "modalities",
+	isSuperseded: "lifecycle",
 	deprecationDate: "lifecycle",
 	replacedBy: "lifecycle",
 	adapterFamily: "dispatch",
@@ -2368,6 +2631,59 @@ z$1.object({
 	summary: z$1.string(),
 	counts: orgFeedbackSummaryCountsSchema
 });
+const MODAL_MEDIA_HOST_SUFFIXES = [".amazonaws.com", ".cloudfront.net"];
+const MODAL_MEDIA_URL_MAX_LENGTH = 2048;
+const MODAL_MEDIA_URL_HINT = "Upload the file, or paste an https URL on amazonaws.com or cloudfront.net";
+function isAllowedModalMediaUrl(url, policy = {}) {
+	if (url.length > MODAL_MEDIA_URL_MAX_LENGTH) return false;
+	if (policy.allowedUrls?.has(url)) return true;
+	try {
+		const { protocol, hostname, origin, port } = new URL(url);
+		if (policy.extraOrigins?.includes(origin)) return true;
+		return protocol === "https:" && port === "" && MODAL_MEDIA_HOST_SUFFIXES.some((suffix) => hostname.endsWith(suffix));
+	} catch {
+		return false;
+	}
+}
+/** Per-field problems with a modal video, empty when it is valid. Shared by the admin form and the API. */
+function getModalVideoErrors(video, policy = {}) {
+	const errors = {};
+	if (!video) return errors;
+	for (const field of [
+		"landscapeUrl",
+		"landscapePosterUrl",
+		"portraitUrl",
+		"portraitPosterUrl"
+	]) {
+		const url = video[field];
+		if (url && !isAllowedModalMediaUrl(url, policy)) errors[field] = MODAL_MEDIA_URL_HINT;
+	}
+	if (video.landscapePosterUrl && !video.landscapeUrl) errors.landscapePosterUrl ??= "A 16:9 poster needs its 16:9 video";
+	if (video.portraitPosterUrl && !video.portraitUrl) errors.portraitPosterUrl ??= "A 9:16 poster needs its 9:16 video";
+	return errors;
+}
+/** The video's fields with no host check, for reading stored or upstream data written under another policy. */
+const ModalVideoShapeSchema = z$1.object({
+	landscapeUrl: z$1.string().nullable().optional(),
+	landscapePosterUrl: z$1.string().nullable().optional(),
+	portraitUrl: z$1.string().nullable().optional(),
+	portraitPosterUrl: z$1.string().nullable().optional()
+});
+/**
+* Product video for a modal slide. Landscape is the 16:9 cut shown on desktop, portrait the 9:16 cut
+* shown on mobile; the slider falls back to the other orientation when one is missing. The API passes
+* its deployment's extra origins; the bare `ModalVideoSchema` allows only the static host list.
+*/
+function createModalVideoSchema(policy = {}) {
+	return ModalVideoShapeSchema.superRefine((video, ctx) => {
+		for (const [field, message] of Object.entries(getModalVideoErrors(video, policy))) ctx.addIssue({
+			code: "custom",
+			path: [field],
+			message
+		});
+	});
+}
+createModalVideoSchema();
 /**
 * Check if a value is a placeholder (not configured or SST default).
 * Uses case-insensitive comparison and trims whitespace to prevent bypass attempts.
@@ -2984,18 +3300,21 @@ const AuditChangeSchema = z$1.object({
 	before: z$1.unknown(),
 	after: z$1.unknown()
 });
+/** Sources a stored AdminAuditLog row can carry; the write input and the filters stay inside this set. */
+const StoredAuditContextSourceSchema = z$1.enum([
+	"admin_ui",
+	"api_key",
+	"script",
+	"worker"
+]);
+/** Read-side context: 'user' is the account holder's own session, which only the security-store adapters emit. */
 const AuditContextSchema = z$1.object({
 	ip: z$1.string().optional(),
 	userAgent: z$1.string().optional(),
 	requestId: z$1.string().optional(),
-	source: z$1.enum([
-		"admin_ui",
-		"api_key",
-		"script",
-		"worker"
-	]),
+	source: StoredAuditContextSourceSchema,
 	route: z$1.string().optional()
-});
+}).extend({ source: z$1.union([StoredAuditContextSourceSchema, z$1.literal("user")]) });
 const AdminAuditCategorySchema = z$1.enum([
 	"credits",
 	"access",
@@ -3037,6 +3356,267 @@ z$1.object({
 	backfilled: z$1.boolean().optional()
 });
 z$1.string({ error: "A reason is required" }).trim().min(5, `A reason of at least 5 characters is required`).max(500);
+/** App defaults for the AdminSettings grant thresholds (AdminAuditCriticalGrantCredits / AdminAuditDailyGrantCredits). */
+const ADMIN_AUDIT_DEFAULT_CRITICAL_GRANT_CREDITS = 5e4;
+const ADMIN_AUDIT_DEFAULT_DAILY_GRANT_CREDITS = 2e5;
+const ADMIN_AUDIT_CATALOGUE = {
+	"org.credits.granted": {
+		category: "credits",
+		severity: "notice",
+		write: "strict",
+		escalatesAboveGrantThreshold: true
+	},
+	"org.credits.topped_up": {
+		category: "credits",
+		severity: "notice",
+		write: "strict",
+		escalatesAboveGrantThreshold: true
+	},
+	"org.credits.adjusted": {
+		category: "credits",
+		severity: "notice",
+		write: "strict",
+		escalatesAboveGrantThreshold: true
+	},
+	"org.credits.refunded": {
+		category: "credits",
+		severity: "notice",
+		write: "strict",
+		escalatesAboveGrantThreshold: true
+	},
+	"user.subscription.granted": {
+		category: "credits",
+		severity: "notice",
+		write: "strict"
+	},
+	"user.credits.adjusted": {
+		category: "credits",
+		severity: "notice",
+		write: "strict",
+		escalatesAboveGrantThreshold: true
+	},
+	"user.credits.denied": {
+		category: "credits",
+		severity: "critical",
+		write: "bestEffort"
+	},
+	"user.subscription.denied": {
+		category: "credits",
+		severity: "critical",
+		write: "bestEffort"
+	},
+	"user.role.admin_granted": {
+		category: "access",
+		severity: "critical",
+		write: "strict"
+	},
+	"user.role.admin_revoked": {
+		category: "access",
+		severity: "critical",
+		write: "strict"
+	},
+	"user.role.denied": {
+		category: "access",
+		severity: "critical",
+		write: "bestEffort"
+	},
+	"user.impersonation.started": {
+		category: "access",
+		severity: "critical",
+		write: "strict"
+	},
+	"user.impersonation.ended": {
+		category: "access",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"user.impersonation.denied": {
+		category: "access",
+		severity: "critical",
+		write: "bestEffort"
+	},
+	"user.deleted": {
+		category: "account",
+		severity: "critical",
+		write: "strict"
+	},
+	"user.deletion.denied": {
+		category: "account",
+		severity: "critical",
+		write: "bestEffort"
+	},
+	"user.profile.updated": {
+		category: "account",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"org.seats.changed": {
+		category: "org",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"org.seats.ceiling_raised": {
+		category: "org",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"org.conversion.initiated": {
+		category: "org",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"org.revoked": {
+		category: "org",
+		severity: "notice",
+		write: "strict"
+	},
+	"org.group_types.updated": {
+		category: "org",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"org.admins.updated": {
+		category: "org",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"org.group_member.assigned": {
+		category: "org",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"org.group_member.unassigned": {
+		category: "org",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"org.invite.created": {
+		category: "org",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"org.member_budget.updated": {
+		category: "org",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"settings.admin_settings.updated": {
+		category: "settings",
+		severity: "notice",
+		write: "strict"
+	},
+	"settings.whats_new.updated": {
+		category: "settings",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"settings.whats_new.synced": {
+		category: "settings",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"settings.whats_new.generation_triggered": {
+		category: "settings",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"settings.security_scan.enabled": {
+		category: "settings",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"settings.security_scan.disabled": {
+		category: "settings",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"settings.security_scan.triggered": {
+		category: "settings",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"security.attack_simulation.run": {
+		category: "settings",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"oauth_client.created": {
+		category: "settings",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"oauth_client.secret_rotated": {
+		category: "settings",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"oauth_client.updated": {
+		category: "settings",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"oauth_client.activated": {
+		category: "settings",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"oauth_client.deactivated": {
+		category: "settings",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"system_health.test_run": {
+		category: "settings",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"user.email.verified": {
+		category: "identity",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"user.email.unverified": {
+		category: "identity",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"user.email.verification_resent": {
+		category: "identity",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"user.email.change_resent": {
+		category: "identity",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"user.email.change_cancelled": {
+		category: "identity",
+		severity: "info",
+		write: "bestEffort"
+	},
+	"user.sessions.revoked": {
+		category: "identity",
+		severity: "notice",
+		write: "bestEffort"
+	},
+	"user.mfa.reset": {
+		category: "identity",
+		severity: "notice",
+		write: "strict"
+	},
+	"user.mfa.denied": {
+		category: "identity",
+		severity: "critical",
+		write: "bestEffort"
+	},
+	"audit.exported": {
+		category: "support",
+		severity: "info",
+		write: "bestEffort"
+	}
+};
+Object.keys(ADMIN_AUDIT_CATALOGUE).filter((action) => "escalatesAboveGrantThreshold" in ADMIN_AUDIT_CATALOGUE[action]);
 z$1.object({
 	category: AdminAuditCategorySchema.optional(),
 	severity: AdminAuditSeveritySchema.optional(),
@@ -3045,13 +3625,14 @@ z$1.object({
 	actorUserId: z$1.string().min(1).optional(),
 	targetKind: AuditTargetSchema.shape.kind.optional(),
 	targetId: z$1.string().min(1).optional(),
-	source: AuditContextSchema.shape.source.optional(),
+	source: StoredAuditContextSourceSchema.optional(),
 	actorScope: AuditActorSchema.shape.scope.optional(),
 	from: z$1.iso.datetime().optional(),
 	to: z$1.iso.datetime().optional(),
 	requestId: z$1.string().min(1).optional(),
 	impersonationSessionId: z$1.string().min(1).optional()
 });
+z$1.enum(["target", "actor"]);
 let SupportedFabFileMimeTypes = /* @__PURE__ */ function(SupportedFabFileMimeTypes) {
 	SupportedFabFileMimeTypes["PDF"] = "application/pdf";
 	SupportedFabFileMimeTypes["DOCX"] = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
@@ -3097,6 +3678,26 @@ let SupportedFabFileMimeTypes = /* @__PURE__ */ function(SupportedFabFileMimeTyp
 	return SupportedFabFileMimeTypes;
 }({});
 new Set(Object.values(SupportedFabFileMimeTypes));
+/**
+* Known MIME types emitted by the generated-audio endpoints (TTS + sound
+* effects). Deliberately SEPARATE from SupportedFabFileMimeTypes: that set is
+* the ingest pipeline's chunk+vectorize allowlist, and audio is intentionally
+* NOT vectorizable and NOT attachable to a chat completion (no model accepts
+* audio input). Kept only for extension mapping / documentation; the runtime
+* guard below matches any `audio/*` so unusual provider subtypes are still
+* treated as audio (i.e. still excluded from every LLM path).
+*/
+let AudioMimeType = /* @__PURE__ */ function(AudioMimeType) {
+	AudioMimeType["MP3"] = "audio/mpeg";
+	AudioMimeType["WAV"] = "audio/wav";
+	AudioMimeType["OPUS"] = "audio/opus";
+	AudioMimeType["AAC"] = "audio/aac";
+	AudioMimeType["FLAC"] = "audio/flac";
+	AudioMimeType["PCM"] = "audio/pcm";
+	AudioMimeType["OGG"] = "audio/ogg";
+	AudioMimeType["WEBM"] = "audio/webm";
+	return AudioMimeType;
+}({});
 /** Reads back the classifier set by the tagged-error helpers above; `undefined` for untagged errors. */
 function getQuestErrorCode(error) {
 	const code = error?.additionalInfo?.errorCode;
@@ -3233,6 +3834,49 @@ const PROMPT_META_MODEL_TYPES = [
 	"image",
 	"video"
 ];
+/**
+* Native Anthropic tool capabilities, by Claude family and version. Allow-lists rather than a
+* version comparison, so an older or not-yet-reviewed id (a preview, a new family) reads false.
+* Sources: the tool search tool and mid-conversation system messages pages of the Claude docs.
+*/
+const TOOL_SEARCH_VERSIONS = /* @__PURE__ */ new Set([
+	"opus-4-5",
+	"opus-4-6",
+	"opus-4-7",
+	"opus-4-8",
+	"opus-5",
+	"opus-5-5",
+	"sonnet-4-5",
+	"sonnet-4-6",
+	"sonnet-5",
+	"sonnet-5-5",
+	"haiku-4-5",
+	"haiku-5-5",
+	"fable-5",
+	"fable-5-1",
+	"mythos-5",
+	"mythos-5-1"
+]);
+function servedNatively(model, versions) {
+	if (model.backend !== "anthropic" && model.backend !== "bedrock") return false;
+	const version = claudeFamilyVersion(model.id);
+	return version !== null && versions.has(version);
+}
+/** Whether the model accepts the tool search server tool and `defer_loading` on tool definitions. */
+function supportsToolSearch(model) {
+	return servedNatively(model, TOOL_SEARCH_VERSIONS);
+}
+function servedByDirectAnthropic(model) {
+	return model.adapterFamily ? model.adapterFamily === "anthropic-messages" : model.backend === "anthropic";
+}
+function servedByClaudeAdapter(model) {
+	if (servedByDirectAnthropic(model)) return true;
+	return model.adapterFamily ? model.adapterFamily === "bedrock-anthropic" : model.backend === "bedrock";
+}
+/** supportsToolSearch, narrowed to models whose `/api/ai/v1/completions` adapter actually forwards it. */
+function completionsSupportsToolSearch(model) {
+	return servedByClaudeAdapter(model) && supportsToolSearch(model);
+}
 const DEFAULT_PRICE_MARGIN = 1.2;
 const DEFAULT_USD_TO_CREDITS_RATE = 6e-4;
 /**
@@ -3848,7 +4492,7 @@ const CompletionCustomToolSchema = z$1.object({
 			required: z$1.array(z$1.string()).optional()
 		}).passthrough(),
 		strict: z$1.boolean().optional(),
-		defer_loading: z$1.boolean().optional().describe("Keep this definition out of the model context until the tool search server tool (or a `tool_reference`) loads it. Honoured only on models served by the direct Anthropic API whose `supports_tool_search` is true; on every other model (including Bedrock-served Claude, for now) it is ignored and the tool is sent as usual. At least one tool, or a `serverTool` entry, must stay non-deferred (`errorCode: \"all_tools_deferred\"`)."),
+		defer_loading: z$1.boolean().optional().describe("Keep this definition out of the model context until the tool search server tool (or a `tool_reference`) loads it. Honoured only on Claude models (direct Anthropic or Bedrock) whose `supports_tool_search` is true; on every other model it is ignored and the tool is sent as usual. At least one tool, or a `serverTool` entry, must stay non-deferred (`errorCode: \"all_tools_deferred\"`)."),
 		cache_control: z$1.unknown().optional().describe("Accepted for validation only and not forwarded. Rejected on a deferred tool (`errorCode: \"deferred_tool_cache_control\"`).")
 	}),
 	_isMcpTool: z$1.boolean().optional()
@@ -3861,7 +4505,7 @@ const ToolSearchServerToolSchema = z$1.discriminatedUnion("type", [z$1.object({
 	type: z$1.literal("tool_search_tool_bm25_20251119"),
 	name: z$1.literal("tool_search_tool_bm25")
 })]);
-const CompletionServerToolSchema = z$1.object({ serverTool: ToolSearchServerToolSchema.describe("A provider-run tool, sent to the provider as `{ type, name }`. Only the Anthropic tool search tools exist today, and only on models served by the direct Anthropic API whose `supports_tool_search` is true; any other model, Bedrock-served Claude included, is refused with `errorCode: \"tool_search_unsupported\"` rather than run without it.") });
+const CompletionServerToolSchema = z$1.object({ serverTool: ToolSearchServerToolSchema.describe("A provider-run tool, sent to the provider as `{ type, name }`. Only the Anthropic tool search tools exist today, and only on Claude models (direct Anthropic or Bedrock) whose `supports_tool_search` is true; any other model is refused with `errorCode: \"tool_search_unsupported\"` rather than run without it.") });
 /** One `tools[]` entry: a caller-defined tool, or a provider-run server tool. */
 const CompletionToolSchema = z$1.union([CompletionCustomToolSchema, CompletionServerToolSchema]);
 /**
@@ -3930,7 +4574,7 @@ const CompletionMessageSchema = z$1.object({
 */
 const CompletionRequestSchema = z$1.object({
 	model: z$1.string().max(256),
-	messages: z$1.array(CompletionMessageSchema),
+	messages: z$1.array(CompletionMessageSchema).min(1),
 	response_format: ResponseFormatSchema.optional(),
 	stream: z$1.boolean().optional(),
 	tools: z$1.array(CompletionToolSchema).optional(),
@@ -3991,6 +4635,7 @@ const CompletionContentEventSchema = z$1.object({
 */
 const COMPLETION_SSE_ERROR_CODES = [
 	...QUEST_ERROR_CODES,
+	"invalid_request",
 	"provider_error",
 	"provider_rejected",
 	"content_blocked"
@@ -4001,9 +4646,9 @@ const COMPLETION_SSE_ERROR_CODES = [
 * real status instead; see completions.contract.ts.
 *
 * `code` is the machine-readable classifier: a billing code when settlement runs out mid-generation,
-* `provider_rejected` / `provider_error` when the model provider fails, `content_blocked` when the
-* model's safety classifier declined the request. Optional; callers must never match on the prose
-* `message`.
+* `invalid_request` when the provider rejects caller-controlled input, `provider_rejected` /
+* `provider_error` when the model provider fails, `content_blocked` when the model's safety classifier
+* declined the request. Optional; callers must never match on the prose `message`.
 *
 * The field is `code` rather than the conventions' `errorCode` because this frame shipped that way
 * and is a published wire shape.
@@ -5128,9 +5773,9 @@ const RetrievalSummarySchema = z$1.object({
 * `citables` and `retrieval` - this field needs no merge case in applyQuestStatusChanges: a
 * later tool-arm write that omits it is preserved by the one-level spread.
 *
-* `reasons` is the same diagnostic prose the warnings entry interpolates. It is shown to the
-* reader behind a disclosure rather than in the banner body, because only some reasons are
-* actionable (a document mid-reindex returns on its own; a per-turn chunk budget does not).
+* `reasons` is reader-facing prose with no document ids or internal limits, shown behind a
+* disclosure in the chat notice. The diagnostic version (ids, caps, counts) lives only in the
+* `warnings` entry. A supersession collapse alone does not produce this field at all.
 */
 const RetrievalCoverageSchema = z$1.object({
 	/** Always true - see the presence contract above. */
@@ -5460,10 +6105,14 @@ const StorageLimitErrorSchema = ApiErrorSchema.extend(StorageLimitErrorInfoSchem
 /** 503 when this deployment has no usable key for a provider the request needs (data-lake search, voice). */
 const ProviderNotConfiguredErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.literal("provider_not_configured").optional() });
 /**
-* 400 for a `model` the caller cannot use, or a refused tool search request; `errorCode` is absent on the
-* other 400s (e.g. malformed JSON).
+* 400 for provider-rejected caller input, a `model` the caller cannot use, or a refused tool search
+* request; `errorCode` is absent on the other 400s (e.g. malformed JSON).
 */
-const CompletionsBadRequestErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.enum([UNKNOWN_MODEL_ERROR_CODE, ...COMPLETION_TOOL_ERROR_CODES]).optional() });
+const CompletionsBadRequestErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.enum([
+	"invalid_request",
+	UNKNOWN_MODEL_ERROR_CODE,
+	...COMPLETION_TOOL_ERROR_CODES
+]).optional() });
 /**
 * Error envelope for the 403 apiKeyAuth (apps/client/server/middlewares/apiKeyAuth.ts)
 * throws when an API key lacks a route's scopes. It names what the ROUTE requires,
@@ -5491,10 +6140,11 @@ const voiceOutputFormatSchema = z.enum([
 	"flac",
 	"pcm"
 ]);
-const TTS_ABSOLUTE_MAX_INPUT_CHARS = Math.max(...Object.values({
+const TTS_MAX_INPUT_CHARS = {
 	openai: 4096,
 	elevenlabs: 1e4
-}));
+};
+const TTS_ABSOLUTE_MAX_INPUT_CHARS = Math.max(...Object.values(TTS_MAX_INPUT_CHARS));
 const ttsLanguageCodeSchema = z.string().regex(/^[a-z]{2}$/, "languageCode must be a lowercase ISO 639-1 code, e.g. \"en\" or \"ja\"");
 const ttsRequestSchema = z.object({
 	text: z.string().min(1).max(TTS_ABSOLUTE_MAX_INPUT_CHARS),
@@ -5586,12 +6236,30 @@ const ttsResponseTooLargeSchema = generatedAudioTooLargeSchema.extend({
 	fabFileId: z.string().optional(),
 	fileUrl: z.string().optional()
 });
+/**
+* The model each vendor's service synthesizes and bills with when the caller
+* names none. Read by OpenAIVoiceService / ElevenLabsVoiceService in
+* @bike4mind/utils, so a pre-flight estimate prices the model the charge will use
+* when the requested vendor serves the call. The TTS route reserves the highest
+* estimate across its candidate vendors, using these defaults for alternates,
+* then settles the actual vendor's cost and refunds the difference.
+*/
+const TTS_DEFAULT_MODEL = {
+	openai: "tts-1",
+	elevenlabs: "eleven_multilingual_v2"
+};
 const GENERATION_OUTPUT_AVAILABILITIES = [
 	"ready",
 	"pending_scan",
 	"unavailable"
 ];
 const VIDEO_MODES = ["text_to_video", "image_to_video"];
+const VIDEO_INPUT_ROLES = [
+	"first_frame",
+	"last_frame",
+	"reference",
+	"style"
+];
 const ASPECT_RATIOS = [
 	"16:9",
 	"9:16",
@@ -5615,6 +6283,13 @@ const VideoModelIdSchema = z$1.enum([
 	"grok-imagine-video-1.5",
 	"veo-3.1-fast-generate-preview"
 ]);
+const VideoInputSchema = z$1.union([z$1.strictObject({
+	role: z$1.enum(VIDEO_INPUT_ROLES),
+	fileId: z$1.string().min(1)
+}), z$1.strictObject({
+	role: z$1.enum(VIDEO_INPUT_ROLES),
+	generatedImageKey: z$1.string().min(1)
+})]);
 z$1.object({
 	model: VideoModelIdSchema,
 	mode: z$1.enum(VIDEO_MODES),
@@ -5622,6 +6297,7 @@ z$1.object({
 	durationSeconds: z$1.number().positive(),
 	aspectRatio: z$1.enum(ASPECT_RATIOS),
 	resolution: z$1.enum(RESOLUTION_TIERS),
+	inputs: z$1.array(VideoInputSchema).max(8).optional(),
 	inputImageFileId: z$1.string().min(1).optional(),
 	inputGeneratedImageKey: z$1.string().min(1).optional(),
 	audio: z$1.boolean().optional()
@@ -5633,6 +6309,7 @@ const VIDEO_VALIDATION_ERROR_CODES = [
 	"unsupported_mode",
 	"missing_input_image",
 	"unexpected_input_image",
+	"unsupported_input_role",
 	"unsupported_audio_option"
 ];
 const MAX_MUSIC_LYRICS_CHARS = 1e4;
@@ -5854,6 +6531,7 @@ z$2.object({
 	]),
 	slackSettings: redactedSubdocument([
 		"slackUserId",
+		"slackTeamId",
 		"defaultNotebookId",
 		"autoCreateNotebook",
 		"notebookNamePrefix",
@@ -5874,7 +6552,10 @@ z$2.object({
 		"connectedAt"
 	])
 }).extend({
-	securityQuestions: passthroughField,
+	securityQuestions: z$2.array(z$2.object({
+		question: z$2.string(),
+		answer: z$2.literal("")
+	})).nullable().optional(),
 	userNotes: passthroughField
 });
 /**
@@ -5894,7 +6575,6 @@ const INTEGRATION_IDS = [
 	"mcp-cli",
 	"atlassian",
 	"notion",
-	"google-calendar",
 	"slack",
 	"email",
 	"linkedin",
@@ -6067,20 +6747,6 @@ const INTEGRATION_CATALOG = {
 			mcpServer: "notion"
 		}]
 	},
-	"google-calendar": {
-		name: "Google Calendar",
-		description: "Book briefing calls into open slots on a shared Bike4Mind calendar, not your own.",
-		category: "productivity",
-		logo: "google-calendar",
-		stage: "beta",
-		flag: "enableGoogleCalendar",
-		capabilities: [{
-			id: "calendar-booking",
-			label: "Book briefings on a shared calendar",
-			kind: "notifications",
-			stage: "beta"
-		}]
-	},
 	slack: {
 		name: "Slack",
 		description: "Chat with Bike4Mind in Slack and send threads and files to a data lake.",
@@ -6655,7 +7321,7 @@ let OllamaEmbeddingModel = /* @__PURE__ */ function(OllamaEmbeddingModel) {
 *
 * Deliberately answers from the ENVIRONMENT only, and deliberately does NOT try to answer "can this
 * deployment actually reach that model". It cannot: on a hosted stage an SST secret arrives as a
-* linked Resource, never as process.env (see apps/client/server/modelDiscovery/adapters.ts), so an
+* linked Resource, never as process.env (see packages/server-utils/src/modelDiscovery/adapters.ts), so an
 * absent OPENAI_API_KEY here means "unknown", not "no key" - it is absent on production too. This
 * function is also bundled into the browser via settingsMap, where every env read is undefined, so
 * any answer it gives must be one that is safe as a stage-neutral constant.
@@ -6764,6 +7430,7 @@ z$1.object({
 	status: ReleaseNoteStatusSchema,
 	publishAt: z$1.coerce.date(),
 	editedAt: z$1.coerce.date().nullable(),
+	video: ModalVideoShapeSchema.nullable().optional(),
 	schemaVersion: z$1.number().int()
 });
 const ReleaseNotesJobPrSchema = z$1.object({
@@ -6791,6 +7458,22 @@ const ReleaseNotesConfigSchema = z$1.object({
 	slackTeamId: z$1.string().optional(),
 	slackChannelId: z$1.string().optional()
 });
+/** A release note video on the public wire: ModalVideo with snake_case keys. */
+const PublicReleaseNoteVideoSchema = z$1.object({
+	landscape_url: z$1.string().nullable().optional(),
+	landscape_poster_url: z$1.string().nullable().optional(),
+	portrait_url: z$1.string().nullable().optional(),
+	portrait_poster_url: z$1.string().nullable().optional()
+});
+const ReleaseNoteMediaParamsSchema = z$1.object({
+	id: z$1.string().min(1),
+	asset: z$1.enum(Object.keys({
+		landscape: "landscapeUrl",
+		"landscape-poster": "landscapePosterUrl",
+		portrait: "portraitUrl",
+		"portrait-poster": "portraitPosterUrl"
+	}))
+});
 /**
 * A release note as GET /api/v1/whats-new serves it. An allowlist: provenance (sourcePrs, deployedSha),
 * workflow state (status, editedAt) and storage fields never reach the public wire.
@@ -6805,7 +7488,8 @@ const PublicReleaseNoteSchema = z$1.object({
 		category: ReleaseNoteCategorySchema,
 		text: z$1.string(),
 		importance: z$1.number().int().min(1).max(3)
-	}))
+	})),
+	video: PublicReleaseNoteVideoSchema.nullable().optional()
 });
 /**
 * The measured per-space floors, rendered for an admin-facing description (e.g. "75 for
@@ -7100,6 +7784,7 @@ z$1.enum([
 	"serverStatus",
 	"defaultSeats",
 	"CSMandCTAFlag",
+	"showDesktopAppPromo",
 	"SystemFiles",
 	"OpenWeatherKey",
 	"SerperKey",
@@ -7115,6 +7800,9 @@ z$1.enum([
 	"MaxActiveDungeons",
 	"DungeonSpawnIntervalHeartbeats",
 	"DungeonTTLMinutes",
+	"EnableStudioCreateV2",
+	"EnableStudioImage",
+	"EnableStudioProductions",
 	"VectorThreshold",
 	"bflApiKey",
 	"EnableMCPServer",
@@ -7148,10 +7836,6 @@ z$1.enum([
 	"teamPlanCreditsPerSeat",
 	"lowCreditsThreshold",
 	"syntheticUserEmailDomains",
-	"enableGoogleCalendar",
-	"googleCalendarServiceAccountEmail",
-	"googleCalendarServiceAccountSecret",
-	"googleCalendarOrganizerEmail",
 	"EnableWeatherService",
 	"WeatherUnits",
 	"defaultEmbeddingModel",
@@ -7197,6 +7881,9 @@ z$1.enum([
 	"SlackFeedbackWebhookUrl",
 	"SlackNonProdFeedbackWebhookUrl",
 	"SlackEmailAuditWebhookUrl",
+	"SlackSecurityAlertsWebhookUrl",
+	"AdminAuditCriticalGrantCredits",
+	"AdminAuditDailyGrantCredits",
 	"slackSigningSecret",
 	"slackBotToken",
 	"enforceMFA",
@@ -7441,15 +8128,17 @@ function makeNumberSetting(config) {
 		schema: z$1.preprocess((val) => isBlankSettingValue(val) ? void 0 : val, numberSchema.prefault(config.defaultValue ?? 0))
 	};
 }
-function makeBooleanSetting(config) {
+function makeBooleanSetting({ acceptNumeric = false, ...config }) {
 	return {
 		...config,
 		type: "boolean",
 		schema: z$1.preprocess((val) => {
 			if (typeof val === "string") {
-				if (val.toLowerCase() === "true") return true;
-				if (val.toLowerCase() === "false") return false;
+				if (val.toLowerCase() === "true" || acceptNumeric && val === "1") return true;
+				if (val.toLowerCase() === "false" || acceptNumeric && val === "0") return false;
 			}
+			if (acceptNumeric && val === 1) return true;
+			if (acceptNumeric && val === 0) return false;
 			return val;
 		}, z$1.boolean()).prefault(config.defaultValue ?? false)
 	};
@@ -8391,30 +9080,6 @@ const API_SERVICE_GROUPS = {
 			}
 		]
 	},
-	CALENDAR: {
-		id: "calendarAPIService",
-		name: "Google Calendar",
-		description: "Google Calendar integration settings",
-		icon: "CalendarMonth",
-		settings: [
-			{
-				key: "enableGoogleCalendar",
-				order: 1
-			},
-			{
-				key: "googleCalendarServiceAccountEmail",
-				order: 2
-			},
-			{
-				key: "googleCalendarServiceAccountSecret",
-				order: 3
-			},
-			{
-				key: "googleCalendarOrganizerEmail",
-				order: 4
-			}
-		]
-	},
 	FEEDBACK: {
 		id: "feedbackService",
 		name: "Feedback System",
@@ -8736,6 +9401,18 @@ const API_SERVICE_GROUPS = {
 			{
 				key: "DungeonTTLMinutes",
 				order: 293
+			},
+			{
+				key: "EnableStudioCreateV2",
+				order: 300
+			},
+			{
+				key: "EnableStudioImage",
+				order: 301
+			},
+			{
+				key: "EnableStudioProductions",
+				order: 302
 			}
 		]
 	},
@@ -8774,10 +9451,6 @@ const API_SERVICE_GROUPS = {
 			{
 				key: "defaultTags",
 				order: 5
-			},
-			{
-				key: "enforceCredits",
-				order: 6
 			}
 		]
 	},
@@ -8788,36 +9461,16 @@ const API_SERVICE_GROUPS = {
 		icon: "Payments",
 		settings: [
 			{
-				key: "pricePerCredit",
+				key: "billOperationalUsage",
 				order: 1
 			},
 			{
-				key: "enforceCredits",
+				key: "blockDisposableEmails",
 				order: 2
 			},
 			{
-				key: "billOperationalUsage",
+				key: "syntheticUserEmailDomains",
 				order: 3
-			},
-			{
-				key: "enableTeamPlan",
-				order: 4
-			},
-			{
-				key: "teamPlanMinSeats",
-				order: 5
-			},
-			{
-				key: "teamPlanMaxSeats",
-				order: 6
-			},
-			{
-				key: "teamPlanCreditsPerSeat",
-				order: 7
-			},
-			{
-				key: "lowCreditsThreshold",
-				order: 8
 			}
 		]
 	},
@@ -8895,6 +9548,10 @@ const API_SERVICE_GROUPS = {
 			{
 				key: "RedditLink",
 				order: 8
+			},
+			{
+				key: "showDesktopAppPromo",
+				order: 9
 			}
 		]
 	},
@@ -9590,7 +10247,7 @@ const settingsMap = {
 		key: "SkillMarketUrlAllowlist",
 		name: "Skill Market URL Allowlist",
 		defaultValue: "",
-		description: "Comma-separated host names a Skill Market skill may reference without a finding (subdomains included). Any other URL holds a Public listing for review.",
+		description: "Comma-separated host names a Skill Market skill may reference without a finding (subdomains included). Any other URL holds a listing for review at every visibility.",
 		category: "AI Moderation"
 	}),
 	SkillMarketClassifierMinConfidence: makeNumberSetting({
@@ -9725,9 +10382,7 @@ const settingsMap = {
 		name: "Price Per Credit",
 		defaultValue: 50,
 		description: `The price in USD of one credit bought pay-as-you-go. Cannot be set below ${formatUsdPerCredit(MIN_PRICE_PER_CREDIT_USD)}, the per-credit sale price including markup.`,
-		category: "Users",
-		group: API_SERVICE_GROUPS.CREDITS.id,
-		order: 1
+		category: "Users"
 	}),
 	apiRateLimitFreePerMin: makeNumberSetting({
 		key: "apiRateLimitFreePerMin",
@@ -9933,6 +10588,32 @@ const settingsMap = {
 		order: 8,
 		isSensitive: true
 	}),
+	SlackSecurityAlertsWebhookUrl: makeStringSetting({
+		key: "SlackSecurityAlertsWebhookUrl",
+		name: "Security Alerts Channel Webhook URL",
+		defaultValue: "",
+		description: "Incoming-webhook URL for the security Slack channel that receives critical Admin Audit Log entries and credit-grant bursts. Leave empty to turn alerts off; the Audit Log page then shows a banner. It never falls back to the default webhook.",
+		category: "SecOps",
+		isSensitive: true
+	}),
+	AdminAuditCriticalGrantCredits: makeNumberSetting({
+		key: "AdminAuditCriticalGrantCredits",
+		name: "Critical Single Credit Grant",
+		defaultValue: ADMIN_AUDIT_DEFAULT_CRITICAL_GRANT_CREDITS,
+		min: 1,
+		int: true,
+		description: "An admin credit grant above this many credits is recorded as critical in the Admin Audit Log and alerts the security channel.",
+		category: "SecOps"
+	}),
+	AdminAuditDailyGrantCredits: makeNumberSetting({
+		key: "AdminAuditDailyGrantCredits",
+		name: "Critical Daily Credit Grants per Admin",
+		defaultValue: ADMIN_AUDIT_DEFAULT_DAILY_GRANT_CREDITS,
+		min: 1,
+		int: true,
+		description: "A grant that takes one admin past this many credits granted in the last 24 hours is recorded as critical in the Admin Audit Log and alerts the security channel.",
+		category: "SecOps"
+	}),
 	liveFeedbackEmail: makeStringSetting({
 		key: "liveFeedbackEmail",
 		name: "Live Feedback Email",
@@ -10071,51 +10752,12 @@ const settingsMap = {
 		description: "The default number of seats for new organizations.",
 		category: "Users"
 	}),
-	enableGoogleCalendar: makeBooleanSetting({
-		key: "enableGoogleCalendar",
-		name: "Enable Google Calendar Integration",
-		defaultValue: false,
-		description: "Whether to enable scheduling of briefing/advisory using google calendar",
-		category: "Calendar",
-		group: API_SERVICE_GROUPS.CALENDAR.id,
-		order: 1,
-		userReadable: true
-	}),
-	googleCalendarServiceAccountEmail: makeStringSetting({
-		key: "googleCalendarServiceAccountEmail",
-		name: "Service Account Email",
-		defaultValue: "",
-		description: "The service account email address that has access to google calendar API.",
-		category: "Calendar",
-		group: API_SERVICE_GROUPS.CALENDAR.id,
-		order: 2
-	}),
-	googleCalendarServiceAccountSecret: makeStringSetting({
-		key: "googleCalendarServiceAccountSecret",
-		name: "Service Account Secret",
-		defaultValue: "",
-		description: "The base64 encoded service account secret that is associated with the service account email.",
-		category: "Calendar",
-		group: API_SERVICE_GROUPS.CALENDAR.id,
-		order: 3,
-		isSensitive: true
-	}),
-	googleCalendarOrganizerEmail: makeStringSetting({
-		key: "googleCalendarOrganizerEmail",
-		name: "Organizer Email",
-		defaultValue: "",
-		description: "The organizer email for creating events.",
-		category: "Calendar",
-		group: API_SERVICE_GROUPS.CALENDAR.id,
-		order: 4
-	}),
 	enforceCredits: makeBooleanSetting({
 		key: "enforceCredits",
 		userReadable: true,
 		name: "Enforce Credits",
 		defaultValue: process.env.B4M_SELF_HOST === "true" ? false : true,
 		description: "Whether to enforce credits for users",
-		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users"
 	}),
 	billOperationalUsage: makeBooleanSetting({
@@ -10127,12 +10769,12 @@ const settingsMap = {
 		category: "Users"
 	}),
 	enableTeamPlan: makeBooleanSetting({
+		acceptNumeric: true,
 		key: "enableTeamPlan",
 		userReadable: true,
 		name: "Enable Team Plan",
 		defaultValue: false,
 		description: "Whether to enable team plans",
-		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users"
 	}),
 	allowOpenRegistration: makeBooleanSetting({
@@ -10140,7 +10782,6 @@ const settingsMap = {
 		name: "Allow Open Registration",
 		defaultValue: false,
 		description: "Master switch for self-serve signup. When OFF (default), a valid invite code is required to register. When ON, users may register without an invite code; the Default Free Credits grant is then applied after they verify their email (anti-spam — see Default Free Credits). Safe to enable: the pre-request credit reservation caps every free user at the credits they are granted.",
-		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users"
 	}),
 	blockDisposableEmails: makeBooleanSetting({
@@ -10157,7 +10798,6 @@ const settingsMap = {
 		name: "Default Free Credits",
 		defaultValue: 0,
 		description: "Base credits granted after email verification to a user who registers WITHOUT an invite code, including eligible partner signups when Allow Open Registration is OFF. Partner-rule credits are added on top of this amount. An unverified account receives no credits. A free user cannot spend beyond their total granted balance.",
-		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users"
 	}),
 	teamPlanMinSeats: makeNumberSetting({
@@ -10169,7 +10809,6 @@ const settingsMap = {
 		min: 1,
 		max: TEAM_PLAN_SEATS_HARD_LIMIT,
 		description: "Fewest seats a paid team subscription can be bought with. Enforced at checkout, on seat changes from Stripe and on admin conversion to paid. Admin grants may still go down to 1. If set above the maximum seats, the maximum wins.",
-		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users"
 	}),
 	teamPlanMaxSeats: makeNumberSetting({
@@ -10181,7 +10820,6 @@ const settingsMap = {
 		min: 1,
 		max: TEAM_PLAN_SEATS_HARD_LIMIT,
 		description: "Most seats any team can hold (owner + members + pending invites). Enforced at checkout, on every seat change, on admin grants and on the partner-signup auto-raise. Lowering it below a team that is already larger does not remove anyone; that team can only be set down to this cap.",
-		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users"
 	}),
 	teamPlanCreditsPerSeat: makeNumberSetting({
@@ -10192,7 +10830,6 @@ const settingsMap = {
 		min: 0,
 		max: 1e8,
 		description: "Credits added to a team pool per paid seat each billing cycle (and per seat-month on admin team grants). Applies to invoices issued after the change; credits already granted are not adjusted.",
-		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users",
 		userReadable: true
 	}),
@@ -10205,7 +10842,6 @@ const settingsMap = {
 		min: 0,
 		max: 1e8,
 		description: "Below this many credits a user sees the low-credit warning state. Set to 0 to show warnings only once credits run out.",
-		group: API_SERVICE_GROUPS.CREDITS.id,
 		category: "Users"
 	}),
 	syntheticUserEmailDomains: makeStringSetting({
@@ -10284,6 +10920,16 @@ const settingsMap = {
 		group: API_SERVICE_GROUPS.USER_MANAGEMENT.id,
 		order: 3
 	}),
+	showDesktopAppPromo: makeBooleanSetting({
+		key: "showDesktopAppPromo",
+		name: "Promote the Desktop App",
+		defaultValue: true,
+		description: "Show signed-in users the \"Try the desktop app\" button and the profile-menu link to the desktop download page. Turn off for deployments that do not want to point users at the published desktop builds.",
+		category: "Branding",
+		group: API_SERVICE_GROUPS.BRANDING.id,
+		order: 9,
+		userReadable: true
+	}),
 	SystemFiles: makeStringSetting({
 		key: "SystemFiles",
 		name: "System Prompt Files",
@@ -10376,6 +11022,35 @@ const settingsMap = {
 		order: 4,
 		isSensitive: true
 	}),
+	EnableStudioCreateV2: makeBooleanSetting({
+		key: "EnableStudioCreateV2",
+		name: "Enable Studio Create v2",
+		defaultValue: false,
+		description: "Admin-only preview of the restructured Studio Create area. Non-admins never see it, whatever this is set to.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 300
+	}),
+	EnableStudioImage: makeBooleanSetting({
+		key: "EnableStudioImage",
+		name: "Enable Image in Studio",
+		defaultValue: false,
+		description: "Admin-only preview of the Image tab in Studio. Non-admins never see it, whatever this is set to.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 301,
+		dependsOn: "EnableStudioCreateV2"
+	}),
+	EnableStudioProductions: makeBooleanSetting({
+		key: "EnableStudioProductions",
+		name: "Enable Studio Productions",
+		defaultValue: false,
+		description: "Admin-only preview of Studio Productions (assembling many assets into one piece). Non-admins never see it, whatever this is set to.",
+		category: "Experimental",
+		group: API_SERVICE_GROUPS.EXPERIMENTAL.id,
+		order: 302,
+		dependsOn: "EnableStudioCreateV2"
+	}),
 	EnablePotionQuest: makeBooleanSetting({
 		key: "EnablePotionQuest",
 		name: "Enable PotionQuest Tools",
@@ -12044,6 +12719,41 @@ const musicRequestSchema = z.object({
 	format: z.string().optional(),
 	...generatedAudioRequestFields
 });
+const turnRetryShape = {
+	reason: z$1.enum(TURN_RETRY_REASONS),
+	status: z$1.number().optional(),
+	retryAfterMs: z$1.number().optional(),
+	requestId: z$1.string().optional(),
+	delayMs: z$1.number(),
+	model: z$1.string()
+};
+const turnTimingShape = {
+	queueMs: z$1.number(),
+	contextBuildMs: z$1.number().optional(),
+	semaphoreWaitMs: z$1.number(),
+	totalMs: z$1.number().optional(),
+	fallbackHops: z$1.number()
+};
+/** Wire shape of ITurnTiming for the live chat frame; hydrates `at` into a Date server-side. */
+const TurnTimingSchema = z$1.object({
+	...turnTimingShape,
+	retries: z$1.array(z$1.object({
+		...turnRetryShape,
+		at: z$1.coerce.date()
+	}))
+});
+/**
+* The same record for the public quest poll. `at` is an ISO string on the wire (a Date only
+* before JSON serialization). Not z.coerce.date() here: like the other public response schemas
+* (schemas/chat.ts, schemas/session.ts), it would document the field as nullable in OpenAPI.
+*/
+const TurnTimingPollSchema = z$1.object({
+	...turnTimingShape,
+	retries: z$1.array(z$1.object({
+		...turnRetryShape,
+		at: z$1.union([z$1.string().datetime(), z$1.date()])
+	}))
+});
 /**
 * Canonical agent execution status tuple. Shared between the database model
 * (`AgentExecutionModel`), the client store (`useAgentExecutionStore`), and
@@ -12228,7 +12938,7 @@ const CliCompletionRequestAction = z$1.object({
 		]),
 		content: z$1.union([z$1.string(), z$1.array(z$1.unknown())]),
 		cache: z$1.boolean().optional()
-	})),
+	})).min(1),
 	options: z$1.object({
 		temperature: z$1.number().optional(),
 		maxTokens: z$1.number().optional(),
@@ -12563,6 +13273,7 @@ const StreamedChatCompletionAction = z$1.object({
 			endTime: z$1.number().optional()
 		}).optional(),
 		fallbackInfo: FallbackInfoSchema.nullish(),
+		turnTiming: TurnTimingSchema.optional(),
 		pendingAction: z$1.object({
 			tool: z$1.string(),
 			params: z$1.record(z$1.string(), z$1.unknown()),
@@ -13529,7 +14240,7 @@ const ConfidenceGateAction = z$1.object({
 	iteration: z$1.number(),
 	/** 0..1, the agent's reported confidence for the paused iteration. */
 	confidence: z$1.number(),
-	/** Pre-formatted server copy, e.g. "Iteration confidence 42% below threshold 60%". */
+	/** Pre-formatted server copy, e.g. "2 iterations in a row below the 60% confidence threshold (latest 42%)". */
 	reason: z$1.string()
 });
 const ChildExecutionSnapshotSchema = z$1.lazy(() => z$1.object({
@@ -14438,7 +15149,9 @@ z.object({
 	/** Set to true if the file should be publicly accessible */
 	public: z.boolean().optional(),
 	/** The prefix to use for the file path */
-	prefix: z.string().optional()
+	prefix: z.string().optional(),
+	/** Admin What's New media: the server stores it under its modal prefix and admits mp4 */
+	purpose: z.literal("modal-media").optional()
 });
 /**
 * Constants for BFL safety tolerance settings.
@@ -15040,6 +15753,7 @@ const QuestPollResponseSchema = ChatQuestPollResultSchema.extend({
 	promptMeta: z$1.record(z$1.string(), z$1.unknown()).optional(),
 	attachmentNotices: z$1.array(z$1.string()).optional(),
 	attachmentDelivery: z$1.record(z$1.string(), z$1.unknown()).optional(),
+	turnTiming: TurnTimingPollSchema.optional(),
 	executionTracking: z$1.unknown().optional()
 });
 /**
@@ -15270,6 +15984,7 @@ z$2.object(passthroughShape({
 	pendingAction: true,
 	attachmentNotices: true,
 	attachmentDelivery: true,
+	turnTiming: true,
 	navigationIntents: true,
 	suggestedChoices: true,
 	attachmentList: true,
@@ -15317,6 +16032,123 @@ z$2.object({
 	envVariables: envVariableResponseSchema,
 	metadata: metadataResponseSchema.nullish()
 });
+const SAML_CONFIG_RESPONSE_FIELDS = {
+	entryPoint: true,
+	issuer: true,
+	cert: true,
+	callbackUrl: true,
+	identifierFormat: true,
+	acceptedClockSkewMs: true,
+	attributeConsumingServiceIndex: true,
+	disableRequestedAuthnContext: true,
+	attributeMappings: true
+};
+const OKTA_CONFIG_RESPONSE_FIELDS = {
+	audience: true,
+	clientId: true,
+	authServerId: true,
+	useOrgAuthServer: true
+};
+/** An identity provider as the admin routes return it: configuration only, no credential values. */
+const identityProviderResponseSchema = z$2.object({
+	...passthroughShape({
+		id: true,
+		name: true,
+		emailDomain: true,
+		type: true,
+		isActive: true,
+		samlConfig: true,
+		oktaConfig: true,
+		createdAt: true,
+		updatedAt: true,
+		createdBy: true
+	}),
+	samlConfig: z$2.object(passthroughShape(SAML_CONFIG_RESPONSE_FIELDS)).nullish(),
+	oktaConfig: z$2.object(passthroughShape(OKTA_CONFIG_RESPONSE_FIELDS)).nullish()
+});
+/**
+* Which credentials an identity provider has stored: flags, never values. The single source for
+* the repository that computes them and the admin UI that reads them.
+*/
+const identityProviderSecretPresenceSchema = z$2.object({
+	decryptionPvk: z$2.boolean(),
+	privateCert: z$2.boolean(),
+	clientSecret: z$2.boolean()
+});
+/** The admin list row: the provider plus which credentials are stored. */
+const identityProviderListItemResponseSchema = identityProviderResponseSchema.extend({ hasSecrets: identityProviderSecretPresenceSchema });
+z$2.array(identityProviderListItemResponseSchema);
+/** An API key as the admin routes return it: everything but the secret material. */
+const userApiKeyResponseSchema = z$2.object(passthroughShape({
+	id: true,
+	userId: true,
+	name: true,
+	keyPrefix: true,
+	scopes: true,
+	status: true,
+	expiresAt: true,
+	lastUsedAt: true,
+	revokedAt: true,
+	revokedBy: true,
+	revokedReason: true,
+	callbackSigningSecretCreatedAt: true,
+	rateLimit: true,
+	usage: true,
+	metadata: true,
+	productId: true,
+	productName: true,
+	billingOwnerType: true,
+	organizationId: true,
+	agentId: true,
+	allowedOrigins: true,
+	identifiedClientIds: true,
+	preauthorizedLakeIds: true,
+	branding: true,
+	spendCap: true,
+	ownerHasWhitelabel: true,
+	createdAt: true,
+	updatedAt: true
+}));
+/**
+* A key's live minute/day rate-limit counters. The single source for the server's
+* `RateLimitUsage` and the admin client's response type, so a new field cannot be stripped here
+* while the producer and the UI both expect it.
+*/
+const apiKeyRateLimitUsageSchema = z$2.object({
+	minute: z$2.number(),
+	day: z$2.number(),
+	/** Epoch seconds when the current minute window ends; undefined when no window is open (count 0). */
+	minuteResetAt: z$2.number().optional(),
+	/** Epoch seconds when the current day window ends; undefined when no window is open (count 0). */
+	dayResetAt: z$2.number().optional()
+});
+z$2.object({
+	apiKeys: z$2.array(userApiKeyResponseSchema),
+	liveUsage: z$2.record(z$2.string(), apiKeyRateLimitUsageSchema)
+});
+const emailVerificationUserResponseSchema = z$2.object(passthroughShape({
+	_id: true,
+	username: true,
+	email: true,
+	name: true,
+	emailVerified: true,
+	emailVerifiedAt: true,
+	emailVerificationSentAt: true,
+	emailVerificationExpires: true,
+	pendingEmail: true,
+	pendingEmailSentAt: true,
+	pendingEmailExpires: true,
+	createdAt: true
+}));
+z$2.object({
+	users: z$2.array(emailVerificationUserResponseSchema),
+	pagination: z$2.object({
+		page: z$2.number(),
+		limit: z$2.number(),
+		totalPages: z$2.number(),
+		totalCount: z$2.number()
+	})
+});
 const questMasterPlanResponseSchema = z$2.object(passthroughShape({
 	id: true,
 	createdAt: true,
@@ -15767,6 +16599,14 @@ const EmbeddingsErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.enum([
 	"provider_not_configured",
 	"provider_rejected"
 ]).optional() });
+const MAX_REFINE_TEXT_CHARS = 1e4;
+const MAX_REFINE_CONTEXT_CHARS = 1e4;
+const TextRefinementRequestSchema = z$1.object({
+	text: z$1.string().min(1).max(MAX_REFINE_TEXT_CHARS),
+	context: z$1.string().max(MAX_REFINE_CONTEXT_CHARS).optional()
+});
+const TextRefinementResponseSchema = z$1.object({ text: z$1.string() });
+const TextRefinementErrorSchema = ApiErrorSchema.extend({ errorCode: z$1.enum(["provider_not_configured", "provider_rejected"]).optional() });
 /**
 * Every tool name in `b4mLLMTools`. Exhaustive by annotation - do not widen the type.
 */
@@ -15868,6 +16708,19 @@ const InternalTeamMemberSchema = z$1.object({
 	isActive: z$1.boolean().optional()
 });
 z$1.array(InternalTeamMemberSchema);
+/** An internal team member as the admin routes return it. */
+const internalTeamMemberResponseSchema = z$1.object(passthroughShape({
+	id: true,
+	name: true,
+	phone: true,
+	email: true,
+	role: true,
+	department: true,
+	isActive: true,
+	createdAt: true,
+	updatedAt: true
+}));
+z$1.array(internalTeamMemberResponseSchema);
 /**
 * Lattice Zod Schemas
 *
@@ -16654,6 +17507,32 @@ const UpdateProjectRequestSchema = z$1.object({
 	description: z$1.string().min(1).optional()
 }).strict();
 /**
+* Wire schemas for the Skill Market's Claude Code plugin feed
+* (api-contract/contracts/skillMarket.contract.ts). The 200 body is a Claude Code
+* `marketplace.json`, so its field names follow Claude Code, not this API's snake_case.
+*/
+const ClaudeMarketplaceQuerySchema = z$1.object({ orgId: z$1.string().min(1) });
+const ClaudePluginZipParamSchema = z$1.object({ id: z$1.string().min(1) });
+const ClaudePluginZipQuerySchema = z$1.object({ version: z$1.coerce.number().int().positive().optional() });
+const ClaudeMarketplacePluginSchema = z$1.object({
+	name: z$1.string(),
+	description: z$1.string(),
+	/** The listing's approved version number; Claude Code offers an update when it changes. */
+	version: z$1.string(),
+	source: z$1.object({
+		source: z$1.literal("archive"),
+		url: z$1.string(),
+		sha256: z$1.string()
+	})
+});
+const ClaudeMarketplaceSchema = z$1.object({
+	name: z$1.string(),
+	owner: z$1.object({ name: z$1.string() }),
+	/** Claude Code uninstalls installed plugins this feed stops listing, at the next session start. */
+	forceRemoveDeletedPlugins: z$1.boolean(),
+	plugins: z$1.array(ClaudeMarketplacePluginSchema)
+});
+/**
 * The public projection of `ModelInfo` served by `GET /api/v1/models`.
 *
 * Deliberately narrower than `ModelInfo`: every field here is one an integrator can pin, so
@@ -16733,8 +17612,8 @@ const ListModelsResponseSchema = paginatedResponseSchema(z$1.object({
 	reasons_within_output_budget: z$1.boolean().describe("Whether reasoning tokens are spent inside `max_output_tokens` on every turn. When true, a small `max_tokens` can be used up by reasoning alone and return an empty reply, so leave room above the answer you expect."),
 	reasoning_efforts: z$1.array(CompletionReasoningEffortSchema).describe("The `reasoningEffort` levels this model acts on, lowest first; empty when it ignores the option. `none` is listed only where it turns reasoning off. Each level is mapped to the nearest one the provider offers. A listed level can still be dropped on one request: some OpenAI models drop it on tool turns, and Claude models with a fixed thinking budget drop it when `max_tokens` leaves no room for the budget plus the answer."),
 	supports_tools: z$1.boolean(),
-	supports_tool_search: z$1.boolean().describe("Whether the model accepts the tool search server tool and `defer_loading: true` on tool definitions, so a large tool catalog is searched on demand instead of loaded into context up front. Describes the model: `/api/ai/v1/completions` honours it only for models whose `backend` is `anthropic`. A `bedrock` model with this flag set is not served with tool search there yet: a `serverTool` entry is refused with `errorCode: \"tool_search_unsupported\"` and `defer_loading` is ignored."),
-	supports_tool_changes: z$1.boolean().describe("Whether a system-role message can carry `tool_addition` and `tool_removal` blocks, which add or remove a declared tool mid-conversation. Describes the model only: `/api/ai/v1/completions` does not accept these blocks yet, and will accept them first for models whose `backend` is `anthropic`."),
+	supports_tool_search: z$1.boolean().describe("Whether the model accepts the tool search server tool and `defer_loading: true` on tool definitions, so a large tool catalog is searched on demand instead of loaded into context up front. Describes the model: `/api/ai/v1/completions` honours it for every model with this flag set, whether its `backend` is `anthropic` or `bedrock`."),
+	supports_tool_changes: z$1.boolean().describe("Whether a system-role message can carry `tool_addition` and `tool_removal` blocks, which add or remove a declared tool mid-conversation. Describes the model: `/api/ai/v1/completions` honours it only for models whose `backend` is `anthropic`; a `bedrock` model with this flag set is refused there with `errorCode: \"tool_changes_unsupported\"`."),
 	supports_vision: z$1.boolean(),
 	deprecation_date: z$1.string().nullable().describe("`YYYY-MM-DD`; null when no retirement is scheduled."),
 	replaced_by: z$1.string().nullable().describe("The id of the recommended successor, when there is one."),
@@ -16860,7 +17739,7 @@ const GenerateImageIvokeParamsSchema = OpenAIImageGenerationInput.extend({
 	referenceImageFabFileIds: z$1.array(z$1.string()).max(15).optional(),
 	tools: z$1.array(z$1.union([b4mLLMTools, z$1.string()])).optional(),
 	safety_tolerance: BFLSafetyToleranceSchema,
-	prompt_upsampling: z$1.boolean().optional(),
+	prompt_upsampling: z$1.boolean().prefault(false).describe("Let the provider rewrite and expand the prompt before rendering. Applies to Black Forest Labs (FLUX) models only; other models ignore it. Defaults to false."),
 	seed: z$1.number().nullable().optional(),
 	output_format: ImageOutputFormatSchema.nullable().optional(),
 	/** Resolved by the API route's prompt resolver. Defaults to 'fresh' for first-turn or sessions with no prior image. */
@@ -16990,7 +17869,13 @@ z$1.object({
 			"tool"
 		]),
 		content: z$1.union([z$1.string(), z$1.array(z$1.any())]),
-		fabFileIds: z$1.array(z$1.string()).optional()
+		fabFileIds: z$1.array(z$1.string()).optional(),
+		/**
+		* Send this message in the current user turn instead of the system prompt, keeping the
+		* system prefix byte-stable for prompt caching. Only for content that changes every turn
+		* (a view description, a per-send brief); a caller's actual system prompt must not set it.
+		*/
+		perTurn: z$1.boolean().optional()
 	})).optional(),
 	/** Dashboard related params */
 	dashboardParams: DashboardParamsSchema.optional(),
@@ -17179,11 +18064,15 @@ const VideoGenerationErrorResponseSchema = ApiErrorSchema.extend({ errorCode: z$
 const CreateVideoGenerationBodySchema = z$1.strictObject({
 	model: z$1.string().min(1).describe("A model id from GET /api/v1/video-models."),
 	prompt: z$1.string().min(1).max(4e3),
-	mode: z$1.enum(VIDEO_MODES).optional().describe("Defaults to image_to_video when input_image_file_id is set, else text_to_video."),
+	mode: z$1.enum(VIDEO_MODES).optional().describe("Defaults to image_to_video when a first_frame input (or input_image_file_id) is set, else text_to_video."),
 	duration_seconds: z$1.number().positive().optional().describe("Defaults to the model's default duration."),
 	aspect_ratio: z$1.enum(ASPECT_RATIOS).optional(),
 	resolution: z$1.enum(RESOLUTION_TIERS).optional(),
-	input_image_file_id: z$1.string().min(1).optional().describe("An image file you own, for image_to_video."),
+	inputs: z$1.array(z$1.strictObject({
+		file_id: z$1.string().min(1),
+		role: z$1.enum(VIDEO_INPUT_ROLES)
+	})).max(8).optional().describe("Image files you own, each tagged with what it is for. image_to_video needs a first_frame. The roles a model accepts, and how many of each, are its input_roles in GET /api/v1/video-models."),
+	input_image_file_id: z$1.string().min(1).optional().describe("Deprecated: send inputs with role first_frame instead. Cannot be combined with inputs."),
 	audio: z$1.boolean().optional(),
 	organization_id: BillingOrganizationIdSchema
 });
@@ -17225,6 +18114,10 @@ const VideoModelSchema = z$1.object({
 	display_name: z$1.string(),
 	provider: z$1.string(),
 	modes: z$1.array(z$1.enum(VIDEO_MODES)),
+	input_roles: z$1.array(z$1.object({
+		role: z$1.string(),
+		max: z$1.number().int().positive()
+	})).optional().describe(`The inputs[] roles this model accepts and the most of each one request may carry. Roles today: ${VIDEO_INPUT_ROLES.join(", ")}; ignore any you do not know.`),
 	duration: z$1.union([z$1.object({
 		kind: z$1.literal("range"),
 		min: z$1.number(),
@@ -17802,7 +18695,7 @@ defineEndpoint({
 	path: "/api/ai/v1/completions",
 	operationId: "createCompletion",
 	summary: "Create a chat completion",
-	description: "OpenAI-compatible completion. A successful request is ALWAYS answered with an SSE stream (`text/event-stream`), regardless of the `stream` flag: a `meta` event, then `content`/`tool_use` events carrying `usage`/`credits`, terminated by `data: [DONE]`. The terminal event carries `stopReason`; treat `max_tokens` as a TRUNCATED reply rather than a complete one, and note that omitting `max_tokens` on the request lets the server size the output ceiling for the model (recommended for reasoning models, which spend thinking tokens inside that ceiling). A message `content` may be a string or an array of parts; image parts are accepted in OpenAI Chat (`image_url`), OpenAI Responses (`input_image`) or Anthropic (`image` with a `source`) form and are translated to whatever the target model speaks. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nTOOL SEARCH. On a model whose `GET /api/v1/models` row has `supports_tool_search: true` and `backend: \"anthropic\"`, a `tools` entry may set `toolSchema.defer_loading: true`, and a `{ \"serverTool\": { \"type\": \"tool_search_tool_regex_20251119\", \"name\": \"tool_search_tool_regex\" } }` (or the `bm25` pair) entry adds Anthropic's tool search, so deferred definitions load only when the model searches for them. The stream then carries `provider_block` events (`{ type, provider: \"anthropic\", block }`) for the server-run search; echo each block back verbatim, in order, in the assistant `messages` content of the next request, and never answer one with a `tool_result`. When the server-run search loop hits its iteration limit the stream ends with `stopReason: \"pause_turn\"`; continue by re-sending the conversation with that assistant turn's provider blocks echoed. A client-side search may return `{ \"type\": \"tool_reference\", \"tool_name\": \"...\" }` blocks inside a `tool_result`'s content. On every other model, Bedrock-served Claude included, `defer_loading` is ignored (every tool is sent as usual) and a server tool, a `tool_reference` or an echoed tool search block is refused with a `400` rather than run without it.\n\nERRORS. Everything checked before the model provider is called fails with a JSON error body and a real HTTP status, before any stream opens: a malformed or otherwise invalid request or an unknown `model` `400` (`errorCode: \"unknown_model\"` for the latter), a bad credential `401`, a key without a required scope `403` (with `required_scopes`), a body over 25 MB `413`, a body that fails schema validation `422`, insufficient credits `422` with `errorCode: \"insufficient_credits\"` (personal or org balance, or an org per-member credit cap), a rate limit `429` with `Retry-After`, and a catalogued model whose provider is not configured on this deployment `503` with `errorCode: \"provider_not_configured\"` (retryable). Once the stream has opened the status stays `200` and a failure arrives as one terminal in-band `error` event. Branch on that event's `code`, never on `message`, which is prose and may change: `insufficient_credits` (buy credits) when credits run out mid-generation, `provider_rejected` when the model provider refused our credentials, `content_blocked` when the model declined the request (do not retry it unchanged), and `provider_error` for any other provider failure. Treat `code` as optional.",
+	description: "OpenAI-compatible completion. A successful request is ALWAYS answered with an SSE stream (`text/event-stream`), regardless of the `stream` flag: a `meta` event, then `content`/`tool_use` events carrying `usage`/`credits`, terminated by `data: [DONE]`. The terminal event carries `stopReason`; treat `max_tokens` as a TRUNCATED reply rather than a complete one, and note that omitting `max_tokens` on the request lets the server size the output ceiling for the model (recommended for reasoning models, which spend thinking tokens inside that ceiling). A message `content` may be a string or an array of parts; image parts are accepted in OpenAI Chat (`image_url`), OpenAI Responses (`input_image`) or Anthropic (`image` with a `source`) form and are translated to whatever the target model speaks. Authenticate with an API key (`b4m_live_`) or a JWT.\n\nTOOL SEARCH. On a model whose `GET /api/v1/models` row has `supports_tool_search: true` (`backend` `\"anthropic\"` or `\"bedrock\"`), a `tools` entry may set `toolSchema.defer_loading: true`, and a `{ \"serverTool\": { \"type\": \"tool_search_tool_regex_20251119\", \"name\": \"tool_search_tool_regex\" } }` (or the `bm25` pair) entry adds Anthropic's tool search, so deferred definitions load only when the model searches for them. The stream then carries `provider_block` events (`{ type, provider: \"anthropic\", block }`) for the server-run search; echo each block back verbatim, in order, in the assistant `messages` content of the next request, and never answer one with a `tool_result`. When the server-run search loop hits its iteration limit the stream ends with `stopReason: \"pause_turn\"`; continue by re-sending the conversation with that assistant turn's provider blocks echoed. A client-side search may return `{ \"type\": \"tool_reference\", \"tool_name\": \"...\" }` blocks inside a `tool_result`'s content. On every other model `defer_loading` is ignored (every tool is sent as usual) and a server tool, a `tool_reference` or an echoed tool search block is refused with a `400` rather than run without it.\n\nERRORS. Everything checked before the model provider is called fails with a JSON error body and a real HTTP status, before any stream opens: an empty `messages` array, a conversation with no non-empty user or assistant message (system-only, or only blank content), a malformed request, or an unknown `model` `400` (`errorCode: \"unknown_model\"` for an unknown model), a bad credential `401`, a key without a required scope `403` (with `required_scopes`), a body over 25 MB `413`, any other body that fails schema validation `422`, insufficient credits `422` with `errorCode: \"insufficient_credits\"` (personal or org balance, or an org per-member credit cap), a rate limit `429` with `Retry-After`, and a catalogued model whose provider is not configured on this deployment, or a model that could only come from a self-hosted model server (Ollama, local image) that is currently unreachable, `503` with `errorCode: \"provider_not_configured\"` (retryable). A provider rejection of caller input that happens before the stream opens is also a JSON `400`, with `errorCode: \"invalid_request\"` (do not retry it unchanged). Once the stream has opened the status stays `200` and a failure arrives as one terminal in-band `error` event. Branch on that event's `code`, never on `message`, which is prose and may change: `insufficient_credits` (buy credits) when credits run out mid-generation, `invalid_request` when the provider rejects caller input (do not retry it unchanged), `provider_rejected` when the model provider refused our credentials, `content_blocked` when the model declined the request (do not retry it unchanged), and `provider_error` for any other provider failure. Treat `code` as optional.",
 	tags: ["AI"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:chat", "ai:generate"],
@@ -17836,7 +18729,7 @@ defineEndpoint({
 			}
 		},
 		400: {
-			description: "Malformed or otherwise invalid request (no `errorCode`), or a `model` the caller cannot use (`errorCode: \"unknown_model\"`): not in the catalog or not available to the caller. List valid ids with `GET /api/v1/models`. Tool search requests are refused with: `tool_search_unsupported` (a server tool, `tool_reference` or echoed tool search block on a model that cannot serve tool search here), `all_tools_deferred` (every tool deferred and no server tool), `deferred_tool_cache_control` (`cache_control` on a deferred tool), `unknown_tool_reference` (a `tool_reference` naming a tool not in `tools`, or carrying no string `tool_name`). Mid-conversation tool changes are refused with: `tool_changes_unsupported` (a `tool_addition` / `tool_removal` system message on a model that cannot serve it here), `invalid_tool_change` (a malformed block, or one placed where the provider does not accept it), and `unknown_tool_reference` (a changed tool not in `tools`).",
+			description: "Malformed or otherwise invalid request (no `errorCode`), provider-rejected caller input (`errorCode: \"invalid_request\"`), or a `model` the caller cannot use (`errorCode: \"unknown_model\"`): not in the catalog or not available to the caller. List valid ids with `GET /api/v1/models`. Tool search requests are refused with: `tool_search_unsupported` (a server tool, `tool_reference` or echoed tool search block on a model that cannot serve tool search here), `all_tools_deferred` (every tool deferred and no server tool), `deferred_tool_cache_control` (`cache_control` on a deferred tool), `unknown_tool_reference` (a `tool_reference` naming a tool not in `tools`, or carrying no string `tool_name`). Mid-conversation tool changes are refused with: `tool_changes_unsupported` (a `tool_addition` / `tool_removal` system message on a model that cannot serve it here), `invalid_tool_change` (a malformed block, or one placed where the provider does not accept it), and `unknown_tool_reference` (a changed tool not in `tools`).",
 			schema: CompletionsBadRequestErrorSchema
 		},
 		413: {
@@ -17857,7 +18750,7 @@ defineEndpoint({
 			schema: ApiErrorSchema
 		},
 		503: {
-			description: "Temporarily unavailable: the model's provider is not configured on this deployment (`errorCode: \"provider_not_configured\"`), or the database is unreachable (no `errorCode`). Retry later.",
+			description: "Temporarily unavailable: the model's provider is not configured on this deployment, or the self-hosted model server that lists it (Ollama, local image) is unreachable (`errorCode: \"provider_not_configured\"`), or the database is unreachable (no `errorCode`). Retry later.",
 			schema: ProviderNotConfiguredErrorSchema
 		}
 	},
@@ -18660,7 +19553,7 @@ defineEndpoint({
 		streaming: false
 	}
 });
-const EXAMPLE_REQUEST$1 = {
+const EXAMPLE_REQUEST$2 = {
 	model: "text-embedding-3-small",
 	input: ["The quick brown fox", "jumps over the lazy dog"],
 	dimensions: 1024
@@ -18675,7 +19568,7 @@ defineEndpoint({
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:generate"],
 	request: EmbeddingsRequestSchema,
-	requestExample: EXAMPLE_REQUEST$1,
+	requestExample: EXAMPLE_REQUEST$2,
 	responses: {
 		200: {
 			description: "One embedding per input, in input order.",
@@ -18732,6 +19625,55 @@ defineEndpoint({
 		}
 	},
 	emitsRateLimitHeaders: true,
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: EXAMPLE_REQUEST$2
+	}
+});
+const EXAMPLE_REQUEST$1 = {
+	text: "a dog on a beach",
+	context: "prompt for an image generator"
+};
+defineEndpoint({
+	method: "post",
+	path: "/api/v1/text-refinements",
+	operationId: "createTextRefinement",
+	summary: "Refine text",
+	description: `Rewrites \`text\` to be more concise, clear and detailed while keeping its intent. \`context\` is optional background that steers the rewrite. \`text\` is at most ${MAX_REFINE_TEXT_CHARS} characters and \`context\` at most ${MAX_REFINE_CONTEXT_CHARS}. Output is capped at about 800 tokens, and identical requests are served from a cache for about five minutes. Not billed in credits. Authenticate with an API key (\`b4m_live_\`) carrying \`ai:generate\`, or a JWT.`,
+	tags: ["AI"],
+	auth: "apiKeyOrJwt",
+	scopes: ["ai:generate"],
+	request: TextRefinementRequestSchema,
+	requestExample: EXAMPLE_REQUEST$1,
+	responses: {
+		200: {
+			description: "The refined text.",
+			schema: TextRefinementResponseSchema,
+			example: { text: "A golden retriever running along a sunlit beach at sunset, waves breaking behind it." }
+		},
+		401: {
+			description: "Missing/invalid credentials, or the text-refinement provider refused the configured key (`errorCode: \"provider_rejected\"`).",
+			schema: TextRefinementErrorSchema
+		},
+		429: {
+			description: "Per-key rate limit exceeded.",
+			schema: ApiErrorSchema
+		},
+		500: {
+			description: "Unexpected server error (for example the refinement cache is unavailable).",
+			schema: ApiErrorSchema
+		},
+		502: {
+			description: "The model call failed for a reason other than a rejected credential, or returned no refined text.",
+			schema: ApiErrorSchema
+		},
+		503: {
+			description: "This deployment has no operations model configured (`errorCode: \"provider_not_configured\"`).",
+			schema: TextRefinementErrorSchema
+		}
+	},
+	emitsRateLimitHeaders: true,
 	codeSample: {
 		authToken: "b4m_live_<key>",
 		streaming: false,
@@ -19385,7 +20327,7 @@ defineEndpoint({
 	path: "/api/v1/transcriptions",
 	operationId: "createTranscription",
 	summary: "Transcribe audio",
-	description: "Transcribes an upload minted by `POST /api/v1/transcriptions/uploads` and returns the text. Call it within 5 minutes of minting the upload. Credits are charged by file size. The uploaded audio is deleted when the call returns, whether it succeeds or fails, so each upload can be transcribed once.\n\n**Limit:** this call is synchronous. The request times out after about 60 seconds, while the AWS speech backend can take up to about 5 minutes on long audio, so a long recording can fail with a gateway timeout (`504`) instead of returning text. A timed-out upload may not be deleted right away (it expires on its own), so do not retry with the same `file_key`: mint a new upload, or send shorter audio.",
+	description: "Transcribes an upload minted by `POST /api/v1/transcriptions/uploads` and returns the text. Call it within 5 minutes of minting the upload. Credits are charged by file size. The uploaded audio is deleted when the call returns, whether it succeeds or fails, so each upload can be transcribed once.\n\n**Limit:** this call is synchronous. Provider work stops being awaited after 45 seconds from request arrival, leaving time to return reserved credits and delete the upload before the hosted server stops at 60 seconds. A slow recording returns a gateway timeout (`504`) instead of text. AWS batch jobs cannot be cancelled remotely and may finish later; their output expires automatically. Do not retry with the same `file_key`: mint a new upload and send shorter audio. If cleanup fails, the upload may not be deleted right away (it expires on its own).",
 	tags: ["Transcriptions"],
 	auth: "apiKeyOrJwt",
 	scopes: ["ai:generate"],
@@ -19415,6 +20357,10 @@ defineEndpoint({
 		503: {
 			description: "This deployment has no speech model, or no credential for its provider, configured (`errorCode: \"provider_not_configured\"`).",
 			schema: ProviderNotConfiguredErrorSchema
+		},
+		504: {
+			description: "The transcription exceeded the request deadline; reserved credits are returned.",
+			schema: ApiErrorSchema
 		}
 	},
 	codeSample: {
@@ -19521,6 +20467,35 @@ defineEndpoint({
 		}
 	}
 });
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/whats-new/media/{id}/{asset}",
+	operationId: "getWhatsNewMedia",
+	summary: "Get release note media",
+	description: "Redirects to one file of a published release note video: `landscape` and `portrait` are the 16:9 and 9:16 MP4s, the `-poster` assets their still images. The `video` URLs that listWhatsNew returns for uploaded files point here, so a browser can use them as `src` and `poster` as they are. Public: no credentials are needed, and the note must be one listWhatsNew would show. The redirect is cacheable for up to 10 minutes and its target is signed for 1 hour, longer than that, so follow it rather than storing the target. Rate limited per client IP.",
+	tags: ["Release notes"],
+	auth: "public",
+	pathParams: ReleaseNoteMediaParamsSchema,
+	responses: {
+		303: {
+			description: "`Location` is a time-limited signed GET for the file.",
+			noBody: true,
+			headers: { Location: "Signed URL of the file." }
+		},
+		404: {
+			description: "No published note has this id, or the note has no such file, or the file is not an upload this deployment serves (a linked URL is listed as is, not through this route).",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-IP rate limit exceeded.",
+			schema: ApiErrorSchema
+		},
+		500: {
+			description: "Unexpected server error.",
+			schema: ApiErrorSchema
+		}
+	}
+});
 /**
 * The read/write/query API-key scope sets the data-lake doors accept (OR semantics), shared by the
 * SPA routes (`apps/client/server/dataLakes/dataLakeScopes.ts` re-exports these) and the public
@@ -19873,11 +20848,11 @@ defineEndpoint({
 			schema: ApiErrorSchema
 		},
 		404: {
-			description: "`input_image_file_id` does not name an image you own (`errorCode: input_image_not_found`). A nonexistent `organization_id` is `404` only for an admin caller; for anyone else it is `403`.",
+			description: "An `inputs` file (or `input_image_file_id`) does not name an image you own (`errorCode: input_image_not_found`). A nonexistent `organization_id` is `404` only for an admin caller; for anyone else it is `403`.",
 			schema: VideoGenerationErrorResponseSchema
 		},
 		422: {
-			description: "The request cannot run: a body or capability violation (`errorCode` names it, e.g. `unsupported_duration`), an unknown or unavailable model (`model_unavailable`), a model your administrator disabled (`model_disabled`), too few credits (`insufficient_credits`), or an Idempotency-Key problem (`invalid_idempotency_key`, `idempotency_key_reused`).",
+			description: "The request cannot run: a body or capability violation (`errorCode` names it, e.g. `unsupported_duration`, or `unsupported_input_role` for an input role the model does not take), an unknown or unavailable model (`model_unavailable`), a model your administrator disabled (`model_disabled`), too few credits (`insufficient_credits`), or an Idempotency-Key problem (`invalid_idempotency_key`, `idempotency_key_reused`).",
 			schema: VideoGenerationErrorResponseSchema
 		},
 		429: rateLimited$1
@@ -20720,6 +21695,94 @@ defineEndpoint({
 		streaming: false
 	}
 });
+const AUTH_NOTE = "Authenticate with an API key (`b4m_live_`) carrying `skills:read`, sent as `Authorization: Bearer`. Claude Code sends that header when it is set as the marketplace source's `headers` in its settings, and forwards it to the same-origin plugin archives.";
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/skills/market/claude-marketplace.json",
+	operationId: "getClaudeMarketplace",
+	summary: "Get an organization's Claude Code plugin marketplace",
+	description: `Returns a Claude Code \`marketplace.json\` listing the organization's approved Organization-visibility Skill Market listings, one \`archive\` plugin each, pinned by \`sha256\`. Public and unlisted listings are not included. Responses are never cacheable. ${AUTH_NOTE}`,
+	tags: ["Skills"],
+	auth: "apiKeyOrJwt",
+	scopes: ["skills:read"],
+	queryParams: ClaudeMarketplaceQuerySchema,
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "The marketplace.",
+			schema: ClaudeMarketplaceSchema,
+			example: {
+				name: `b4m-org-${EXAMPLE_RESOURCE_ID}`,
+				owner: { name: "Acme" },
+				forceRemoveDeletedPlugins: true,
+				plugins: [{
+					name: "review-pr",
+					description: "Review a pull request against the team checklist.",
+					version: "3",
+					source: {
+						source: "archive",
+						url: `https://app.bike4mind.com/api/v1/skills/market/${EXAMPLE_RESOURCE_ID}/claude-plugin.zip?version=3`,
+						sha256: "a3f1c0de9b8e7d6c5b4a39281706f5e4d3c2b1a09f8e7d6c5b4a392817060f5e"
+					}
+				}]
+			}
+		},
+		403: {
+			description: "The API key lacks `skills:read`, or the caller is not a member of the organization.",
+			schema: ScopeForbiddenErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {}
+	}
+});
+defineEndpoint({
+	method: "get",
+	path: "/api/v1/skills/market/{id}/claude-plugin.zip",
+	operationId: "getClaudePluginZip",
+	summary: "Download a Skill Market listing as a Claude Code plugin",
+	description: `A zip holding an approved version as \`skills/<name>/SKILL.md\`. The optional \`version\` query pins the listing version advertised by the feed, so later approvals do not change its bytes or \`sha256\`. Without it, returns the current approved version. ${AUTH_NOTE}`,
+	tags: ["Skills"],
+	auth: "apiKeyOrJwt",
+	scopes: ["skills:read"],
+	pathParams: ClaudePluginZipParamSchema,
+	queryParams: ClaudePluginZipQuerySchema,
+	validationErrorStatus: 400,
+	emitsRateLimitHeaders: true,
+	responses: {
+		200: {
+			description: "The plugin archive.",
+			contentType: "application/zip"
+		},
+		400: {
+			description: "Invalid version query.",
+			schema: ApiErrorSchema
+		},
+		403: {
+			description: "The API key lacks `skills:read`.",
+			schema: ScopeForbiddenErrorSchema
+		},
+		404: {
+			description: "No Organization listing with that id is visible to the caller. A listing in an org you are not in, a public or unlisted listing, and a malformed id are all reported as 404.",
+			schema: ApiErrorSchema
+		},
+		429: {
+			description: "Per-user rate limit exceeded.",
+			schema: ApiErrorSchema
+		}
+	},
+	codeSample: {
+		authToken: "b4m_live_<key>",
+		streaming: false,
+		body: {}
+	}
+});
 /**
 * The fence language the model writes to place an inline map of search-result places in a reply.
 *
@@ -23448,7 +24511,7 @@ async function sleep(ms, abortSignal) {
 * Respects Retry-After headers when present (e.g., for 429 rate limiting).
 */
 async function withRetry(fn, options = {}) {
-	const { maxRetries = 3, initialDelayMs = 100, maxDelayMs = 5e3, jitterFactor = .1, isRetryable = isRetryableError, logger, abortSignal } = options;
+	const { maxRetries = 3, initialDelayMs = 100, maxDelayMs = 5e3, jitterFactor = .1, isRetryable = isRetryableError, logger, abortSignal, onRetry } = options;
 	let attempts = 0;
 	let totalDelayMs = 0;
 	while (true) try {
@@ -23479,6 +24542,15 @@ async function withRetry(fn, options = {}) {
 			attempt: attempts,
 			delayMs
 		});
+		try {
+			onRetry?.({
+				attempt: attempts,
+				delayMs,
+				error: err
+			});
+		} catch (callbackError) {
+			logger?.warn("onRetry callback threw; continuing the retry", { error: String(callbackError) });
+		}
 		try {
 			await sleep(delayMs, abortSignal);
 		} catch {
@@ -26015,4 +27087,4 @@ var ConfigStore = class {
 	}
 };
 //#endregion
-export { OllamaEmbeddingModel as $, ARTIFACT_REMOVED_PLACEHOLDER as A, secureParameters as At, CreateArtifactRequestSchema as B, withRetry as Bt, htmlErrorTitle as C, isPlaceholderImageSigningSecret as Ct, AGENT_QUEST_MANIFEST as D, obfuscateApiKey as Dt, AGENT_QUEST_ID as E, joinReplySlots as Et, BriefcasePromptIdSchema as F, supportedVoiceGenerationVendor as Ft, GENERATED_IMAGE_EXTENSION_RE as G, actorKindSchema as Gt, DEGENERATE_FINISH_REASON as H, DELEGATION_PAYLOAD_SCHEMA_NAME as Ht, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as I, tokenEstimateMultiplier as It, LOCATION_MAP_LANGUAGE as J, frontmatterHasSourceStamp as Jt, ImageModels as K, delegationPayloadSchema as Kt, CREDIT_DEDUCT_TRANSACTION_TYPES as L, ttsBase64ResponseSchema as Lt, ArtifactTypeSchema as M, splitEquals as Mt, BRIEFCASE_CATALOG_QUERIES as N, stripDeliveredArtifactBlocks as Nt, AGENT_QUEST_MCP_URI as O, questReplyText as Ot, BedrockEmbeddingModel as P, stripToolArtifactMarkup as Pt, NotFoundError as Q, ChatModels as R, ttsRequestSchema as Rt, isValidSessionId as S, isEarlyStop as St, escapeArtifactBodyJson as T, isUserInitiatedAbort as Tt, DecisionTextPartSchema as U, actorColorIndex as Ut, DEFAULT_TTS_PROVIDER as V, ACTOR_COLOR_SLOTS as Vt, DecisionsRequestSchema as W, actorKindMarker as Wt, McpServerName as X, WEBSITE_URL as Xt, MODEL_INFO_FIELD_GROUP_OF as Y, APP_NAME as Yt, ModelBackend as Z, LOCAL_DEV_URL as _, generatedAudioResponseSchema as _t, commandTextOf as a, SLUG_OWNED_BY_OTHER as at, logger as b, googleMapsSearchUrl as bt, toolCategory as c, UnprocessableEntityError as ct, getCreditsUrl as d, WORK_ITEM_STATUSES as dt, OpenAIEmbeddingModel as et, getEnvironmentName as f, assertAuthOriginMatchesApiKey as ft, DeviceFlowClient as g, filterToolArtifactMarkup as gt, AuthenticatedApiClient as h, escapeThinkMarkers as ht, ToolCatalog as i, SEARCH_RESULT_CARDS_LANGUAGE as it, ApiKeyType as j, signImageUrl as jt, ARTIFACT_DELIVERED_PLACEHOLDER as k, replacePromptVariables as kt, writePathOf as l, VisibilitySchema as lt, resolveApiEndpoint as m, createThinkMarkerEscaper as mt, extractCompactInstructions as n, PermissionDeniedError as nt, isReadOnlyTool as o, SUBQUEST_STATUS_VALUES as ot, requireApiUrl as p, buildPromptContext as pt, ImagePromptResolutionSchema as q, selfClaimedActorKindSchema as qt, loadContextFiles as r, REVIEW_GATE_STATUS_VALUES as rt, sandboxedCommandArg as s, SupportedFabFileMimeTypes as st, ConfigStore as t, PROMPT_TEXT_MAX as tt, ApiEndpointUnconfiguredError as u, VoyageAIEmbeddingModel as ut, NotAuthenticatedError as v, getMcpProviderMetadata as vt, htmlFirstH1 as w, isRetryableError as wt, SESSION_ID_PATTERN as x, hasDeliverablePinnedArtifact as xt, parseApiUrl as y, getQuestErrorCode as yt, CompletionReasoningEffortSchema as z, ttsResponseTooLargeSchema as zt };
+export { ModelBackend as $, selfClaimedActorKindSchema as $t, ARTIFACT_REMOVED_PLACEHOLDER as A, isUserInitiatedAbort as At, ChatModels as B, supportedVoiceGenerationVendor as Bt, htmlErrorTitle as C, getMcpProviderMetadata as Ct, AGENT_QUEST_MANIFEST as D, isEarlyStop as Dt, AGENT_QUEST_ID as E, hasDeliverablePinnedArtifact as Et, BRIEFCASE_CATALOG_QUERIES as F, secureParameters as Ft, DecisionTextPartSchema as G, visibleReplyText as Gt, CreateArtifactRequestSchema as H, ttsBase64ResponseSchema as Ht, BedrockEmbeddingModel as I, signImageUrl as It, ImageModels as J, DELEGATION_PAYLOAD_SCHEMA_NAME as Jt, DecisionsRequestSchema as K, withRetry as Kt, BriefcasePromptIdSchema as L, splitEquals as Lt, ApiKeyType as M, obfuscateApiKey as Mt, ArtifactTypeSchema as N, questReplyText as Nt, AGENT_QUEST_MCP_URI as O, isPlaceholderImageSigningSecret as Ot, AudioMimeType as P, replacePromptVariables as Pt, McpServerName as Q, delegationPayloadSchema as Qt, CONTEXT_WINDOW_SAFETY_BUFFER_TOKENS as R, stripDeliveredArtifactBlocks as Rt, isValidSessionId as S, generatedAudioResponseSchema as St, escapeArtifactBodyJson as T, googleMapsSearchUrl as Tt, DEFAULT_TTS_PROVIDER as U, ttsRequestSchema as Ut, CompletionReasoningEffortSchema as V, tokenEstimateMultiplier as Vt, DEGENERATE_FINISH_REASON as W, ttsResponseTooLargeSchema as Wt, LOCATION_MAP_LANGUAGE as X, actorKindMarker as Xt, ImagePromptResolutionSchema as Y, actorColorIndex as Yt, MODEL_INFO_FIELD_GROUP_OF as Z, actorKindSchema as Zt, LOCAL_DEV_URL as _, buildPromptContext as _t, commandTextOf as a, REVIEW_GATE_STATUS_VALUES as at, logger as b, escapeThinkMarkers as bt, toolCategory as c, SUBQUEST_STATUS_VALUES as ct, getCreditsUrl as d, TTS_MAX_INPUT_CHARS as dt, frontmatterHasSourceStamp as en, NotFoundError as et, getEnvironmentName as f, UnprocessableEntityError as ft, DeviceFlowClient as g, assertAuthOriginMatchesApiKey as gt, AuthenticatedApiClient as h, WORK_ITEM_STATUSES as ht, ToolCatalog as i, WEBSITE_URL as in, PermissionDeniedError as it, ApiKeyScope as j, joinReplySlots as jt, ARTIFACT_DELIVERED_PLACEHOLDER as k, isRetryableError as kt, writePathOf as l, SupportedFabFileMimeTypes as lt, resolveApiEndpoint as m, VoyageAIEmbeddingModel as mt, extractCompactInstructions as n, splitSkillMdFrontmatter as nn, OpenAIEmbeddingModel as nt, isReadOnlyTool as o, SEARCH_RESULT_CARDS_LANGUAGE as ot, requireApiUrl as p, VisibilitySchema as pt, GENERATED_IMAGE_EXTENSION_RE as q, ACTOR_COLOR_SLOTS as qt, loadContextFiles as r, APP_NAME as rn, PROMPT_TEXT_MAX as rt, sandboxedCommandArg as s, SLUG_OWNED_BY_OTHER as st, ConfigStore as t, readSkillMdSourceUrl as tn, OllamaEmbeddingModel as tt, ApiEndpointUnconfiguredError as u, TTS_DEFAULT_MODEL as ut, NotAuthenticatedError as v, completionsSupportsToolSearch as vt, htmlFirstH1 as w, getQuestErrorCode as wt, SESSION_ID_PATTERN as x, filterToolArtifactMarkup as xt, parseApiUrl as y, createThinkMarkerEscaper as yt, CREDIT_DEDUCT_TRANSACTION_TYPES as z, stripToolArtifactMarkup as zt };