@newheap/platform-ai-chat 0.15.0 → 0.17.0

package/fesm2022/newheap-platform-ai-chat-testing.mjs

@@ -1,6 +1,6 @@
 import * as i0 from '@angular/core';
 import { InjectionToken, inject, signal, Injectable, computed, DestroyRef, makeEnvironmentProviders } from '@angular/core';
-import { NH_ASSISTANT_MAX_PROPOSAL_LOOKUP, NH_ASSISTANT_CONFIG, applyNhAssistantEvent, normalizeNhAssistantClientContext, applyNhAssistantApprovalDecision, NH_ASSISTANT_FETCH, NhAssistantLiveService, NH_ASSISTANT_MCP_AUTHORIZATION_WINDOW } from '@newheap/platform-ai-chat';
+import { NH_ASSISTANT_UPLOAD_HEADER, NH_ASSISTANT_MAX_PROPOSAL_LOOKUP, NH_ASSISTANT_CONFIG, applyNhAssistantEvent, normalizeNhAssistantClientContext, applyNhAssistantApprovalDecision, NH_ASSISTANT_FETCH, NH_ASSISTANT_UPLOAD, NhAssistantLiveService, NH_ASSISTANT_MCP_AUTHORIZATION_WINDOW } from '@newheap/platform-ai-chat';
 import { Observable, Subject } from 'rxjs';
 
 /**
@@ -25,6 +25,7 @@ const statusTable = {
         'assistant-run-filter-invalid',
         'assistant-board-scope-invalid',
         'assistant-feedback-invalid',
+        'assistant-trigger-filter-not-found',
         'assistant-replay-not-shadow',
         'assistant-evaluation-not-variant',
         'assistant-instructions-too-long',
@@ -39,7 +40,12 @@ const statusTable = {
         'assistant-mcp-authorization-invalid',
         'assistant-mcp-pkce-unsupported',
         'assistant-mcp-client-registration-required',
-        'assistant-mcp-oauth-not-configured'
+        'assistant-mcp-oauth-not-configured',
+        'assistant-file-reference-invalid',
+        'assistant-file-upload-invalid',
+        'assistant-file-too-many-pages',
+        'assistant-file-count-limit',
+        'assistant-file-token-limit'
     ],
     401: [
         'assistant-webhook-signature-invalid'
@@ -55,7 +61,8 @@ const statusTable = {
         'assistant-four-eyes-required',
         'assistant-forbidden',
         'assistant-mcp-credential-mismatch',
-        'assistant-mcp-initiator-only'
+        'assistant-mcp-initiator-only',
+        'assistant-file-forbidden'
     ],
     404: [
         'assistant-disabled',
@@ -79,7 +86,9 @@ const statusTable = {
         'assistant-not-found',
         'assistant-context-not-found',
         'assistant-mcp-server-not-found',
-        'assistant-mcp-tool-not-found'
+        'assistant-mcp-tool-not-found',
+        'assistant-files-unavailable',
+        'assistant-file-not-found'
     ],
     409: [
         'assistant-conversation-busy',
@@ -123,10 +132,20 @@ const statusTable = {
         'assistant-mcp-issuer-changed',
         'assistant-mcp-authorization-not-confirmed',
         'assistant-mcp-connection-not-supported',
-        'assistant-mcp-secret-unreadable'
+        'assistant-mcp-secret-unreadable',
+        'assistant-files-not-accepted'
     ],
     413: [
-        'assistant-webhook-payload-too-large'
+        'assistant-webhook-payload-too-large',
+        'assistant-file-too-large'
+    ],
+    415: [
+        'assistant-file-type-not-supported',
+        'assistant-file-type-not-accepted'
+    ],
+    422: [
+        'assistant-file-upload-refused',
+        'assistant-file-scan-refused'
     ],
     429: [
         'assistant-mcp-too-many-authorizations'
@@ -142,7 +161,9 @@ const statusTable = {
     503: [
         'assistant-proposal-check-failed',
         'assistant-trigger-rolled-back',
-        'assistant-mcp-secret-unavailable'
+        'assistant-mcp-secret-unavailable',
+        'assistant-file-unavailable',
+        'assistant-file-upload-failed'
     ]
 };
 const statuses = buildStatuses();
@@ -188,6 +209,16 @@ function mockValidationFailure(field) {
     return mockFailure('assistant-validation', field ? { [field]: ['invalid'] } : undefined);
 }
 /** A stable, non-cryptographic fingerprint; the mock only needs change detection. */
+/**
+ * The warnings of an agent or skill that classifies its model calls with `classification` on
+ * `profile`: `classification-not-permitted` when the scenario lists what the profile and its
+ * fallbacks permit and that does not include it, as the server reports it; none without a
+ * classification of its own.
+ */
+function mockClassificationWarnings(permitted, profile, classification) {
+    const allowed = profile ? permitted?.[profile] : undefined;
+    return classification && allowed && !allowed.includes(classification) ? ['classification-not-permitted'] : [];
+}
 function mockHashText(text) {
     let hash = 0x811c9dc5;
     for (let index = 0; index < text.length; index++) {
@@ -333,7 +364,10 @@ function mockWorksOnCovers(agent, subjectType) {
     return agent.worksOnAllSubjects !== false || (agent.worksOnSubjectTypes ?? []).includes(subjectType);
 }
 
+/** The profile of an agent that did not choose one, as the application's chat profile. */
+const mockChatProfile = 'chat';
 const autonomyLevels = ['observe', 'explain', 'propose', 'simulate', 'execute'];
+const dataClassifications$1 = ['public', 'internal', 'confidential', 'restricted'];
 /**
  * The agents of the mock administration: agents in code and agents created as data, their state,
  * shadow modes, technical accounts, feedback, evaluation and replays. The mock runs no agents on
@@ -367,7 +401,7 @@ class NhAssistantMockAdminAgents {
                     skills: (skills ?? []).map((skill) => ({
                         skillId: skill.skillId,
                         description: skill.description,
-                        runState: 'active',
+                        runState: skill.startsOff === true ? 'off' : 'active',
                         changedAt: null,
                         changedBy: null,
                         reason: null,
@@ -468,9 +502,15 @@ class NhAssistantMockAdminAgents {
             if (typeof engaged !== 'boolean') {
                 return mockValidationFailure();
             }
-            const changed = this.agentStateEndpoint(stored, 'POST', { state: engaged ? 'stopped' : 'active' });
+            // Releasing never switches on an agent that was off, as on the server: one that was off when
+            // it stopped goes back off, and one that is off stays off.
+            const released = stored.agent.runState === 'off' || stored.offBeforeStop === true ? 'off' : 'active';
+            const changed = this.agentStateEndpoint(stored, 'POST', { state: engaged ? 'stopped' : released });
             return changed.status === 200
-                ? { status: 200, body: { agentId: id, enabled: stored.agent.runState !== 'stopped', cancelledRuns: 0 } }
+                ? {
+                    status: 200,
+                    body: { agentId: id, enabled: stored.agent.runState !== 'stopped', cancelledRuns: 0, runState: stored.agent.runState }
+                }
                 : changed;
         }
         if (length !== 3) {
@@ -511,7 +551,7 @@ class NhAssistantMockAdminAgents {
             return { status: 405 };
         }
         const request = body;
-        if (request?.state !== 'active' && request?.state !== 'paused' && request?.state !== 'stopped') {
+        if (request?.state !== 'active' && request?.state !== 'paused' && request?.state !== 'stopped' && request?.state !== 'off') {
             return mockValidationFailure();
         }
         const reason = typeof request.reason === 'string' && request.reason.trim().length > 0 ? request.reason.trim() : null;
@@ -672,9 +712,9 @@ class NhAssistantMockAdminAgents {
     }
     /**
      * A skill defined as data shows among the agent's skills as a skill in shadow by default, as the
-     * server shows it; removing it takes its state along.
+     * server shows it, and off when it was added with `startsOff`; removing it takes its state along.
      */
-    setDataSkill(agentId, skillId, description) {
+    setDataSkill(agentId, skillId, description, startsOff = false) {
         const stored = this.agents.get(agentId);
         if (!stored) {
             return;
@@ -688,9 +728,9 @@ class NhAssistantMockAdminAgents {
                 : [...others, existing ? { ...existing, description } : {
                         skillId,
                         description,
-                        runState: 'active',
-                        changedAt: null,
-                        changedBy: null,
+                        runState: startsOff ? 'off' : 'active',
+                        changedAt: startsOff ? this.now() : null,
+                        changedBy: startsOff ? 'current-user' : null,
                         reason: null,
                         waitingInputs: 0,
                         toolCallsToday: 0,
@@ -766,7 +806,8 @@ class NhAssistantMockAdminAgents {
     }
     /**
      * `GET` and `POST admin/agents/{id}/state`. The mock runs no agents on their own, so a pause
-     * collects no waiting events and a stop cancels no runs; the version never changes.
+     * collects no waiting events, a stop cancels no runs and switching an agent off or on starts
+     * nothing; the version never changes.
      */
     agentStateEndpoint(stored, method, body) {
         if (method === 'GET') {
@@ -779,7 +820,7 @@ class NhAssistantMockAdminAgents {
         if (request?.state === undefined || request.state === null) {
             return mockValidationFailure();
         }
-        if (request.state !== 'active' && request.state !== 'paused' && request.state !== 'stopped') {
+        if (request.state !== 'active' && request.state !== 'paused' && request.state !== 'stopped' && request.state !== 'off') {
             return mockValidationFailure();
         }
         const reason = typeof request.reason === 'string' && request.reason.trim().length > 0 ? request.reason.trim() : null;
@@ -792,6 +833,8 @@ class NhAssistantMockAdminAgents {
                 : { status: 200, body: toAgentState(stored.agent) };
         }
         if (stored.agent.runState !== request.state) {
+            // A stop remembers whether the agent was off, for the kill switch; every other change forgets it.
+            stored.offBeforeStop = request.state === 'stopped' && stored.agent.runState === 'off';
             stored.agent = {
                 ...stored.agent,
                 isEnabled: request.state !== 'stopped',
@@ -821,6 +864,19 @@ class NhAssistantMockAdminAgents {
                 return mockFailure('assistant-validation', errors);
             }
         }
+        // An agent created here uses a profile the run catalog offers, or keeps the one it has or the
+        // chat profile it gets by default; an agent in code takes its own.
+        const profile = typeof input?.profile === 'string' ? input.profile.trim() : '';
+        if (source === 'admin' && profile.length > 0 && profile !== mockChatProfile
+            && profile !== this.agents.get(input.id)?.agent.profile
+            && !this.rules.profileNames().includes(profile)) {
+            return mockFailure('assistant-validation', { profile: ['not-found'] });
+        }
+        // An agent created here names the classification of its model calls, as a data skill does.
+        const classification = chosenClassification(input.dataClassification);
+        if (source === 'admin' && classification !== null && !dataClassifications$1.includes(classification)) {
+            return mockFailure('assistant-validation', { dataClassification: ['invalid'] });
+        }
         return null;
     }
     validAgent(input) {
@@ -841,18 +897,28 @@ class NhAssistantMockAdminAgents {
      * `previous`, and a new agent starts active.
      */
     toAgent(input, source, version, isOverridden, previous) {
-        const { isEnabled, ...definition } = structuredClone(input);
-        return {
+        // Only a new agent starts off, created that way here or with StartsOff() in code.
+        const { isEnabled, startsOff, profile, dataClassification, ...definition } = structuredClone(input);
+        const createdOff = previous === undefined && startsOff === true;
+        const chosenProfile = source === 'admin' && typeof profile === 'string' && profile.trim().length > 0 ? profile.trim() : null;
+        const classification = chosenClassification(dataClassification);
+        return this.withWarnings({
             ...definition,
+            // An agent created here keeps its profile when the input omits it; code decides for the others.
+            profile: chosenProfile ?? previous?.profile ?? mockChatProfile,
+            // The same for its classification; an agent in code keeps the one of its scenario.
+            dataClassification: source === 'admin' || previous === undefined
+                ? classification ?? previous?.dataClassification ?? null
+                : previous.dataClassification ?? null,
             isEnabled: previous?.isEnabled ?? true,
             version,
             source,
             isOverridden,
             instructionsHash: mockHashText(input.instructions),
             updatedAt: this.now(),
-            runState: previous?.runState ?? 'active',
-            stateChangedAt: previous?.stateChangedAt ?? null,
-            stateChangedBy: previous?.stateChangedBy ?? null,
+            runState: previous?.runState ?? (createdOff ? 'off' : 'active'),
+            stateChangedAt: previous?.stateChangedAt ?? (createdOff && source === 'admin' ? this.now() : null),
+            stateChangedBy: previous?.stateChangedBy ?? (createdOff && source === 'admin' ? 'current-user' : null),
             stateReason: previous?.stateReason ?? null,
             waitingInputs: previous?.waitingInputs ?? 0,
             skills: previous?.skills ?? [],
@@ -868,9 +934,20 @@ class NhAssistantMockAdminAgents {
                 ? pickWorksOn(previous)
                 : mockWorksOnFromInput(input) ?? (previous ? pickWorksOn(previous) : { ...mockUndeclaredWorksOn, worksOnDeclared: true })),
             knownSubjectTypes: previous?.knownSubjectTypes ?? []
+        });
+    }
+    /** The agent with the warnings the server reports for it, from its profile and classification. */
+    withWarnings(agent) {
+        return {
+            ...agent,
+            warnings: mockClassificationWarnings(this.scenario.admin?.profileClassifications, agent.profile, agent.dataClassification)
         };
     }
 }
+/** A classification name the input chose, or `null` when it chose none. */
+function chosenClassification(value) {
+    return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null;
+}
 function codeAgentFromSummary(agent) {
     return {
         id: agent.id,
@@ -949,6 +1026,17 @@ const maxUserName = 256;
 const maxPolicy = 256;
 const maxClientId = 512;
 const maxAccountLabel = 200;
+/**
+ * The readers of a server: at most 16, each with at most 16 media types, a tool name of at most 128
+ * characters and a priority from -1000 to 1000.
+ */
+const maxReaders = 16;
+const maxReaderMediaTypes = 16;
+const maxReaderToolName = 128;
+const readerPriority = { min: -1000, max: 1000 };
+const classifications = ['public', 'internal', 'confidential', 'restricted'];
+const mediaTypePattern$1 = /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/;
+const controlCharacters = /[\u0000-\u001f\u007f]/;
 /**
  * The MCP servers of the mock administration and the caller's own connections: secrets are
  * write-only, new tools start disabled as mutations, a changed remote schema disables a tool, OAuth
@@ -990,6 +1078,12 @@ class NhAssistantMockAdminMcp {
                 remoteTools: remoteTools ?? [],
                 tools: new Map()
             };
+            const readers = readersAfter(input, []);
+            if (readers.length > 0) {
+                // Preconfigured readers were set up after a sync of the server's tools.
+                this.sync(stored);
+                stored.server.readers = readers;
+            }
             if (oauthModes.includes(input.authMode)) {
                 // A preconfigured OAuth server was confirmed by an administrator before.
                 const found = this.discovery(input.url);
@@ -1240,7 +1334,8 @@ class NhAssistantMockAdminMcp {
                     ...toServerFields(input, stored.server),
                     ...oauthFields(input, stored.server, oauth.authorization),
                     headlessUse,
-                    transport: input.transport ?? stored.server.transport
+                    transport: input.transport ?? stored.server.transport,
+                    readers: readersAfter(input, stored.server.readers)
                 };
                 if (!oauthModes.includes(input.authMode)) {
                     stored.oauthSecret = null;
@@ -1444,6 +1539,7 @@ class NhAssistantMockAdminMcp {
         checkServerFields(input, stored, this.scenario.admin?.policies, add, this.scenario.admin?.mcpAuthModes ?? []);
         this.checkCredential(input, stored, add);
         this.checkOAuth(input, stored, add);
+        checkReaders(input, stored, add);
         return errors;
     }
     /**
@@ -1933,9 +2029,97 @@ function newServerState(input) {
         headlessUse: input.headlessUse ?? 'never',
         lastConnectAt: null,
         lastConnectCode: null,
-        transport: input.transport ?? 'streamable-http'
+        transport: input.transport ?? 'streamable-http',
+        // A new server has no synced tools, so it gets its readers after a sync.
+        readers: []
     };
 }
+/** A media type in lowercase without parameters, or null for a value that is not one. */
+function normalizeMediaType$1(value) {
+    if (typeof value !== 'string') {
+        return null;
+    }
+    const essence = value.split(';')[0].trim().toLowerCase();
+    return essence.length <= 128 && mediaTypePattern$1.test(essence) ? essence : null;
+}
+/**
+ * The readers after a valid input, as on the server: omitted or null readers keep the stored ones,
+ * an empty list removes them all, and the media types are stored normalized and once each. The
+ * server returns them by priority, highest first, then by tool name.
+ */
+function readersAfter(input, stored) {
+    const readers = input.readers;
+    if (readers === undefined || readers === null) {
+        return stored;
+    }
+    return readers
+        .map(reader => ({
+        mediaTypes: [...new Set(reader.mediaTypes.map(normalizeMediaType$1).filter((mediaType) => mediaType !== null))],
+        toolName: reader.toolName ?? '',
+        maxClassification: reader.maxClassification ?? 'restricted',
+        priority: reader.priority ?? 0
+    }))
+        .sort((left, right) => right.priority - left.priority || compareOrdinal(left.toolName, right.toolName));
+}
+/**
+ * The field errors of the readers, as the server reports them: `readers` (too-long for more than
+ * 16) and per reader, with its index: `readers[0].mediaTypes` (required, invalid, too-long for more
+ * than 16), `readers[0].toolName` (required, invalid also for a second reader of the same tool,
+ * not-found when the server has not synced that tool), `readers[0].maxClassification` (required,
+ * invalid) and `readers[0].priority` (invalid outside -1000 to 1000).
+ */
+function checkReaders(input, stored, add) {
+    const readers = input.readers;
+    if (!Array.isArray(readers) || readers.length === 0) {
+        return;
+    }
+    if (readers.length > maxReaders) {
+        add('readers', 'too-long');
+        return;
+    }
+    const readTools = new Set();
+    readers.forEach((reader, index) => {
+        const field = (name) => `readers[${index}].${name}`;
+        const mediaTypes = Array.isArray(reader?.mediaTypes) ? reader.mediaTypes.map(normalizeMediaType$1) : [];
+        if (mediaTypes.length === 0) {
+            add(field('mediaTypes'), 'required');
+        }
+        else if (mediaTypes.some(mediaType => mediaType === null)) {
+            add(field('mediaTypes'), 'invalid');
+        }
+        else if (new Set(mediaTypes).size > maxReaderMediaTypes) {
+            add(field('mediaTypes'), 'too-long');
+        }
+        const toolName = reader?.toolName;
+        if (typeof toolName !== 'string' || toolName.trim().length === 0) {
+            add(field('toolName'), 'required');
+        }
+        else if (toolName.length > maxReaderToolName || controlCharacters.test(toolName) || readTools.has(toolName)) {
+            add(field('toolName'), 'invalid');
+        }
+        else if (!stored?.tools.has(toolName)) {
+            add(field('toolName'), 'not-found');
+        }
+        if (typeof toolName === 'string') {
+            readTools.add(toolName);
+        }
+        const classification = reader?.maxClassification;
+        if (classification === null || classification === undefined) {
+            add(field('maxClassification'), 'required');
+        }
+        else if (!classifications.includes(classification)) {
+            add(field('maxClassification'), 'invalid');
+        }
+        const priority = reader?.priority ?? 0;
+        if (!Number.isInteger(priority) || priority < readerPriority.min || priority > readerPriority.max) {
+            add(field('priority'), 'invalid');
+        }
+    });
+}
+/** Compares two names by their characters, as the server orders them. */
+function compareOrdinal(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
 /**
  * `organization` needs a credential of the organization; `personal` is the forwarded token of the
  * person a run acts for.
@@ -2032,12 +2216,24 @@ function kebab(value) {
 }
 
 const dashCase$4 = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const dataClassifications = ['public', 'internal', 'confidential', 'restricted'];
 const accountabilities = ['agent', 'subject-responsible', 'service-account'];
 const conflicts = ['coalesce', 'queue', 'supersede', 'ignore'];
 const maxDescription$1 = 300;
 const maxInstructions = 20_000;
 const maxMessage$1 = 2_000;
 const maxReason$1 = 500;
+/** A data trigger applies at most this many filters of its event, each named in lowercase dash-case. */
+const maxTriggerFilters = 10;
+const filterName = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** The platform's default file limits (`NhAssistantLimits`). */
+const defaultFileLimits = {
+    maxFileBytes: 20 * 1024 * 1024,
+    maxFilePages: 100,
+    maxFilesPerTurn: 5,
+    maxFileTokensPerTurn: 100_000
+};
+const fileLimitFields = ['maxFileBytes', 'maxFilePages', 'maxFilesPerTurn', 'maxFileTokensPerTurn'];
 /**
  * In-memory run configuration as data of the mock API: run settings of agents created in the
  * administration, skills defined as data with versions and candidates, and data triggers. Saving
@@ -2057,7 +2253,8 @@ class NhAssistantMockRunConfiguration {
         this.triggers = new Map();
         const approvalPolicies = scenario.runCatalog?.approvalPolicies ?? scenario.policies ?? [];
         this.catalog = {
-            triggerEvents: scenario.runCatalog?.triggerEvents ?? [],
+            // A trigger event lists its named filters, none unless the scenario's application registers some.
+            triggerEvents: (scenario.runCatalog?.triggerEvents ?? []).map(event => ({ ...event, filters: event.filters ?? [] })),
             subjectSets: scenario.runCatalog?.subjectSets ?? [],
             ruleHandlers: scenario.runCatalog?.ruleHandlers ?? [],
             approvalPolicies,
@@ -2072,13 +2269,16 @@ class NhAssistantMockRunConfiguration {
             })),
             accountSearch: accounts.searchable,
             agentPolicies: scenario.runCatalog?.agentPolicies ?? [],
-            divisions: scenario.runCatalog?.divisions ?? false
+            divisions: scenario.runCatalog?.divisions ?? false,
+            // The platform's default file limits, unless the scenario's application chose its own.
+            fileLimits: scenario.runCatalog?.fileLimits ?? defaultFileLimits
         };
         this.codeTriggers = (scenario.codeTriggers ?? []).map(trigger => ({
             ...trigger,
             skillId: trigger.skillId ?? null,
             subjectType: trigger.subjectType ?? null
         }));
+        this.profileClassifications = scenario.profileClassifications;
         this.codeRunSettings = new Map((scenario.agents ?? [])
             .filter(agent => agent.source === 'code')
             .map(agent => [agent.id, agent.codeRunSettings ?? {}]));
@@ -2091,6 +2291,10 @@ class NhAssistantMockRunConfiguration {
     get divisionsListed() {
         return this.catalog.divisions === true;
     }
+    /** The profiles the run catalog offers to data skills and to agents created in the administration. */
+    get profileNames() {
+        return [...this.catalog.profiles];
+    }
     /** `GET admin/run-catalog`. */
     runCatalog(method) {
         return method === 'GET' ? { status: 200, body: this.catalog } : { status: 405 };
@@ -2164,7 +2368,9 @@ class NhAssistantMockRunConfiguration {
             accountability: given.accountability ?? (agent.serviceAccount ? 'service-account' : 'agent'),
             delegateFromInitiator: given.delegateFromInitiator ?? false,
             approvalPolicy: given.approvalPolicy ?? null,
-            usesRules: given.usesRules ?? false
+            usesRules: given.usesRules ?? false,
+            startsOff: given.startsOff ?? false,
+            acceptsFiles: given.acceptsFiles ?? false
         };
     }
     /**
@@ -2174,8 +2380,13 @@ class NhAssistantMockRunConfiguration {
      */
     triggerProblem(agent, trigger) {
         if (trigger.source === 'event') {
-            const subjectType = this.catalog.triggerEvents.find(item => item.name === trigger.event)?.subjectType;
-            return subjectType && !mockWorksOnCovers(agent, subjectType) ? 'not-worked-on' : null;
+            const event = this.catalog.triggerEvents.find(item => item.name === trigger.event);
+            if (event?.subjectType && !mockWorksOnCovers(agent, event.subjectType)) {
+                return 'not-worked-on';
+            }
+            // A filter the event no longer offers keeps the trigger from firing.
+            const offered = (event?.filters ?? []).map(filter => filter.name);
+            return (trigger.filters ?? []).some(name => !offered.includes(name)) ? 'unknown-filter' : null;
         }
         return trigger.subjectSet === null && !mockWorksOnCovers(agent, mockSystemSubjectType) ? 'not-worked-on' : null;
     }
@@ -2227,6 +2438,7 @@ class NhAssistantMockRunConfiguration {
         this.requireKnown(errors, 'approvalPolicy', request.approvalPolicy, this.catalog.approvalPolicies);
         this.requireKnown(errors, 'triageProfile', request.triageProfile, this.catalog.profiles);
         this.requireKnown(errors, 'ruleHandler', request.ruleHandler, this.catalog.ruleHandlers.map(handler => handler.name));
+        this.requireFileLimits(errors, request.acceptsFiles ?? false, request);
         if (Object.keys(errors).length > 0) {
             return mockFailure('assistant-validation', errors);
         }
@@ -2256,7 +2468,9 @@ class NhAssistantMockRunConfiguration {
             changedBy: 'current-user',
             reason: text(request.reason),
             inEffect: true,
-            problem: null
+            problem: null,
+            acceptsFiles: request.acceptsFiles ?? false,
+            ...storedFileLimits(request)
         };
         this.settings.set(agent.id, saved);
         return { status: 200, body: saved };
@@ -2316,9 +2530,18 @@ class NhAssistantMockRunConfiguration {
         if (request.apply === 'shadow' && (request.expectedVersion ?? null) === null) {
             errors['apply'] = ['invalid'];
         }
+        // Only a new skill starts off; a skill that exists keeps its state.
+        if (request.startsOff === true && (request.expectedVersion ?? null) !== null) {
+            errors['startsOff'] = ['invalid'];
+        }
+        const classification = text(request.dataClassification);
+        if (classification !== null && !dataClassifications.includes(classification)) {
+            errors['dataClassification'] = ['invalid'];
+        }
         this.requireKnown(errors, 'profile', request.profile, this.catalog.profiles);
         this.requireKnown(errors, 'ruleHandler', request.ruleHandler, this.catalog.ruleHandlers.map(handler => handler.name));
         this.requireKnown(errors, 'approvalPolicy', request.approvalPolicy, this.catalog.approvalPolicies);
+        this.requireFileLimits(errors, request.acceptsFiles ?? false, request);
         if (Object.keys(errors).length > 0) {
             return mockFailure('assistant-validation', errors);
         }
@@ -2344,6 +2567,9 @@ class NhAssistantMockRunConfiguration {
             instructionsHash: instructions === null ? null : hashText(instructions),
             tools: [...new Set(request.tools ?? [])],
             profile: text(request.profile),
+            dataClassification: classification,
+            acceptsFiles: request.acceptsFiles ?? false,
+            ...storedFileLimits(request),
             ruleHandler: text(request.ruleHandler),
             maxTokensPerRun: request.maxTokensPerRun ?? null,
             dailyToolCalls: request.dailyToolCalls ?? null,
@@ -2357,9 +2583,10 @@ class NhAssistantMockRunConfiguration {
         };
         this.skills.set(key$1(agent.id, skillId), [...versions, saved]);
         if (!candidate) {
-            this.agents.setDataSkill(agent.id, skillId, saved.description);
+            this.agents.setDataSkill(agent.id, skillId, saved.description, live === undefined && request.startsOff === true);
         }
-        return { status: 200, body: toSkill(saved) };
+        // A classification that no profile permits never refuses the save; the skill reports it.
+        return { status: 200, body: this.withWarnings(agent, toSkill(saved)) };
     }
     candidate(method, agent, skillId, action, body) {
         const versions = this.skills.get(key$1(agent.id, skillId)) ?? [];
@@ -2403,7 +2630,7 @@ class NhAssistantMockRunConfiguration {
         }
         candidate.status = 'live';
         this.agents.setDataSkill(agent.id, skillId, candidate.description);
-        return { status: 200, body: toSkill(candidate) };
+        return { status: 200, body: this.withWarnings(agent, toSkill(candidate)) };
     }
     versions(agentId, skillId) {
         return [...(this.skills.get(key$1(agentId, skillId)) ?? [])]
@@ -2489,9 +2716,20 @@ class NhAssistantMockRunConfiguration {
         if (skill !== null && !this.skillIds(agent).includes(skill)) {
             errors['skill'] = ['not-found'];
         }
+        // The filters in the order chosen, each once; only an event trigger takes them.
+        const filters = [...new Set((request.filters ?? []).map(name => (typeof name === 'string' ? name.trim() : '')))];
+        if (filters.length > maxTriggerFilters || filters.some(name => name.length > 64 || !filterName.test(name)) || (schedule && filters.length > 0)) {
+            errors['filters'] = ['invalid'];
+        }
         if (Object.keys(errors).length > 0) {
             return mockFailure('assistant-validation', errors);
         }
+        if (request.source === 'event') {
+            const offered = (this.catalog.triggerEvents.find(item => item.name === text(request.event))?.filters ?? []).map(filter => filter.name);
+            if (filters.some(name => !offered.includes(name))) {
+                return mockFailure('assistant-trigger-filter-not-found', { filters: ['not-found'] });
+            }
+        }
         if ((request.expectedVersion ?? null) !== (existing?.version ?? null)) {
             return mockFailure('assistant-version-conflict');
         }
@@ -2512,7 +2750,8 @@ class NhAssistantMockRunConfiguration {
             changedBy: 'current-user',
             reason: text(request.reason),
             inEffect: true,
-            problem: null
+            problem: null,
+            filters: schedule ? [] : filters
         };
         this.triggers.set(triggerId, Object.assign(saved, { [ownerKey]: agent.id }));
         return { status: 200, body: withoutOwner(saved) };
@@ -2547,6 +2786,7 @@ class NhAssistantMockRunConfiguration {
     }
     liveSkills(agentId) {
         const result = [];
+        const agent = this.agents.find(agentId);
         for (const [stored, versions] of this.skills) {
             if (!stored.startsWith(`${agentId}/`)) {
                 continue;
@@ -2554,11 +2794,24 @@ class NhAssistantMockRunConfiguration {
             const live = versions.find(version => version.status === 'live');
             if (live) {
                 const candidate = versions.find(version => version.status === 'candidate');
-                result.push({ ...toSkill(live), candidate: candidate ? toSkill(candidate) : null });
+                result.push({
+                    ...this.withWarnings(agent, toSkill(live)),
+                    candidate: candidate ? this.withWarnings(agent, toSkill(candidate)) : null
+                });
             }
         }
         return result.sort((left, right) => left.skillId.localeCompare(right.skillId));
     }
+    /**
+     * The skill with the warnings the server reports for it: its classification, or else its agent's,
+     * that its profile, or else its agent's, does not permit.
+     */
+    withWarnings(agent, skill) {
+        return {
+            ...skill,
+            warnings: mockClassificationWarnings(this.profileClassifications, skill.profile ?? agent?.profile, skill.dataClassification ?? agent?.dataClassification)
+        };
+    }
     ownerOf(trigger) {
         return trigger[ownerKey];
     }
@@ -2574,6 +2827,28 @@ class NhAssistantMockRunConfiguration {
             errors[field] = ['not-found'];
         }
     }
+    /**
+     * Lower file limits as the server checks them: each a whole number from 1 to the application's
+     * limit, and only next to `acceptsFiles`.
+     */
+    requireFileLimits(errors, acceptsFiles, request) {
+        const application = this.catalog.fileLimits ?? defaultFileLimits;
+        for (const field of fileLimitFields) {
+            const value = request[field];
+            if (value !== null && value !== undefined && (!acceptsFiles || !inRange(value, 1, application[field]))) {
+                errors[field] = ['invalid'];
+            }
+        }
+    }
+}
+/** The lower file limits a save stores, `null` where the request keeps the application's. */
+function storedFileLimits(request) {
+    return {
+        maxFileBytes: request.maxFileBytes ?? null,
+        maxFilePages: request.maxFilePages ?? null,
+        maxFilesPerTurn: request.maxFilesPerTurn ?? null,
+        maxFileTokensPerTurn: request.maxFileTokensPerTurn ?? null
+    };
 }
 const ownerKey = '__agentId';
 function key$1(agentId, skillId) {
@@ -2649,12 +2924,13 @@ class NhAssistantMockAdmin {
         this.agents = new NhAssistantMockAdminAgents(scenario, now, {
             hasServer: serverId => this.mcp.hasServer(serverId),
             agentPolicyNames: () => this.runConfiguration.agentPolicyNames,
-            divisionsListed: () => this.runConfiguration.divisionsListed
+            divisionsListed: () => this.runConfiguration.divisionsListed,
+            profileNames: () => this.runConfiguration.profileNames
         });
         this.accounts = new NhAssistantMockAccounts(admin);
         this.runConfiguration = new NhAssistantMockRunConfiguration(admin, {
             find: agentId => this.agents.find(agentId),
-            setDataSkill: (agentId, skillId, description) => this.agents.setDataSkill(agentId, skillId, description)
+            setDataSkill: (agentId, skillId, description, startsOff) => this.agents.setDataSkill(agentId, skillId, description, startsOff)
         }, now, this.accounts);
         this.mcp = new NhAssistantMockAdminMcp(scenario, now, {
             agents: () => this.agents.all(),
@@ -2859,6 +3135,159 @@ function toContext(version) {
     return { text: version.text, version: version.version, hash: version.hash, updatedAt: version.updatedAt, updatedBy: version.updatedBy };
 }
 
+/** The longest file name a reference takes, as on the server. */
+const maxNameLength = 256;
+const mediaTypePattern = /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/;
+/** How files of the platform's types start; other accepted types are the application's to check. */
+const signatures = {
+    'application/pdf': head => indexOf(head, [0x25, 0x50, 0x44, 0x46, 0x2d]) >= 0,
+    'image/png': head => startsWith(head, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
+    'image/jpeg': head => startsWith(head, [0xff, 0xd8, 0xff]),
+    'application/vnd.openxmlformats-officedocument.wordprocessingml.document': head => startsWith(head, [0x50, 0x4b, 0x03, 0x04]),
+    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': head => startsWith(head, [0x50, 0x4b, 0x03, 0x04])
+};
+/**
+ * The files of the mock API: `POST conversations/{id}/files` with the server's checks, and the
+ * attachments of a message, which a turn opens again as the server's file source would.
+ */
+class NhAssistantMockFiles {
+    constructor(refuse, scan) {
+        this.refuse = refuse;
+        this.scan = scan;
+        this.stored = new Map();
+        this.next = 0;
+    }
+    /** The uploads the mock stored, oldest first. */
+    get uploads() {
+        return [...this.stored.values()];
+    }
+    /**
+     * Checks an upload as the server does, in its order: a file source, an agent that accepts files,
+     * the upload header, one file part named `file` with a name and content, an accepted media type
+     * whose content matches, the agent's largest size, the application's scanner, and finally the
+     * application's own refusal.
+     */
+    async upload(conversationId, offered, uploads, headers, form) {
+        if (!offered) {
+            return mockFailure('assistant-files-unavailable');
+        }
+        if (!uploads) {
+            return mockFailure('assistant-files-not-accepted');
+        }
+        const header = Object.entries(headers).find(([name]) => name.toLowerCase() === NH_ASSISTANT_UPLOAD_HEADER.toLowerCase());
+        let parts = 0;
+        form.forEach(() => parts++);
+        const file = form.get('file');
+        if (!header?.[1] || parts !== 1 || !(file instanceof Blob)) {
+            return mockFailure('assistant-file-upload-invalid');
+        }
+        const name = nameOf(file instanceof File ? file.name : '');
+        if (name === null || file.size === 0) {
+            return mockFailure('assistant-file-upload-invalid');
+        }
+        const mediaType = normalizeMediaType(file.type);
+        if (mediaType === null || !uploads.acceptedMediaTypes.includes(mediaType)) {
+            return mockFailure('assistant-file-type-not-accepted');
+        }
+        if (file.size > uploads.maxFileBytes) {
+            return mockFailure('assistant-file-too-large');
+        }
+        const head = new Uint8Array(await file.slice(0, 1024).arrayBuffer());
+        if (!(signatures[mediaType]?.(head) ?? true)) {
+            return mockFailure('assistant-file-type-not-accepted');
+        }
+        const upload = { conversationId, name, mediaType, size: file.size };
+        // The application's scanner sees the file before its file source stores anything.
+        const scanned = this.scan?.(upload) ?? null;
+        if (scanned) {
+            return mockFailure(scanned === 'refused' ? 'assistant-file-scan-refused' : 'assistant-file-upload-failed');
+        }
+        const refusal = this.refuse?.(upload) ?? null;
+        if (refusal) {
+            return mockFailure(refusalCode(refusal));
+        }
+        this.next++;
+        const reference = { id: `mock-file-${this.next}`, name, mediaType, size: file.size, hash: null };
+        this.stored.set(reference.id, { ...upload, reference });
+        return { status: 200, body: reference };
+    }
+    /**
+     * The code the server refuses a message's `files` with before the turn starts, or `null`: without
+     * a file source, more files than one message carries, or a reference that is not one.
+     */
+    checkMessage(files, offered, maxFiles) {
+        if (files === undefined || files === null || (Array.isArray(files) && files.length === 0)) {
+            return null;
+        }
+        if (!Array.isArray(files)) {
+            return 'assistant-file-reference-invalid';
+        }
+        if (!offered) {
+            return 'assistant-files-unavailable';
+        }
+        if (files.length > maxFiles) {
+            return 'assistant-file-count-limit';
+        }
+        return files.every(isReference) ? null : 'assistant-file-reference-invalid';
+    }
+    /**
+     * The code of the first attachment the turn cannot open, as the server's file source refuses it,
+     * or `null` when it opens them all. A reference the mock never stored, or one of another
+     * conversation, is not found.
+     */
+    openCode(conversationId, files) {
+        const missing = files.find(file => this.stored.get(file.id)?.conversationId !== conversationId);
+        return missing ? 'assistant-file-not-found' : null;
+    }
+}
+/** The file name without a path; `null` when nothing usable is left, as on the server. */
+function nameOf(fileName) {
+    const name = fileName.slice(Math.max(fileName.lastIndexOf('/'), fileName.lastIndexOf('\\')) + 1).trim();
+    return name.length === 0 || name.length > maxNameLength || /[\u0000-\u001f\u007f]/.test(name) ? null : name;
+}
+function normalizeMediaType(value) {
+    const essence = value.split(';')[0].trim().toLowerCase();
+    return essence.length <= 128 && mediaTypePattern.test(essence) ? essence : null;
+}
+function isReference(value) {
+    const file = value;
+    return !!file
+        && isText(file.id)
+        && isText(file.name)
+        && typeof file.mediaType === 'string' && normalizeMediaType(file.mediaType) !== null
+        && typeof file.size === 'number' && file.size >= 0;
+}
+function isText(value) {
+    return typeof value === 'string' && value.trim().length > 0 && value.length <= maxNameLength && !/[\u0000-\u001f\u007f]/.test(value);
+}
+/** The application's refusal as the server passes it on. */
+function refusalCode(code) {
+    switch (code) {
+        case 'assistant-files-unavailable':
+        case 'assistant-file-too-large':
+            return code;
+        case 'assistant-file-type-not-accepted':
+        case 'assistant-file-type-not-supported':
+            return 'assistant-file-type-not-accepted';
+        case 'assistant-file-upload-failed':
+        case 'assistant-file-unavailable':
+            return 'assistant-file-upload-failed';
+        default:
+            return 'assistant-file-upload-refused';
+    }
+}
+function startsWith(head, signature) {
+    return head.length >= signature.length && signature.every((byte, index) => head[index] === byte);
+}
+function indexOf(head, signature) {
+    for (let start = 0; start + signature.length <= head.length; start++) {
+        if (signature.every((byte, index) => head[start + index] === byte)) {
+            return start;
+        }
+    }
+    return -1;
+}
+
 const dashCase$3 = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 const minQueryLength = 2;
 const maxQueryLength = 100;
@@ -3246,7 +3675,7 @@ class NhAssistantMockAgentRuns {
             result: this.answerOf(found.run.id, language),
             resultTruncated: this.truncated.has(found.run.id),
             summary: found.run.summary,
-            proposals: [],
+            proposals: this.context.runProposals?.(found.run.id) ?? [],
             hiddenProposals: 0,
             artifacts: [],
             canOpenConversation: this.mayView(found.thread, language)
@@ -3829,9 +4258,9 @@ class NhAssistantMockAgentRuns {
         const picked = localized ? mockPickText({ ...localized }, '', language) : null;
         return picked ?? this.results.get(runId) ?? null;
     }
-    /** Neither stopped nor disabled in code; a paused agent still works for people. */
+    /** Neither stopped nor disabled in code; a paused agent, and one that is off, still works for people. */
     isWorking(agent) {
-        return agent.runState === 'active' || agent.runState === 'paused';
+        return agent.runState === 'active' || agent.runState === 'paused' || agent.runState === 'off';
     }
     mayUse(agent) {
         return agent.requiredPolicy === null || agent.requiredPolicy === undefined || this.passes(agent.requiredPolicy);
@@ -3981,7 +4410,7 @@ const maxGroupId = 64;
 const maxGroups = 100;
 const maxName = 100;
 const maxDescription = 300;
-const guid = /^[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}$/i;
+const guid$1 = /^[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}$/i;
 /**
  * Groups and boards of the mock API (K15, K16), as the server serves them: the scenario's
  * `agentGroups` are the groups in code with their names per language, checked as the server checks
@@ -4108,7 +4537,7 @@ class NhAssistantMockBoards {
         }
         const groupId = segments[1];
         const divisionId = query.get('divisionId');
-        if (divisionId !== null && divisionId !== '' && !guid.test(divisionId)) {
+        if (divisionId !== null && divisionId !== '' && !guid$1.test(divisionId)) {
             return mockFailure('assistant-board-scope-invalid');
         }
         const division = divisionId ? this.division(divisionId, requested) : null;
@@ -4249,6 +4678,7 @@ const dashCase = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 const maxReason = 500;
 const maxItemsPerPage = 100;
 const maxBulkDecisions = 50;
+const guid = /^[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}$/i;
 const lifetimeMs = 3 * 24 * 60 * 60 * 1000;
 /** The platform's subject type of the whole application. */
 const systemType = 'nh-system';
@@ -4264,12 +4694,15 @@ const systemType = 'nh-system';
  * answers `404` and deciding it `404 assistant-approval-not-found`.
  */
 class NhAssistantMockProposals {
-    constructor(scenario = [], actorId, now, mayDecideApplication = () => true, decided = () => undefined) {
+    constructor(scenario = [], actorId, now, mayDecideApplication = () => true, decided = () => undefined, mayWorkIn = () => true) {
         this.actorId = actorId;
         this.now = now;
         this.mayDecideApplication = mayDecideApplication;
         this.decided = decided;
+        this.mayWorkIn = mayWorkIn;
         this.proposals = new Map();
+        /** When the caller last looked at the inbox, by scope key. */
+        this.visits = new Map();
         const created = new Date(now()).getTime();
         for (const item of scenario) {
             if (this.proposals.has(item.approvalId)) {
@@ -4300,8 +4733,8 @@ class NhAssistantMockProposals {
                     mode: 'deferred',
                     policyId: null,
                     grantSource: 'agent',
-                    createdAt: new Date(created).toISOString(),
-                    expiresAt: new Date(created + lifetimeMs).toISOString(),
+                    createdAt: item.createdAt ?? new Date(created).toISOString(),
+                    expiresAt: item.expiresAt ?? new Date(Date.parse(item.createdAt ?? new Date(created).toISOString()) + lifetimeMs).toISOString(),
                     initiatorActorId: null,
                     decidedByActorId: null,
                     decidedAt: null,
@@ -4309,8 +4742,10 @@ class NhAssistantMockProposals {
                     executedAt: null,
                     rationale: item.rationale ?? null,
                     placedBy: item.placedBy ?? null,
+                    parent: item.parent ?? null,
                     canGiveFeedback: false
                 },
+                divisionId: item.divisionId ?? null,
                 canDecide: item.canDecide ?? true,
                 reasonCode: item.canDecide === false ? item.reasonCode ?? 'assistant-approval-policy-denied' : null
             });
@@ -4321,6 +4756,9 @@ class NhAssistantMockProposals {
         if (segments.length === 2 && segments[1] === 'inbox') {
             return method === 'GET' ? this.inbox(query) : { status: 405 };
         }
+        if (segments.length === 3 && segments[1] === 'inbox' && segments[2] === 'visit') {
+            return method === 'POST' ? this.visit(query) : { status: 405 };
+        }
         if (segments.length === 2 && segments[1] === 'lookup') {
             return method === 'POST' ? this.lookup(body) : { status: 405 };
         }
@@ -4343,6 +4781,12 @@ class NhAssistantMockProposals {
             .reverse();
         return items.length === 0 ? null : items;
     }
+    /** The proposals of a run the caller may see, in the order the scenario lists them. */
+    ofRun(runId) {
+        return this.visible()
+            .filter(item => item.proposal.runId === runId)
+            .map(item => item.proposal);
+    }
     /** The pending proposals on a subject with the caller's right to decide each, earliest expiry first. */
     openOfSubject(subjectType, subjectId) {
         return this.visible()
@@ -4372,19 +4816,49 @@ class NhAssistantMockProposals {
         }
         const agentId = query.get('agentId');
         const runId = query.get('runId');
+        const divisionId = query.get('divisionId');
+        if (divisionId !== null && !guid.test(divisionId)) {
+            return { status: 400 };
+        }
+        const grouped = query.get('grouped') === 'true';
         const items = this.visible()
             .filter(item => item.proposal.status === 'pending' && item.canDecide)
+            .filter(item => divisionId === null || sameGuid(item.divisionId, divisionId))
             .map(item => item.proposal)
             .filter(proposal => (subjectType === null || proposal.subjectType === subjectType)
             && (agentId === null || proposal.agentId === agentId)
             && (runId === null || proposal.runId === runId))
             .sort((left, right) => left.expiresAt.localeCompare(right.expiresAt) || left.approvalId.localeCompare(right.approvalId));
+        const ordered = grouped ? groupedOrder(items) : items;
+        const offset = (page - 1) * itemsPerPage;
+        const pageItems = ordered.slice(offset, offset + itemsPerPage);
+        const scopeKey = scopeKeyOf(divisionId);
+        const lastVisitedAt = this.visits.get(scopeKey) ?? null;
         const body = {
-            items: items.slice((page - 1) * itemsPerPage, page * itemsPerPage),
-            total: items.length
+            items: pageItems,
+            total: items.length,
+            scopeKey,
+            lastVisitedAt,
+            newApprovalIds: pageItems
+                .filter(proposal => lastVisitedAt === null || Date.parse(proposal.createdAt) > Date.parse(lastVisitedAt))
+                .map(proposal => proposal.approvalId),
+            groups: grouped ? groupsOf(ordered, offset, pageItems.length) : null
         };
         return { status: 200, body };
     }
+    /** `POST approvals/inbox/visit`: the whole inbox, or that of a division the caller works in. */
+    visit(query) {
+        const divisionId = query.get('divisionId');
+        if (divisionId !== null && !guid.test(divisionId)) {
+            return { status: 400 };
+        }
+        if (divisionId !== null && !this.mayWorkIn(divisionId)) {
+            return mockFailure('assistant-subject-not-found');
+        }
+        const body = { scopeKey: scopeKeyOf(divisionId), visitedAt: this.now() };
+        this.visits.set(body.scopeKey, body.visitedAt);
+        return { status: 200, body };
+    }
     read(approvalId) {
         const stored = this.find(approvalId);
         return stored ? { status: 200, body: this.withRight(stored) } : mockFailure('assistant-approval-not-found');
@@ -4472,6 +4946,99 @@ class NhAssistantMockProposals {
         };
     }
 }
+/** The scope of the inbox's visits: `global`, or the scope key of a division. */
+function scopeKeyOf(divisionId) {
+    return divisionId === null ? 'global' : `division:${divisionId.replaceAll('-', '').toLowerCase()}`;
+}
+function sameGuid(left, right) {
+    return left !== null && left.replaceAll('-', '').toLowerCase() === right.replaceAll('-', '').toLowerCase();
+}
+/** The group a proposal belongs to: its parent, or its own subject without one. */
+function groupKeyOf(proposal) {
+    return proposal.parent
+        ? `${proposal.parent.subjectType}|${proposal.parent.subjectId}`
+        : `${proposal.subjectType}|${proposal.subjectId}`;
+}
+function subjectKeyOf(proposal) {
+    return `${groupKeyOf(proposal)}|${proposal.subjectType}|${proposal.subjectId}`;
+}
+function firstExpiries(items, key) {
+    const first = new Map();
+    for (const proposal of items) {
+        const current = first.get(key(proposal));
+        if (current === undefined || proposal.expiresAt < current) {
+            first.set(key(proposal), proposal.expiresAt);
+        }
+    }
+    return first;
+}
+/**
+ * The order of the grouped inbox, as the server sorts: groups by their first expiry, a group's own
+ * subject first, then its other subjects by their first expiry, one run's proposals together, then by
+ * expiry.
+ */
+function groupedOrder(items) {
+    const groups = firstExpiries(items, groupKeyOf);
+    const subjects = firstExpiries(items, subjectKeyOf);
+    const compare = (left, right) => (left < right ? -1 : left > right ? 1 : 0);
+    return [...items].sort((left, right) => compare(groups.get(groupKeyOf(left)), groups.get(groupKeyOf(right)))
+        || compare(groupKeyOf(left), groupKeyOf(right))
+        || (left.parent ? 1 : 0) - (right.parent ? 1 : 0)
+        || compare(subjects.get(subjectKeyOf(left)), subjects.get(subjectKeyOf(right)))
+        || compare(subjectKeyOf(left), subjectKeyOf(right))
+        || (left.runId === null ? 1 : 0) - (right.runId === null ? 1 : 0)
+        || compare(left.runId ?? '', right.runId ?? '')
+        || compare(left.expiresAt, right.expiresAt)
+        || compare(left.approvalId, right.approvalId));
+}
+/** The groups of the page `ordered[offset, offset + count)`, with their totals and continuation. */
+function groupsOf(ordered, offset, count) {
+    const page = ordered.slice(offset, offset + count);
+    const previous = offset > 0 ? ordered[offset - 1] : undefined;
+    const next = ordered[offset + count];
+    const groups = [];
+    for (let index = 0; index < page.length;) {
+        const key = groupKeyOf(page[index]);
+        let end = index;
+        while (end < page.length && groupKeyOf(page[end]) === key) {
+            end++;
+        }
+        const members = page.slice(index, end);
+        const own = members.find(proposal => !proposal.parent);
+        const parent = members.find(proposal => proposal.parent)?.parent ?? null;
+        const subjects = [];
+        for (let at = 0; at < members.length;) {
+            const subjectKey = subjectKeyOf(members[at]);
+            let stop = at;
+            while (stop < members.length && subjectKeyOf(members[stop]) === subjectKey) {
+                stop++;
+            }
+            subjects.push({
+                subjectType: members[at].subjectType,
+                subjectId: members[at].subjectId,
+                count: stop - at,
+                total: ordered.filter(proposal => subjectKeyOf(proposal) === subjectKey).length,
+                continuesFromPreviousPage: index === 0 && at === 0 && previous !== undefined && subjectKeyOf(previous) === subjectKey,
+                continuesOnNextPage: end === page.length && stop === members.length && next !== undefined && subjectKeyOf(next) === subjectKey
+            });
+            at = stop;
+        }
+        groups.push({
+            subjectType: own?.subjectType ?? parent.subjectType,
+            subjectId: own?.subjectId ?? parent.subjectId,
+            displayName: own ? own.subjectDisplayName : parent.displayName,
+            subjectTypeName: own ? own.subjectTypeName ?? null : parent.subjectTypeName ?? null,
+            subjectLink: own ? own.subjectLink ?? null : parent.subjectLink ?? null,
+            count: members.length,
+            total: ordered.filter(proposal => groupKeyOf(proposal) === key).length,
+            continuesFromPreviousPage: index === 0 && previous !== undefined && groupKeyOf(previous) === key,
+            continuesOnNextPage: end === page.length && next !== undefined && groupKeyOf(next) === key,
+            subjects
+        });
+        index = end;
+    }
+    return groups;
+}
 function validDecision(request) {
     return !!request
         && (request.decision === 'approve' || request.decision === 'reject')
@@ -4539,12 +5106,13 @@ class NhAssistantMockBackend {
             runId: proposal.runId,
             subjectType: proposal.subjectType,
             subjectId: proposal.subjectId
-        }, proposal.agentId));
+        }, proposal.agentId), (divisionId) => this.subjects.describe(mockSystemSubjectType, divisionSubjectId({ id: divisionId, name: '' }), null, this.admin.administers) != null);
         this.subjects = new NhAssistantMockSubjects(this.scenario.subjectTypes, this.scenario.divisions, (type, id) => this.proposals.openOfSubject(type, id));
         this.agentRuns = new NhAssistantMockAgentRuns(this.scenario, this.subjects, {
             agents: () => this.admin.allAgents(),
             administers: () => this.admin.administers,
             threadProposals: conversationId => this.proposals.ofThread(conversationId),
+            runProposals: runId => this.proposals.ofRun(runId),
             workChanged: (change, agentId) => this.publishAgentWork(change, agentId)
         }, () => new Date().toISOString());
         this.boards = new NhAssistantMockBoards(this.scenario, this.subjects, this.agentRuns, {
@@ -4557,6 +5125,7 @@ class NhAssistantMockBackend {
         this.shareTokens = new Map();
         this.activeActors = new Map();
         this.liveSubject = new Subject();
+        this.files = new NhAssistantMockFiles(this.scenario.refuseUpload, this.scenario.scanUpload);
         this.pushEnabled = true;
         this.sequence = 0;
         /** Requests received so far, oldest first. */
@@ -4570,12 +5139,45 @@ class NhAssistantMockBackend {
          * provides it as `NH_ASSISTANT_MCP_AUTHORIZATION_WINDOW`.
          */
         this.authorizationWindow = new NhAssistantMockAuthorizationWindow(flowId => this.admin.authorizeFlow(flowId));
+        /**
+         * An upload implementation (`NH_ASSISTANT_UPLOAD`) that answers `POST conversations/{id}/files` with
+         * the server's checks, after reporting the progress in four steps.
+         */
+        this.upload = async (request) => {
+            const path = this.pathOf(request.url);
+            const file = request.body.get('file');
+            this.requests.push({
+                method: 'POST',
+                path: path ?? request.url,
+                headers: { ...request.headers },
+                body: file instanceof Blob ? { name: file instanceof File ? file.name : null, mediaType: file.type, size: file.size } : undefined
+            });
+            const total = file instanceof Blob ? file.size : 0;
+            for (const share of [0.25, 0.5, 0.75, 1]) {
+                if (request.signal.aborted) {
+                    throw new DOMException('The operation was aborted.', 'AbortError');
+                }
+                await delay(this.scenario.timing?.eventDelayMs ?? 40);
+                request.onProgress(Math.round(total * share), total);
+            }
+            if (request.signal.aborted) {
+                throw new DOMException('The operation was aborted.', 'AbortError');
+            }
+            const segments = path?.split('/').map(segment => decodeURIComponent(segment)) ?? [];
+            if (!this.enabledState() || segments.length !== 3 || segments[0] !== 'conversations' || segments[2] !== 'files') {
+                return this.empty(404);
+            }
+            const conversation = this.conversations.get(segments[1]);
+            if (!conversation) {
+                return this.error('assistant-conversation-not-found');
+            }
+            return this.result(await this.files.upload(conversation.id, this.offersFiles(), this.uploadsOf(conversation.agentId), request.headers, request.body));
+        };
         /** A `fetch` implementation that answers the assistant endpoints below `apiBaseUrl`. */
         this.fetch = async (input, init) => {
             const method = (init.method ?? 'GET').toUpperCase();
             const url = new URL(input, 'http://mock.local');
-            const base = new URL(this.config.apiBaseUrl.replace(/\/+$/, ''), 'http://mock.local').pathname;
-            const path = url.pathname.startsWith(`${base}/`) ? url.pathname.slice(base.length + 1) : null;
+            const path = this.pathOf(input);
             const body = typeof init.body === 'string' && init.body.length > 0 ? JSON.parse(init.body) : undefined;
             this.requests.push({ method, path: path ?? url.pathname, headers: { ...init.headers }, body });
             if (init.signal?.aborted) {
@@ -4654,6 +5256,10 @@ class NhAssistantMockBackend {
     setMcpConnectionStatus(serverId, status) {
         this.admin.setMcpConnectionStatus(serverId, status);
     }
+    /** The files people uploaded, oldest first, as the application's file source stored them. */
+    get uploads() {
+        return this.files.uploads;
+    }
     route(method, path, query, body, language = null) {
         const segments = path.split('/').map(segment => decodeURIComponent(segment));
         if (method === 'GET' && path === 'status') {
@@ -4831,6 +5437,12 @@ class NhAssistantMockBackend {
         if (text.length === 0 || text.length > limit || !request.clientMessageId) {
             return this.empty(400);
         }
+        // Like the server: the attachments are checked before the turn claims the conversation.
+        const uploads = this.uploadsOf(conversation.agentId);
+        const filesCode = this.files.checkMessage(request.files, this.offersFiles(), uploads?.maxFiles ?? 5);
+        if (filesCode) {
+            return this.error(filesCode);
+        }
         if (!acceptsMessage(conversation.status)) {
             return this.empty(409);
         }
@@ -4840,6 +5452,14 @@ class NhAssistantMockBackend {
         const turn = this.findTurn(text, conversation.agentId, pageContext);
         const userMessageId = this.nextId();
         const assistantMessageId = this.nextId();
+        const files = request.files ?? [];
+        // The turn opens the attachments with the sender's rights; it ends with the first refusal and the
+        // message keeps only what the model read.
+        const refusal = files.length === 0 ? null : uploads ? this.files.openCode(conversation.id, files) : 'assistant-files-not-accepted';
+        const parts = [
+            { type: 'text', text },
+            ...(refusal ? [] : files.map(file => ({ type: 'file', name: file.name, mediaType: file.mediaType, size: file.size })))
+        ];
         this.activeActors.set(conversation.id, this.currentUser.actorId);
         this.update(conversation.id, current => ({
             ...current,
@@ -4847,14 +5467,17 @@ class NhAssistantMockBackend {
             status: 'running',
             messages: [
                 ...current.messages,
-                { id: userMessageId, role: 'user', createdAt: new Date().toISOString(), parts: [{ type: 'text', text }], authorActorId: this.currentUser.actorId }
+                { id: userMessageId, role: 'user', createdAt: new Date().toISOString(), parts, authorActorId: this.currentUser.actorId }
             ]
         }));
         // The sender has read their own message.
         this.readPositions.set(conversation.id, lastSequence(this.conversations.get(conversation.id)));
         return this.stream(conversation.id, async (emit) => {
             await emit({ type: 'turn.started', data: { turnId: this.nextId(), userMessageId, assistantMessageId } });
-            await this.playSteps(conversation.id, assistantMessageId, turn?.steps ?? [], emit);
+            const steps = refusal
+                ? [{ error: { code: refusal, messageKey: `nh-assistant.errors.${refusal}` } }]
+                : turn?.steps ?? [];
+            await this.playSteps(conversation.id, assistantMessageId, steps, emit);
         });
     }
     decide(conversation, approvalId, request) {
@@ -5218,6 +5841,22 @@ class NhAssistantMockBackend {
     error(code) {
         return this.result(mockFailure(code));
     }
+    /** The path below `apiBaseUrl`, or `null` for another URL. */
+    pathOf(input) {
+        const url = new URL(input, 'http://mock.local');
+        const base = new URL(this.config.apiBaseUrl.replace(/\/+$/, ''), 'http://mock.local').pathname;
+        return url.pathname.startsWith(`${base}/`) ? url.pathname.slice(base.length + 1) : null;
+    }
+    /** Whether the application keeps files for the assistant: an agent of the scenario takes uploads. */
+    offersFiles() {
+        return this.scenario.agents.some(agent => !!agent.uploads);
+    }
+    /** What people may attach to a message to the agent, as its summary says. */
+    uploadsOf(agentId) {
+        return this.admin.chatAgents().find(agent => agent.id === agentId)?.uploads
+            ?? this.scenario.agents.find(agent => agent.id === agentId)?.uploads
+            ?? null;
+    }
     /**
      * Whether the caller decides the agent's proposals of the whole application: an approver of the whole
      * application (an administrator in the mock) who passes the agent's view policy, by default its
@@ -5381,15 +6020,16 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.34", ngImpo
  * Replaces the assistant transport with an in-memory back-end that plays `script`.
  * Register it after `provideNhAssistant(...)` in the same injector. Every client feature
  * (status, agents, conversations, streamed turns, approvals, cancellation, sharing, read
- * state, live updates and MCP authorizations) then works without a server. Inject
- * `NhAssistantMockBackend` to switch the feature flag, simulate a colleague or inspect the
- * received requests.
+ * state, live updates, uploads with their progress and MCP authorizations) then works without a
+ * server. Inject `NhAssistantMockBackend` to switch the feature flag, simulate a colleague or
+ * inspect the received requests and uploads.
  */
 function provideNhAssistantMockApi(script) {
     return makeEnvironmentProviders([
         { provide: NH_ASSISTANT_MOCK_SCENARIO, useValue: script },
         NhAssistantMockBackend,
         { provide: NH_ASSISTANT_FETCH, useFactory: () => inject(NhAssistantMockBackend).fetch },
+        { provide: NH_ASSISTANT_UPLOAD, useFactory: () => inject(NhAssistantMockBackend).upload },
         { provide: NhAssistantLiveService, useClass: NhAssistantMockLiveService },
         { provide: NH_ASSISTANT_MCP_AUTHORIZATION_WINDOW, useFactory: () => inject(NhAssistantMockBackend).authorizationWindow }
     ]);