librechat-data-provider 0.8.509 → 0.8.521

package/dist/{data-service-XTxx76uB.js → data-service-DOIF4BkW.js}

@@ -189,6 +189,9 @@ const feedbackSchema = zod.z.object({
 	rating: feedbackRatingSchema,
 	tag: feedbackTagKeySchema,
 	text: zod.z.string().max(1024).optional()
+}).refine(({ rating, tag }) => FEEDBACK_TAGS.some((feedbackTag) => feedbackTag.key === tag && feedbackTag.direction === rating), {
+	message: "Feedback tag does not match rating",
+	path: ["tag"]
 });
 function toMinimalFeedback(feedback) {
 	if (!feedback?.rating || !feedback?.tag || !feedback.tag.key) return;
@@ -484,6 +487,7 @@ let ReasoningEffort = /* @__PURE__ */ function(ReasoningEffort) {
 	ReasoningEffort["medium"] = "medium";
 	ReasoningEffort["high"] = "high";
 	ReasoningEffort["xhigh"] = "xhigh";
+	ReasoningEffort["max"] = "max";
 	return ReasoningEffort;
 }({});
 let ReasoningParameterFormat = /* @__PURE__ */ function(ReasoningParameterFormat) {
@@ -550,6 +554,21 @@ let ThinkingLevel = /* @__PURE__ */ function(ThinkingLevel) {
 	ThinkingLevel["high"] = "high";
 	return ThinkingLevel;
 }({});
+/** OpenAI Responses API `reasoning.mode` (GPT-5.6+). */
+let ReasoningMode = /* @__PURE__ */ function(ReasoningMode) {
+	ReasoningMode["unset"] = "";
+	ReasoningMode["standard"] = "standard";
+	ReasoningMode["pro"] = "pro";
+	return ReasoningMode;
+}({});
+/** OpenAI Responses API `reasoning.context` (GPT-5.6+). */
+let ReasoningContext = /* @__PURE__ */ function(ReasoningContext) {
+	ReasoningContext["unset"] = "";
+	ReasoningContext["auto"] = "auto";
+	ReasoningContext["current_turn"] = "current_turn";
+	ReasoningContext["all_turns"] = "all_turns";
+	return ReasoningContext;
+}({});
 const imageDetailNumeric = {
 	["low"]: 0,
 	["auto"]: 1,
@@ -569,6 +588,8 @@ const eThinkingDisplaySchema = zod.z.nativeEnum(ThinkingDisplay);
 const eReasoningSummarySchema = zod.z.nativeEnum(ReasoningSummary);
 const eVerbositySchema = zod.z.nativeEnum(Verbosity);
 const eThinkingLevelSchema = zod.z.nativeEnum(ThinkingLevel);
+const eReasoningModeSchema = zod.z.nativeEnum(ReasoningMode);
+const eReasoningContextSchema = zod.z.nativeEnum(ReasoningContext);
 const defaultAssistantFormValues = {
 	assistant: "",
 	id: "",
@@ -600,6 +621,7 @@ const defaultAgentFormValues = {
 	["execute_code"]: false,
 	["file_search"]: false,
 	["web_search"]: false,
+	["memory"]: false,
 	category: "general",
 	support_contact: {
 		name: "",
@@ -612,7 +634,9 @@ const defaultAgentFormValues = {
 	*  (full catalog unless `skills` narrows it). Anything else = inactive. */
 	skills_enabled: void 0,
 	/** `undefined` = feature disabled by default (no subagent tool injected). */
-	subagents: void 0
+	subagents: void 0,
+	/** Memory partition: 'agent' isolates memories per (user, agent); default shared pool */
+	memory_scope: void 0
 };
 const ImageVisionTool = {
 	type: "function",
@@ -732,6 +756,7 @@ const CLAUDE_4_64K_MAX_OUTPUT = 64e3;
 const CLAUDE_32K_MAX_OUTPUT = 32e3;
 const DEFAULT_MAX_OUTPUT = 8192;
 const LEGACY_ANTHROPIC_MAX_OUTPUT = 4096;
+const CLAUDE_SONNET_128K_OUTPUT_PATTERN = /claude-sonnet[-.]?(?:4[-.]?(?:[6-9]|\d{2})|[5-9]|\d{2,})(?=$|[^0-9])/;
 /**
 * Claude "Mythos-class" model families — new top-level classes (peers of
 * `opus`/`sonnet`/`haiku`) that ship with the post-Opus-4.7 modern profile:
@@ -775,6 +800,7 @@ const anthropicSettings = {
 		reset: (modelName) => {
 			if (isMythosClassModel(modelName)) return ANTHROPIC_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:4[-.]?(?:[6-9]|\d{2,})|[5-9]|\d{2,})/.test(modelName)) return ANTHROPIC_MAX_OUTPUT;
+			if (CLAUDE_SONNET_128K_OUTPUT_PATTERN.test(modelName)) return ANTHROPIC_MAX_OUTPUT;
 			if (/claude-(?:sonnet|haiku)[-.]?[4-9]/.test(modelName)) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:[5-9]|4[-.]?([5-9]|\d{2,}))/.test(modelName)) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?[4-9]/.test(modelName)) return CLAUDE_32K_MAX_OUTPUT;
@@ -789,6 +815,10 @@ const anthropicSettings = {
 				if (value > ANTHROPIC_MAX_OUTPUT) return ANTHROPIC_MAX_OUTPUT;
 				return value;
 			}
+			if (CLAUDE_SONNET_128K_OUTPUT_PATTERN.test(modelName)) {
+				if (value > ANTHROPIC_MAX_OUTPUT) return ANTHROPIC_MAX_OUTPUT;
+				return value;
+			}
 			if (/claude-(?:sonnet|haiku)[-.]?[4-9]/.test(modelName) && value > CLAUDE_4_64K_MAX_OUTPUT) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:[5-9]|4[-.]?([5-9]|\d{2,}))/.test(modelName)) {
 				if (value > CLAUDE_4_64K_MAX_OUTPUT) return CLAUDE_4_64K_MAX_OUTPUT;
@@ -967,6 +997,16 @@ const tMessageSchema = zod.z.object({
 	*/
 	quotes: zod.z.array(zod.z.string()).optional()
 });
+/**
+* Which memory partition an agent reads/writes.
+* `user` = the shared personal pool (default); `agent` = a partition
+* isolated per (user, agent) so the agent only sees its own memories.
+*/
+let MemoryScope = /* @__PURE__ */ function(MemoryScope) {
+	MemoryScope["user"] = "user";
+	MemoryScope["agent"] = "agent";
+	return MemoryScope;
+}({});
 const coerceNumber = zod.z.union([zod.z.number(), zod.z.string()]).transform((val) => {
 	if (typeof val === "string") return val.trim() === "" ? void 0 : parseFloat(val);
 	return val;
@@ -985,6 +1025,8 @@ const tConversationSchema = zod.z.object({
 	endpointType: eModelEndpointSchema.nullable().optional(),
 	isArchived: zod.z.boolean().optional(),
 	pinned: zod.z.boolean().optional(),
+	/** Server-derived: an active shared link exists for this conversation. Not persisted. */
+	isShared: zod.z.boolean().optional(),
 	title: zod.z.string().nullable().or(zod.z.literal("New Chat")).default("New Chat"),
 	user: zod.z.string().optional(),
 	messages: zod.z.array(zod.z.string()).optional(),
@@ -1022,6 +1064,8 @@ const tConversationSchema = zod.z.object({
 	imageDetail: eImageDetailSchema.optional(),
 	reasoning_effort: eReasoningEffortSchema.optional().nullable(),
 	reasoning_summary: eReasoningSummarySchema.optional().nullable(),
+	reasoning_mode: eReasoningModeSchema.optional().nullable(),
+	reasoning_context: eReasoningContextSchema.optional().nullable(),
 	verbosity: eVerbositySchema.optional().nullable(),
 	useResponsesApi: zod.z.boolean().optional(),
 	effort: eAnthropicEffortSchema.optional().nullable(),
@@ -1113,6 +1157,10 @@ const tQueryParamsSchema = tConversationSchema.pick({
 	/** @endpoints openAI, custom, azureOpenAI */
 	reasoning_summary: true,
 	/** @endpoints openAI, custom, azureOpenAI */
+	reasoning_mode: true,
+	/** @endpoints openAI, custom, azureOpenAI */
+	reasoning_context: true,
+	/** @endpoints openAI, custom, azureOpenAI */
 	verbosity: true,
 	/** @endpoints openAI, custom, azureOpenAI */
 	useResponsesApi: true,
@@ -1368,6 +1416,8 @@ const openAIBaseSchema = tConversationSchema.pick({
 	max_tokens: true,
 	reasoning_effort: true,
 	reasoning_summary: true,
+	reasoning_mode: true,
+	reasoning_context: true,
 	verbosity: true,
 	useResponsesApi: true,
 	web_search: true,
@@ -1816,12 +1866,17 @@ const tModelSpecSchema = zod.z.object({
 	showIconInHeader: zod.z.boolean().optional(),
 	showOnLanding: zod.z.boolean().optional(),
 	conversation_starters: zod.z.array(zod.z.string()).optional(),
+	showInMenu: zod.z.boolean().optional(),
 	iconURL: zod.z.union([zod.z.string(), eModelEndpointSchema]).optional(),
 	authType: authTypeSchema.optional(),
 	hideBadgeRow: zod.z.boolean().optional(),
 	webSearch: zod.z.boolean().optional(),
 	fileSearch: zod.z.boolean().optional(),
 	executeCode: zod.z.boolean().optional(),
+	memory: zod.z.boolean().optional(),
+	askUserQuestion: zod.z.boolean().optional(),
+	runInBackground: zod.z.union([zod.z.boolean(), zod.z.array(zod.z.string())]).optional(),
+	describeIntent: zod.z.union([zod.z.boolean(), zod.z.array(zod.z.string())]).optional(),
 	artifacts: zod.z.union([zod.z.string(), zod.z.boolean()]).optional(),
 	mcpServers: zod.z.array(zod.z.string()).optional(),
 	skills: zod.z.union([zod.z.boolean(), zod.z.array(zod.z.string())]).optional(),
@@ -1903,6 +1958,7 @@ const fullMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -1933,6 +1989,7 @@ const fullMimeTypesList = [
 	"application/vnd.oasis.opendocument.graphics",
 	"image/svg",
 	"image/svg+xml",
+	"message/rfc822",
 	"video/mp4",
 	"video/avi",
 	"video/mov",
@@ -1966,6 +2023,7 @@ const codeInterpreterMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -1998,6 +2056,7 @@ const retrievalMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -2019,11 +2078,34 @@ const bedrockDocumentFormats = {
 	"text/markdown": "md"
 };
 const isBedrockDocumentType = (mimeType) => mimeType != null && mimeType in bedrockDocumentFormats;
+/** MIME types Bedrock's Converse document path can send to the model (mirrors `bedrockDocumentFormats`). */
+const bedrockDocumentMimeTypes = Object.keys(bedrockDocumentFormats);
 /** File extensions accepted by Bedrock document uploads (for input accept attributes) */
 const bedrockDocumentExtensions = ".pdf,.csv,.doc,.docx,.xls,.xlsx,.html,.htm,.txt,.md,application/pdf,text/csv,application/csv,application/msword,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.ms-excel,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,text/html,text/plain,text/markdown";
+/** Textual `application/*` MIME types that can be decoded and sent as plain text */
+const textualApplicationTypes = new Set([
+	"application/json",
+	"application/xml",
+	"application/yaml",
+	"application/sql",
+	"application/typescript",
+	"application/x-sh",
+	"application/csv"
+]);
+/**
+* MIME types the Anthropic Messages API accepts as a plain-text document source
+* (`source.type: 'text'`)
+*/
+const isAnthropicTextDocumentType = (mimeType) => mimeType != null && (mimeType.startsWith("text/") || textualApplicationTypes.has(mimeType));
+/**
+* MIME types the Anthropic Messages API document path can send to the model
+* (mirrors `isBedrockDocumentType`): PDF via base64, textual types via a
+* plain-text document source. All other types are rejected with a provider 400.
+*/
+const isAnthropicDocumentType = (mimeType) => mimeType === "application/pdf" || isAnthropicTextDocumentType(mimeType);
 const excelMimeTypes = /^application\/(vnd\.ms-excel|msexcel|x-msexcel|x-ms-excel|x-excel|x-dos_ms_excel|xls|x-xls|vnd\.openxmlformats-officedocument\.spreadsheetml\.sheet)$/;
 const textMimeTypes = /^(text\/(x-c|x-csharp|tab-separated-values|x-c\+\+|x-h|x-java|html|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|css|vtt|javascript|csv|xml|calendar))$/;
-const applicationMimeTypes = /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|x-zip-compressed|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
+const applicationMimeTypes = /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|x-zip-compressed|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.(presentation|template)|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
 const imageMimeTypes = /^image\/(jpeg|gif|png|webp|heic|heif)$/;
 const audioMimeTypes = /^audio\/(mp3|mpeg|mpeg3|wav|wave|x-wav|ogg|vorbis|mp4|m4a|x-m4a|flac|x-flac|webm|aac|wma|opus)$/;
 const videoMimeTypes = /^video\/(mp4|avi|mov|wmv|flv|webm|mkv|m4v|3gp|ogv)$/;
@@ -2032,6 +2114,7 @@ const defaultOCRMimeTypes = [
 	excelMimeTypes,
 	/^application\/pdf$/,
 	/^application\/vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation)$/,
+	/^application\/vnd\.openxmlformats-officedocument\.presentationml\.template$/,
 	/^application\/vnd\.ms-(word|powerpoint)$/,
 	/^application\/epub\+zip$/,
 	/^application\/vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)$/
@@ -2053,7 +2136,8 @@ const supportedMimeTypes = [
 	imageMimeTypes,
 	videoMimeTypes,
 	audioMimeTypes,
-	/^image\/(svg|svg\+xml)$/
+	/^image\/(svg|svg\+xml)$/,
+	/^message\/rfc822$/
 ];
 const codeInterpreterMimeTypes = [
 	textMimeTypes,
@@ -2108,6 +2192,7 @@ const codeTypeMapping = {
 	cljs: "text/plain",
 	cljc: "text/plain",
 	elm: "text/plain",
+	eml: "message/rfc822",
 	erl: "text/plain",
 	hrl: "text/plain",
 	ex: "text/plain",
@@ -2179,6 +2264,13 @@ const codeTypeMapping = {
 	ods: "application/vnd.oasis.opendocument.spreadsheet",
 	odp: "application/vnd.oasis.opendocument.presentation",
 	odg: "application/vnd.oasis.opendocument.graphics",
+	doc: "application/msword",
+	docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+	xls: "application/vnd.ms-excel",
+	xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+	ppt: "application/vnd.ms-powerpoint",
+	pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	potx: "application/vnd.openxmlformats-officedocument.presentationml.template",
 	ics: "text/calendar",
 	ical: "text/calendar",
 	ifb: "text/calendar",
@@ -2193,7 +2285,11 @@ const imageTypeMapping = {
 const mimeTypeAliases = {
 	"application/x-zip-compressed": "application/zip",
 	"text/x-python-script": "text/x-python",
-	"text/x-markdown": "text/markdown"
+	"text/x-markdown": "text/markdown",
+	/** freedesktop shared-mime-info (Chrome on Linux) */
+	"application/x-shellscript": "application/x-sh",
+	/** libmagic, i.e. `file --mime-type` */
+	"text/x-shellscript": "application/x-sh"
 };
 /**
 * Infers the MIME type from a file's extension when the browser doesn't recognize it,
@@ -2207,7 +2303,7 @@ function inferMimeType(fileName, currentType) {
 	const extension = fileName.split(".").pop()?.toLowerCase() ?? "";
 	return codeTypeMapping[extension] || imageTypeMapping[extension] || currentType;
 }
-const retrievalMimeTypes = [/^(text\/(x-c|x-c\+\+|x-h|html|x-java|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|vtt|xml))$/, /^(application\/(json|pdf|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation)))$/];
+const retrievalMimeTypes = [/^(text\/(x-c|x-c\+\+|x-h|html|x-java|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|vtt|xml))$/, /^(application\/(json|pdf|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.(presentation|template))))$/];
 const megabyte = 1024 * 1024;
 /** Helper function to get megabytes value */
 const mbToBytes = (mb) => mb * megabyte;
@@ -2286,21 +2382,212 @@ const fileConfigSchema = zod.z.object({
 	ocr: zod.z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional(),
 	text: zod.z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional()
 });
-/** Helper function to safely convert string patterns to RegExp objects */
-const convertStringsToRegex = (patterns) => patterns.reduce((acc, pattern) => {
-	try {
-		const regex = new RegExp(pattern);
-		acc.push(regex);
-	} catch (error) {
-		console.error(`Invalid regex pattern "${pattern}" skipped.`, error);
+/**
+* Compiler for admin-supplied MIME patterns. Defaults to native `RegExp`, which browser
+* builds keep so no extra dependency is bundled. The server swaps in a linear-time engine
+* via `setFileConfigRegexCompiler` so an admin-authored catastrophic-backtracking pattern
+* cannot ReDoS the shared event loop when tested against an uploaded file's MIME type.
+*/
+let compileMimeRegex = (pattern) => new RegExp(pattern);
+/** Override the MIME-pattern compiler; the server injects a linear-time engine at startup. */
+const setFileConfigRegexCompiler = (compile) => {
+	compileMimeRegex = compile;
+};
+/** Returned when every configured pattern fails to compile, so consumers that read an empty
+*  allowlist as "no restriction" fail closed instead of allowing every file. */
+const rejectAllMimeMatcher = { test: () => false };
+/** Helper function to safely convert string patterns to matcher objects */
+const convertStringsToRegex = (patterns) => {
+	const compiled = patterns.reduce((acc, pattern) => {
+		try {
+			acc.push(compileMimeRegex(pattern));
+		} catch (error) {
+			console.error(`Invalid regex pattern "${pattern}" skipped.`, error);
+		}
+		return acc;
+	}, []);
+	if (patterns.length > 0 && compiled.length === 0) {
+		console.error(`All ${patterns.length} MIME type pattern(s) were invalid and skipped; the resulting allowlist rejects every file.`);
+		return [rejectAllMimeMatcher];
 	}
-	return acc;
-}, []);
+	return compiled;
+};
 /** Detects whether the given MIME type patterns accept all file types (e.g., `.*` or `.+`). */
 const isPermissiveMimeConfig = (types) => {
 	if (!types || types.length === 0) return false;
 	return types.some((regex) => regex.test("x-librechat/x-probe"));
 };
+/** Media categories that collapse to a wildcard `accept` token when any member type is allowed. */
+const mimeAcceptCategories = [
+	{
+		/** Mirrors `imageMimeTypes` (+ the code-interpreter svg variants) so every accepted type is known. */
+		category: "image",
+		token: "image/*",
+		samples: [
+			"image/jpeg",
+			"image/gif",
+			"image/png",
+			"image/webp",
+			"image/heic",
+			"image/heif",
+			"image/svg",
+			"image/svg+xml"
+		],
+		extras: [".heif", ".heic"]
+	},
+	{
+		/** Mirrors `audioMimeTypes`. */
+		category: "audio",
+		token: "audio/*",
+		samples: [
+			"audio/mp3",
+			"audio/mpeg",
+			"audio/mpeg3",
+			"audio/wav",
+			"audio/wave",
+			"audio/x-wav",
+			"audio/ogg",
+			"audio/vorbis",
+			"audio/mp4",
+			"audio/m4a",
+			"audio/x-m4a",
+			"audio/flac",
+			"audio/x-flac",
+			"audio/webm",
+			"audio/aac",
+			"audio/wma",
+			"audio/opus"
+		]
+	},
+	{
+		/** Mirrors `videoMimeTypes`. */
+		category: "video",
+		token: "video/*",
+		samples: [
+			"video/mp4",
+			"video/avi",
+			"video/mov",
+			"video/wmv",
+			"video/flv",
+			"video/webm",
+			"video/mkv",
+			"video/m4v",
+			"video/3gp",
+			"video/ogv"
+		]
+	}
+];
+/** Document/text MIME types paired with the extension(s) browsers filter on in the file picker. */
+const documentMimeExtensions = [
+	["application/pdf", [".pdf"]],
+	["application/msword", [".doc"]],
+	["application/vnd.openxmlformats-officedocument.wordprocessingml.document", [".docx"]],
+	["application/vnd.ms-excel", [".xls"]],
+	["application/msexcel", [".xls"]],
+	["application/x-msexcel", [".xls"]],
+	["application/x-ms-excel", [".xls"]],
+	["application/x-excel", [".xls"]],
+	["application/x-dos_ms_excel", [".xls"]],
+	["application/xls", [".xls"]],
+	["application/x-xls", [".xls"]],
+	["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", [".xlsx"]],
+	["application/vnd.ms-powerpoint", [".ppt"]],
+	["application/vnd.openxmlformats-officedocument.presentationml.presentation", [".pptx"]],
+	["application/vnd.openxmlformats-officedocument.presentationml.template", [".potx"]],
+	["application/vnd.oasis.opendocument.text", [".odt"]],
+	["application/vnd.oasis.opendocument.spreadsheet", [".ods"]],
+	["application/vnd.oasis.opendocument.presentation", [".odp"]],
+	["application/vnd.oasis.opendocument.graphics", [".odg"]],
+	["application/rtf", [".rtf"]],
+	["application/json", [".json"]],
+	["application/xml", [".xml"]],
+	["application/yaml", [".yaml", ".yml"]],
+	["application/zip", [".zip"]],
+	["application/x-zip-compressed", [".zip"]],
+	["application/epub+zip", [".epub"]],
+	["application/x-parquet", [".parquet"]],
+	["application/vnd.apache.parquet", [".parquet"]],
+	["text/csv", [".csv"]],
+	["application/csv", [".csv"]],
+	["text/tab-separated-values", [".tsv"]],
+	["text/plain", [".txt"]],
+	["text/markdown", [".md"]],
+	["text/html", [".html", ".htm"]],
+	["text/calendar", [".ics"]],
+	["message/rfc822", [".eml"]]
+];
+const documentMimeSet = new Set(documentMimeExtensions.map(([mimeType]) => mimeType));
+/** Every MIME type LibreChat may accept, used to detect patterns that reach beyond the representable set. */
+const knownMimeUniverse = Array.from(new Set([
+	...fullMimeTypesList,
+	...documentMimeExtensions.map(([mimeType]) => mimeType),
+	...mimeAcceptCategories.flatMap((category) => category.samples)
+]));
+const categoryOf = (mimeType) => {
+	if (mimeType.startsWith("image/")) return "image";
+	if (mimeType.startsWith("audio/")) return "audio";
+	if (mimeType.startsWith("video/")) return "video";
+	return "document";
+};
+/** Media types are covered by their `<cat>/*` wildcard token; document types need an explicit entry. */
+const isRepresentable = (mimeType) => categoryOf(mimeType) !== "document" || documentMimeSet.has(mimeType);
+/**
+* Translates a finite MIME allowlist into a file-input `accept` string, intersected with what the
+* provider upload path can actually send. Returns `undefined` (keep the provider filter) when a
+* configured pattern matches a supported, path-handleable type that cannot be represented, so the
+* picker never hides a file the path would have accepted.
+*/
+const buildMimeAccept = (types, { categories, documentMimeTypes }) => {
+	const permittedSet = new Set(categories);
+	const documentAllowSet = documentMimeTypes ? new Set(documentMimeTypes) : null;
+	const emittedMedia = /* @__PURE__ */ new Set();
+	const emittedDocuments = /* @__PURE__ */ new Set();
+	if (!types.every((regex) => knownMimeUniverse.some((mimeType) => regex.test(mimeType)))) return;
+	for (const regex of types) for (const mimeType of knownMimeUniverse) {
+		if (!regex.test(mimeType)) continue;
+		const category = categoryOf(mimeType);
+		if (!permittedSet.has(category)) continue;
+		/** The path handles documents but drops this specific type (e.g. Bedrock ignores pptx/ODF). */
+		if (category === "document" && documentAllowSet && !documentAllowSet.has(mimeType)) continue;
+		if (!isRepresentable(mimeType)) return;
+		if (category === "document") emittedDocuments.add(mimeType);
+		else emittedMedia.add(category);
+	}
+	const tokens = [];
+	const seen = /* @__PURE__ */ new Set();
+	const push = (token) => {
+		if (!seen.has(token)) {
+			seen.add(token);
+			tokens.push(token);
+		}
+	};
+	for (const category of mimeAcceptCategories) if (emittedMedia.has(category.category)) {
+		push(category.token);
+		category.extras?.forEach(push);
+	}
+	for (const [mimeType, extensions] of documentMimeExtensions) if (emittedDocuments.has(mimeType)) {
+		extensions.forEach(push);
+		push(mimeType);
+	}
+	return tokens.length > 0 ? tokens.join(",") : void 0;
+};
+/**
+* Resolves the file-input `accept` value for a configured `supportedMimeTypes` allowlist, scoped to
+* what the current upload path (`capability`) can send to the model.
+* - `undefined` for the built-in default or a config that can't be represented safely, so callers
+*   keep their provider-specific filter.
+* - `''` for permissive configs (e.g. `.*`), leaving the picker unrestricted.
+* - a translated `accept` string for a recognized finite allowlist (images, PDFs, Office docs, etc.).
+*
+* The picker `accept` is a UX convenience, not a security boundary: the backend still enforces
+* `supportedMimeTypes` on upload.
+*/
+const getConfiguredMimeAccept = (types, capability) => {
+	/** Referential identity with the built-in list signals an unconfigured endpoint (keep provider filter). */
+	if (!types || types.length === 0 || types === supportedMimeTypes) return;
+	if (isPermissiveMimeConfig(types)) return "";
+	return buildMimeAccept(types, capability);
+};
 /**
 * Gets the appropriate endpoint file configuration with standardized lookup logic.
 *
@@ -2470,9 +2757,16 @@ const messagesArtifacts = (messageId) => `${messagesRoot}/artifact/${messageId}`
 const messagesBranch = () => `${messagesRoot}/branch`;
 const shareRoot = `${BASE_URL}/api/share`;
 const shareMessages = (shareId) => `${shareRoot}/${shareId}`;
+const forkSharedMessages = (shareId) => `${shareRoot}/${shareId}/fork`;
 const sharedStartupConfig = (shareId) => `${shareMessages(shareId)}/config`;
 const getSharedLink$1 = (conversationId) => `${shareRoot}/link/${conversationId}`;
-const getSharedLinks = (pageSize, sortBy, sortDirection, search, cursor) => `${shareRoot}?pageSize=${pageSize}&sortBy=${sortBy}&sortDirection=${sortDirection}${search ? `&search=${search}` : ""}${cursor ? `&cursor=${cursor}` : ""}`;
+const getSharedLinks = (pageSize, sortBy, sortDirection, search, cursor) => `${shareRoot}${buildQuery({
+	pageSize,
+	sortBy,
+	sortDirection,
+	search,
+	cursor
+})}`;
 const createSharedLink$1 = (conversationId) => `${shareRoot}/${conversationId}`;
 const updateSharedLink$1 = (shareId) => `${shareRoot}/${shareId}`;
 /** Share-scoped file routes: serve snapshotted files via shared-link permission. */
@@ -2512,7 +2806,6 @@ const presets = () => `${BASE_URL}/api/presets`;
 const deletePreset$1 = () => `${BASE_URL}/api/presets/delete`;
 const aiEndpoints = () => `${BASE_URL}/api/endpoints`;
 const tokenConfig = () => `${BASE_URL}/api/endpoints/token-config`;
-const contextProjection = () => `${BASE_URL}/api/endpoints/context-projection`;
 const models = () => `${BASE_URL}/api/models`;
 const tokenizer = () => `${BASE_URL}/api/tokenizer`;
 const login$1 = () => `${BASE_URL}/api/auth/login`;
@@ -2551,6 +2844,7 @@ const mcpAuthValues = (serverName) => {
 const cancelMCPOAuth$1 = (serverName) => {
 	return `${BASE_URL}/api/mcp/oauth/cancel/${serverName}`;
 };
+const mcpOAuthStatus = (flowId) => `${BASE_URL}/api/mcp/oauth/status/${encodeURIComponent(flowId)}`;
 const mcpOAuthBind = (serverName) => `${BASE_URL}/api/mcp/${serverName}/oauth/bind`;
 const actionOAuthBind = (actionId) => `${BASE_URL}/api/actions/${actionId}/oauth/bind`;
 const config = (context) => `${BASE_URL}/api/config${buildQuery({ context })}`;
@@ -2587,6 +2881,8 @@ const mcpServer = (serverName) => `${BASE_URL}/api/mcp/servers/${serverName}`;
 const revertAgentVersion$1 = (agent_id) => `${agents({ path: `${agent_id}/revert` })}`;
 const files = () => `${BASE_URL}/api/files`;
 const filePreview = (fileId) => `${BASE_URL}/api/files/${encodeURIComponent(fileId)}/preview`;
+/** Owner-scoped usage touch so queued attachments outlive the upload-window TTL. */
+const fileUsage = () => `${BASE_URL}/api/files/usage`;
 const agentFiles = (agentId) => `${BASE_URL}/api/files/agent/${agentId}`;
 const images = () => `${files()}/images`;
 const avatar = () => `${images()}/avatar`;
@@ -2648,6 +2944,11 @@ const adminSkillsSyncStatus = () => `${adminSkillsSync()}/status`;
 const adminSkillsSyncRun = () => `${adminSkillsSync()}/run`;
 const adminSkillsSyncCredential = (credentialKey) => `${adminSkillsSync()}/credentials/${encodeURIComponent(credentialKey)}`;
 const skillStates = () => `${BASE_URL}/api/user/settings/skills/active`;
+const adminLangfuseConnection = () => `${BASE_URL}/api/admin/langfuse/connection`;
+const adminLangfuseConnectionTest = () => `${adminLangfuseConnection()}/test`;
+const adminLangfuseSessionLink = (conversationId) => `${adminLangfuseConnection()}/session/${encodeURIComponent(conversationId)}`;
+const toolFavorites = () => `${BASE_URL}/api/user/settings/favorites/tools`;
+const toolFavorite = (itemType, itemId) => `${toolFavorites()}/${itemType}/${encodeURIComponent(itemId)}`;
 const roles = () => `${BASE_URL}/api/roles`;
 const adminRoles = () => `${BASE_URL}/api/admin/roles`;
 const getRole$1 = (roleName) => `${roles()}/${encodeURIComponent(roleName)}`;
@@ -2672,7 +2973,7 @@ const disableTwoFactor$1 = () => `${BASE_URL}/api/auth/2fa/disable`;
 const regenerateBackupCodes$1 = () => `${BASE_URL}/api/auth/2fa/backup/regenerate`;
 const verifyTwoFactorTemp$1 = () => `${BASE_URL}/api/auth/2fa/verify-temp`;
 const memories = () => `${BASE_URL}/api/memories`;
-const memory = (key) => `${memories()}/${encodeURIComponent(key)}`;
+const memory = (key, agentId) => `${memories()}/${encodeURIComponent(key)}${agentId ? `?agentId=${encodeURIComponent(agentId)}` : ""}`;
 const memoryPreferences = () => `${memories()}/preferences`;
 const searchPrincipals$1 = (params) => {
 	const { q: query, limit, types } = params;
@@ -2955,7 +3256,12 @@ const StdioOptionsSchema = BaseOptionsSchema.extend({
 		"pipe",
 		"ignore",
 		"inherit"
-	]), zod.z.number().int().nonnegative()]).optional()
+	]), zod.z.number().int().nonnegative()]).optional(),
+	/**
+	* Working directory for the spawned process. Supplied by Agent Plugins
+	* packages, which resolve and contain the path before it reaches this schema.
+	*/
+	cwd: zod.z.string().optional()
 });
 const WebSocketOptionsSchema = BaseOptionsSchema.extend({
 	type: zod.z.literal("websocket").default("websocket"),
@@ -3091,6 +3397,9 @@ const defaultSocialLogins = [
 	"saml"
 ];
 const BASE_ONLY_CONFIG_SECTIONS = [];
+/** Sections that may be stored in the tenant's base config document but must
+* not be overridden or tombstoned by role, group, or user config documents. */
+const BASE_PRINCIPAL_CONFIG_SECTIONS = ["langfuse"];
 const defaultRetrievalModels = [
 	"gpt-4o",
 	"o1-preview-2024-09-12",
@@ -3174,6 +3483,32 @@ function isPrivateIPv4Literal(value) {
 	if (a >= 224) return true;
 	return false;
 }
+/**
+* Mirrors `hasPrivateEmbeddedIPv4` in `@librechat/api`'s ip helpers: 6to4, NAT64, and Teredo
+* carry an IPv4 address inside the IPv6 one, and the runtime guard blocks those when the
+* embedded address is private. Kept in sync so an operator can exempt what the runtime blocks.
+*/
+function hasPrivateEmbeddedIPv4Literal(value) {
+	const is6to4 = value.startsWith("2002:");
+	const isNat64 = value.startsWith("64:ff9b::");
+	const isTeredo = value.startsWith("2001::");
+	if (!is6to4 && !isNat64 && !isTeredo) return false;
+	const segments = value.split(":").filter((segment) => segment !== "");
+	const pair = is6to4 ? segments.slice(1, 3) : segments.slice(-2);
+	if (pair.length !== 2) return false;
+	const hi = parseInt(pair[0], 16);
+	const lo = parseInt(pair[1], 16);
+	if (isNaN(hi) || isNaN(lo)) return false;
+	/** RFC 4380: Teredo stores the external IPv4 as a bitwise complement. */
+	const high = isTeredo ? ~hi : hi;
+	const low = isTeredo ? ~lo : lo;
+	return isPrivateIPv4Literal([
+		high >> 8 & 255,
+		high & 255,
+		low >> 8 & 255,
+		low & 255
+	].join("."));
+}
 function isPrivateIPv6Literal(value) {
 	if (!value.includes(":")) return false;
 	if (value === "::1" || value === "::") return true;
@@ -3184,7 +3519,7 @@ function isPrivateIPv6Literal(value) {
 	}
 	const mappedMatch = value.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
 	if (mappedMatch) return isPrivateIPv4Literal(mappedMatch[1]);
-	return false;
+	return hasPrivateEmbeddedIPv4Literal(value);
 }
 /**
 * Mirrors the allowedAddresses parser in `@librechat/api`'s auth helpers.
@@ -3401,6 +3736,7 @@ let AgentCapabilities = /* @__PURE__ */ function(AgentCapabilities) {
 	AgentCapabilities["end_after_tools"] = "end_after_tools";
 	AgentCapabilities["deferred_tools"] = "deferred_tools";
 	AgentCapabilities["execute_code"] = "execute_code";
+	AgentCapabilities["stateful_code_sessions"] = "stateful_code_sessions";
 	AgentCapabilities["file_search"] = "file_search";
 	AgentCapabilities["web_search"] = "web_search";
 	AgentCapabilities["artifacts"] = "artifacts";
@@ -3408,9 +3744,13 @@ let AgentCapabilities = /* @__PURE__ */ function(AgentCapabilities) {
 	AgentCapabilities["actions"] = "actions";
 	AgentCapabilities["context"] = "context";
 	AgentCapabilities["skills"] = "skills";
+	AgentCapabilities["memory"] = "memory";
+	AgentCapabilities["ask_user_question"] = "ask_user_question";
 	AgentCapabilities["tools"] = "tools";
 	AgentCapabilities["chain"] = "chain";
 	AgentCapabilities["ocr"] = "ocr";
+	AgentCapabilities["run_in_background"] = "run_in_background";
+	AgentCapabilities["tool_intents"] = "tool_intents";
 	return AgentCapabilities;
 }({});
 const defaultAssistantsVersion = {
@@ -3418,7 +3758,14 @@ const defaultAssistantsVersion = {
 	["azureAssistants"]: 1
 };
 const baseEndpointSchema = zod.z.object({
-	streamRate: zod.z.number().optional(),
+	/**
+	* Milliseconds between visible streamed chunks. Agents SDK-backed
+	* providers (openAI, custom, anthropic, google, bedrock, agents) smooth
+	* adaptively at 25ms by default; set to override the cadence, 0 to
+	* disable smoothing. Legacy Assistants and Ollama paths instead sleep
+	* this long per provider chunk (default 1ms), with no adaptive smoothing.
+	*/
+	streamRate: zod.z.number().min(0).optional(),
 	baseURL: zod.z.string().optional(),
 	/**
 	* Custom request headers forwarded to the provider on every request. Values
@@ -3446,6 +3793,37 @@ const baseEndpointSchema = zod.z.object({
 	* completes (legacy behavior).
 	*/
 	titleTiming: zod.z.union([zod.z.literal("immediate"), zod.z.literal("final")]).optional(),
+	/**
+	* Agent activity groups: collapse each contiguous block of reasoning and
+	* tool calls under a generated one-line header. Mirrors the title options
+	* above — `activityLabel` enables it (like `titleConvo`), the rest tune
+	* the fast model that writes the label.
+	*
+	* NOTE: fields added here reach `endpoints.all` automatically (that schema
+	* is `baseEndpointSchema.omit({ baseURL })`), but NOT Azure — see the
+	* enumerated `.pick()` in `azureEndpointSchema` below.
+	*/
+	activityLabel: zod.z.boolean().optional(),
+	/** Model used to write activity labels. Defaults to `titleModel`, then the agent's model. */
+	activityModel: zod.z.string().optional(),
+	/** Endpoint whose credentials the label model runs on. Defaults to the agent's endpoint. */
+	activityEndpoint: zod.z.string().optional(),
+	/** Overrides the system prompt used to write activity labels. */
+	activityPrompt: zod.z.string().optional(),
+	/** Cost cap: maximum labels generated per run. Default 20. */
+	activityMaxPerRun: zod.z.number().int().positive().optional(),
+	/** Per-entry truncation of tool input/output in the label prompt. Default 600. */
+	activityCharLimit: zod.z.number().int().positive().optional(),
+	/** Generates one parent summary for each run phase containing 2+ activities. */
+	activityPhaseLabel: zod.z.boolean().optional(),
+	/** Model used for phase summaries. Defaults to activityModel, titleModel, then the run model. */
+	activityPhaseModel: zod.z.string().optional(),
+	/** Endpoint whose credentials the phase summary model uses. Defaults to activityEndpoint. */
+	activityPhaseEndpoint: zod.z.string().optional(),
+	/** Overrides the dedicated phase-summary system prompt. */
+	activityPhasePrompt: zod.z.string().optional(),
+	/** Cost cap: maximum phase summaries generated per run. Default 5. */
+	activityPhaseMaxPerRun: zod.z.number().int().positive().optional(),
 	/** Maximum characters allowed in a single tool result before truncation. */
 	maxToolResultChars: zod.z.number().positive().optional()
 });
@@ -3486,6 +3864,11 @@ const assistantEndpointSchema = baseEndpointSchema.merge(zod.z.object({
 		"tools"
 	]),
 	apiKey: zod.z.string().optional(),
+	/** Masked preview of the API key, stored at write time so admin
+	* reads can show which key is configured without returning the secret.
+	* Shared by both `endpoints.assistants` and `endpoints.azureAssistants`,
+	* which both use this schema. */
+	apiKeyPreview: zod.z.string().optional(),
 	models: zod.z.object({
 		default: zod.z.array(modelItemSchema).min(1),
 		fetch: zod.z.boolean().optional(),
@@ -3503,6 +3886,8 @@ const defaultAgentCapabilities = [
 	"actions",
 	"context",
 	"skills",
+	"memory",
+	"ask_user_question",
 	"tools",
 	"chain",
 	"ocr"
@@ -3548,17 +3933,136 @@ const remoteApiAuthSchema = zod.z.object({
 	oidc: remoteApiOidcSchema.optional()
 });
 const remoteApiSchema = zod.z.object({ auth: remoteApiAuthSchema.optional() });
+/**
+* Permission mode applied to a tool call. Mirrors `@librechat/agents`'s
+* `ToolPolicyMode` 1:1.
+*
+* - `default`: ask the user about anything not explicitly allowed (default-on).
+* - `dontAsk`: deny anything not explicitly allowed (headless / API-key flows).
+* - `bypass`: auto-approve everything that isn't explicitly denied
+*   (the user-facing "stop asking me" toggle).
+*
+* Subagents inherit the parent's mode; this is enforced by the SDK and not
+* overridable per-subagent.
+*/
+const toolApprovalModeSchema = zod.z.enum([
+	"default",
+	"dontAsk",
+	"bypass"
+]);
+/**
+* Per-endpoint tool-approval policy.
+*
+* Shape mirrors `@librechat/agents`'s `ToolPolicyConfig` so the host can map it
+* directly into `createToolPolicyHook(config)`. The SDK does the evaluation
+* (`deny → bypass → allow → ask → dontAsk → fallthrough(ask)`); this config
+* just describes the surface.
+*
+* Conventions:
+* - All list entries are matched as globs (`*`). Use `mcp:server:*` to scope
+*   a rule to every tool from a single MCP server.
+* - `deny` always wins, including under `bypass`.
+* - `enabled: false` is a LibreChat-only kill switch that disables the entire
+*   HITL machinery for this endpoint (no checkpointer, no hooks, no prompts).
+*   This is admin-level; users toggle prompting via `mode: 'bypass'` instead.
+*/
+/**
+* A programmatic tool-approval hook loaded from a module at startup.
+*
+* The referenced module's default export must be a builder
+* `(options?) => ToolApprovalHookFactory` (see `@librechat/api`'s `registerToolApprovalHook`).
+* Hooks compose with the static `allow`/`deny`/`ask` policy above and can only TIGHTEN it
+* (the SDK folds decisions `deny → ask → allow`). This is admin-level config — the module is
+* dynamically imported and executed in-process, so only reference trusted code.
+*/
+const toolApprovalHookConfigSchema = zod.z.object({
+	/**
+	* Module specifier to import: a bare package name (e.g. `@acme/approval-hooks`) or a path —
+	* absolute, or relative to the app root. Its default export is the hook builder.
+	*/
+	module: zod.z.string().min(1),
+	/** Optional regex matched against the tool name; omit to run for every tool. */
+	matcher: zod.z.string().optional(),
+	/** Static options forwarded to the module's builder; the hook's own per-call config. */
+	options: zod.z.record(zod.z.unknown()).optional()
+});
+const toolApprovalPolicySchema = zod.z.object({
+	enabled: zod.z.boolean().optional(),
+	mode: toolApprovalModeSchema.optional(),
+	allow: zod.z.array(zod.z.string()).optional(),
+	deny: zod.z.array(zod.z.string()).optional(),
+	ask: zod.z.array(zod.z.string()).optional(),
+	/** Optional reason template surfaced in the prompt; `{tool}` is interpolated. */
+	reason: zod.z.string().optional(),
+	/**
+	* Programmatic policy hooks loaded from modules at startup. They layer on top of the
+	* static lists above for dynamic, context-aware decisions the lists can't express
+	* (per-args, per-agent, per-user). See {@link toolApprovalHookConfigSchema}.
+	*
+	* BASE-CONFIG ONLY: hooks are imported + registered once, process-wide, at server
+	* startup — they are NOT reloaded from per-role/user/tenant admin overrides. Encode
+	* per-user/tenant behavior INSIDE the hook (via its runtime context), not by varying the
+	* module list per override. Honored only when `enabled` is true.
+	*/
+	hooks: zod.z.array(toolApprovalHookConfigSchema).optional()
+}).optional();
+/**
+* Durable checkpointer backing human-in-the-loop resume.
+*
+* When `toolApproval.enabled` is true, a run that pauses for review suspends its
+* LangGraph state to a checkpoint; resuming rebuilds that state on a *fresh* `Run`
+* — possibly on a different replica, or the same worker after a restart. That only
+* works if the checkpoint outlives the original request, so HITL needs a durable
+* saver, not the SDK's process-local `MemorySaver` fallback.
+*
+* Defaults are zero-config: with `toolApproval.enabled` on and no `checkpointer`
+* block, LibreChat persists checkpoints to its primary MongoDB, so resume works
+* across replicas out of the box.
+*
+* - `type: 'mongo'` (default) — persist to the app database; survives restarts and
+*   resolves on any replica. A TTL index reclaims runs that are never resolved.
+* - `type: 'memory'` — process-local only. Paused runs do NOT survive a restart and
+*   can only be resolved on the originating worker. Single-process / dev only.
+*/
+const checkpointerTypeSchema = zod.z.enum(["mongo", "memory"]);
+const checkpointerSchema = zod.z.object({
+	type: checkpointerTypeSchema.optional(),
+	/**
+	* Approval window, in seconds: how long a paused run waits for a decision
+	* before it is reclaimed. Drives both the Mongo TTL index on checkpoints and
+	* the pending-action expiry, keeping the two layers in lockstep. Defaults to
+	* 86400 (24h). Raise it for longer review windows.
+	*/
+	ttl: zod.z.number().int().positive().optional(),
+	/** Advanced: override the Mongo collection names used for checkpoints. */
+	checkpointCollectionName: zod.z.string().optional(),
+	checkpointWritesCollectionName: zod.z.string().optional()
+}).optional();
 const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(zod.z.object({
 	recursionLimit: zod.z.number().optional(),
 	disableBuilder: zod.z.boolean().optional().default(false),
 	maxRecursionLimit: zod.z.number().optional(),
+	/** Max cumulative bytes a single streamed tool call's arguments may reach before the run
+	* aborts. Defaults to 64 KiB in the agents SDK; `0` disables the guard. */
+	maxToolCallArgBytes: zod.z.number().optional(),
+	/** Max streamed chunk events per model generation before the run aborts. Off by default. */
+	maxDeltaEventsPerTurn: zod.z.number().optional(),
+	/** Per-tool overrides of `maxToolCallArgBytes`, keyed by model-facing tool name; `0`
+	* disables the guard for that tool only. Merged over LibreChat's shipped default of
+	* `{ create_file: 131072 }`. */
+	maxToolCallArgBytesByTool: zod.z.record(zod.z.number()).optional(),
 	maxCitations: zod.z.number().min(1).max(50).optional().default(30),
 	maxCitationsPerFile: zod.z.number().min(1).max(10).optional().default(7),
 	minRelevanceScore: zod.z.number().min(0).max(1).optional().default(.45),
 	allowedProviders: zod.z.array(zod.z.union([zod.z.string(), eModelEndpointSchema])).optional(),
 	capabilities: zod.z.array(zod.z.nativeEnum(AgentCapabilities)).optional().default(defaultAgentCapabilities),
 	skills: zod.z.object({ maxCatalogSkills: zod.z.number().int().min(1).max(100).optional() }).optional(),
-	remoteApi: remoteApiSchema.optional()
+	remoteApi: remoteApiSchema.optional(),
+	/** Human-in-the-loop tool approval policy. Off by default. */
+	toolApproval: toolApprovalPolicySchema,
+	/** Durable checkpointer backing tool-approval and Ask User resume.
+	*  Defaults to the app's MongoDB when either flow needs it. */
+	checkpointer: checkpointerSchema
 })).default({
 	disableBuilder: false,
 	capabilities: defaultAgentCapabilities,
@@ -3617,6 +4121,9 @@ const paramDefinitionSchema = zod.z.object({
 const endpointSchema = baseEndpointSchema.merge(zod.z.object({
 	name: zod.z.string().refine((value) => !eModelEndpointSchema.safeParse(value).success, { message: `Value cannot be one of the default endpoint (EModelEndpoint) values: ${Object.values(EModelEndpoint).join(", ")}` }),
 	apiKey: zod.z.string(),
+	/** Masked preview of the API key, stored at write time so admin
+	* reads can show which key is configured without returning the secret. */
+	apiKeyPreview: zod.z.string().optional(),
 	baseURL: zod.z.string(),
 	models: zod.z.object({
 		default: zod.z.array(modelItemSchema).min(1),
@@ -3664,15 +4171,35 @@ const endpointSchema = baseEndpointSchema.merge(zod.z.object({
 const azureEndpointSchema = zod.z.object({
 	groups: azureGroupConfigsSchema,
 	assistants: zod.z.boolean().optional()
-}).and(endpointSchema.pick({
-	streamRate: true,
-	titleConvo: true,
-	titleMethod: true,
-	titleModel: true,
-	titlePrompt: true,
-	titleTiming: true,
-	titlePromptTemplate: true
-}).partial());
+}).and(
+	/**
+	* Azure carries only the base-endpoint fields enumerated here. This is a
+	* `.pick()`, NOT an omit, so a field added to `baseEndpointSchema` is
+	* silently unavailable on Azure endpoints until it is listed below —
+	* unlike `endpoints.all`, which omits and therefore inherits new fields
+	* automatically. Keep this list in sync when adding endpoint options.
+	*/
+	endpointSchema.pick({
+		streamRate: true,
+		titleConvo: true,
+		titleMethod: true,
+		titleModel: true,
+		titlePrompt: true,
+		titleTiming: true,
+		titlePromptTemplate: true,
+		activityLabel: true,
+		activityModel: true,
+		activityEndpoint: true,
+		activityPrompt: true,
+		activityMaxPerRun: true,
+		activityCharLimit: true,
+		activityPhaseLabel: true,
+		activityPhaseModel: true,
+		activityPhaseEndpoint: true,
+		activityPhasePrompt: true,
+		activityPhaseMaxPerRun: true
+	}).partial()
+);
 /**
 * Vertex AI model configuration - similar to Azure model config
 * Allows specifying deployment name for each model
@@ -3708,15 +4235,20 @@ const anthropicEndpointSchema = baseEndpointSchema.merge(zod.z.object({
 	/** Optional: List of available models */
 	models: zod.z.array(zod.z.string()).optional()
 }));
+/** Masked preview of the API key, stored at write time so admin
+* reads can show which key is configured without returning the secret. */
+const apiKeyPreviewSchema = zod.z.string().optional();
 const ttsOpenaiSchema = zod.z.object({
 	url: zod.z.string().optional(),
 	apiKey: zod.z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: zod.z.string(),
 	voices: zod.z.array(zod.z.string())
 });
 const ttsAzureOpenAISchema = zod.z.object({
 	instanceName: zod.z.string(),
 	apiKey: zod.z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	deploymentName: zod.z.string(),
 	apiVersion: zod.z.string(),
 	model: zod.z.string(),
@@ -3726,6 +4258,7 @@ const ttsElevenLabsSchema = zod.z.object({
 	url: zod.z.string().optional(),
 	websocketUrl: zod.z.string().optional(),
 	apiKey: zod.z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: zod.z.string(),
 	voices: zod.z.array(zod.z.string()),
 	voice_settings: zod.z.object({
@@ -3739,10 +4272,12 @@ const ttsElevenLabsSchema = zod.z.object({
 const ttsLocalaiSchema = zod.z.object({
 	url: zod.z.string(),
 	apiKey: zod.z.string().optional(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	voices: zod.z.array(zod.z.string()),
 	backend: zod.z.string()
 });
 const ttsSchema = zod.z.object({
+	allowedAddresses: allowedAddressesSchema,
 	openai: ttsOpenaiSchema.optional(),
 	azureOpenAI: ttsAzureOpenAISchema.optional(),
 	elevenlabs: ttsElevenLabsSchema.optional(),
@@ -3751,15 +4286,18 @@ const ttsSchema = zod.z.object({
 const sttOpenaiSchema = zod.z.object({
 	url: zod.z.string().optional(),
 	apiKey: zod.z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: zod.z.string()
 });
 const sttAzureOpenAISchema = zod.z.object({
 	instanceName: zod.z.string(),
 	apiKey: zod.z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	deploymentName: zod.z.string(),
 	apiVersion: zod.z.string()
 });
 const sttSchema = zod.z.object({
+	allowedAddresses: allowedAddressesSchema,
 	openai: sttOpenaiSchema.optional(),
 	azureOpenAI: sttAzureOpenAISchema.optional()
 });
@@ -3767,16 +4305,23 @@ const speechTab = zod.z.object({
 	conversationMode: zod.z.boolean().optional(),
 	advancedMode: zod.z.boolean().optional(),
 	speechToText: zod.z.boolean().optional().or(zod.z.object({
-		/** Keep in sync with STTProviders enum (defined below — cannot reference due to eval order) */
-		engineSTT: zod.z.enum(["openai", "azureOpenAI"]).optional(),
+		/** Provider names remain valid for backward compatibility and are normalized for clients. */
+		engineSTT: zod.z.enum([
+			"browser",
+			"external",
+			"openai",
+			"azureOpenAI"
+		]).optional(),
 		languageSTT: zod.z.string().optional(),
 		autoTranscribeAudio: zod.z.boolean().optional(),
 		decibelValue: zod.z.number().optional(),
 		autoSendText: zod.z.number().optional()
 	})).optional(),
 	textToSpeech: zod.z.boolean().optional().or(zod.z.object({
-		/** Keep in sync with TTSProviders enum (defined below — cannot reference due to eval order) */
+		/** Provider names remain valid for backward compatibility and are normalized for clients. */
 		engineTTS: zod.z.enum([
+			"browser",
+			"external",
 			"openai",
 			"azureOpenAI",
 			"elevenlabs",
@@ -4037,18 +4582,25 @@ let SafeSearchTypes = /* @__PURE__ */ function(SafeSearchTypes) {
 	return SafeSearchTypes;
 }({});
 const webSearchSchema = zod.z.object({
+	allowedAddresses: allowedAddressesSchema,
 	serperApiKey: zod.z.string().optional().default("${SERPER_API_KEY}"),
+	serperApiKeyPreview: apiKeyPreviewSchema,
 	searxngInstanceUrl: zod.z.string().optional().default("${SEARXNG_INSTANCE_URL}"),
 	searxngApiKey: zod.z.string().optional().default("${SEARXNG_API_KEY}"),
+	searxngApiKeyPreview: apiKeyPreviewSchema,
 	firecrawlApiKey: zod.z.string().optional().default("${FIRECRAWL_API_KEY}"),
+	firecrawlApiKeyPreview: apiKeyPreviewSchema,
 	firecrawlApiUrl: zod.z.string().optional().default("${FIRECRAWL_API_URL}"),
 	firecrawlVersion: zod.z.string().optional().default("${FIRECRAWL_VERSION}"),
 	tavilyApiKey: zod.z.string().optional().default("${TAVILY_API_KEY}"),
+	tavilyApiKeyPreview: apiKeyPreviewSchema,
 	tavilySearchUrl: zod.z.string().optional().default("${TAVILY_SEARCH_URL}"),
 	tavilyExtractUrl: zod.z.string().optional().default("${TAVILY_EXTRACT_URL}"),
 	jinaApiKey: zod.z.string().optional().default("${JINA_API_KEY}"),
+	jinaApiKeyPreview: apiKeyPreviewSchema,
 	jinaApiUrl: zod.z.string().optional().default("${JINA_API_URL}"),
 	cohereApiKey: zod.z.string().optional().default("${COHERE_API_KEY}"),
+	cohereApiKeyPreview: apiKeyPreviewSchema,
 	searchProvider: zod.z.nativeEnum(SearchProviders).optional(),
 	scraperProvider: zod.z.nativeEnum(ScraperProviders).optional(),
 	rerankerType: zod.z.nativeEnum(RerankerTypes).optional(),
@@ -4124,8 +4676,10 @@ const webSearchSchema = zod.z.object({
 	}).optional()
 });
 const ocrSchema = zod.z.object({
+	allowedAddresses: allowedAddressesSchema,
 	mistralModel: zod.z.string().optional(),
 	apiKey: zod.z.string().optional().default("${OCR_API_KEY}"),
+	apiKeyPreview: apiKeyPreviewSchema,
 	baseURL: zod.z.string().optional().default("${OCR_BASEURL}"),
 	strategy: zod.z.nativeEnum(OCRStrategy).default("mistral_ocr")
 });
@@ -4183,6 +4737,10 @@ const contextPruningSchema = zod.z.object({
 	hardClearRatio: zod.z.number().min(0).max(1).optional(),
 	minPrunableToolChars: zod.z.number().min(0).optional()
 });
+const retainRecentConfigSchema = zod.z.object({
+	turns: zod.z.number().min(0).max(20).optional(),
+	tokens: zod.z.number().positive().optional()
+});
 const summarizationConfigSchema = zod.z.object({
 	enabled: zod.z.boolean().optional(),
 	provider: zod.z.string().optional(),
@@ -4198,31 +4756,56 @@ const summarizationConfigSchema = zod.z.object({
 	updatePrompt: zod.z.string().optional(),
 	reserveRatio: zod.z.number().min(0).max(1).optional(),
 	maxSummaryTokens: zod.z.number().positive().optional(),
-	contextPruning: contextPruningSchema.optional()
+	contextPruning: contextPruningSchema.optional(),
+	retainRecent: retainRecentConfigSchema.optional()
 });
 const customEndpointsSchema = zod.z.array(endpointSchema.partial()).optional();
+/**
+* Validates a messageFilter PII regex at config load. Defaults to native RegExp so browser
+* builds add no extra engine; the server injects a check backed by the linear-time runtime
+* engine (RE2) via setMessageFilterRegexValidator, so a pattern the runtime cannot compile
+* (backreferences, lookaround, control escapes, and so on) is rejected at load rather than
+* silently dropped at request time.
+*/
+let messageFilterRegexValidator = (value) => {
+	try {
+		new RegExp(value, "g");
+		return true;
+	} catch {
+		return false;
+	}
+};
+const setMessageFilterRegexValidator = (validate) => {
+	messageFilterRegexValidator = validate;
+};
 const messageFilterPiiCustomPatternSchema = zod.z.object({
 	id: zod.z.string().min(1),
 	label: zod.z.string().min(1),
-	regex: zod.z.string().min(1).refine((value) => {
-		try {
-			new RegExp(value, "g");
-			return true;
-		} catch {
-			return false;
-		}
-	}, { message: "Invalid regex" })
+	regex: zod.z.string().min(1).refine((value) => messageFilterRegexValidator(value), { message: "Unsupported regex: not compatible with the RE2 engine (no backreferences, lookaround, or control escapes)" })
 });
 const messageFilterPiiSchema = zod.z.object({
 	starterPatterns: zod.z.array(zod.z.string()).optional(),
 	customPatterns: zod.z.array(messageFilterPiiCustomPatternSchema).optional()
 });
 const messageFilterSchema = zod.z.object({ pii: messageFilterPiiSchema.optional() });
+const langfuseConfigSchema = zod.z.object({
+	enabled: zod.z.boolean().optional(),
+	publicKey: zod.z.string().optional(),
+	secretKey: zod.z.string().optional(),
+	/** Stable Langfuse project identity returned when credentials are verified. */
+	projectId: zod.z.string().optional(),
+	/** Masked preview of the secret key, stored at write time so
+	* admin reads can show which secret key is configured without returning the secret. */
+	secretKeyPreview: zod.z.string().optional(),
+	/** Routing key for one of the deployment-configured tenant Langfuse destinations. */
+	destination: zod.z.string().optional()
+});
 const configSchema = zod.z.object({
 	version: zod.z.string(),
 	cache: zod.z.boolean().default(true),
 	ocr: ocrSchema.optional(),
 	webSearch: webSearchSchema.optional(),
+	langfuse: langfuseConfigSchema.optional(),
 	memory: memorySchema.optional(),
 	summarization: summarizationConfigSchema.optional(),
 	skillSync: skillSyncConfigSchema,
@@ -4261,6 +4844,13 @@ const configSchema = zod.z.object({
 	messageFilter: messageFilterSchema.optional(),
 	endpoints: zod.z.object({
 		allowedAddresses: allowedAddressesSchema,
+		/**
+		* Defaults applied to every endpoint. Omit-based, so options added to
+		* `baseEndpointSchema` are inherited here automatically — no list to
+		* maintain (contrast `azureEndpointSchema`, which enumerates via
+		* `.pick()`). Resolution order at read sites is `all` > the named
+		* endpoint > a custom endpoint's own config.
+		*/
 		all: baseEndpointSchema.omit({ baseURL: true }).optional(),
 		["openAI"]: baseEndpointSchema.optional(),
 		["google"]: baseEndpointSchema.optional(),
@@ -4330,6 +4920,9 @@ const alternateName = {
 	["helicone"]: "Helicone"
 };
 const sharedOpenAIModels = [
+	"gpt-5.6",
+	"gpt-5.6-terra",
+	"gpt-5.6-luna",
 	"gpt-5.5",
 	"gpt-5.5-pro",
 	"chat-latest",
@@ -4354,8 +4947,10 @@ const sharedOpenAIModels = [
 ];
 const sharedAnthropicModels = [
 	"claude-fable-5",
+	"claude-opus-5",
 	"claude-opus-4-8",
 	"claude-opus-4-7",
+	"claude-sonnet-5",
 	"claude-sonnet-4-6",
 	"claude-opus-4-6",
 	"claude-sonnet-4-5",
@@ -4376,18 +4971,25 @@ const sharedAnthropicModels = [
 	"claude-3-5-sonnet-20240620",
 	"claude-3-5-sonnet-latest"
 ];
+/**
+* Claude 4+ models are not invocable on-demand by their bare foundation-model
+* ID on the Converse path — Bedrock rejects those with "Invocation of model ID
+* ... with on-demand throughput isn't supported. Retry your request with the ID
+* or ARN of an inference profile that contains this model." Default to the
+* `global.` cross-region profile (no regional pricing premium, widest
+* availability); Opus 4.1 has no global profile, so it uses `us.`.
+*/
 const bedrockModels = [
-	"anthropic.claude-fable-5",
-	"anthropic.claude-opus-4-8",
-	"anthropic.claude-opus-4-7",
-	"anthropic.claude-sonnet-4-6",
-	"anthropic.claude-opus-4-6-v1",
-	"anthropic.claude-sonnet-4-5-20250929-v1:0",
-	"anthropic.claude-haiku-4-5-20251001-v1:0",
-	"anthropic.claude-opus-4-1-20250805-v1:0",
-	"anthropic.claude-3-5-sonnet-20241022-v2:0",
-	"anthropic.claude-3-5-sonnet-20240620-v1:0",
-	"anthropic.claude-3-5-haiku-20241022-v1:0",
+	"global.anthropic.claude-fable-5",
+	"global.anthropic.claude-opus-5",
+	"global.anthropic.claude-opus-4-8",
+	"global.anthropic.claude-opus-4-7",
+	"global.anthropic.claude-sonnet-5",
+	"global.anthropic.claude-sonnet-4-6",
+	"global.anthropic.claude-opus-4-6-v1",
+	"global.anthropic.claude-sonnet-4-5-20250929-v1:0",
+	"global.anthropic.claude-haiku-4-5-20251001-v1:0",
+	"us.anthropic.claude-opus-4-1-20250805-v1:0",
 	"cohere.command-r-v1:0",
 	"cohere.command-r-plus-v1:0",
 	"meta.llama2-13b-chat-v1",
@@ -4412,7 +5014,10 @@ const defaultModels = {
 	["assistants"]: [...sharedOpenAIModels, "chatgpt-4o-latest"],
 	["agents"]: sharedOpenAIModels,
 	["google"]: [
+		"gemini-3.7-flash",
+		"gemini-3.6-flash",
 		"gemini-3.5-flash",
+		"gemini-3.5-flash-lite",
 		"gemini-3.1-pro-preview",
 		"gemini-3.1-pro-preview-customtools",
 		"gemini-3.1-flash-lite-preview",
@@ -4572,6 +5177,14 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	*/
 	CacheKeys["ROLES"] = "ROLES";
 	/**
+	* Key for cached group memberships used to resolve ACL user principals.
+	*/
+	CacheKeys["USER_PRINCIPALS"] = "USER_PRINCIPALS";
+	/**
+	* Key for per-conversation stateful code sandbox prewarm/warm state.
+	*/
+	CacheKeys["SANDBOX_PREWARM"] = "SANDBOX_PREWARM";
+	/**
 	* Key for the title generation cache.
 	*/
 	CacheKeys["GEN_TITLE"] = "GEN_TITLE";
@@ -4641,6 +5254,10 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	*/
 	CacheKeys["OPENID_EXCHANGED_TOKENS"] = "OPENID_EXCHANGED_TOKENS";
 	/**
+	* Key for cached authenticated user documents.
+	*/
+	CacheKeys["AUTH_USER_DOC"] = "AUTH_USER_DOC";
+	/**
 	* Key for OpenID session.
 	*/
 	CacheKeys["OPENID_SESSION"] = "OPENID_SESSION";
@@ -4654,6 +5271,7 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	CacheKeys["ADMIN_OAUTH_EXCHANGE"] = "ADMIN_OAUTH_EXCHANGE";
 	return CacheKeys;
 }({});
+const AUTH_USER_DOC_BY_ID_PREFIX = "auth-user-doc-byid";
 /**
 * Enum for violation types, used to identify, log, and cache violations.
 */
@@ -4777,6 +5395,14 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	*/
 	ErrorTypes["GOOGLE_TOOL_CONFLICT"] = "google_tool_conflict";
 	/**
+	* Google provider could not process a linked video (most often longer than the model accepts)
+	*/
+	ErrorTypes["GOOGLE_VIDEO_UNPROCESSABLE"] = "google_video_unprocessable";
+	/**
+	* Required CodeAPI resources could not be restored before model invocation.
+	*/
+	ErrorTypes["RESOURCE_RECOVERY_REQUIRED"] = "resource_recovery_required";
+	/**
 	* Invalid Agent Provider (excluded by Admin)
 	*/
 	ErrorTypes["INVALID_AGENT_PROVIDER"] = "invalid_agent_provider";
@@ -4869,6 +5495,10 @@ let SettingsTabValues = /* @__PURE__ */ function(SettingsTabValues) {
 	*/
 	SettingsTabValues["SPEECH"] = "speech";
 	/**
+	* Tab for Langfuse Settings
+	*/
+	SettingsTabValues["LANGFUSE"] = "langfuse";
+	/**
 	* Tab for Beta Features
 	*/
 	SettingsTabValues["BETA"] = "beta";
@@ -4931,7 +5561,7 @@ let TTSProviders = /* @__PURE__ */ function(TTSProviders) {
 /** Enum for app-wide constants */
 let Constants = /* @__PURE__ */ function(Constants) {
 	/**
-	* Key for the app's version. The placeholder `v0.8.7` is
+	* Key for the app's version. The placeholder `v0.8.8-rc1` is
 	* swapped in by `@rollup/plugin-replace` during `npm run build:data-provider`
 	* using the value of the root `package.json`'s `version` field. Consumers
 	* always import this via the built dist bundle (see `main` field in
@@ -4939,9 +5569,9 @@ let Constants = /* @__PURE__ */ function(Constants) {
 	* substituted value. Only tests that import the TypeScript source directly
 	* would observe the raw placeholder.
 	*/
-	Constants["VERSION"] = "v0.8.7";
+	Constants["VERSION"] = "v0.8.8-rc1";
 	/** Key for the Custom Config's version (librechat.yaml). */
-	Constants["CONFIG_VERSION"] = "1.3.13";
+	Constants["CONFIG_VERSION"] = "1.3.14";
 	/** Standard value for the first message's `parentMessageId` value, to indicate no parent exists. */
 	Constants["NO_PARENT"] = "00000000-0000-0000-0000-000000000000";
 	/** Standard value to use whatever the submission prelim. `responseMessageId` is */
@@ -4993,8 +5623,126 @@ let Constants = /* @__PURE__ */ function(Constants) {
 	Constants["BASH_PROGRAMMATIC_TOOL_CALLING"] = "run_tools_with_bash";
 	/** Subagent spawn tool name (must match `@librechat/agents` `Constants.SUBAGENT`). */
 	Constants["SUBAGENT"] = "subagent";
+	/** Poll tool for retrieving the status/result of a backgrounded tool call. */
+	Constants["CHECK_BACKGROUND_TASK"] = "check_background_task";
 	return Constants;
 }({});
+/**
+* Normalizes a server name into the character set tool keys are built from.
+* Tool keys embed this output, so any candidate list matched against a key must
+* be normalized the same way.
+*/
+function normalizeServerName(serverName) {
+	if (/^[a-zA-Z0-9_.-]+$/.test(serverName)) return serverName;
+	const normalized = serverName.replace(/[^a-zA-Z0-9_.-]/g, "_").replace(/^_+|_+$/g, "");
+	if (normalized) return normalized;
+	/** All characters were stripped; hash the original so the name stays unique. */
+	let hash = 0;
+	for (let i = 0; i < serverName.length; i++) {
+		hash = (hash << 5) - hash + serverName.charCodeAt(i);
+		hash |= 0;
+	}
+	return `server_${Math.abs(hash)}`;
+}
+/**
+* Splits a combined MCP tool key (`${rawToolName}${mcp_delimiter}${serverName}`)
+* back into its two parts.
+*
+* Both halves can legitimately contain the delimiter, so position alone cannot
+* identify the boundary. Raw tool names come from the upstream server and are
+* untrusted (`get_mcp_server_version`, or a gateway-prefixed
+* `gitlab-get_mcp_server_version`), and `normalizeServerName` preserves
+* underscores, so a configured server may be named `Google_mcp_Workspace`.
+*
+* When `knownServerNames` is supplied the boundary is resolved against it: the
+* longest configured name the key actually ends with wins. Otherwise this falls
+* back to the last delimiter, which is correct whenever only the tool half
+* contains one and matches `.split()` when neither does.
+*
+* One case stays undecidable from the key alone: if both `bar` and `foo_mcp_bar`
+* are configured, `tool_mcp_foo_mcp_bar` is a valid key for either. Longest match
+* is the deterministic tiebreak; resolving it properly needs the tool/server
+* mapping carried alongside the key rather than re-derived from the string.
+*/
+/**
+* Maps each configured server name's normalized form back to the raw config
+* name. Model-facing tool keys embed `normalizeServerName(server)`, while the
+* registry, config maps, tool cache, and plugin-auth rows are keyed by the raw
+* name — any consumer that parses a server out of a tool key must resolve it
+* through this map before those lookups. Identity entries are included so
+* `aliases.get(name) ?? name` works uniformly.
+*
+* When two configured names normalize to the same value their tool keys are
+* inherently ambiguous; the FIRST configured name wins deterministically here,
+* and `resolveMCPServerContext` warns about the collision so the operator can
+* rename one server.
+*/
+function buildServerNameAliases(rawServerNames) {
+	const aliases = /* @__PURE__ */ new Map();
+	/** Identity entries claim their slot FIRST regardless of configuration
+	*  order: a server literally named `foo` must never have its keys rerouted
+	*  to a `foo!` whose normalized form collides with it. */
+	for (const raw of rawServerNames) if (raw && normalizeServerName(raw) === raw) aliases.set(raw, raw);
+	for (const raw of rawServerNames) {
+		if (!raw) continue;
+		const normalized = normalizeServerName(raw);
+		if (!aliases.has(normalized)) aliases.set(normalized, raw);
+	}
+	return aliases;
+}
+/**
+* Rewrites a tool key's server segment into the normalized form model-facing
+* keys carry, resolving the boundary against the configured raw names (longest
+* suffix wins, mirroring {@link splitMCPToolKey}). Returns the key unchanged
+* when no configured raw name matches — already-normalized keys, placeholder
+* tokens, and keys for servers that are no longer configured all pass through.
+* Idempotent: a normalized segment never matches a raw candidate that needs
+* rewriting.
+*/
+function normalizeMCPToolKey(toolKey, rawServerNames) {
+	let matched;
+	for (let i = 0; i < rawServerNames.length; i++) {
+		const raw = rawServerNames[i];
+		if (!raw || raw.length <= (matched?.length ?? 0)) continue;
+		if (toolKey.endsWith(`_mcp_${raw}`)) matched = raw;
+	}
+	if (matched == null) return toolKey;
+	const normalized = normalizeServerName(matched);
+	if (normalized === matched) return toolKey;
+	return `${toolKey.slice(0, toolKey.length - matched.length)}${normalized}`;
+}
+function splitMCPToolKey(toolKey, knownServerNames) {
+	if (knownServerNames?.length) {
+		let matched;
+		for (let i = 0; i < knownServerNames.length; i++) {
+			const serverName = knownServerNames[i];
+			if (!serverName || serverName.length <= (matched?.length ?? 0)) continue;
+			if (toolKey.endsWith(`_mcp_${serverName}`)) matched = serverName;
+		}
+		if (matched != null) return [toolKey.slice(0, toolKey.length - matched.length - 5), matched];
+	}
+	const idx = toolKey.lastIndexOf("_mcp_");
+	if (idx === -1) return [toolKey, void 0];
+	return [toolKey.slice(0, idx), toolKey.slice(idx + 5)];
+}
+/**
+* Splits a tool-call name for display, where the key may be a synthetic MCP OAuth
+* call (`oauth${mcp_delimiter}${serverName}`) rather than a real tool key.
+*
+* A configured server name is authoritative when one matches, because a real tool key
+* always ends in its server. Only when none matches does the `oauth` prefix decide,
+* which keeps a genuine upstream tool named `oauth${mcp_delimiter}...` from being read
+* as a synthetic call while still resolving OAuth prompts for unconfigured servers.
+*/
+function splitToolCallName(toolCallName, knownServerNames) {
+	if (knownServerNames?.length) {
+		const [toolName, serverName] = splitMCPToolKey(toolCallName, knownServerNames);
+		if (serverName != null && knownServerNames.includes(serverName)) return [toolName, serverName];
+	}
+	const oauthPrefix = `oauth_mcp_`;
+	if (toolCallName.startsWith(oauthPrefix)) return ["oauth", toolCallName.slice(oauthPrefix.length)];
+	return splitMCPToolKey(toolCallName, knownServerNames);
+}
 /** Maximum explicit subagent hops allowed from any root agent at runtime. */
 const MAX_SUBAGENT_DEPTH = 5;
 /** Maximum unique explicit subagent targets that may be loaded at runtime. */
@@ -5046,6 +5794,8 @@ let LocalStorageKeys = /* @__PURE__ */ function(LocalStorageKeys) {
 	LocalStorageKeys["LAST_ARTIFACTS_TOGGLE_"] = "LAST_ARTIFACTS_TOGGLE_";
 	/** Last checked toggle for Skills per conversation ID */
 	LocalStorageKeys["LAST_SKILLS_TOGGLE_"] = "LAST_SKILLS_TOGGLE_";
+	/** Last checked toggle for Memory per conversation ID */
+	LocalStorageKeys["LAST_MEMORY_TOGGLE_"] = "LAST_MEMORY_TOGGLE_";
 	/** Key for the last selected agent provider */
 	LocalStorageKeys["LAST_AGENT_PROVIDER"] = "lastAgentProvider";
 	/** Key for the last selected agent model */
@@ -5364,13 +6114,14 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["searchConversations"] = "searchConversations";
 	QueryKeys["conversation"] = "conversation";
 	QueryKeys["searchEnabled"] = "searchEnabled";
+	QueryKeys["langfuseConnection"] = "langfuseConnection";
+	QueryKeys["langfuseSessionLink"] = "langfuseSessionLink";
 	QueryKeys["user"] = "user";
 	QueryKeys["name"] = "name";
 	QueryKeys["models"] = "models";
 	QueryKeys["balance"] = "balance";
 	QueryKeys["endpoints"] = "endpoints";
 	QueryKeys["tokenConfig"] = "tokenConfig";
-	QueryKeys["contextProjection"] = "contextProjection";
 	QueryKeys["presets"] = "presets";
 	QueryKeys["searchResults"] = "searchResults";
 	QueryKeys["tokenCount"] = "tokenCount";
@@ -5430,17 +6181,20 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["skillFileContent"] = "skillFileContent";
 	QueryKeys["skillTree"] = "skillTree";
 	QueryKeys["skillNodeContent"] = "skillNodeContent";
-	QueryKeys["skillFavorites"] = "skillFavorites";
+	QueryKeys["toolFavorites"] = "toolFavorites";
 	QueryKeys["skillStates"] = "skillStates";
 	QueryKeys["favorites"] = "favorites";
 	return QueryKeys;
 }({});
 const DynamicQueryKeys = { agentFiles: (agentId) => ["agentFiles", agentId] };
 let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
+	MutationKeys["updateLangfuseConnection"] = "updateLangfuseConnection";
+	MutationKeys["testLangfuseConnection"] = "testLangfuseConnection";
 	MutationKeys["createAgentApiKey"] = "createAgentApiKey";
 	MutationKeys["deleteAgentApiKey"] = "deleteAgentApiKey";
 	MutationKeys["fileUpload"] = "fileUpload";
 	MutationKeys["fileDelete"] = "fileDelete";
+	MutationKeys["fileUsage"] = "fileUsage";
 	MutationKeys["updatePreset"] = "updatePreset";
 	MutationKeys["deletePreset"] = "deletePreset";
 	MutationKeys["loginUser"] = "loginUser";
@@ -5529,6 +6283,7 @@ const TOKEN_REFRESH_BUFFER_MS = 120 * 1e3;
 const refreshToken = (retry) => _post(refreshToken$1(retry));
 const SHARE_PAGE_PATH_REGEX = /^\/share\/[^/]+\/?$/;
 const SHARED_MESSAGES_PATH_REGEX = /^\/api\/share\/[^/]+$/;
+const SHARE_FORK_PATH_REGEX = /^\/api\/share\/[^/]+\/fork$/;
 const normalizePathname = (pathname) => pathname.startsWith("/") ? pathname : `/${pathname}`;
 const stripBasePath = (pathname) => {
 	const normalizedPathname = normalizePathname(pathname);
@@ -5548,6 +6303,11 @@ const getRequestPathname = (url) => {
 	}
 };
 const isSharedMessagesRequest = (url, method) => method?.toLowerCase() === "get" && SHARED_MESSAGES_PATH_REGEX.test(stripBasePath(getRequestPathname(url)));
+/** The "continue this chat" fork is a deliberate authenticated action initiated
+*  from a share page, so it must reach auth recovery/redirect like the shared
+*  data request — otherwise a logged-out (or cold-loaded) viewer's 401 is
+*  rejected silently instead of routing them through login. */
+const isShareForkRequest = (url, method) => method?.toLowerCase() === "post" && SHARE_FORK_PATH_REGEX.test(stripBasePath(getRequestPathname(url)));
 const dispatchTokenUpdatedEvent = (token) => {
 	setTokenHeader(token);
 	clearAuthRedirectStartedAt();
@@ -5646,16 +6406,42 @@ const shouldRefreshBeforeRequest = (url) => {
 	const timeUntilExpiry = expiresAt - Date.now();
 	return timeUntilExpiry > 0 && timeUntilExpiry <= TOKEN_REFRESH_BUFFER_MS;
 };
+const refreshBeforeRequest = async (url) => {
+	const state = getAuthRecoveryState();
+	if (state.refreshPromise && !isAuthRecoveryEndpoint(url)) return state.refreshPromise.catch(() => null);
+	if (!shouldRefreshBeforeRequest(url)) return null;
+	return startAuthRecovery(false).catch(() => null);
+};
+const withAuthorization = (options, token) => {
+	const headers = new Headers(options?.headers);
+	if (token) headers.set("Authorization", `Bearer ${token}`);
+	return {
+		...options,
+		headers
+	};
+};
+async function _authenticatedFetch(url, options) {
+	if (typeof window === "undefined") return fetch(url, options);
+	const token = await refreshBeforeRequest(url) ?? getBearerToken();
+	const response = await fetch(url, withAuthorization(options, token));
+	if (response.status !== 401 || isAuthRecoveryEndpoint(url) || isAuthRedirectInProgress() || !getBearerToken()) return response;
+	let refreshedToken;
+	try {
+		refreshedToken = await startAuthRecovery(false);
+	} catch {
+		redirectToLoginOnce();
+		return response;
+	}
+	if (!refreshedToken) {
+		redirectToLoginOnce();
+		return response;
+	}
+	await response.body?.cancel().catch(() => void 0);
+	return fetch(url, withAuthorization(options, refreshedToken));
+}
 if (typeof window !== "undefined") {
 	axios.default.interceptors.request.use(async (config) => {
-		const state = getAuthRecoveryState();
-		if (state.refreshPromise && !isAuthRecoveryEndpoint(config.url)) {
-			const token = await state.refreshPromise.catch(() => null);
-			if (token) setRequestAuthorizationHeader(config, token);
-			return config;
-		}
-		if (!shouldRefreshBeforeRequest(config.url)) return config;
-		const token = await startAuthRecovery(false).catch(() => null);
+		const token = await refreshBeforeRequest(config.url);
 		if (token) setRequestAuthorizationHeader(config, token);
 		return config;
 	});
@@ -5669,7 +6455,7 @@ if (typeof window !== "undefined") {
 		/** Skip refresh when the Authorization header has been cleared (e.g. during logout),
 		*  but allow the shared link data request to proceed so private shares can still
 		*  recover auth/redirect without unrelated share-page queries forcing login. */
-		if (!axios.default.defaults.headers.common["Authorization"] && !(isSharePage() && isSharedMessagesRequest(originalRequest.url, originalRequest.method))) return Promise.reject(error);
+		if (!axios.default.defaults.headers.common["Authorization"] && !(isSharePage() && (isSharedMessagesRequest(originalRequest.url, originalRequest.method) || isShareForkRequest(originalRequest.url, originalRequest.method)))) return Promise.reject(error);
 		if (isAuthRedirectInProgress()) return Promise.reject(error);
 		if (error.response.status === 401 && !originalRequest._retry) {
 			if (!(getAuthRecoveryState().refreshPromise != null)) console.warn("401 error, refreshing token");
@@ -5682,8 +6468,12 @@ if (typeof window !== "undefined") {
 				}
 				redirectToLoginOnce();
 				return Promise.reject(error);
-			} catch (err) {
-				return Promise.reject(err);
+			} catch {
+				/** A rejected refresh (stale/invalid session → 401/403) must route to
+				*  login just like an empty-token refresh, otherwise the original 401
+				*  surfaces to the caller (e.g. the share fork button) with no redirect. */
+				redirectToLoginOnce();
+				return Promise.reject(error);
 			}
 		}
 		return Promise.reject(error);
@@ -5699,15 +6489,142 @@ var request_default = {
 	delete: _delete,
 	deleteWithOptions: _deleteWithOptions,
 	patch: _patch,
+	authenticatedFetch: _authenticatedFetch,
 	refreshToken,
 	dispatchTokenUpdatedEvent
 };
 //#endregion
+//#region src/upload.ts
+const EVENT_STREAM_MEDIA_TYPE = "text/event-stream";
+const HEARTBEAT_TIMEOUT_MS = 15e3;
+var FileUploadError = class extends Error {
+	constructor(message, fileId, toolResource, displayToUser = false, code = 0) {
+		super(message);
+		this.name = "CustomAppError";
+		this.code = code;
+		this.file_id = fileId;
+		this.tool_resource = toolResource;
+		this.display_to_user = displayToUser;
+		this.response = { data: { message: displayToUser ? message : "" } };
+	}
+};
+var UploadCanceledError = class extends Error {
+	constructor(..._args) {
+		super(..._args);
+		this.code = "ERR_CANCELED";
+	}
+};
+const getFileId = (formData) => String(formData.get("file_id") ?? "");
+const getToolResource = (formData) => formData.get("tool_resource") ?? void 0;
+const parseEvent = (message) => {
+	let type = "message";
+	const data = [];
+	for (const line of message.split(/\r?\n/)) {
+		if (line.startsWith("event:")) {
+			type = line.slice(6).trim();
+			continue;
+		}
+		if (line.startsWith("data:")) data.push(line.slice(5).trimStart());
+	}
+	return {
+		type,
+		data: data.join("\n")
+	};
+};
+const createHttpError = async (response, formData) => {
+	let message = `Server responded with status: ${response.status}`;
+	try {
+		message = (await response.json()).message || message;
+	} catch {}
+	return new FileUploadError(message, getFileId(formData), getToolResource(formData), true, response.status);
+};
+const createStreamError = (data, formData) => {
+	let error;
+	try {
+		error = JSON.parse(data);
+	} catch {
+		error = { message: data };
+	}
+	return new FileUploadError(error.message || "File upload failed.", error.temp_file_id || getFileId(formData), error.tool_resource || getToolResource(formData), error.display_to_user ?? false, error.code ?? 0);
+};
+const readEventStream = async (stream, formData) => {
+	const reader = stream.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	let result = null;
+	let streamEnded = false;
+	let timeoutError = null;
+	let heartbeatTimer;
+	const resetHeartbeatTimer = () => {
+		clearTimeout(heartbeatTimer);
+		heartbeatTimer = setTimeout(() => {
+			timeoutError = /* @__PURE__ */ new Error("Upload connection timed out waiting for a heartbeat.");
+			reader.cancel(timeoutError);
+		}, HEARTBEAT_TIMEOUT_MS);
+	};
+	resetHeartbeatTimer();
+	try {
+		while (true) {
+			const { value, done } = await reader.read();
+			if (done) {
+				streamEnded = true;
+				if (timeoutError) throw timeoutError;
+				if (result) return result;
+				throw new Error("Upload connection closed before completion.");
+			}
+			buffer += decoder.decode(value, { stream: true });
+			const messages = buffer.split(/\r?\n\r?\n/);
+			buffer = messages.pop() ?? "";
+			for (const message of messages) {
+				const event = parseEvent(message);
+				if (event.type === "heartbeat") {
+					resetHeartbeatTimer();
+					continue;
+				}
+				if (event.type === "error") throw createStreamError(event.data, formData);
+				if (event.type === "data") {
+					result = JSON.parse(event.data);
+					continue;
+				}
+				if (event.type === "close") {
+					if (result) return result;
+					throw new Error("Upload stream closed without a result.");
+				}
+			}
+		}
+	} catch (error) {
+		if (error instanceof Error && error.name === "AbortError") throw new UploadCanceledError("Upload canceled.");
+		throw error;
+	} finally {
+		clearTimeout(heartbeatTimer);
+		if (!streamEnded) await reader.cancel().catch(() => void 0);
+		reader.releaseLock();
+	}
+};
+async function uploadEventStream(url, formData, signal) {
+	try {
+		const response = await request_default.authenticatedFetch(url, {
+			method: "POST",
+			body: formData,
+			headers: { Accept: EVENT_STREAM_MEDIA_TYPE },
+			signal: signal ?? void 0
+		});
+		if (!response.ok) throw await createHttpError(response, formData);
+		if (!(response.headers.get("Content-Type")?.toLowerCase() ?? "").includes(EVENT_STREAM_MEDIA_TYPE)) return await response.json();
+		if (!response.body) throw new Error("No upload response body received.");
+		return await readEventStream(response.body, formData);
+	} catch (error) {
+		if (signal?.aborted || error instanceof Error && error.name === "AbortError") throw new UploadCanceledError("Upload canceled.");
+		throw error;
+	}
+}
+//#endregion
 //#region src/data-service.ts
 var data_service_exports = /* @__PURE__ */ __exportAll({
 	acceptTerms: () => acceptTerms,
 	addPromptToGroup: () => addPromptToGroup,
 	addTagToConversation: () => addTagToConversation,
+	addToolFavorite: () => addToolFavorite,
 	archiveConversation: () => archiveConversation,
 	assignConversationToProject: () => assignConversationToProject,
 	bindActionOAuth: () => bindActionOAuth,
@@ -5755,6 +6672,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	editArtifact: () => editArtifact,
 	enableTwoFactor: () => enableTwoFactor,
 	forkConversation: () => forkConversation,
+	forkSharedConversation: () => forkSharedConversation,
 	genTitle: () => genTitle,
 	getAIEndpoints: () => getAIEndpoints,
 	getAccessRoles: () => getAccessRoles,
@@ -5764,6 +6682,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getAgentById: () => getAgentById,
 	getAgentCategories: () => getAgentCategories,
 	getAgentFiles: () => getAgentFiles,
+	getAgentVersions: () => getAgentVersions,
 	getAllEffectivePermissions: () => getAllEffectivePermissions,
 	getAllPromptGroups: () => getAllPromptGroups,
 	getAssistantById: () => getAssistantById,
@@ -5774,7 +6693,6 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getBanner: () => getBanner,
 	getCategories: () => getCategories,
 	getCodeOutputDownload: () => getCodeOutputDownload,
-	getContextProjection: () => getContextProjection,
 	getConversationById: () => getConversationById,
 	getConversationTags: () => getConversationTags,
 	getConversations: () => getConversations,
@@ -5790,9 +6708,12 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getFiles: () => getFiles,
 	getGitHubSkillSyncStatus: () => getGitHubSkillSyncStatus,
 	getGraphApiToken: () => getGraphApiToken,
+	getLangfuseConnection: () => getLangfuseConnection,
+	getLangfuseSessionLink: () => getLangfuseSessionLink,
 	getLoginGoogle: () => getLoginGoogle,
 	getMCPAuthValues: () => getMCPAuthValues,
 	getMCPConnectionStatus: () => getMCPConnectionStatus,
+	getMCPOAuthStatus: () => getMCPOAuthStatus,
 	getMCPServer: () => getMCPServer,
 	getMCPServerConnectionStatus: () => getMCPServerConnectionStatus,
 	getMCPServers: () => getMCPServers,
@@ -5817,7 +6738,6 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getSharedMessages: () => getSharedMessages,
 	getSharedStartupConfig: () => getSharedStartupConfig,
 	getSkill: () => getSkill,
-	getSkillFavorites: () => getSkillFavorites,
 	getSkillFileContent: () => getSkillFileContent,
 	getSkillNodeContent: () => getSkillNodeContent,
 	getSkillStates: () => getSkillStates,
@@ -5825,6 +6745,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getStartupConfig: () => getStartupConfig,
 	getTokenConfig: () => getTokenConfig,
 	getToolCalls: () => getToolCalls,
+	getToolFavorites: () => getToolFavorites,
 	getUser: () => getUser,
 	getUserBalance: () => getUserBalance,
 	getUserTerms: () => getUserTerms,
@@ -5845,12 +6766,14 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	login: () => login,
 	logout: () => logout,
 	makePromptProduction: () => makePromptProduction,
+	markFilesUsage: () => markFilesUsage,
 	pinConversation: () => pinConversation,
 	rebuildConversationTags: () => rebuildConversationTags,
 	recordPromptGroupUsage: () => recordPromptGroupUsage,
 	regenerateBackupCodes: () => regenerateBackupCodes,
 	register: () => register,
 	reinitializeMCPServer: () => reinitializeMCPServer,
+	removeToolFavorite: () => removeToolFavorite,
 	requestPasswordReset: () => requestPasswordReset,
 	resendVerificationEmail: () => resendVerificationEmail,
 	resetPassword: () => resetPassword,
@@ -5861,6 +6784,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	searchPrincipals: () => searchPrincipals,
 	setGitHubSkillSyncCredential: () => setGitHubSkillSyncCredential,
 	speechToText: () => speechToText,
+	testLangfuseConnection: () => testLangfuseConnection,
 	textToSpeech: () => textToSpeech,
 	updateAction: () => updateAction,
 	updateAgent: () => updateAgent,
@@ -5871,6 +6795,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	updateConversationTag: () => updateConversationTag,
 	updateFavorites: () => updateFavorites,
 	updateFeedback: () => updateFeedback,
+	updateLangfuseConnection: () => updateLangfuseConnection,
 	updateMCPServer: () => updateMCPServer,
 	updateMCPServersPermissions: () => updateMCPServersPermissions,
 	updateMarketplacePermissions: () => updateMarketplacePermissions,
@@ -5889,7 +6814,6 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	updateResourcePermissions: () => updateResourcePermissions,
 	updateSharedLink: () => updateSharedLink,
 	updateSkill: () => updateSkill,
-	updateSkillFavorites: () => updateSkillFavorites,
 	updateSkillNode: () => updateSkillNode,
 	updateSkillNodeContent: () => updateSkillNodeContent,
 	updateSkillPermissions: () => updateSkillPermissions,
@@ -5908,6 +6832,18 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	verifyTwoFactor: () => verifyTwoFactor,
 	verifyTwoFactorTemp: () => verifyTwoFactorTemp
 });
+function getLangfuseConnection() {
+	return request_default.get(adminLangfuseConnection());
+}
+function updateLangfuseConnection(payload) {
+	return request_default.put(adminLangfuseConnection(), payload);
+}
+function testLangfuseConnection(payload) {
+	return request_default.post(adminLangfuseConnectionTest(), payload);
+}
+function getLangfuseSessionLink(conversationId) {
+	return request_default.get(adminLangfuseSessionLink(conversationId));
+}
 function revokeUserKey(name) {
 	return request_default.delete(revokeUserKey$1(name));
 }
@@ -5923,16 +6859,15 @@ function getFavorites() {
 function updateFavorites(favorites) {
 	return request_default.post(`${apiBaseUrl()}/api/user/settings/favorites`, { favorites });
 }
-/**
-* Skill favorites (star-a-skill). The backend route is phase 2 — see the
-* original UI PR for the client surface. Until then, these resolve with
-* an empty list so the UI hooks compile and the Star button is a no-op.
-*/
-function getSkillFavorites() {
-	return Promise.resolve([]);
+/** Tool favorites — starred marketplace items (builtins, tools, MCP servers, skills). */
+function getToolFavorites() {
+	return request_default.get(toolFavorites());
 }
-function updateSkillFavorites(skillFavorites) {
-	return Promise.resolve(skillFavorites);
+function addToolFavorite(favorite) {
+	return request_default.put(toolFavorite(favorite.itemType, favorite.itemId));
+}
+function removeToolFavorite(favorite) {
+	return request_default.delete(toolFavorite(favorite.itemType, favorite.itemId));
 }
 /** Per-user skill active/inactive overrides. */
 function getSkillStates() {
@@ -6059,6 +6994,9 @@ const getMCPAuthValues = (serverName) => {
 function cancelMCPOAuth(serverName) {
 	return request_default.post(cancelMCPOAuth$1(serverName), {});
 }
+function getMCPOAuthStatus(flowId) {
+	return request_default.get(mcpOAuthStatus(flowId));
+}
 const getStartupConfig = (options) => {
 	return request_default.get(config(options?.context));
 };
@@ -6068,9 +7006,6 @@ const getAIEndpoints = () => {
 const getTokenConfig = () => {
 	return request_default.get(tokenConfig());
 };
-const getContextProjection = (payload) => {
-	return request_default.post(contextProjection(), payload);
-};
 const getModels = async () => {
 	return request_default.get(models());
 };
@@ -6170,14 +7105,24 @@ const getAgentFiles = (agentId) => {
 const getFileConfig = () => {
 	return request_default.get(`${files()}/config`);
 };
-const uploadImage = (data, signal) => {
+const uploadImage = (data, signal, sseEnabled = false) => {
 	const requestConfig = signal ? { signal } : void 0;
+	if (sseEnabled) return uploadEventStream(images(), data, signal);
 	return request_default.postMultiPart(images(), data, requestConfig);
 };
-const uploadFile = (data, signal) => {
+const uploadFile = (data, signal, sseEnabled = false) => {
 	const requestConfig = signal ? { signal } : void 0;
+	if (sseEnabled) return uploadEventStream(files(), data, signal);
 	return request_default.postMultiPart(files(), data, requestConfig);
 };
+/**
+* Marks uploaded files as used (owner-scoped TTL touch) so the upload-window
+* TTL cannot reap attachments held in a client-side queue during a long run.
+* Best-effort: callers fire-and-forget — send-time marking is the backstop.
+*/
+const markFilesUsage = (body) => {
+	return request_default.post(fileUsage(), body);
+};
 const updateAction = (data) => {
 	const { assistant_id, version, ...body } = data;
 	return request_default.post(assistants({
@@ -6205,6 +7150,9 @@ const getAgentById = ({ agent_id }) => {
 const getExpandedAgentById = ({ agent_id }) => {
 	return request_default.get(agents({ path: `${agent_id}/expanded` }));
 };
+const getAgentVersions = ({ agent_id }) => {
+	return request_default.get(agents({ path: `${agent_id}/versions` }));
+};
 const updateAgent = ({ agent_id, data }) => {
 	return request_default.patch(agents({ path: agent_id }), data);
 };
@@ -6339,6 +7287,12 @@ function duplicateConversation(payload) {
 function forkConversation(payload) {
 	return request_default.post(forkConversation$1(), payload);
 }
+function forkSharedConversation(shareId, targetMessageIndex, shareRevision) {
+	return request_default.post(forkSharedMessages(shareId), {
+		targetMessageIndex,
+		shareRevision
+	});
+}
 function deleteConversation(payload) {
 	return request_default.deleteWithOptions(deleteConversation$1(), { data: { arg: payload } });
 }
@@ -6653,11 +7607,11 @@ function verifyTwoFactorTemp(payload) {
 const getMemories = () => {
 	return request_default.get(memories());
 };
-const deleteMemory = (key) => {
-	return request_default.delete(memory(key));
+const deleteMemory = (key, agentId) => {
+	return request_default.delete(memory(key, agentId));
 };
-const updateMemory = (key, value, originalKey) => {
-	return request_default.patch(memory(originalKey || key), {
+const updateMemory = (key, value, originalKey, agentId) => {
+	return request_default.patch(memory(originalKey || key, agentId), {
 		key,
 		value
 	});
@@ -6696,6 +7650,12 @@ const getActiveJobs = () => {
 	return request_default.get(activeJobs());
 };
 //#endregion
+Object.defineProperty(exports, "AUTH_USER_DOC_BY_ID_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return AUTH_USER_DOC_BY_ID_PREFIX;
+	}
+});
 Object.defineProperty(exports, "AccessRoleIds", {
 	enumerable: true,
 	get: function() {
@@ -6756,6 +7716,12 @@ Object.defineProperty(exports, "BASE_ONLY_CONFIG_SECTIONS", {
 		return BASE_ONLY_CONFIG_SECTIONS;
 	}
 });
+Object.defineProperty(exports, "BASE_PRINCIPAL_CONFIG_SECTIONS", {
+	enumerable: true,
+	get: function() {
+		return BASE_PRINCIPAL_CONFIG_SECTIONS;
+	}
+});
 Object.defineProperty(exports, "BedrockProviders", {
 	enumerable: true,
 	get: function() {
@@ -6978,6 +7944,12 @@ Object.defineProperty(exports, "MYTHOS_CLASS_FAMILIES", {
 		return MYTHOS_CLASS_FAMILIES;
 	}
 });
+Object.defineProperty(exports, "MemoryScope", {
+	enumerable: true,
+	get: function() {
+		return MemoryScope;
+	}
+});
 Object.defineProperty(exports, "MessageContentTypes", {
 	enumerable: true,
 	get: function() {
@@ -7044,12 +8016,24 @@ Object.defineProperty(exports, "RateLimitPrefix", {
 		return RateLimitPrefix;
 	}
 });
+Object.defineProperty(exports, "ReasoningContext", {
+	enumerable: true,
+	get: function() {
+		return ReasoningContext;
+	}
+});
 Object.defineProperty(exports, "ReasoningEffort", {
 	enumerable: true,
 	get: function() {
 		return ReasoningEffort;
 	}
 });
+Object.defineProperty(exports, "ReasoningMode", {
+	enumerable: true,
+	get: function() {
+		return ReasoningMode;
+	}
+});
 Object.defineProperty(exports, "ReasoningParameterFormat", {
 	enumerable: true,
 	get: function() {
@@ -7428,6 +8412,12 @@ Object.defineProperty(exports, "bedrockDocumentFormats", {
 		return bedrockDocumentFormats;
 	}
 });
+Object.defineProperty(exports, "bedrockDocumentMimeTypes", {
+	enumerable: true,
+	get: function() {
+		return bedrockDocumentMimeTypes;
+	}
+});
 Object.defineProperty(exports, "bedrockEndpointSchema", {
 	enumerable: true,
 	get: function() {
@@ -7452,6 +8442,12 @@ Object.defineProperty(exports, "buildLoginRedirectUrl", {
 		return buildLoginRedirectUrl;
 	}
 });
+Object.defineProperty(exports, "buildServerNameAliases", {
+	enumerable: true,
+	get: function() {
+		return buildServerNameAliases;
+	}
+});
 Object.defineProperty(exports, "cacheSubsetProviders", {
 	enumerable: true,
 	get: function() {
@@ -7470,6 +8466,18 @@ Object.defineProperty(exports, "checkOpenAIStorage", {
 		return checkOpenAIStorage;
 	}
 });
+Object.defineProperty(exports, "checkpointerSchema", {
+	enumerable: true,
+	get: function() {
+		return checkpointerSchema;
+	}
+});
+Object.defineProperty(exports, "checkpointerTypeSchema", {
+	enumerable: true,
+	get: function() {
+		return checkpointerTypeSchema;
+	}
+});
 Object.defineProperty(exports, "clearAllConversations", {
 	enumerable: true,
 	get: function() {
@@ -7680,12 +8688,24 @@ Object.defineProperty(exports, "eModelEndpointSchema", {
 		return eModelEndpointSchema;
 	}
 });
+Object.defineProperty(exports, "eReasoningContextSchema", {
+	enumerable: true,
+	get: function() {
+		return eReasoningContextSchema;
+	}
+});
 Object.defineProperty(exports, "eReasoningEffortSchema", {
 	enumerable: true,
 	get: function() {
 		return eReasoningEffortSchema;
 	}
 });
+Object.defineProperty(exports, "eReasoningModeSchema", {
+	enumerable: true,
+	get: function() {
+		return eReasoningModeSchema;
+	}
+});
 Object.defineProperty(exports, "eReasoningParameterFormatSchema", {
 	enumerable: true,
 	get: function() {
@@ -7890,6 +8910,12 @@ Object.defineProperty(exports, "getConfigDefaults", {
 		return getConfigDefaults;
 	}
 });
+Object.defineProperty(exports, "getConfiguredMimeAccept", {
+	enumerable: true,
+	get: function() {
+		return getConfiguredMimeAccept;
+	}
+});
 Object.defineProperty(exports, "getConversationById", {
 	enumerable: true,
 	get: function() {
@@ -8118,6 +9144,18 @@ Object.defineProperty(exports, "isAgentsEndpoint", {
 		return isAgentsEndpoint;
 	}
 });
+Object.defineProperty(exports, "isAnthropicDocumentType", {
+	enumerable: true,
+	get: function() {
+		return isAnthropicDocumentType;
+	}
+});
+Object.defineProperty(exports, "isAnthropicTextDocumentType", {
+	enumerable: true,
+	get: function() {
+		return isAnthropicTextDocumentType;
+	}
+});
 Object.defineProperty(exports, "isAssistantsEndpoint", {
 	enumerable: true,
 	get: function() {
@@ -8184,6 +9222,12 @@ Object.defineProperty(exports, "isUUID", {
 		return isUUID;
 	}
 });
+Object.defineProperty(exports, "langfuseConfigSchema", {
+	enumerable: true,
+	get: function() {
+		return langfuseConfigSchema;
+	}
+});
 Object.defineProperty(exports, "loginPage", {
 	enumerable: true,
 	get: function() {
@@ -8256,6 +9300,18 @@ Object.defineProperty(exports, "normalizeEndpointName", {
 		return normalizeEndpointName;
 	}
 });
+Object.defineProperty(exports, "normalizeMCPToolKey", {
+	enumerable: true,
+	get: function() {
+		return normalizeMCPToolKey;
+	}
+});
+Object.defineProperty(exports, "normalizeServerName", {
+	enumerable: true,
+	get: function() {
+		return normalizeServerName;
+	}
+});
 Object.defineProperty(exports, "ocrSchema", {
 	enumerable: true,
 	get: function() {
@@ -8382,6 +9438,12 @@ Object.defineProperty(exports, "resourcePermissionsResponseSchema", {
 		return resourcePermissionsResponseSchema;
 	}
 });
+Object.defineProperty(exports, "retainRecentConfigSchema", {
+	enumerable: true,
+	get: function() {
+		return retainRecentConfigSchema;
+	}
+});
 Object.defineProperty(exports, "retrievalMimeTypes", {
 	enumerable: true,
 	get: function() {
@@ -8418,6 +9480,18 @@ Object.defineProperty(exports, "setAcceptLanguageHeader", {
 		return setAcceptLanguageHeader;
 	}
 });
+Object.defineProperty(exports, "setFileConfigRegexCompiler", {
+	enumerable: true,
+	get: function() {
+		return setFileConfigRegexCompiler;
+	}
+});
+Object.defineProperty(exports, "setMessageFilterRegexValidator", {
+	enumerable: true,
+	get: function() {
+		return setMessageFilterRegexValidator;
+	}
+});
 Object.defineProperty(exports, "setTokenHeader", {
 	enumerable: true,
 	get: function() {
@@ -8454,6 +9528,18 @@ Object.defineProperty(exports, "specsConfigSchema", {
 		return specsConfigSchema;
 	}
 });
+Object.defineProperty(exports, "splitMCPToolKey", {
+	enumerable: true,
+	get: function() {
+		return splitMCPToolKey;
+	}
+});
+Object.defineProperty(exports, "splitToolCallName", {
+	enumerable: true,
+	get: function() {
+		return splitToolCallName;
+	}
+});
 Object.defineProperty(exports, "summarizationConfigSchema", {
 	enumerable: true,
 	get: function() {
@@ -8574,6 +9660,24 @@ Object.defineProperty(exports, "toMinimalFeedback", {
 		return toMinimalFeedback;
 	}
 });
+Object.defineProperty(exports, "toolApprovalHookConfigSchema", {
+	enumerable: true,
+	get: function() {
+		return toolApprovalHookConfigSchema;
+	}
+});
+Object.defineProperty(exports, "toolApprovalModeSchema", {
+	enumerable: true,
+	get: function() {
+		return toolApprovalModeSchema;
+	}
+});
+Object.defineProperty(exports, "toolApprovalPolicySchema", {
+	enumerable: true,
+	get: function() {
+		return toolApprovalPolicySchema;
+	}
+});
 Object.defineProperty(exports, "transactionsSchema", {
 	enumerable: true,
 	get: function() {
@@ -8695,4 +9799,4 @@ Object.defineProperty(exports, "webSearchSchema", {
 	}
 });
 
-//# sourceMappingURL=data-service-XTxx76uB.js.map
+//# sourceMappingURL=data-service-DOIF4BkW.js.map