librechat-data-provider 0.8.509 → 0.8.521

package/dist/{data-service-BsdHkdKS.mjs → data-service-pwrlWjJs.mjs}

@@ -169,6 +169,9 @@ const feedbackSchema = z.object({
 	rating: feedbackRatingSchema,
 	tag: feedbackTagKeySchema,
 	text: z.string().max(1024).optional()
+}).refine(({ rating, tag }) => FEEDBACK_TAGS.some((feedbackTag) => feedbackTag.key === tag && feedbackTag.direction === rating), {
+	message: "Feedback tag does not match rating",
+	path: ["tag"]
 });
 function toMinimalFeedback(feedback) {
 	if (!feedback?.rating || !feedback?.tag || !feedback.tag.key) return;
@@ -464,6 +467,7 @@ let ReasoningEffort = /* @__PURE__ */ function(ReasoningEffort) {
 	ReasoningEffort["medium"] = "medium";
 	ReasoningEffort["high"] = "high";
 	ReasoningEffort["xhigh"] = "xhigh";
+	ReasoningEffort["max"] = "max";
 	return ReasoningEffort;
 }({});
 let ReasoningParameterFormat = /* @__PURE__ */ function(ReasoningParameterFormat) {
@@ -530,6 +534,21 @@ let ThinkingLevel = /* @__PURE__ */ function(ThinkingLevel) {
 	ThinkingLevel["high"] = "high";
 	return ThinkingLevel;
 }({});
+/** OpenAI Responses API `reasoning.mode` (GPT-5.6+). */
+let ReasoningMode = /* @__PURE__ */ function(ReasoningMode) {
+	ReasoningMode["unset"] = "";
+	ReasoningMode["standard"] = "standard";
+	ReasoningMode["pro"] = "pro";
+	return ReasoningMode;
+}({});
+/** OpenAI Responses API `reasoning.context` (GPT-5.6+). */
+let ReasoningContext = /* @__PURE__ */ function(ReasoningContext) {
+	ReasoningContext["unset"] = "";
+	ReasoningContext["auto"] = "auto";
+	ReasoningContext["current_turn"] = "current_turn";
+	ReasoningContext["all_turns"] = "all_turns";
+	return ReasoningContext;
+}({});
 const imageDetailNumeric = {
 	["low"]: 0,
 	["auto"]: 1,
@@ -549,6 +568,8 @@ const eThinkingDisplaySchema = z.nativeEnum(ThinkingDisplay);
 const eReasoningSummarySchema = z.nativeEnum(ReasoningSummary);
 const eVerbositySchema = z.nativeEnum(Verbosity);
 const eThinkingLevelSchema = z.nativeEnum(ThinkingLevel);
+const eReasoningModeSchema = z.nativeEnum(ReasoningMode);
+const eReasoningContextSchema = z.nativeEnum(ReasoningContext);
 const defaultAssistantFormValues = {
 	assistant: "",
 	id: "",
@@ -580,6 +601,7 @@ const defaultAgentFormValues = {
 	["execute_code"]: false,
 	["file_search"]: false,
 	["web_search"]: false,
+	["memory"]: false,
 	category: "general",
 	support_contact: {
 		name: "",
@@ -592,7 +614,9 @@ const defaultAgentFormValues = {
 	*  (full catalog unless `skills` narrows it). Anything else = inactive. */
 	skills_enabled: void 0,
 	/** `undefined` = feature disabled by default (no subagent tool injected). */
-	subagents: void 0
+	subagents: void 0,
+	/** Memory partition: 'agent' isolates memories per (user, agent); default shared pool */
+	memory_scope: void 0
 };
 const ImageVisionTool = {
 	type: "function",
@@ -712,6 +736,7 @@ const CLAUDE_4_64K_MAX_OUTPUT = 64e3;
 const CLAUDE_32K_MAX_OUTPUT = 32e3;
 const DEFAULT_MAX_OUTPUT = 8192;
 const LEGACY_ANTHROPIC_MAX_OUTPUT = 4096;
+const CLAUDE_SONNET_128K_OUTPUT_PATTERN = /claude-sonnet[-.]?(?:4[-.]?(?:[6-9]|\d{2})|[5-9]|\d{2,})(?=$|[^0-9])/;
 /**
 * Claude "Mythos-class" model families — new top-level classes (peers of
 * `opus`/`sonnet`/`haiku`) that ship with the post-Opus-4.7 modern profile:
@@ -755,6 +780,7 @@ const anthropicSettings = {
 		reset: (modelName) => {
 			if (isMythosClassModel(modelName)) return ANTHROPIC_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:4[-.]?(?:[6-9]|\d{2,})|[5-9]|\d{2,})/.test(modelName)) return ANTHROPIC_MAX_OUTPUT;
+			if (CLAUDE_SONNET_128K_OUTPUT_PATTERN.test(modelName)) return ANTHROPIC_MAX_OUTPUT;
 			if (/claude-(?:sonnet|haiku)[-.]?[4-9]/.test(modelName)) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:[5-9]|4[-.]?([5-9]|\d{2,}))/.test(modelName)) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?[4-9]/.test(modelName)) return CLAUDE_32K_MAX_OUTPUT;
@@ -769,6 +795,10 @@ const anthropicSettings = {
 				if (value > ANTHROPIC_MAX_OUTPUT) return ANTHROPIC_MAX_OUTPUT;
 				return value;
 			}
+			if (CLAUDE_SONNET_128K_OUTPUT_PATTERN.test(modelName)) {
+				if (value > ANTHROPIC_MAX_OUTPUT) return ANTHROPIC_MAX_OUTPUT;
+				return value;
+			}
 			if (/claude-(?:sonnet|haiku)[-.]?[4-9]/.test(modelName) && value > CLAUDE_4_64K_MAX_OUTPUT) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:[5-9]|4[-.]?([5-9]|\d{2,}))/.test(modelName)) {
 				if (value > CLAUDE_4_64K_MAX_OUTPUT) return CLAUDE_4_64K_MAX_OUTPUT;
@@ -947,6 +977,16 @@ const tMessageSchema = z.object({
 	*/
 	quotes: z.array(z.string()).optional()
 });
+/**
+* Which memory partition an agent reads/writes.
+* `user` = the shared personal pool (default); `agent` = a partition
+* isolated per (user, agent) so the agent only sees its own memories.
+*/
+let MemoryScope = /* @__PURE__ */ function(MemoryScope) {
+	MemoryScope["user"] = "user";
+	MemoryScope["agent"] = "agent";
+	return MemoryScope;
+}({});
 const coerceNumber = z.union([z.number(), z.string()]).transform((val) => {
 	if (typeof val === "string") return val.trim() === "" ? void 0 : parseFloat(val);
 	return val;
@@ -965,6 +1005,8 @@ const tConversationSchema = z.object({
 	endpointType: eModelEndpointSchema.nullable().optional(),
 	isArchived: z.boolean().optional(),
 	pinned: z.boolean().optional(),
+	/** Server-derived: an active shared link exists for this conversation. Not persisted. */
+	isShared: z.boolean().optional(),
 	title: z.string().nullable().or(z.literal("New Chat")).default("New Chat"),
 	user: z.string().optional(),
 	messages: z.array(z.string()).optional(),
@@ -1002,6 +1044,8 @@ const tConversationSchema = z.object({
 	imageDetail: eImageDetailSchema.optional(),
 	reasoning_effort: eReasoningEffortSchema.optional().nullable(),
 	reasoning_summary: eReasoningSummarySchema.optional().nullable(),
+	reasoning_mode: eReasoningModeSchema.optional().nullable(),
+	reasoning_context: eReasoningContextSchema.optional().nullable(),
 	verbosity: eVerbositySchema.optional().nullable(),
 	useResponsesApi: z.boolean().optional(),
 	effort: eAnthropicEffortSchema.optional().nullable(),
@@ -1093,6 +1137,10 @@ const tQueryParamsSchema = tConversationSchema.pick({
 	/** @endpoints openAI, custom, azureOpenAI */
 	reasoning_summary: true,
 	/** @endpoints openAI, custom, azureOpenAI */
+	reasoning_mode: true,
+	/** @endpoints openAI, custom, azureOpenAI */
+	reasoning_context: true,
+	/** @endpoints openAI, custom, azureOpenAI */
 	verbosity: true,
 	/** @endpoints openAI, custom, azureOpenAI */
 	useResponsesApi: true,
@@ -1348,6 +1396,8 @@ const openAIBaseSchema = tConversationSchema.pick({
 	max_tokens: true,
 	reasoning_effort: true,
 	reasoning_summary: true,
+	reasoning_mode: true,
+	reasoning_context: true,
 	verbosity: true,
 	useResponsesApi: true,
 	web_search: true,
@@ -1796,12 +1846,17 @@ const tModelSpecSchema = z.object({
 	showIconInHeader: z.boolean().optional(),
 	showOnLanding: z.boolean().optional(),
 	conversation_starters: z.array(z.string()).optional(),
+	showInMenu: z.boolean().optional(),
 	iconURL: z.union([z.string(), eModelEndpointSchema]).optional(),
 	authType: authTypeSchema.optional(),
 	hideBadgeRow: z.boolean().optional(),
 	webSearch: z.boolean().optional(),
 	fileSearch: z.boolean().optional(),
 	executeCode: z.boolean().optional(),
+	memory: z.boolean().optional(),
+	askUserQuestion: z.boolean().optional(),
+	runInBackground: z.union([z.boolean(), z.array(z.string())]).optional(),
+	describeIntent: z.union([z.boolean(), z.array(z.string())]).optional(),
 	artifacts: z.union([z.string(), z.boolean()]).optional(),
 	mcpServers: z.array(z.string()).optional(),
 	skills: z.union([z.boolean(), z.array(z.string())]).optional(),
@@ -1883,6 +1938,7 @@ const fullMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -1913,6 +1969,7 @@ const fullMimeTypesList = [
 	"application/vnd.oasis.opendocument.graphics",
 	"image/svg",
 	"image/svg+xml",
+	"message/rfc822",
 	"video/mp4",
 	"video/avi",
 	"video/mov",
@@ -1946,6 +2003,7 @@ const codeInterpreterMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -1978,6 +2036,7 @@ const retrievalMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -1999,11 +2058,34 @@ const bedrockDocumentFormats = {
 	"text/markdown": "md"
 };
 const isBedrockDocumentType = (mimeType) => mimeType != null && mimeType in bedrockDocumentFormats;
+/** MIME types Bedrock's Converse document path can send to the model (mirrors `bedrockDocumentFormats`). */
+const bedrockDocumentMimeTypes = Object.keys(bedrockDocumentFormats);
 /** File extensions accepted by Bedrock document uploads (for input accept attributes) */
 const bedrockDocumentExtensions = ".pdf,.csv,.doc,.docx,.xls,.xlsx,.html,.htm,.txt,.md,application/pdf,text/csv,application/csv,application/msword,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.ms-excel,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,text/html,text/plain,text/markdown";
+/** Textual `application/*` MIME types that can be decoded and sent as plain text */
+const textualApplicationTypes = new Set([
+	"application/json",
+	"application/xml",
+	"application/yaml",
+	"application/sql",
+	"application/typescript",
+	"application/x-sh",
+	"application/csv"
+]);
+/**
+* MIME types the Anthropic Messages API accepts as a plain-text document source
+* (`source.type: 'text'`)
+*/
+const isAnthropicTextDocumentType = (mimeType) => mimeType != null && (mimeType.startsWith("text/") || textualApplicationTypes.has(mimeType));
+/**
+* MIME types the Anthropic Messages API document path can send to the model
+* (mirrors `isBedrockDocumentType`): PDF via base64, textual types via a
+* plain-text document source. All other types are rejected with a provider 400.
+*/
+const isAnthropicDocumentType = (mimeType) => mimeType === "application/pdf" || isAnthropicTextDocumentType(mimeType);
 const excelMimeTypes = /^application\/(vnd\.ms-excel|msexcel|x-msexcel|x-ms-excel|x-excel|x-dos_ms_excel|xls|x-xls|vnd\.openxmlformats-officedocument\.spreadsheetml\.sheet)$/;
 const textMimeTypes = /^(text\/(x-c|x-csharp|tab-separated-values|x-c\+\+|x-h|x-java|html|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|css|vtt|javascript|csv|xml|calendar))$/;
-const applicationMimeTypes = /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|x-zip-compressed|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
+const applicationMimeTypes = /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|x-zip-compressed|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.(presentation|template)|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
 const imageMimeTypes = /^image\/(jpeg|gif|png|webp|heic|heif)$/;
 const audioMimeTypes = /^audio\/(mp3|mpeg|mpeg3|wav|wave|x-wav|ogg|vorbis|mp4|m4a|x-m4a|flac|x-flac|webm|aac|wma|opus)$/;
 const videoMimeTypes = /^video\/(mp4|avi|mov|wmv|flv|webm|mkv|m4v|3gp|ogv)$/;
@@ -2012,6 +2094,7 @@ const defaultOCRMimeTypes = [
 	excelMimeTypes,
 	/^application\/pdf$/,
 	/^application\/vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation)$/,
+	/^application\/vnd\.openxmlformats-officedocument\.presentationml\.template$/,
 	/^application\/vnd\.ms-(word|powerpoint)$/,
 	/^application\/epub\+zip$/,
 	/^application\/vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)$/
@@ -2033,7 +2116,8 @@ const supportedMimeTypes = [
 	imageMimeTypes,
 	videoMimeTypes,
 	audioMimeTypes,
-	/^image\/(svg|svg\+xml)$/
+	/^image\/(svg|svg\+xml)$/,
+	/^message\/rfc822$/
 ];
 const codeInterpreterMimeTypes = [
 	textMimeTypes,
@@ -2088,6 +2172,7 @@ const codeTypeMapping = {
 	cljs: "text/plain",
 	cljc: "text/plain",
 	elm: "text/plain",
+	eml: "message/rfc822",
 	erl: "text/plain",
 	hrl: "text/plain",
 	ex: "text/plain",
@@ -2159,6 +2244,13 @@ const codeTypeMapping = {
 	ods: "application/vnd.oasis.opendocument.spreadsheet",
 	odp: "application/vnd.oasis.opendocument.presentation",
 	odg: "application/vnd.oasis.opendocument.graphics",
+	doc: "application/msword",
+	docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+	xls: "application/vnd.ms-excel",
+	xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+	ppt: "application/vnd.ms-powerpoint",
+	pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	potx: "application/vnd.openxmlformats-officedocument.presentationml.template",
 	ics: "text/calendar",
 	ical: "text/calendar",
 	ifb: "text/calendar",
@@ -2173,7 +2265,11 @@ const imageTypeMapping = {
 const mimeTypeAliases = {
 	"application/x-zip-compressed": "application/zip",
 	"text/x-python-script": "text/x-python",
-	"text/x-markdown": "text/markdown"
+	"text/x-markdown": "text/markdown",
+	/** freedesktop shared-mime-info (Chrome on Linux) */
+	"application/x-shellscript": "application/x-sh",
+	/** libmagic, i.e. `file --mime-type` */
+	"text/x-shellscript": "application/x-sh"
 };
 /**
 * Infers the MIME type from a file's extension when the browser doesn't recognize it,
@@ -2187,7 +2283,7 @@ function inferMimeType(fileName, currentType) {
 	const extension = fileName.split(".").pop()?.toLowerCase() ?? "";
 	return codeTypeMapping[extension] || imageTypeMapping[extension] || currentType;
 }
-const retrievalMimeTypes = [/^(text\/(x-c|x-c\+\+|x-h|html|x-java|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|vtt|xml))$/, /^(application\/(json|pdf|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation)))$/];
+const retrievalMimeTypes = [/^(text\/(x-c|x-c\+\+|x-h|html|x-java|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|vtt|xml))$/, /^(application\/(json|pdf|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.(presentation|template))))$/];
 const megabyte = 1024 * 1024;
 /** Helper function to get megabytes value */
 const mbToBytes = (mb) => mb * megabyte;
@@ -2266,21 +2362,212 @@ const fileConfigSchema = z.object({
 	ocr: z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional(),
 	text: z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional()
 });
-/** Helper function to safely convert string patterns to RegExp objects */
-const convertStringsToRegex = (patterns) => patterns.reduce((acc, pattern) => {
-	try {
-		const regex = new RegExp(pattern);
-		acc.push(regex);
-	} catch (error) {
-		console.error(`Invalid regex pattern "${pattern}" skipped.`, error);
+/**
+* Compiler for admin-supplied MIME patterns. Defaults to native `RegExp`, which browser
+* builds keep so no extra dependency is bundled. The server swaps in a linear-time engine
+* via `setFileConfigRegexCompiler` so an admin-authored catastrophic-backtracking pattern
+* cannot ReDoS the shared event loop when tested against an uploaded file's MIME type.
+*/
+let compileMimeRegex = (pattern) => new RegExp(pattern);
+/** Override the MIME-pattern compiler; the server injects a linear-time engine at startup. */
+const setFileConfigRegexCompiler = (compile) => {
+	compileMimeRegex = compile;
+};
+/** Returned when every configured pattern fails to compile, so consumers that read an empty
+*  allowlist as "no restriction" fail closed instead of allowing every file. */
+const rejectAllMimeMatcher = { test: () => false };
+/** Helper function to safely convert string patterns to matcher objects */
+const convertStringsToRegex = (patterns) => {
+	const compiled = patterns.reduce((acc, pattern) => {
+		try {
+			acc.push(compileMimeRegex(pattern));
+		} catch (error) {
+			console.error(`Invalid regex pattern "${pattern}" skipped.`, error);
+		}
+		return acc;
+	}, []);
+	if (patterns.length > 0 && compiled.length === 0) {
+		console.error(`All ${patterns.length} MIME type pattern(s) were invalid and skipped; the resulting allowlist rejects every file.`);
+		return [rejectAllMimeMatcher];
 	}
-	return acc;
-}, []);
+	return compiled;
+};
 /** Detects whether the given MIME type patterns accept all file types (e.g., `.*` or `.+`). */
 const isPermissiveMimeConfig = (types) => {
 	if (!types || types.length === 0) return false;
 	return types.some((regex) => regex.test("x-librechat/x-probe"));
 };
+/** Media categories that collapse to a wildcard `accept` token when any member type is allowed. */
+const mimeAcceptCategories = [
+	{
+		/** Mirrors `imageMimeTypes` (+ the code-interpreter svg variants) so every accepted type is known. */
+		category: "image",
+		token: "image/*",
+		samples: [
+			"image/jpeg",
+			"image/gif",
+			"image/png",
+			"image/webp",
+			"image/heic",
+			"image/heif",
+			"image/svg",
+			"image/svg+xml"
+		],
+		extras: [".heif", ".heic"]
+	},
+	{
+		/** Mirrors `audioMimeTypes`. */
+		category: "audio",
+		token: "audio/*",
+		samples: [
+			"audio/mp3",
+			"audio/mpeg",
+			"audio/mpeg3",
+			"audio/wav",
+			"audio/wave",
+			"audio/x-wav",
+			"audio/ogg",
+			"audio/vorbis",
+			"audio/mp4",
+			"audio/m4a",
+			"audio/x-m4a",
+			"audio/flac",
+			"audio/x-flac",
+			"audio/webm",
+			"audio/aac",
+			"audio/wma",
+			"audio/opus"
+		]
+	},
+	{
+		/** Mirrors `videoMimeTypes`. */
+		category: "video",
+		token: "video/*",
+		samples: [
+			"video/mp4",
+			"video/avi",
+			"video/mov",
+			"video/wmv",
+			"video/flv",
+			"video/webm",
+			"video/mkv",
+			"video/m4v",
+			"video/3gp",
+			"video/ogv"
+		]
+	}
+];
+/** Document/text MIME types paired with the extension(s) browsers filter on in the file picker. */
+const documentMimeExtensions = [
+	["application/pdf", [".pdf"]],
+	["application/msword", [".doc"]],
+	["application/vnd.openxmlformats-officedocument.wordprocessingml.document", [".docx"]],
+	["application/vnd.ms-excel", [".xls"]],
+	["application/msexcel", [".xls"]],
+	["application/x-msexcel", [".xls"]],
+	["application/x-ms-excel", [".xls"]],
+	["application/x-excel", [".xls"]],
+	["application/x-dos_ms_excel", [".xls"]],
+	["application/xls", [".xls"]],
+	["application/x-xls", [".xls"]],
+	["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", [".xlsx"]],
+	["application/vnd.ms-powerpoint", [".ppt"]],
+	["application/vnd.openxmlformats-officedocument.presentationml.presentation", [".pptx"]],
+	["application/vnd.openxmlformats-officedocument.presentationml.template", [".potx"]],
+	["application/vnd.oasis.opendocument.text", [".odt"]],
+	["application/vnd.oasis.opendocument.spreadsheet", [".ods"]],
+	["application/vnd.oasis.opendocument.presentation", [".odp"]],
+	["application/vnd.oasis.opendocument.graphics", [".odg"]],
+	["application/rtf", [".rtf"]],
+	["application/json", [".json"]],
+	["application/xml", [".xml"]],
+	["application/yaml", [".yaml", ".yml"]],
+	["application/zip", [".zip"]],
+	["application/x-zip-compressed", [".zip"]],
+	["application/epub+zip", [".epub"]],
+	["application/x-parquet", [".parquet"]],
+	["application/vnd.apache.parquet", [".parquet"]],
+	["text/csv", [".csv"]],
+	["application/csv", [".csv"]],
+	["text/tab-separated-values", [".tsv"]],
+	["text/plain", [".txt"]],
+	["text/markdown", [".md"]],
+	["text/html", [".html", ".htm"]],
+	["text/calendar", [".ics"]],
+	["message/rfc822", [".eml"]]
+];
+const documentMimeSet = new Set(documentMimeExtensions.map(([mimeType]) => mimeType));
+/** Every MIME type LibreChat may accept, used to detect patterns that reach beyond the representable set. */
+const knownMimeUniverse = Array.from(new Set([
+	...fullMimeTypesList,
+	...documentMimeExtensions.map(([mimeType]) => mimeType),
+	...mimeAcceptCategories.flatMap((category) => category.samples)
+]));
+const categoryOf = (mimeType) => {
+	if (mimeType.startsWith("image/")) return "image";
+	if (mimeType.startsWith("audio/")) return "audio";
+	if (mimeType.startsWith("video/")) return "video";
+	return "document";
+};
+/** Media types are covered by their `<cat>/*` wildcard token; document types need an explicit entry. */
+const isRepresentable = (mimeType) => categoryOf(mimeType) !== "document" || documentMimeSet.has(mimeType);
+/**
+* Translates a finite MIME allowlist into a file-input `accept` string, intersected with what the
+* provider upload path can actually send. Returns `undefined` (keep the provider filter) when a
+* configured pattern matches a supported, path-handleable type that cannot be represented, so the
+* picker never hides a file the path would have accepted.
+*/
+const buildMimeAccept = (types, { categories, documentMimeTypes }) => {
+	const permittedSet = new Set(categories);
+	const documentAllowSet = documentMimeTypes ? new Set(documentMimeTypes) : null;
+	const emittedMedia = /* @__PURE__ */ new Set();
+	const emittedDocuments = /* @__PURE__ */ new Set();
+	if (!types.every((regex) => knownMimeUniverse.some((mimeType) => regex.test(mimeType)))) return;
+	for (const regex of types) for (const mimeType of knownMimeUniverse) {
+		if (!regex.test(mimeType)) continue;
+		const category = categoryOf(mimeType);
+		if (!permittedSet.has(category)) continue;
+		/** The path handles documents but drops this specific type (e.g. Bedrock ignores pptx/ODF). */
+		if (category === "document" && documentAllowSet && !documentAllowSet.has(mimeType)) continue;
+		if (!isRepresentable(mimeType)) return;
+		if (category === "document") emittedDocuments.add(mimeType);
+		else emittedMedia.add(category);
+	}
+	const tokens = [];
+	const seen = /* @__PURE__ */ new Set();
+	const push = (token) => {
+		if (!seen.has(token)) {
+			seen.add(token);
+			tokens.push(token);
+		}
+	};
+	for (const category of mimeAcceptCategories) if (emittedMedia.has(category.category)) {
+		push(category.token);
+		category.extras?.forEach(push);
+	}
+	for (const [mimeType, extensions] of documentMimeExtensions) if (emittedDocuments.has(mimeType)) {
+		extensions.forEach(push);
+		push(mimeType);
+	}
+	return tokens.length > 0 ? tokens.join(",") : void 0;
+};
+/**
+* Resolves the file-input `accept` value for a configured `supportedMimeTypes` allowlist, scoped to
+* what the current upload path (`capability`) can send to the model.
+* - `undefined` for the built-in default or a config that can't be represented safely, so callers
+*   keep their provider-specific filter.
+* - `''` for permissive configs (e.g. `.*`), leaving the picker unrestricted.
+* - a translated `accept` string for a recognized finite allowlist (images, PDFs, Office docs, etc.).
+*
+* The picker `accept` is a UX convenience, not a security boundary: the backend still enforces
+* `supportedMimeTypes` on upload.
+*/
+const getConfiguredMimeAccept = (types, capability) => {
+	/** Referential identity with the built-in list signals an unconfigured endpoint (keep provider filter). */
+	if (!types || types.length === 0 || types === supportedMimeTypes) return;
+	if (isPermissiveMimeConfig(types)) return "";
+	return buildMimeAccept(types, capability);
+};
 /**
 * Gets the appropriate endpoint file configuration with standardized lookup logic.
 *
@@ -2450,9 +2737,16 @@ const messagesArtifacts = (messageId) => `${messagesRoot}/artifact/${messageId}`
 const messagesBranch = () => `${messagesRoot}/branch`;
 const shareRoot = `${BASE_URL}/api/share`;
 const shareMessages = (shareId) => `${shareRoot}/${shareId}`;
+const forkSharedMessages = (shareId) => `${shareRoot}/${shareId}/fork`;
 const sharedStartupConfig = (shareId) => `${shareMessages(shareId)}/config`;
 const getSharedLink$1 = (conversationId) => `${shareRoot}/link/${conversationId}`;
-const getSharedLinks = (pageSize, sortBy, sortDirection, search, cursor) => `${shareRoot}?pageSize=${pageSize}&sortBy=${sortBy}&sortDirection=${sortDirection}${search ? `&search=${search}` : ""}${cursor ? `&cursor=${cursor}` : ""}`;
+const getSharedLinks = (pageSize, sortBy, sortDirection, search, cursor) => `${shareRoot}${buildQuery({
+	pageSize,
+	sortBy,
+	sortDirection,
+	search,
+	cursor
+})}`;
 const createSharedLink$1 = (conversationId) => `${shareRoot}/${conversationId}`;
 const updateSharedLink$1 = (shareId) => `${shareRoot}/${shareId}`;
 /** Share-scoped file routes: serve snapshotted files via shared-link permission. */
@@ -2492,7 +2786,6 @@ const presets = () => `${BASE_URL}/api/presets`;
 const deletePreset$1 = () => `${BASE_URL}/api/presets/delete`;
 const aiEndpoints = () => `${BASE_URL}/api/endpoints`;
 const tokenConfig = () => `${BASE_URL}/api/endpoints/token-config`;
-const contextProjection = () => `${BASE_URL}/api/endpoints/context-projection`;
 const models = () => `${BASE_URL}/api/models`;
 const tokenizer = () => `${BASE_URL}/api/tokenizer`;
 const login$1 = () => `${BASE_URL}/api/auth/login`;
@@ -2531,6 +2824,7 @@ const mcpAuthValues = (serverName) => {
 const cancelMCPOAuth$1 = (serverName) => {
 	return `${BASE_URL}/api/mcp/oauth/cancel/${serverName}`;
 };
+const mcpOAuthStatus = (flowId) => `${BASE_URL}/api/mcp/oauth/status/${encodeURIComponent(flowId)}`;
 const mcpOAuthBind = (serverName) => `${BASE_URL}/api/mcp/${serverName}/oauth/bind`;
 const actionOAuthBind = (actionId) => `${BASE_URL}/api/actions/${actionId}/oauth/bind`;
 const config = (context) => `${BASE_URL}/api/config${buildQuery({ context })}`;
@@ -2567,6 +2861,8 @@ const mcpServer = (serverName) => `${BASE_URL}/api/mcp/servers/${serverName}`;
 const revertAgentVersion$1 = (agent_id) => `${agents({ path: `${agent_id}/revert` })}`;
 const files = () => `${BASE_URL}/api/files`;
 const filePreview = (fileId) => `${BASE_URL}/api/files/${encodeURIComponent(fileId)}/preview`;
+/** Owner-scoped usage touch so queued attachments outlive the upload-window TTL. */
+const fileUsage = () => `${BASE_URL}/api/files/usage`;
 const agentFiles = (agentId) => `${BASE_URL}/api/files/agent/${agentId}`;
 const images = () => `${files()}/images`;
 const avatar = () => `${images()}/avatar`;
@@ -2628,6 +2924,11 @@ const adminSkillsSyncStatus = () => `${adminSkillsSync()}/status`;
 const adminSkillsSyncRun = () => `${adminSkillsSync()}/run`;
 const adminSkillsSyncCredential = (credentialKey) => `${adminSkillsSync()}/credentials/${encodeURIComponent(credentialKey)}`;
 const skillStates = () => `${BASE_URL}/api/user/settings/skills/active`;
+const adminLangfuseConnection = () => `${BASE_URL}/api/admin/langfuse/connection`;
+const adminLangfuseConnectionTest = () => `${adminLangfuseConnection()}/test`;
+const adminLangfuseSessionLink = (conversationId) => `${adminLangfuseConnection()}/session/${encodeURIComponent(conversationId)}`;
+const toolFavorites = () => `${BASE_URL}/api/user/settings/favorites/tools`;
+const toolFavorite = (itemType, itemId) => `${toolFavorites()}/${itemType}/${encodeURIComponent(itemId)}`;
 const roles = () => `${BASE_URL}/api/roles`;
 const adminRoles = () => `${BASE_URL}/api/admin/roles`;
 const getRole$1 = (roleName) => `${roles()}/${encodeURIComponent(roleName)}`;
@@ -2652,7 +2953,7 @@ const disableTwoFactor$1 = () => `${BASE_URL}/api/auth/2fa/disable`;
 const regenerateBackupCodes$1 = () => `${BASE_URL}/api/auth/2fa/backup/regenerate`;
 const verifyTwoFactorTemp$1 = () => `${BASE_URL}/api/auth/2fa/verify-temp`;
 const memories = () => `${BASE_URL}/api/memories`;
-const memory = (key) => `${memories()}/${encodeURIComponent(key)}`;
+const memory = (key, agentId) => `${memories()}/${encodeURIComponent(key)}${agentId ? `?agentId=${encodeURIComponent(agentId)}` : ""}`;
 const memoryPreferences = () => `${memories()}/preferences`;
 const searchPrincipals$1 = (params) => {
 	const { q: query, limit, types } = params;
@@ -2935,7 +3236,12 @@ const StdioOptionsSchema = BaseOptionsSchema.extend({
 		"pipe",
 		"ignore",
 		"inherit"
-	]), z.number().int().nonnegative()]).optional()
+	]), z.number().int().nonnegative()]).optional(),
+	/**
+	* Working directory for the spawned process. Supplied by Agent Plugins
+	* packages, which resolve and contain the path before it reaches this schema.
+	*/
+	cwd: z.string().optional()
 });
 const WebSocketOptionsSchema = BaseOptionsSchema.extend({
 	type: z.literal("websocket").default("websocket"),
@@ -3071,6 +3377,9 @@ const defaultSocialLogins = [
 	"saml"
 ];
 const BASE_ONLY_CONFIG_SECTIONS = [];
+/** Sections that may be stored in the tenant's base config document but must
+* not be overridden or tombstoned by role, group, or user config documents. */
+const BASE_PRINCIPAL_CONFIG_SECTIONS = ["langfuse"];
 const defaultRetrievalModels = [
 	"gpt-4o",
 	"o1-preview-2024-09-12",
@@ -3154,6 +3463,32 @@ function isPrivateIPv4Literal(value) {
 	if (a >= 224) return true;
 	return false;
 }
+/**
+* Mirrors `hasPrivateEmbeddedIPv4` in `@librechat/api`'s ip helpers: 6to4, NAT64, and Teredo
+* carry an IPv4 address inside the IPv6 one, and the runtime guard blocks those when the
+* embedded address is private. Kept in sync so an operator can exempt what the runtime blocks.
+*/
+function hasPrivateEmbeddedIPv4Literal(value) {
+	const is6to4 = value.startsWith("2002:");
+	const isNat64 = value.startsWith("64:ff9b::");
+	const isTeredo = value.startsWith("2001::");
+	if (!is6to4 && !isNat64 && !isTeredo) return false;
+	const segments = value.split(":").filter((segment) => segment !== "");
+	const pair = is6to4 ? segments.slice(1, 3) : segments.slice(-2);
+	if (pair.length !== 2) return false;
+	const hi = parseInt(pair[0], 16);
+	const lo = parseInt(pair[1], 16);
+	if (isNaN(hi) || isNaN(lo)) return false;
+	/** RFC 4380: Teredo stores the external IPv4 as a bitwise complement. */
+	const high = isTeredo ? ~hi : hi;
+	const low = isTeredo ? ~lo : lo;
+	return isPrivateIPv4Literal([
+		high >> 8 & 255,
+		high & 255,
+		low >> 8 & 255,
+		low & 255
+	].join("."));
+}
 function isPrivateIPv6Literal(value) {
 	if (!value.includes(":")) return false;
 	if (value === "::1" || value === "::") return true;
@@ -3164,7 +3499,7 @@ function isPrivateIPv6Literal(value) {
 	}
 	const mappedMatch = value.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
 	if (mappedMatch) return isPrivateIPv4Literal(mappedMatch[1]);
-	return false;
+	return hasPrivateEmbeddedIPv4Literal(value);
 }
 /**
 * Mirrors the allowedAddresses parser in `@librechat/api`'s auth helpers.
@@ -3381,6 +3716,7 @@ let AgentCapabilities = /* @__PURE__ */ function(AgentCapabilities) {
 	AgentCapabilities["end_after_tools"] = "end_after_tools";
 	AgentCapabilities["deferred_tools"] = "deferred_tools";
 	AgentCapabilities["execute_code"] = "execute_code";
+	AgentCapabilities["stateful_code_sessions"] = "stateful_code_sessions";
 	AgentCapabilities["file_search"] = "file_search";
 	AgentCapabilities["web_search"] = "web_search";
 	AgentCapabilities["artifacts"] = "artifacts";
@@ -3388,9 +3724,13 @@ let AgentCapabilities = /* @__PURE__ */ function(AgentCapabilities) {
 	AgentCapabilities["actions"] = "actions";
 	AgentCapabilities["context"] = "context";
 	AgentCapabilities["skills"] = "skills";
+	AgentCapabilities["memory"] = "memory";
+	AgentCapabilities["ask_user_question"] = "ask_user_question";
 	AgentCapabilities["tools"] = "tools";
 	AgentCapabilities["chain"] = "chain";
 	AgentCapabilities["ocr"] = "ocr";
+	AgentCapabilities["run_in_background"] = "run_in_background";
+	AgentCapabilities["tool_intents"] = "tool_intents";
 	return AgentCapabilities;
 }({});
 const defaultAssistantsVersion = {
@@ -3398,7 +3738,14 @@ const defaultAssistantsVersion = {
 	["azureAssistants"]: 1
 };
 const baseEndpointSchema = z.object({
-	streamRate: z.number().optional(),
+	/**
+	* Milliseconds between visible streamed chunks. Agents SDK-backed
+	* providers (openAI, custom, anthropic, google, bedrock, agents) smooth
+	* adaptively at 25ms by default; set to override the cadence, 0 to
+	* disable smoothing. Legacy Assistants and Ollama paths instead sleep
+	* this long per provider chunk (default 1ms), with no adaptive smoothing.
+	*/
+	streamRate: z.number().min(0).optional(),
 	baseURL: z.string().optional(),
 	/**
 	* Custom request headers forwarded to the provider on every request. Values
@@ -3426,6 +3773,37 @@ const baseEndpointSchema = z.object({
 	* completes (legacy behavior).
 	*/
 	titleTiming: z.union([z.literal("immediate"), z.literal("final")]).optional(),
+	/**
+	* Agent activity groups: collapse each contiguous block of reasoning and
+	* tool calls under a generated one-line header. Mirrors the title options
+	* above — `activityLabel` enables it (like `titleConvo`), the rest tune
+	* the fast model that writes the label.
+	*
+	* NOTE: fields added here reach `endpoints.all` automatically (that schema
+	* is `baseEndpointSchema.omit({ baseURL })`), but NOT Azure — see the
+	* enumerated `.pick()` in `azureEndpointSchema` below.
+	*/
+	activityLabel: z.boolean().optional(),
+	/** Model used to write activity labels. Defaults to `titleModel`, then the agent's model. */
+	activityModel: z.string().optional(),
+	/** Endpoint whose credentials the label model runs on. Defaults to the agent's endpoint. */
+	activityEndpoint: z.string().optional(),
+	/** Overrides the system prompt used to write activity labels. */
+	activityPrompt: z.string().optional(),
+	/** Cost cap: maximum labels generated per run. Default 20. */
+	activityMaxPerRun: z.number().int().positive().optional(),
+	/** Per-entry truncation of tool input/output in the label prompt. Default 600. */
+	activityCharLimit: z.number().int().positive().optional(),
+	/** Generates one parent summary for each run phase containing 2+ activities. */
+	activityPhaseLabel: z.boolean().optional(),
+	/** Model used for phase summaries. Defaults to activityModel, titleModel, then the run model. */
+	activityPhaseModel: z.string().optional(),
+	/** Endpoint whose credentials the phase summary model uses. Defaults to activityEndpoint. */
+	activityPhaseEndpoint: z.string().optional(),
+	/** Overrides the dedicated phase-summary system prompt. */
+	activityPhasePrompt: z.string().optional(),
+	/** Cost cap: maximum phase summaries generated per run. Default 5. */
+	activityPhaseMaxPerRun: z.number().int().positive().optional(),
 	/** Maximum characters allowed in a single tool result before truncation. */
 	maxToolResultChars: z.number().positive().optional()
 });
@@ -3466,6 +3844,11 @@ const assistantEndpointSchema = baseEndpointSchema.merge(z.object({
 		"tools"
 	]),
 	apiKey: z.string().optional(),
+	/** Masked preview of the API key, stored at write time so admin
+	* reads can show which key is configured without returning the secret.
+	* Shared by both `endpoints.assistants` and `endpoints.azureAssistants`,
+	* which both use this schema. */
+	apiKeyPreview: z.string().optional(),
 	models: z.object({
 		default: z.array(modelItemSchema).min(1),
 		fetch: z.boolean().optional(),
@@ -3483,6 +3866,8 @@ const defaultAgentCapabilities = [
 	"actions",
 	"context",
 	"skills",
+	"memory",
+	"ask_user_question",
 	"tools",
 	"chain",
 	"ocr"
@@ -3528,17 +3913,136 @@ const remoteApiAuthSchema = z.object({
 	oidc: remoteApiOidcSchema.optional()
 });
 const remoteApiSchema = z.object({ auth: remoteApiAuthSchema.optional() });
+/**
+* Permission mode applied to a tool call. Mirrors `@librechat/agents`'s
+* `ToolPolicyMode` 1:1.
+*
+* - `default`: ask the user about anything not explicitly allowed (default-on).
+* - `dontAsk`: deny anything not explicitly allowed (headless / API-key flows).
+* - `bypass`: auto-approve everything that isn't explicitly denied
+*   (the user-facing "stop asking me" toggle).
+*
+* Subagents inherit the parent's mode; this is enforced by the SDK and not
+* overridable per-subagent.
+*/
+const toolApprovalModeSchema = z.enum([
+	"default",
+	"dontAsk",
+	"bypass"
+]);
+/**
+* Per-endpoint tool-approval policy.
+*
+* Shape mirrors `@librechat/agents`'s `ToolPolicyConfig` so the host can map it
+* directly into `createToolPolicyHook(config)`. The SDK does the evaluation
+* (`deny → bypass → allow → ask → dontAsk → fallthrough(ask)`); this config
+* just describes the surface.
+*
+* Conventions:
+* - All list entries are matched as globs (`*`). Use `mcp:server:*` to scope
+*   a rule to every tool from a single MCP server.
+* - `deny` always wins, including under `bypass`.
+* - `enabled: false` is a LibreChat-only kill switch that disables the entire
+*   HITL machinery for this endpoint (no checkpointer, no hooks, no prompts).
+*   This is admin-level; users toggle prompting via `mode: 'bypass'` instead.
+*/
+/**
+* A programmatic tool-approval hook loaded from a module at startup.
+*
+* The referenced module's default export must be a builder
+* `(options?) => ToolApprovalHookFactory` (see `@librechat/api`'s `registerToolApprovalHook`).
+* Hooks compose with the static `allow`/`deny`/`ask` policy above and can only TIGHTEN it
+* (the SDK folds decisions `deny → ask → allow`). This is admin-level config — the module is
+* dynamically imported and executed in-process, so only reference trusted code.
+*/
+const toolApprovalHookConfigSchema = z.object({
+	/**
+	* Module specifier to import: a bare package name (e.g. `@acme/approval-hooks`) or a path —
+	* absolute, or relative to the app root. Its default export is the hook builder.
+	*/
+	module: z.string().min(1),
+	/** Optional regex matched against the tool name; omit to run for every tool. */
+	matcher: z.string().optional(),
+	/** Static options forwarded to the module's builder; the hook's own per-call config. */
+	options: z.record(z.unknown()).optional()
+});
+const toolApprovalPolicySchema = z.object({
+	enabled: z.boolean().optional(),
+	mode: toolApprovalModeSchema.optional(),
+	allow: z.array(z.string()).optional(),
+	deny: z.array(z.string()).optional(),
+	ask: z.array(z.string()).optional(),
+	/** Optional reason template surfaced in the prompt; `{tool}` is interpolated. */
+	reason: z.string().optional(),
+	/**
+	* Programmatic policy hooks loaded from modules at startup. They layer on top of the
+	* static lists above for dynamic, context-aware decisions the lists can't express
+	* (per-args, per-agent, per-user). See {@link toolApprovalHookConfigSchema}.
+	*
+	* BASE-CONFIG ONLY: hooks are imported + registered once, process-wide, at server
+	* startup — they are NOT reloaded from per-role/user/tenant admin overrides. Encode
+	* per-user/tenant behavior INSIDE the hook (via its runtime context), not by varying the
+	* module list per override. Honored only when `enabled` is true.
+	*/
+	hooks: z.array(toolApprovalHookConfigSchema).optional()
+}).optional();
+/**
+* Durable checkpointer backing human-in-the-loop resume.
+*
+* When `toolApproval.enabled` is true, a run that pauses for review suspends its
+* LangGraph state to a checkpoint; resuming rebuilds that state on a *fresh* `Run`
+* — possibly on a different replica, or the same worker after a restart. That only
+* works if the checkpoint outlives the original request, so HITL needs a durable
+* saver, not the SDK's process-local `MemorySaver` fallback.
+*
+* Defaults are zero-config: with `toolApproval.enabled` on and no `checkpointer`
+* block, LibreChat persists checkpoints to its primary MongoDB, so resume works
+* across replicas out of the box.
+*
+* - `type: 'mongo'` (default) — persist to the app database; survives restarts and
+*   resolves on any replica. A TTL index reclaims runs that are never resolved.
+* - `type: 'memory'` — process-local only. Paused runs do NOT survive a restart and
+*   can only be resolved on the originating worker. Single-process / dev only.
+*/
+const checkpointerTypeSchema = z.enum(["mongo", "memory"]);
+const checkpointerSchema = z.object({
+	type: checkpointerTypeSchema.optional(),
+	/**
+	* Approval window, in seconds: how long a paused run waits for a decision
+	* before it is reclaimed. Drives both the Mongo TTL index on checkpoints and
+	* the pending-action expiry, keeping the two layers in lockstep. Defaults to
+	* 86400 (24h). Raise it for longer review windows.
+	*/
+	ttl: z.number().int().positive().optional(),
+	/** Advanced: override the Mongo collection names used for checkpoints. */
+	checkpointCollectionName: z.string().optional(),
+	checkpointWritesCollectionName: z.string().optional()
+}).optional();
 const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(z.object({
 	recursionLimit: z.number().optional(),
 	disableBuilder: z.boolean().optional().default(false),
 	maxRecursionLimit: z.number().optional(),
+	/** Max cumulative bytes a single streamed tool call's arguments may reach before the run
+	* aborts. Defaults to 64 KiB in the agents SDK; `0` disables the guard. */
+	maxToolCallArgBytes: z.number().optional(),
+	/** Max streamed chunk events per model generation before the run aborts. Off by default. */
+	maxDeltaEventsPerTurn: z.number().optional(),
+	/** Per-tool overrides of `maxToolCallArgBytes`, keyed by model-facing tool name; `0`
+	* disables the guard for that tool only. Merged over LibreChat's shipped default of
+	* `{ create_file: 131072 }`. */
+	maxToolCallArgBytesByTool: z.record(z.number()).optional(),
 	maxCitations: z.number().min(1).max(50).optional().default(30),
 	maxCitationsPerFile: z.number().min(1).max(10).optional().default(7),
 	minRelevanceScore: z.number().min(0).max(1).optional().default(.45),
 	allowedProviders: z.array(z.union([z.string(), eModelEndpointSchema])).optional(),
 	capabilities: z.array(z.nativeEnum(AgentCapabilities)).optional().default(defaultAgentCapabilities),
 	skills: z.object({ maxCatalogSkills: z.number().int().min(1).max(100).optional() }).optional(),
-	remoteApi: remoteApiSchema.optional()
+	remoteApi: remoteApiSchema.optional(),
+	/** Human-in-the-loop tool approval policy. Off by default. */
+	toolApproval: toolApprovalPolicySchema,
+	/** Durable checkpointer backing tool-approval and Ask User resume.
+	*  Defaults to the app's MongoDB when either flow needs it. */
+	checkpointer: checkpointerSchema
 })).default({
 	disableBuilder: false,
 	capabilities: defaultAgentCapabilities,
@@ -3597,6 +4101,9 @@ const paramDefinitionSchema = z.object({
 const endpointSchema = baseEndpointSchema.merge(z.object({
 	name: z.string().refine((value) => !eModelEndpointSchema.safeParse(value).success, { message: `Value cannot be one of the default endpoint (EModelEndpoint) values: ${Object.values(EModelEndpoint).join(", ")}` }),
 	apiKey: z.string(),
+	/** Masked preview of the API key, stored at write time so admin
+	* reads can show which key is configured without returning the secret. */
+	apiKeyPreview: z.string().optional(),
 	baseURL: z.string(),
 	models: z.object({
 		default: z.array(modelItemSchema).min(1),
@@ -3644,15 +4151,35 @@ const endpointSchema = baseEndpointSchema.merge(z.object({
 const azureEndpointSchema = z.object({
 	groups: azureGroupConfigsSchema,
 	assistants: z.boolean().optional()
-}).and(endpointSchema.pick({
-	streamRate: true,
-	titleConvo: true,
-	titleMethod: true,
-	titleModel: true,
-	titlePrompt: true,
-	titleTiming: true,
-	titlePromptTemplate: true
-}).partial());
+}).and(
+	/**
+	* Azure carries only the base-endpoint fields enumerated here. This is a
+	* `.pick()`, NOT an omit, so a field added to `baseEndpointSchema` is
+	* silently unavailable on Azure endpoints until it is listed below —
+	* unlike `endpoints.all`, which omits and therefore inherits new fields
+	* automatically. Keep this list in sync when adding endpoint options.
+	*/
+	endpointSchema.pick({
+		streamRate: true,
+		titleConvo: true,
+		titleMethod: true,
+		titleModel: true,
+		titlePrompt: true,
+		titleTiming: true,
+		titlePromptTemplate: true,
+		activityLabel: true,
+		activityModel: true,
+		activityEndpoint: true,
+		activityPrompt: true,
+		activityMaxPerRun: true,
+		activityCharLimit: true,
+		activityPhaseLabel: true,
+		activityPhaseModel: true,
+		activityPhaseEndpoint: true,
+		activityPhasePrompt: true,
+		activityPhaseMaxPerRun: true
+	}).partial()
+);
 /**
 * Vertex AI model configuration - similar to Azure model config
 * Allows specifying deployment name for each model
@@ -3688,15 +4215,20 @@ const anthropicEndpointSchema = baseEndpointSchema.merge(z.object({
 	/** Optional: List of available models */
 	models: z.array(z.string()).optional()
 }));
+/** Masked preview of the API key, stored at write time so admin
+* reads can show which key is configured without returning the secret. */
+const apiKeyPreviewSchema = z.string().optional();
 const ttsOpenaiSchema = z.object({
 	url: z.string().optional(),
 	apiKey: z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: z.string(),
 	voices: z.array(z.string())
 });
 const ttsAzureOpenAISchema = z.object({
 	instanceName: z.string(),
 	apiKey: z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	deploymentName: z.string(),
 	apiVersion: z.string(),
 	model: z.string(),
@@ -3706,6 +4238,7 @@ const ttsElevenLabsSchema = z.object({
 	url: z.string().optional(),
 	websocketUrl: z.string().optional(),
 	apiKey: z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: z.string(),
 	voices: z.array(z.string()),
 	voice_settings: z.object({
@@ -3719,10 +4252,12 @@ const ttsElevenLabsSchema = z.object({
 const ttsLocalaiSchema = z.object({
 	url: z.string(),
 	apiKey: z.string().optional(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	voices: z.array(z.string()),
 	backend: z.string()
 });
 const ttsSchema = z.object({
+	allowedAddresses: allowedAddressesSchema,
 	openai: ttsOpenaiSchema.optional(),
 	azureOpenAI: ttsAzureOpenAISchema.optional(),
 	elevenlabs: ttsElevenLabsSchema.optional(),
@@ -3731,15 +4266,18 @@ const ttsSchema = z.object({
 const sttOpenaiSchema = z.object({
 	url: z.string().optional(),
 	apiKey: z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: z.string()
 });
 const sttAzureOpenAISchema = z.object({
 	instanceName: z.string(),
 	apiKey: z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	deploymentName: z.string(),
 	apiVersion: z.string()
 });
 const sttSchema = z.object({
+	allowedAddresses: allowedAddressesSchema,
 	openai: sttOpenaiSchema.optional(),
 	azureOpenAI: sttAzureOpenAISchema.optional()
 });
@@ -3747,16 +4285,23 @@ const speechTab = z.object({
 	conversationMode: z.boolean().optional(),
 	advancedMode: z.boolean().optional(),
 	speechToText: z.boolean().optional().or(z.object({
-		/** Keep in sync with STTProviders enum (defined below — cannot reference due to eval order) */
-		engineSTT: z.enum(["openai", "azureOpenAI"]).optional(),
+		/** Provider names remain valid for backward compatibility and are normalized for clients. */
+		engineSTT: z.enum([
+			"browser",
+			"external",
+			"openai",
+			"azureOpenAI"
+		]).optional(),
 		languageSTT: z.string().optional(),
 		autoTranscribeAudio: z.boolean().optional(),
 		decibelValue: z.number().optional(),
 		autoSendText: z.number().optional()
 	})).optional(),
 	textToSpeech: z.boolean().optional().or(z.object({
-		/** Keep in sync with TTSProviders enum (defined below — cannot reference due to eval order) */
+		/** Provider names remain valid for backward compatibility and are normalized for clients. */
 		engineTTS: z.enum([
+			"browser",
+			"external",
 			"openai",
 			"azureOpenAI",
 			"elevenlabs",
@@ -4017,18 +4562,25 @@ let SafeSearchTypes = /* @__PURE__ */ function(SafeSearchTypes) {
 	return SafeSearchTypes;
 }({});
 const webSearchSchema = z.object({
+	allowedAddresses: allowedAddressesSchema,
 	serperApiKey: z.string().optional().default("${SERPER_API_KEY}"),
+	serperApiKeyPreview: apiKeyPreviewSchema,
 	searxngInstanceUrl: z.string().optional().default("${SEARXNG_INSTANCE_URL}"),
 	searxngApiKey: z.string().optional().default("${SEARXNG_API_KEY}"),
+	searxngApiKeyPreview: apiKeyPreviewSchema,
 	firecrawlApiKey: z.string().optional().default("${FIRECRAWL_API_KEY}"),
+	firecrawlApiKeyPreview: apiKeyPreviewSchema,
 	firecrawlApiUrl: z.string().optional().default("${FIRECRAWL_API_URL}"),
 	firecrawlVersion: z.string().optional().default("${FIRECRAWL_VERSION}"),
 	tavilyApiKey: z.string().optional().default("${TAVILY_API_KEY}"),
+	tavilyApiKeyPreview: apiKeyPreviewSchema,
 	tavilySearchUrl: z.string().optional().default("${TAVILY_SEARCH_URL}"),
 	tavilyExtractUrl: z.string().optional().default("${TAVILY_EXTRACT_URL}"),
 	jinaApiKey: z.string().optional().default("${JINA_API_KEY}"),
+	jinaApiKeyPreview: apiKeyPreviewSchema,
 	jinaApiUrl: z.string().optional().default("${JINA_API_URL}"),
 	cohereApiKey: z.string().optional().default("${COHERE_API_KEY}"),
+	cohereApiKeyPreview: apiKeyPreviewSchema,
 	searchProvider: z.nativeEnum(SearchProviders).optional(),
 	scraperProvider: z.nativeEnum(ScraperProviders).optional(),
 	rerankerType: z.nativeEnum(RerankerTypes).optional(),
@@ -4104,8 +4656,10 @@ const webSearchSchema = z.object({
 	}).optional()
 });
 const ocrSchema = z.object({
+	allowedAddresses: allowedAddressesSchema,
 	mistralModel: z.string().optional(),
 	apiKey: z.string().optional().default("${OCR_API_KEY}"),
+	apiKeyPreview: apiKeyPreviewSchema,
 	baseURL: z.string().optional().default("${OCR_BASEURL}"),
 	strategy: z.nativeEnum(OCRStrategy).default("mistral_ocr")
 });
@@ -4163,6 +4717,10 @@ const contextPruningSchema = z.object({
 	hardClearRatio: z.number().min(0).max(1).optional(),
 	minPrunableToolChars: z.number().min(0).optional()
 });
+const retainRecentConfigSchema = z.object({
+	turns: z.number().min(0).max(20).optional(),
+	tokens: z.number().positive().optional()
+});
 const summarizationConfigSchema = z.object({
 	enabled: z.boolean().optional(),
 	provider: z.string().optional(),
@@ -4178,31 +4736,56 @@ const summarizationConfigSchema = z.object({
 	updatePrompt: z.string().optional(),
 	reserveRatio: z.number().min(0).max(1).optional(),
 	maxSummaryTokens: z.number().positive().optional(),
-	contextPruning: contextPruningSchema.optional()
+	contextPruning: contextPruningSchema.optional(),
+	retainRecent: retainRecentConfigSchema.optional()
 });
 const customEndpointsSchema = z.array(endpointSchema.partial()).optional();
+/**
+* Validates a messageFilter PII regex at config load. Defaults to native RegExp so browser
+* builds add no extra engine; the server injects a check backed by the linear-time runtime
+* engine (RE2) via setMessageFilterRegexValidator, so a pattern the runtime cannot compile
+* (backreferences, lookaround, control escapes, and so on) is rejected at load rather than
+* silently dropped at request time.
+*/
+let messageFilterRegexValidator = (value) => {
+	try {
+		new RegExp(value, "g");
+		return true;
+	} catch {
+		return false;
+	}
+};
+const setMessageFilterRegexValidator = (validate) => {
+	messageFilterRegexValidator = validate;
+};
 const messageFilterPiiCustomPatternSchema = z.object({
 	id: z.string().min(1),
 	label: z.string().min(1),
-	regex: z.string().min(1).refine((value) => {
-		try {
-			new RegExp(value, "g");
-			return true;
-		} catch {
-			return false;
-		}
-	}, { message: "Invalid regex" })
+	regex: z.string().min(1).refine((value) => messageFilterRegexValidator(value), { message: "Unsupported regex: not compatible with the RE2 engine (no backreferences, lookaround, or control escapes)" })
 });
 const messageFilterPiiSchema = z.object({
 	starterPatterns: z.array(z.string()).optional(),
 	customPatterns: z.array(messageFilterPiiCustomPatternSchema).optional()
 });
 const messageFilterSchema = z.object({ pii: messageFilterPiiSchema.optional() });
+const langfuseConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	publicKey: z.string().optional(),
+	secretKey: z.string().optional(),
+	/** Stable Langfuse project identity returned when credentials are verified. */
+	projectId: z.string().optional(),
+	/** Masked preview of the secret key, stored at write time so
+	* admin reads can show which secret key is configured without returning the secret. */
+	secretKeyPreview: z.string().optional(),
+	/** Routing key for one of the deployment-configured tenant Langfuse destinations. */
+	destination: z.string().optional()
+});
 const configSchema = z.object({
 	version: z.string(),
 	cache: z.boolean().default(true),
 	ocr: ocrSchema.optional(),
 	webSearch: webSearchSchema.optional(),
+	langfuse: langfuseConfigSchema.optional(),
 	memory: memorySchema.optional(),
 	summarization: summarizationConfigSchema.optional(),
 	skillSync: skillSyncConfigSchema,
@@ -4241,6 +4824,13 @@ const configSchema = z.object({
 	messageFilter: messageFilterSchema.optional(),
 	endpoints: z.object({
 		allowedAddresses: allowedAddressesSchema,
+		/**
+		* Defaults applied to every endpoint. Omit-based, so options added to
+		* `baseEndpointSchema` are inherited here automatically — no list to
+		* maintain (contrast `azureEndpointSchema`, which enumerates via
+		* `.pick()`). Resolution order at read sites is `all` > the named
+		* endpoint > a custom endpoint's own config.
+		*/
 		all: baseEndpointSchema.omit({ baseURL: true }).optional(),
 		["openAI"]: baseEndpointSchema.optional(),
 		["google"]: baseEndpointSchema.optional(),
@@ -4310,6 +4900,9 @@ const alternateName = {
 	["helicone"]: "Helicone"
 };
 const sharedOpenAIModels = [
+	"gpt-5.6",
+	"gpt-5.6-terra",
+	"gpt-5.6-luna",
 	"gpt-5.5",
 	"gpt-5.5-pro",
 	"chat-latest",
@@ -4334,8 +4927,10 @@ const sharedOpenAIModels = [
 ];
 const sharedAnthropicModels = [
 	"claude-fable-5",
+	"claude-opus-5",
 	"claude-opus-4-8",
 	"claude-opus-4-7",
+	"claude-sonnet-5",
 	"claude-sonnet-4-6",
 	"claude-opus-4-6",
 	"claude-sonnet-4-5",
@@ -4356,18 +4951,25 @@ const sharedAnthropicModels = [
 	"claude-3-5-sonnet-20240620",
 	"claude-3-5-sonnet-latest"
 ];
+/**
+* Claude 4+ models are not invocable on-demand by their bare foundation-model
+* ID on the Converse path — Bedrock rejects those with "Invocation of model ID
+* ... with on-demand throughput isn't supported. Retry your request with the ID
+* or ARN of an inference profile that contains this model." Default to the
+* `global.` cross-region profile (no regional pricing premium, widest
+* availability); Opus 4.1 has no global profile, so it uses `us.`.
+*/
 const bedrockModels = [
-	"anthropic.claude-fable-5",
-	"anthropic.claude-opus-4-8",
-	"anthropic.claude-opus-4-7",
-	"anthropic.claude-sonnet-4-6",
-	"anthropic.claude-opus-4-6-v1",
-	"anthropic.claude-sonnet-4-5-20250929-v1:0",
-	"anthropic.claude-haiku-4-5-20251001-v1:0",
-	"anthropic.claude-opus-4-1-20250805-v1:0",
-	"anthropic.claude-3-5-sonnet-20241022-v2:0",
-	"anthropic.claude-3-5-sonnet-20240620-v1:0",
-	"anthropic.claude-3-5-haiku-20241022-v1:0",
+	"global.anthropic.claude-fable-5",
+	"global.anthropic.claude-opus-5",
+	"global.anthropic.claude-opus-4-8",
+	"global.anthropic.claude-opus-4-7",
+	"global.anthropic.claude-sonnet-5",
+	"global.anthropic.claude-sonnet-4-6",
+	"global.anthropic.claude-opus-4-6-v1",
+	"global.anthropic.claude-sonnet-4-5-20250929-v1:0",
+	"global.anthropic.claude-haiku-4-5-20251001-v1:0",
+	"us.anthropic.claude-opus-4-1-20250805-v1:0",
 	"cohere.command-r-v1:0",
 	"cohere.command-r-plus-v1:0",
 	"meta.llama2-13b-chat-v1",
@@ -4392,7 +4994,10 @@ const defaultModels = {
 	["assistants"]: [...sharedOpenAIModels, "chatgpt-4o-latest"],
 	["agents"]: sharedOpenAIModels,
 	["google"]: [
+		"gemini-3.7-flash",
+		"gemini-3.6-flash",
 		"gemini-3.5-flash",
+		"gemini-3.5-flash-lite",
 		"gemini-3.1-pro-preview",
 		"gemini-3.1-pro-preview-customtools",
 		"gemini-3.1-flash-lite-preview",
@@ -4552,6 +5157,14 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	*/
 	CacheKeys["ROLES"] = "ROLES";
 	/**
+	* Key for cached group memberships used to resolve ACL user principals.
+	*/
+	CacheKeys["USER_PRINCIPALS"] = "USER_PRINCIPALS";
+	/**
+	* Key for per-conversation stateful code sandbox prewarm/warm state.
+	*/
+	CacheKeys["SANDBOX_PREWARM"] = "SANDBOX_PREWARM";
+	/**
 	* Key for the title generation cache.
 	*/
 	CacheKeys["GEN_TITLE"] = "GEN_TITLE";
@@ -4621,6 +5234,10 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	*/
 	CacheKeys["OPENID_EXCHANGED_TOKENS"] = "OPENID_EXCHANGED_TOKENS";
 	/**
+	* Key for cached authenticated user documents.
+	*/
+	CacheKeys["AUTH_USER_DOC"] = "AUTH_USER_DOC";
+	/**
 	* Key for OpenID session.
 	*/
 	CacheKeys["OPENID_SESSION"] = "OPENID_SESSION";
@@ -4634,6 +5251,7 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	CacheKeys["ADMIN_OAUTH_EXCHANGE"] = "ADMIN_OAUTH_EXCHANGE";
 	return CacheKeys;
 }({});
+const AUTH_USER_DOC_BY_ID_PREFIX = "auth-user-doc-byid";
 /**
 * Enum for violation types, used to identify, log, and cache violations.
 */
@@ -4757,6 +5375,14 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	*/
 	ErrorTypes["GOOGLE_TOOL_CONFLICT"] = "google_tool_conflict";
 	/**
+	* Google provider could not process a linked video (most often longer than the model accepts)
+	*/
+	ErrorTypes["GOOGLE_VIDEO_UNPROCESSABLE"] = "google_video_unprocessable";
+	/**
+	* Required CodeAPI resources could not be restored before model invocation.
+	*/
+	ErrorTypes["RESOURCE_RECOVERY_REQUIRED"] = "resource_recovery_required";
+	/**
 	* Invalid Agent Provider (excluded by Admin)
 	*/
 	ErrorTypes["INVALID_AGENT_PROVIDER"] = "invalid_agent_provider";
@@ -4849,6 +5475,10 @@ let SettingsTabValues = /* @__PURE__ */ function(SettingsTabValues) {
 	*/
 	SettingsTabValues["SPEECH"] = "speech";
 	/**
+	* Tab for Langfuse Settings
+	*/
+	SettingsTabValues["LANGFUSE"] = "langfuse";
+	/**
 	* Tab for Beta Features
 	*/
 	SettingsTabValues["BETA"] = "beta";
@@ -4911,7 +5541,7 @@ let TTSProviders = /* @__PURE__ */ function(TTSProviders) {
 /** Enum for app-wide constants */
 let Constants = /* @__PURE__ */ function(Constants) {
 	/**
-	* Key for the app's version. The placeholder `v0.8.7` is
+	* Key for the app's version. The placeholder `v0.8.8-rc1` is
 	* swapped in by `@rollup/plugin-replace` during `npm run build:data-provider`
 	* using the value of the root `package.json`'s `version` field. Consumers
 	* always import this via the built dist bundle (see `main` field in
@@ -4919,9 +5549,9 @@ let Constants = /* @__PURE__ */ function(Constants) {
 	* substituted value. Only tests that import the TypeScript source directly
 	* would observe the raw placeholder.
 	*/
-	Constants["VERSION"] = "v0.8.7";
+	Constants["VERSION"] = "v0.8.8-rc1";
 	/** Key for the Custom Config's version (librechat.yaml). */
-	Constants["CONFIG_VERSION"] = "1.3.13";
+	Constants["CONFIG_VERSION"] = "1.3.14";
 	/** Standard value for the first message's `parentMessageId` value, to indicate no parent exists. */
 	Constants["NO_PARENT"] = "00000000-0000-0000-0000-000000000000";
 	/** Standard value to use whatever the submission prelim. `responseMessageId` is */
@@ -4973,8 +5603,126 @@ let Constants = /* @__PURE__ */ function(Constants) {
 	Constants["BASH_PROGRAMMATIC_TOOL_CALLING"] = "run_tools_with_bash";
 	/** Subagent spawn tool name (must match `@librechat/agents` `Constants.SUBAGENT`). */
 	Constants["SUBAGENT"] = "subagent";
+	/** Poll tool for retrieving the status/result of a backgrounded tool call. */
+	Constants["CHECK_BACKGROUND_TASK"] = "check_background_task";
 	return Constants;
 }({});
+/**
+* Normalizes a server name into the character set tool keys are built from.
+* Tool keys embed this output, so any candidate list matched against a key must
+* be normalized the same way.
+*/
+function normalizeServerName(serverName) {
+	if (/^[a-zA-Z0-9_.-]+$/.test(serverName)) return serverName;
+	const normalized = serverName.replace(/[^a-zA-Z0-9_.-]/g, "_").replace(/^_+|_+$/g, "");
+	if (normalized) return normalized;
+	/** All characters were stripped; hash the original so the name stays unique. */
+	let hash = 0;
+	for (let i = 0; i < serverName.length; i++) {
+		hash = (hash << 5) - hash + serverName.charCodeAt(i);
+		hash |= 0;
+	}
+	return `server_${Math.abs(hash)}`;
+}
+/**
+* Splits a combined MCP tool key (`${rawToolName}${mcp_delimiter}${serverName}`)
+* back into its two parts.
+*
+* Both halves can legitimately contain the delimiter, so position alone cannot
+* identify the boundary. Raw tool names come from the upstream server and are
+* untrusted (`get_mcp_server_version`, or a gateway-prefixed
+* `gitlab-get_mcp_server_version`), and `normalizeServerName` preserves
+* underscores, so a configured server may be named `Google_mcp_Workspace`.
+*
+* When `knownServerNames` is supplied the boundary is resolved against it: the
+* longest configured name the key actually ends with wins. Otherwise this falls
+* back to the last delimiter, which is correct whenever only the tool half
+* contains one and matches `.split()` when neither does.
+*
+* One case stays undecidable from the key alone: if both `bar` and `foo_mcp_bar`
+* are configured, `tool_mcp_foo_mcp_bar` is a valid key for either. Longest match
+* is the deterministic tiebreak; resolving it properly needs the tool/server
+* mapping carried alongside the key rather than re-derived from the string.
+*/
+/**
+* Maps each configured server name's normalized form back to the raw config
+* name. Model-facing tool keys embed `normalizeServerName(server)`, while the
+* registry, config maps, tool cache, and plugin-auth rows are keyed by the raw
+* name — any consumer that parses a server out of a tool key must resolve it
+* through this map before those lookups. Identity entries are included so
+* `aliases.get(name) ?? name` works uniformly.
+*
+* When two configured names normalize to the same value their tool keys are
+* inherently ambiguous; the FIRST configured name wins deterministically here,
+* and `resolveMCPServerContext` warns about the collision so the operator can
+* rename one server.
+*/
+function buildServerNameAliases(rawServerNames) {
+	const aliases = /* @__PURE__ */ new Map();
+	/** Identity entries claim their slot FIRST regardless of configuration
+	*  order: a server literally named `foo` must never have its keys rerouted
+	*  to a `foo!` whose normalized form collides with it. */
+	for (const raw of rawServerNames) if (raw && normalizeServerName(raw) === raw) aliases.set(raw, raw);
+	for (const raw of rawServerNames) {
+		if (!raw) continue;
+		const normalized = normalizeServerName(raw);
+		if (!aliases.has(normalized)) aliases.set(normalized, raw);
+	}
+	return aliases;
+}
+/**
+* Rewrites a tool key's server segment into the normalized form model-facing
+* keys carry, resolving the boundary against the configured raw names (longest
+* suffix wins, mirroring {@link splitMCPToolKey}). Returns the key unchanged
+* when no configured raw name matches — already-normalized keys, placeholder
+* tokens, and keys for servers that are no longer configured all pass through.
+* Idempotent: a normalized segment never matches a raw candidate that needs
+* rewriting.
+*/
+function normalizeMCPToolKey(toolKey, rawServerNames) {
+	let matched;
+	for (let i = 0; i < rawServerNames.length; i++) {
+		const raw = rawServerNames[i];
+		if (!raw || raw.length <= (matched?.length ?? 0)) continue;
+		if (toolKey.endsWith(`_mcp_${raw}`)) matched = raw;
+	}
+	if (matched == null) return toolKey;
+	const normalized = normalizeServerName(matched);
+	if (normalized === matched) return toolKey;
+	return `${toolKey.slice(0, toolKey.length - matched.length)}${normalized}`;
+}
+function splitMCPToolKey(toolKey, knownServerNames) {
+	if (knownServerNames?.length) {
+		let matched;
+		for (let i = 0; i < knownServerNames.length; i++) {
+			const serverName = knownServerNames[i];
+			if (!serverName || serverName.length <= (matched?.length ?? 0)) continue;
+			if (toolKey.endsWith(`_mcp_${serverName}`)) matched = serverName;
+		}
+		if (matched != null) return [toolKey.slice(0, toolKey.length - matched.length - 5), matched];
+	}
+	const idx = toolKey.lastIndexOf("_mcp_");
+	if (idx === -1) return [toolKey, void 0];
+	return [toolKey.slice(0, idx), toolKey.slice(idx + 5)];
+}
+/**
+* Splits a tool-call name for display, where the key may be a synthetic MCP OAuth
+* call (`oauth${mcp_delimiter}${serverName}`) rather than a real tool key.
+*
+* A configured server name is authoritative when one matches, because a real tool key
+* always ends in its server. Only when none matches does the `oauth` prefix decide,
+* which keeps a genuine upstream tool named `oauth${mcp_delimiter}...` from being read
+* as a synthetic call while still resolving OAuth prompts for unconfigured servers.
+*/
+function splitToolCallName(toolCallName, knownServerNames) {
+	if (knownServerNames?.length) {
+		const [toolName, serverName] = splitMCPToolKey(toolCallName, knownServerNames);
+		if (serverName != null && knownServerNames.includes(serverName)) return [toolName, serverName];
+	}
+	const oauthPrefix = `oauth_mcp_`;
+	if (toolCallName.startsWith(oauthPrefix)) return ["oauth", toolCallName.slice(oauthPrefix.length)];
+	return splitMCPToolKey(toolCallName, knownServerNames);
+}
 /** Maximum explicit subagent hops allowed from any root agent at runtime. */
 const MAX_SUBAGENT_DEPTH = 5;
 /** Maximum unique explicit subagent targets that may be loaded at runtime. */
@@ -5026,6 +5774,8 @@ let LocalStorageKeys = /* @__PURE__ */ function(LocalStorageKeys) {
 	LocalStorageKeys["LAST_ARTIFACTS_TOGGLE_"] = "LAST_ARTIFACTS_TOGGLE_";
 	/** Last checked toggle for Skills per conversation ID */
 	LocalStorageKeys["LAST_SKILLS_TOGGLE_"] = "LAST_SKILLS_TOGGLE_";
+	/** Last checked toggle for Memory per conversation ID */
+	LocalStorageKeys["LAST_MEMORY_TOGGLE_"] = "LAST_MEMORY_TOGGLE_";
 	/** Key for the last selected agent provider */
 	LocalStorageKeys["LAST_AGENT_PROVIDER"] = "lastAgentProvider";
 	/** Key for the last selected agent model */
@@ -5344,13 +6094,14 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["searchConversations"] = "searchConversations";
 	QueryKeys["conversation"] = "conversation";
 	QueryKeys["searchEnabled"] = "searchEnabled";
+	QueryKeys["langfuseConnection"] = "langfuseConnection";
+	QueryKeys["langfuseSessionLink"] = "langfuseSessionLink";
 	QueryKeys["user"] = "user";
 	QueryKeys["name"] = "name";
 	QueryKeys["models"] = "models";
 	QueryKeys["balance"] = "balance";
 	QueryKeys["endpoints"] = "endpoints";
 	QueryKeys["tokenConfig"] = "tokenConfig";
-	QueryKeys["contextProjection"] = "contextProjection";
 	QueryKeys["presets"] = "presets";
 	QueryKeys["searchResults"] = "searchResults";
 	QueryKeys["tokenCount"] = "tokenCount";
@@ -5410,17 +6161,20 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["skillFileContent"] = "skillFileContent";
 	QueryKeys["skillTree"] = "skillTree";
 	QueryKeys["skillNodeContent"] = "skillNodeContent";
-	QueryKeys["skillFavorites"] = "skillFavorites";
+	QueryKeys["toolFavorites"] = "toolFavorites";
 	QueryKeys["skillStates"] = "skillStates";
 	QueryKeys["favorites"] = "favorites";
 	return QueryKeys;
 }({});
 const DynamicQueryKeys = { agentFiles: (agentId) => ["agentFiles", agentId] };
 let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
+	MutationKeys["updateLangfuseConnection"] = "updateLangfuseConnection";
+	MutationKeys["testLangfuseConnection"] = "testLangfuseConnection";
 	MutationKeys["createAgentApiKey"] = "createAgentApiKey";
 	MutationKeys["deleteAgentApiKey"] = "deleteAgentApiKey";
 	MutationKeys["fileUpload"] = "fileUpload";
 	MutationKeys["fileDelete"] = "fileDelete";
+	MutationKeys["fileUsage"] = "fileUsage";
 	MutationKeys["updatePreset"] = "updatePreset";
 	MutationKeys["deletePreset"] = "deletePreset";
 	MutationKeys["loginUser"] = "loginUser";
@@ -5509,6 +6263,7 @@ const TOKEN_REFRESH_BUFFER_MS = 120 * 1e3;
 const refreshToken = (retry) => _post(refreshToken$1(retry));
 const SHARE_PAGE_PATH_REGEX = /^\/share\/[^/]+\/?$/;
 const SHARED_MESSAGES_PATH_REGEX = /^\/api\/share\/[^/]+$/;
+const SHARE_FORK_PATH_REGEX = /^\/api\/share\/[^/]+\/fork$/;
 const normalizePathname = (pathname) => pathname.startsWith("/") ? pathname : `/${pathname}`;
 const stripBasePath = (pathname) => {
 	const normalizedPathname = normalizePathname(pathname);
@@ -5528,6 +6283,11 @@ const getRequestPathname = (url) => {
 	}
 };
 const isSharedMessagesRequest = (url, method) => method?.toLowerCase() === "get" && SHARED_MESSAGES_PATH_REGEX.test(stripBasePath(getRequestPathname(url)));
+/** The "continue this chat" fork is a deliberate authenticated action initiated
+*  from a share page, so it must reach auth recovery/redirect like the shared
+*  data request — otherwise a logged-out (or cold-loaded) viewer's 401 is
+*  rejected silently instead of routing them through login. */
+const isShareForkRequest = (url, method) => method?.toLowerCase() === "post" && SHARE_FORK_PATH_REGEX.test(stripBasePath(getRequestPathname(url)));
 const dispatchTokenUpdatedEvent = (token) => {
 	setTokenHeader(token);
 	clearAuthRedirectStartedAt();
@@ -5626,16 +6386,42 @@ const shouldRefreshBeforeRequest = (url) => {
 	const timeUntilExpiry = expiresAt - Date.now();
 	return timeUntilExpiry > 0 && timeUntilExpiry <= TOKEN_REFRESH_BUFFER_MS;
 };
+const refreshBeforeRequest = async (url) => {
+	const state = getAuthRecoveryState();
+	if (state.refreshPromise && !isAuthRecoveryEndpoint(url)) return state.refreshPromise.catch(() => null);
+	if (!shouldRefreshBeforeRequest(url)) return null;
+	return startAuthRecovery(false).catch(() => null);
+};
+const withAuthorization = (options, token) => {
+	const headers = new Headers(options?.headers);
+	if (token) headers.set("Authorization", `Bearer ${token}`);
+	return {
+		...options,
+		headers
+	};
+};
+async function _authenticatedFetch(url, options) {
+	if (typeof window === "undefined") return fetch(url, options);
+	const token = await refreshBeforeRequest(url) ?? getBearerToken();
+	const response = await fetch(url, withAuthorization(options, token));
+	if (response.status !== 401 || isAuthRecoveryEndpoint(url) || isAuthRedirectInProgress() || !getBearerToken()) return response;
+	let refreshedToken;
+	try {
+		refreshedToken = await startAuthRecovery(false);
+	} catch {
+		redirectToLoginOnce();
+		return response;
+	}
+	if (!refreshedToken) {
+		redirectToLoginOnce();
+		return response;
+	}
+	await response.body?.cancel().catch(() => void 0);
+	return fetch(url, withAuthorization(options, refreshedToken));
+}
 if (typeof window !== "undefined") {
 	axios.interceptors.request.use(async (config) => {
-		const state = getAuthRecoveryState();
-		if (state.refreshPromise && !isAuthRecoveryEndpoint(config.url)) {
-			const token = await state.refreshPromise.catch(() => null);
-			if (token) setRequestAuthorizationHeader(config, token);
-			return config;
-		}
-		if (!shouldRefreshBeforeRequest(config.url)) return config;
-		const token = await startAuthRecovery(false).catch(() => null);
+		const token = await refreshBeforeRequest(config.url);
 		if (token) setRequestAuthorizationHeader(config, token);
 		return config;
 	});
@@ -5649,7 +6435,7 @@ if (typeof window !== "undefined") {
 		/** Skip refresh when the Authorization header has been cleared (e.g. during logout),
 		*  but allow the shared link data request to proceed so private shares can still
 		*  recover auth/redirect without unrelated share-page queries forcing login. */
-		if (!axios.defaults.headers.common["Authorization"] && !(isSharePage() && isSharedMessagesRequest(originalRequest.url, originalRequest.method))) return Promise.reject(error);
+		if (!axios.defaults.headers.common["Authorization"] && !(isSharePage() && (isSharedMessagesRequest(originalRequest.url, originalRequest.method) || isShareForkRequest(originalRequest.url, originalRequest.method)))) return Promise.reject(error);
 		if (isAuthRedirectInProgress()) return Promise.reject(error);
 		if (error.response.status === 401 && !originalRequest._retry) {
 			if (!(getAuthRecoveryState().refreshPromise != null)) console.warn("401 error, refreshing token");
@@ -5662,8 +6448,12 @@ if (typeof window !== "undefined") {
 				}
 				redirectToLoginOnce();
 				return Promise.reject(error);
-			} catch (err) {
-				return Promise.reject(err);
+			} catch {
+				/** A rejected refresh (stale/invalid session → 401/403) must route to
+				*  login just like an empty-token refresh, otherwise the original 401
+				*  surfaces to the caller (e.g. the share fork button) with no redirect. */
+				redirectToLoginOnce();
+				return Promise.reject(error);
 			}
 		}
 		return Promise.reject(error);
@@ -5679,15 +6469,142 @@ var request_default = {
 	delete: _delete,
 	deleteWithOptions: _deleteWithOptions,
 	patch: _patch,
+	authenticatedFetch: _authenticatedFetch,
 	refreshToken,
 	dispatchTokenUpdatedEvent
 };
 //#endregion
+//#region src/upload.ts
+const EVENT_STREAM_MEDIA_TYPE = "text/event-stream";
+const HEARTBEAT_TIMEOUT_MS = 15e3;
+var FileUploadError = class extends Error {
+	constructor(message, fileId, toolResource, displayToUser = false, code = 0) {
+		super(message);
+		this.name = "CustomAppError";
+		this.code = code;
+		this.file_id = fileId;
+		this.tool_resource = toolResource;
+		this.display_to_user = displayToUser;
+		this.response = { data: { message: displayToUser ? message : "" } };
+	}
+};
+var UploadCanceledError = class extends Error {
+	constructor(..._args) {
+		super(..._args);
+		this.code = "ERR_CANCELED";
+	}
+};
+const getFileId = (formData) => String(formData.get("file_id") ?? "");
+const getToolResource = (formData) => formData.get("tool_resource") ?? void 0;
+const parseEvent = (message) => {
+	let type = "message";
+	const data = [];
+	for (const line of message.split(/\r?\n/)) {
+		if (line.startsWith("event:")) {
+			type = line.slice(6).trim();
+			continue;
+		}
+		if (line.startsWith("data:")) data.push(line.slice(5).trimStart());
+	}
+	return {
+		type,
+		data: data.join("\n")
+	};
+};
+const createHttpError = async (response, formData) => {
+	let message = `Server responded with status: ${response.status}`;
+	try {
+		message = (await response.json()).message || message;
+	} catch {}
+	return new FileUploadError(message, getFileId(formData), getToolResource(formData), true, response.status);
+};
+const createStreamError = (data, formData) => {
+	let error;
+	try {
+		error = JSON.parse(data);
+	} catch {
+		error = { message: data };
+	}
+	return new FileUploadError(error.message || "File upload failed.", error.temp_file_id || getFileId(formData), error.tool_resource || getToolResource(formData), error.display_to_user ?? false, error.code ?? 0);
+};
+const readEventStream = async (stream, formData) => {
+	const reader = stream.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	let result = null;
+	let streamEnded = false;
+	let timeoutError = null;
+	let heartbeatTimer;
+	const resetHeartbeatTimer = () => {
+		clearTimeout(heartbeatTimer);
+		heartbeatTimer = setTimeout(() => {
+			timeoutError = /* @__PURE__ */ new Error("Upload connection timed out waiting for a heartbeat.");
+			reader.cancel(timeoutError);
+		}, HEARTBEAT_TIMEOUT_MS);
+	};
+	resetHeartbeatTimer();
+	try {
+		while (true) {
+			const { value, done } = await reader.read();
+			if (done) {
+				streamEnded = true;
+				if (timeoutError) throw timeoutError;
+				if (result) return result;
+				throw new Error("Upload connection closed before completion.");
+			}
+			buffer += decoder.decode(value, { stream: true });
+			const messages = buffer.split(/\r?\n\r?\n/);
+			buffer = messages.pop() ?? "";
+			for (const message of messages) {
+				const event = parseEvent(message);
+				if (event.type === "heartbeat") {
+					resetHeartbeatTimer();
+					continue;
+				}
+				if (event.type === "error") throw createStreamError(event.data, formData);
+				if (event.type === "data") {
+					result = JSON.parse(event.data);
+					continue;
+				}
+				if (event.type === "close") {
+					if (result) return result;
+					throw new Error("Upload stream closed without a result.");
+				}
+			}
+		}
+	} catch (error) {
+		if (error instanceof Error && error.name === "AbortError") throw new UploadCanceledError("Upload canceled.");
+		throw error;
+	} finally {
+		clearTimeout(heartbeatTimer);
+		if (!streamEnded) await reader.cancel().catch(() => void 0);
+		reader.releaseLock();
+	}
+};
+async function uploadEventStream(url, formData, signal) {
+	try {
+		const response = await request_default.authenticatedFetch(url, {
+			method: "POST",
+			body: formData,
+			headers: { Accept: EVENT_STREAM_MEDIA_TYPE },
+			signal: signal ?? void 0
+		});
+		if (!response.ok) throw await createHttpError(response, formData);
+		if (!(response.headers.get("Content-Type")?.toLowerCase() ?? "").includes(EVENT_STREAM_MEDIA_TYPE)) return await response.json();
+		if (!response.body) throw new Error("No upload response body received.");
+		return await readEventStream(response.body, formData);
+	} catch (error) {
+		if (signal?.aborted || error instanceof Error && error.name === "AbortError") throw new UploadCanceledError("Upload canceled.");
+		throw error;
+	}
+}
+//#endregion
 //#region src/data-service.ts
 var data_service_exports = /* @__PURE__ */ __exportAll({
 	acceptTerms: () => acceptTerms,
 	addPromptToGroup: () => addPromptToGroup,
 	addTagToConversation: () => addTagToConversation,
+	addToolFavorite: () => addToolFavorite,
 	archiveConversation: () => archiveConversation,
 	assignConversationToProject: () => assignConversationToProject,
 	bindActionOAuth: () => bindActionOAuth,
@@ -5735,6 +6652,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	editArtifact: () => editArtifact,
 	enableTwoFactor: () => enableTwoFactor,
 	forkConversation: () => forkConversation,
+	forkSharedConversation: () => forkSharedConversation,
 	genTitle: () => genTitle,
 	getAIEndpoints: () => getAIEndpoints,
 	getAccessRoles: () => getAccessRoles,
@@ -5744,6 +6662,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getAgentById: () => getAgentById,
 	getAgentCategories: () => getAgentCategories,
 	getAgentFiles: () => getAgentFiles,
+	getAgentVersions: () => getAgentVersions,
 	getAllEffectivePermissions: () => getAllEffectivePermissions,
 	getAllPromptGroups: () => getAllPromptGroups,
 	getAssistantById: () => getAssistantById,
@@ -5754,7 +6673,6 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getBanner: () => getBanner,
 	getCategories: () => getCategories,
 	getCodeOutputDownload: () => getCodeOutputDownload,
-	getContextProjection: () => getContextProjection,
 	getConversationById: () => getConversationById,
 	getConversationTags: () => getConversationTags,
 	getConversations: () => getConversations,
@@ -5770,9 +6688,12 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getFiles: () => getFiles,
 	getGitHubSkillSyncStatus: () => getGitHubSkillSyncStatus,
 	getGraphApiToken: () => getGraphApiToken,
+	getLangfuseConnection: () => getLangfuseConnection,
+	getLangfuseSessionLink: () => getLangfuseSessionLink,
 	getLoginGoogle: () => getLoginGoogle,
 	getMCPAuthValues: () => getMCPAuthValues,
 	getMCPConnectionStatus: () => getMCPConnectionStatus,
+	getMCPOAuthStatus: () => getMCPOAuthStatus,
 	getMCPServer: () => getMCPServer,
 	getMCPServerConnectionStatus: () => getMCPServerConnectionStatus,
 	getMCPServers: () => getMCPServers,
@@ -5797,7 +6718,6 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getSharedMessages: () => getSharedMessages,
 	getSharedStartupConfig: () => getSharedStartupConfig,
 	getSkill: () => getSkill,
-	getSkillFavorites: () => getSkillFavorites,
 	getSkillFileContent: () => getSkillFileContent,
 	getSkillNodeContent: () => getSkillNodeContent,
 	getSkillStates: () => getSkillStates,
@@ -5805,6 +6725,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getStartupConfig: () => getStartupConfig,
 	getTokenConfig: () => getTokenConfig,
 	getToolCalls: () => getToolCalls,
+	getToolFavorites: () => getToolFavorites,
 	getUser: () => getUser,
 	getUserBalance: () => getUserBalance,
 	getUserTerms: () => getUserTerms,
@@ -5825,12 +6746,14 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	login: () => login,
 	logout: () => logout,
 	makePromptProduction: () => makePromptProduction,
+	markFilesUsage: () => markFilesUsage,
 	pinConversation: () => pinConversation,
 	rebuildConversationTags: () => rebuildConversationTags,
 	recordPromptGroupUsage: () => recordPromptGroupUsage,
 	regenerateBackupCodes: () => regenerateBackupCodes,
 	register: () => register,
 	reinitializeMCPServer: () => reinitializeMCPServer,
+	removeToolFavorite: () => removeToolFavorite,
 	requestPasswordReset: () => requestPasswordReset,
 	resendVerificationEmail: () => resendVerificationEmail,
 	resetPassword: () => resetPassword,
@@ -5841,6 +6764,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	searchPrincipals: () => searchPrincipals,
 	setGitHubSkillSyncCredential: () => setGitHubSkillSyncCredential,
 	speechToText: () => speechToText,
+	testLangfuseConnection: () => testLangfuseConnection,
 	textToSpeech: () => textToSpeech,
 	updateAction: () => updateAction,
 	updateAgent: () => updateAgent,
@@ -5851,6 +6775,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	updateConversationTag: () => updateConversationTag,
 	updateFavorites: () => updateFavorites,
 	updateFeedback: () => updateFeedback,
+	updateLangfuseConnection: () => updateLangfuseConnection,
 	updateMCPServer: () => updateMCPServer,
 	updateMCPServersPermissions: () => updateMCPServersPermissions,
 	updateMarketplacePermissions: () => updateMarketplacePermissions,
@@ -5869,7 +6794,6 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	updateResourcePermissions: () => updateResourcePermissions,
 	updateSharedLink: () => updateSharedLink,
 	updateSkill: () => updateSkill,
-	updateSkillFavorites: () => updateSkillFavorites,
 	updateSkillNode: () => updateSkillNode,
 	updateSkillNodeContent: () => updateSkillNodeContent,
 	updateSkillPermissions: () => updateSkillPermissions,
@@ -5888,6 +6812,18 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	verifyTwoFactor: () => verifyTwoFactor,
 	verifyTwoFactorTemp: () => verifyTwoFactorTemp
 });
+function getLangfuseConnection() {
+	return request_default.get(adminLangfuseConnection());
+}
+function updateLangfuseConnection(payload) {
+	return request_default.put(adminLangfuseConnection(), payload);
+}
+function testLangfuseConnection(payload) {
+	return request_default.post(adminLangfuseConnectionTest(), payload);
+}
+function getLangfuseSessionLink(conversationId) {
+	return request_default.get(adminLangfuseSessionLink(conversationId));
+}
 function revokeUserKey(name) {
 	return request_default.delete(revokeUserKey$1(name));
 }
@@ -5903,16 +6839,15 @@ function getFavorites() {
 function updateFavorites(favorites) {
 	return request_default.post(`${apiBaseUrl()}/api/user/settings/favorites`, { favorites });
 }
-/**
-* Skill favorites (star-a-skill). The backend route is phase 2 — see the
-* original UI PR for the client surface. Until then, these resolve with
-* an empty list so the UI hooks compile and the Star button is a no-op.
-*/
-function getSkillFavorites() {
-	return Promise.resolve([]);
+/** Tool favorites — starred marketplace items (builtins, tools, MCP servers, skills). */
+function getToolFavorites() {
+	return request_default.get(toolFavorites());
 }
-function updateSkillFavorites(skillFavorites) {
-	return Promise.resolve(skillFavorites);
+function addToolFavorite(favorite) {
+	return request_default.put(toolFavorite(favorite.itemType, favorite.itemId));
+}
+function removeToolFavorite(favorite) {
+	return request_default.delete(toolFavorite(favorite.itemType, favorite.itemId));
 }
 /** Per-user skill active/inactive overrides. */
 function getSkillStates() {
@@ -6039,6 +6974,9 @@ const getMCPAuthValues = (serverName) => {
 function cancelMCPOAuth(serverName) {
 	return request_default.post(cancelMCPOAuth$1(serverName), {});
 }
+function getMCPOAuthStatus(flowId) {
+	return request_default.get(mcpOAuthStatus(flowId));
+}
 const getStartupConfig = (options) => {
 	return request_default.get(config(options?.context));
 };
@@ -6048,9 +6986,6 @@ const getAIEndpoints = () => {
 const getTokenConfig = () => {
 	return request_default.get(tokenConfig());
 };
-const getContextProjection = (payload) => {
-	return request_default.post(contextProjection(), payload);
-};
 const getModels = async () => {
 	return request_default.get(models());
 };
@@ -6150,14 +7085,24 @@ const getAgentFiles = (agentId) => {
 const getFileConfig = () => {
 	return request_default.get(`${files()}/config`);
 };
-const uploadImage = (data, signal) => {
+const uploadImage = (data, signal, sseEnabled = false) => {
 	const requestConfig = signal ? { signal } : void 0;
+	if (sseEnabled) return uploadEventStream(images(), data, signal);
 	return request_default.postMultiPart(images(), data, requestConfig);
 };
-const uploadFile = (data, signal) => {
+const uploadFile = (data, signal, sseEnabled = false) => {
 	const requestConfig = signal ? { signal } : void 0;
+	if (sseEnabled) return uploadEventStream(files(), data, signal);
 	return request_default.postMultiPart(files(), data, requestConfig);
 };
+/**
+* Marks uploaded files as used (owner-scoped TTL touch) so the upload-window
+* TTL cannot reap attachments held in a client-side queue during a long run.
+* Best-effort: callers fire-and-forget — send-time marking is the backstop.
+*/
+const markFilesUsage = (body) => {
+	return request_default.post(fileUsage(), body);
+};
 const updateAction = (data) => {
 	const { assistant_id, version, ...body } = data;
 	return request_default.post(assistants({
@@ -6185,6 +7130,9 @@ const getAgentById = ({ agent_id }) => {
 const getExpandedAgentById = ({ agent_id }) => {
 	return request_default.get(agents({ path: `${agent_id}/expanded` }));
 };
+const getAgentVersions = ({ agent_id }) => {
+	return request_default.get(agents({ path: `${agent_id}/versions` }));
+};
 const updateAgent = ({ agent_id, data }) => {
 	return request_default.patch(agents({ path: agent_id }), data);
 };
@@ -6319,6 +7267,12 @@ function duplicateConversation(payload) {
 function forkConversation(payload) {
 	return request_default.post(forkConversation$1(), payload);
 }
+function forkSharedConversation(shareId, targetMessageIndex, shareRevision) {
+	return request_default.post(forkSharedMessages(shareId), {
+		targetMessageIndex,
+		shareRevision
+	});
+}
 function deleteConversation(payload) {
 	return request_default.deleteWithOptions(deleteConversation$1(), { data: { arg: payload } });
 }
@@ -6633,11 +7587,11 @@ function verifyTwoFactorTemp(payload) {
 const getMemories = () => {
 	return request_default.get(memories());
 };
-const deleteMemory = (key) => {
-	return request_default.delete(memory(key));
+const deleteMemory = (key, agentId) => {
+	return request_default.delete(memory(key, agentId));
 };
-const updateMemory = (key, value, originalKey) => {
-	return request_default.patch(memory(originalKey || key), {
+const updateMemory = (key, value, originalKey, agentId) => {
+	return request_default.patch(memory(originalKey || key, agentId), {
 		key,
 		value
 	});
@@ -6676,6 +7630,6 @@ const getActiveJobs = () => {
 	return request_default.get(activeJobs());
 };
 //#endregion
-export { permissionEntrySchema as $, feedbackSchema as $a, extendedModelEndpointSchema as $i, MCP_USER_INPUT_FIELDS as $n, specsConfigSchema as $r, balanceSchema as $t, updateResourcePermissions as A, tPluginAuthConfigSchema as Aa, anthropicSettings as Ai, modularEndpoints as An, fileConfig as Ar, SKILL_SYNC_MAX_INTERVAL_MINUTES as At, MutationKeys as B, RunStatus as Ba, defaultAssistantFormValues as Bi, summarizationTriggerSchema as Bn, mbToBytes as Br, TTSProviders as Bt, resetPassword as C, tBannerSchema as Ca, ThinkingLevel as Ci, initialModelsConfig as Cn, defaultOCRMimeTypes as Cr, MAX_SUBAGENT_RUN_CONFIGS as Ct, updateFeedback as D, tExampleSchema as Da, agentsSettings as Di, messageFilterPiiSchema as Dn, endpointFileConfigSchema as Dr, RetentionMode as Dt, searchPrincipals as E, tConvoUpdateSchema as Ea, agentsSchema as Ei, memorySchema as En, documentParserMimeTypes as Er, RerankerTypes as Et, request_default as F, AnnotationTypes as Fa, compactAgentsBaseSchema as Fi, resolveEndpointType as Fn, imageMimeTypes as Fr, SearchCategories as Ft, PrincipalType as G, defaultOrderQuery as Ga, eReasoningEffortSchema as Gi, validateVisionModel as Gn, retrievalMimeTypesList as Gr, allowedAddressesSchema as Gt, AccessRoleIds as H, Tools as Ha, eAnthropicEffortSchema as Hi, transactionsSchema as Hn, mergeFileConfig as Hr, ViolationTypes as Ht, getTokenHeader as I, AssistantStreamEvents as Ia, compactAgentsSchema as Ii, skillSyncConfigSchema as In, imageTypeMapping as Ir, SearchProviders as It, accessRoleToPermBits as J, isActionTool as Ja, eReasoningSummarySchema as Ji, visionModels as Jn, textMimeTypes as Jr, assistantEndpointSchema as Jt, ResourceType as K, hostImageIdSuffix as Ka, eReasoningParameterFormatSchema as Ki, vertexAISchema as Kn, supportedMimeTypes as Kr, alternateName as Kt, setAcceptLanguageHeader as L, EToolResources as La, compactAssistantSchema as Li, skillSyncGitHubSourceSchema as Ln, inferMimeType as Lr, SettingsTabValues as Lt, updateUserKey as M, tPresetSchema as Ma, authTypeSchema as Mi, paramDefinitionSchema as Mn, fullMimeTypesList as Mr, STTProviders as Mt, updateUserPlugins as N, tQueryParamsSchema as Na, cacheSubsetProviders as Ni, providerEndpointMap as Nn, getEndpointFileConfig as Nr, SafeSearchTypes as Nt, updateMessage as O, tMessageSchema as Oa, anthropicBaseSchema as Oi, messageFilterSchema as On, excelFileTypes as Or, SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH as Ot, userKeyQuery as P, tSharedLinkSchema as Pa, coerceNumber as Pi, rateLimitSchema as Pn, imageExtRegex as Pr, ScraperProviders as Pt, permBitsToAccessLevel as Q, feedbackRatingSchema as Qa, endpointSettings as Qi, MCPServersSchema as Qn, modelSpecSubagentsSchema as Qr, azureGroupSchema as Qt, setTokenHeader as R, FilePurpose as Ra, compactGoogleSchema as Ri, specialVariables as Rn, isBedrockDocumentType as Rr, SettingsViews as Rt, requestPasswordReset as S, removeNullishValues as Sa, ThinkingDisplay as Si, imageGenTools as Sn, convertStringsToRegex as Sr, MAX_SUBAGENT_GRAPH_NODES as St, revokeUserKey as T, tConversationTagSchema as Ta, agentsBaseSchema as Ti, isRemoteOidcUrlAllowed as Tn, defaultTextMimeTypes as Tr, RateLimitPrefix as Tt, PermissionBits as U, actionDelimiter as Ua, eImageDetailSchema as Ui, turnstileOptionsSchema as Un, mimeTypeAliases as Ur, VisionModes as Ut, QueryKeys as V, StepStatus as Va, documentSupportedProviders as Vi, supportsBalanceCheck as Vn, megabyte as Vr, Time as Vt, PrincipalModel as W, actionDomainSeparator as Wa, eModelEndpointSchema as Wi, turnstileSchema as Wn, retrievalMimeTypes as Wr, agentsEndpointSchema as Wt, getResourcePermissionsResponseSchema as X, FEEDBACK_REASON_KEYS as Xa, eThinkingLevelSchema as Xi, MCPOptionsSchema as Xn, REFILL_INTERVAL_UNITS as Xr, azureEndpointSchema as Xt, effectivePermissionsResponseSchema as Y, FEEDBACK_RATINGS as Ya, eThinkingDisplaySchema as Yi, webSearchSchema as Yn, videoMimeTypes as Yr, azureBaseSchema as Yt, hasPermissions as Z, FEEDBACK_TAGS as Za, eVerbositySchema as Zi, MCPServerUserInputSchema as Zn, getRefillEligibilityDate as Zr, azureGroupConfigsSchema as Zt, getResourcePermissions as _, openAIBaseSchema as _a, Providers as _i, fileStrategiesSchema as _n, bedrockDocumentExtensions as _r, ImageDetailCost as _t, data_service_exports as a, googleSettings as aa, generateDynamicSchema as ai, configSchema as an, extractEnvVariable as ao, AuthorizationTypeEnum as ar, AuthKeys as at, register as b, openRouterSchema as ba, ReasoningResponseKey as bi, getEndpointField as bn, codeInterpreterMimeTypesList as br, LocalStorageKeys as bt, getAccessRoles as c, inputTokensIncludesCache as ca, validateSettingDefinitions as ci, defaultAssistantsVersion as cn, normalizeEndpointName as co, FileSources as cr, Capabilities as ct, getAvailablePlugins as d, isDocumentSupportedProvider as da, BedrockProviders as di, defaultRetrievalModels as dn, buildLoginRedirectUrl as dr, DEFAULT_MEMORY_MAX_INPUT_TOKENS as dt, getModelKey as ea, tModelSpecSchema as ei, baseEndpointSchema as en, feedbackTagKeySchema as eo, SSEOptionsSchema as er, principalSchema as et, getConversationById as f, isImageVisionTool as fa, BedrockReasoningConfig as fi, defaultSocialLogins as fn, loginPage as fr, EImageOutputType as ft, getModels as g, isUUID as ga, MYTHOS_CLASS_FAMILIES as gi, fileStorageSchema as gn, audioMimeTypes as gr, ForkOptions as gt, getMCPServerConnectionStatus as h, isParamEndpoint as ha, ImageVisionTool as hi, fileSourceSchema as hn, applicationMimeTypes as hr, FetchTokenConfig as ht, createPreset as i, googleSchema as ia, SettingTypes as ii, cloudfrontConfigSchema as in, envVarRegex as io, AuthTypeEnum as ir, AgentCapabilities as it, updateTokenCount as j, tPluginSchema as ja, assistantSchema as ji, ocrSchema as jn, fileConfigSchema as jr, SKILL_SYNC_MIN_INTERVAL_MINUTES as jt, updateMessageContent as k, tModelSpecPresetSchema as ka, anthropicSchema as ki, modelConfigSchema as kn, excelMimeTypes as kr, SKILL_SYNC_MAX_DISCOVERY_DEPTH as kt, getAgentApiKeys as l, isAgentsEndpoint as la, AnthropicEffort as li, defaultEndpoints as ln, checkOpenAIStorage as lr, CohereConstants as lt, getEffectivePermissions as m, isOpenAILikeProvider as ma, ImageDetail as mi, excludedKeys as mn, sharedFileDownload as mr, ErrorTypes as mt, clearAllConversations as n, googleBaseSchema as na, ComponentTypes as ni, bedrockGuardrailConfigSchema as nn, getTagsForRating as no, StreamableHTTPOptionsSchema as nr, updateResourcePermissionsRequestSchema as nt, deleteAgentApiKey as o, imageDetailNumeric as oa, generateGoogleSchema as oi, contextPruningSchema as on, extractVariableName as oo, TokenExchangeMethodEnum as or, BASE_ONLY_CONFIG_SECTIONS as ot, getCustomConfigSpeech as p, isMythosClassModel as pa, EModelEndpoint as pi, endpointSchema as pn, registerPage as pr, EndpointURLs as pt, accessRoleSchema as q, hostImageNamePrefix as qa, eReasoningResponseKeySchema as qi, vertexModelConfigSchema as qn, supportsFiles as qr, anthropicEndpointSchema as qt, createAgentApiKey as r, googleGenConfigSchema as ra, OptionTypes as ri, bedrockModels as rn, toMinimalFeedback as ro, WebSocketOptionsSchema as rr, updateResourcePermissionsResponseSchema as rt, deletePreset as s, imageDetailValue as sa, generateOpenAISchema as si, defaultAgentCapabilities as sn, isSensitiveEnvVar as so, FileContext as sr, CacheKeys as st, cancelMCPOAuth as t, getSettingsKeys as ta, MAX_SUBAGENTS as ti, bedrockEndpointSchema as tn, getTagByKey as to, StdioOptionsSchema as tr, resourcePermissionsResponseSchema as tt, getAllEffectivePermissions as u, isAssistantsEndpoint as ua, AuthType as ui, defaultModels as un, apiBaseUrl as ur, Constants as ut, getSharedLink as v, openAISchema as va, ReasoningEffort as vi, getConfigDefaults as vn, bedrockDocumentFormats as vr, InfiniteCollections as vt, revokeAllUserKeys as w, tConversationSchema as wa, Verbosity as wi, interfaceSchema as wn, defaultSTTMimeTypes as wr, OCRStrategy as wt, reinitializeMCPServer as x, paramEndpoints as xa, ReasoningSummary as xi, getSchemaDefaults as xn, codeTypeMapping as xr, MAX_SUBAGENT_DEPTH as xt, getSharedMessages as y, openAISettings as ya, ReasoningParameterFormat as yi, getDefaultParamsEndpoint as yn, codeInterpreterMimeTypes as yr, KnownEndpoints as yt, DynamicQueryKeys as z, MessageContentTypes as za, defaultAgentFormValues as zi, summarizationConfigSchema as zn, isPermissiveMimeConfig as zr, SystemCategories as zt };
+export { permissionEntrySchema as $, tMessageSchema as $a, anthropicSettings as $i, supportsBalanceCheck as $n, imageTypeMapping as $r, azureGroupConfigsSchema as $t, updateResourcePermissions as A, googleSettings as Aa, AuthType as Ai, isRemoteOidcUrlAllowed as An, extractEnvVariable as Ao, applicationMimeTypes as Ar, SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH as At, MutationKeys as B, isParamEndpoint as Ba, ReasoningEffort as Bi, paramDefinitionSchema as Bn, defaultSTTMimeTypes as Br, SettingsViews as Bt, resetPassword as C, endpointSettings as Ca, OptionTypes as Ci, getConfigDefaults as Cn, feedbackRatingSchema as Co, FileSources as Cr, MAX_SUBAGENT_DEPTH as Ct, updateFeedback as D, googleBaseSchema as Da, generateOpenAISchema as Di, imageGenTools as Dn, getTagsForRating as Do, loginPage as Dr, RateLimitPrefix as Dt, searchPrincipals as E, getSettingsKeys as Ea, generateGoogleSchema as Ei, getSchemaDefaults as En, getTagByKey as Eo, buildLoginRedirectUrl as Er, OCRStrategy as Et, request_default as F, isAssistantsEndpoint as Fa, ImageVisionTool as Fi, modelConfigSchema as Fn, codeInterpreterMimeTypes as Fr, SafeSearchTypes as Ft, PrincipalType as G, openRouterSchema as Ga, ThinkingDisplay as Gi, setMessageFilterRegexValidator as Gn, excelMimeTypes as Gr, VisionModes as Gt, AccessRoleIds as H, openAIBaseSchema as Ha, ReasoningParameterFormat as Hi, rateLimitSchema as Hn, documentParserMimeTypes as Hr, TTSProviders as Ht, getTokenHeader as I, isDocumentSupportedProvider as Ia, MYTHOS_CLASS_FAMILIES as Ii, modularEndpoints as In, codeInterpreterMimeTypesList as Ir, ScraperProviders as It, accessRoleToPermBits as J, tBannerSchema as Ja, agentsBaseSchema as Ji, specialVariables as Jn, fullMimeTypesList as Jr, alternateName as Jt, ResourceType as K, paramEndpoints as Ka, ThinkingLevel as Ki, skillSyncConfigSchema as Kn, fileConfig as Kr, agentsEndpointSchema as Kt, setAcceptLanguageHeader as L, isImageVisionTool as La, MemoryScope as Li, normalizeMCPToolKey as Ln, codeTypeMapping as Lr, SearchCategories as Lt, updateUserKey as M, imageDetailValue as Ma, BedrockReasoningConfig as Mi, memorySchema as Mn, isSensitiveEnvVar as Mo, bedrockDocumentExtensions as Mr, SKILL_SYNC_MAX_INTERVAL_MINUTES as Mt, updateUserPlugins as N, inputTokensIncludesCache as Na, EModelEndpoint as Ni, messageFilterPiiSchema as Nn, normalizeEndpointName as No, bedrockDocumentFormats as Nr, SKILL_SYNC_MIN_INTERVAL_MINUTES as Nt, updateMessage as O, googleGenConfigSchema as Oa, validateSettingDefinitions as Oi, initialModelsConfig as On, toMinimalFeedback as Oo, registerPage as Or, RerankerTypes as Ot, userKeyQuery as P, isAgentsEndpoint as Pa, ImageDetail as Pi, messageFilterSchema as Pn, bedrockDocumentMimeTypes as Pr, STTProviders as Pt, permBitsToAccessLevel as Q, tExampleSchema as Qa, anthropicSchema as Qi, summarizationTriggerSchema as Qn, imageMimeTypes as Qr, azureEndpointSchema as Qt, setTokenHeader as R, isMythosClassModel as Ra, Providers as Ri, normalizeServerName as Rn, convertStringsToRegex as Rr, SearchProviders as Rt, requestPasswordReset as S, eVerbositySchema as Sa, ComponentTypes as Si, fileStrategiesSchema as Sn, FEEDBACK_TAGS as So, FileContext as Sr, LocalStorageKeys as St, revokeUserKey as T, getModelKey as Ta, generateDynamicSchema as Ti, getEndpointField as Tn, feedbackTagKeySchema as To, apiBaseUrl as Tr, MAX_SUBAGENT_RUN_CONFIGS as Tt, PermissionBits as U, openAISchema as Ua, ReasoningResponseKey as Ui, resolveEndpointType as Un, endpointFileConfigSchema as Ur, Time as Ut, QueryKeys as V, isUUID as Va, ReasoningMode as Vi, providerEndpointMap as Vn, defaultTextMimeTypes as Vr, SystemCategories as Vt, PrincipalModel as W, openAISettings as Wa, ReasoningSummary as Wi, retainRecentConfigSchema as Wn, excelFileTypes as Wr, ViolationTypes as Wt, getResourcePermissionsResponseSchema as X, tConversationTagSchema as Xa, agentsSettings as Xi, splitToolCallName as Xn, getEndpointFileConfig as Xr, assistantEndpointSchema as Xt, effectivePermissionsResponseSchema as Y, tConversationSchema as Ya, agentsSchema as Yi, splitMCPToolKey as Yn, getConfiguredMimeAccept as Yr, anthropicEndpointSchema as Yt, hasPermissions as Z, tConvoUpdateSchema as Za, anthropicBaseSchema as Zi, summarizationConfigSchema as Zn, imageExtRegex as Zr, azureBaseSchema as Zt, getResourcePermissions as _, eReasoningParameterFormatSchema as _a, getRefillEligibilityDate as _i, defaultSocialLogins as _n, hostImageIdSuffix as _o, StreamableHTTPOptionsSchema as _r, FetchTokenConfig as _t, data_service_exports as a, compactAgentsSchema as aa, mbToBytes as ai, bedrockModels as an, tSharedLinkSchema as ao, turnstileSchema as ar, AgentCapabilities as at, register as b, eThinkingDisplaySchema as ba, tModelSpecSchema as bi, fileSourceSchema as bn, FEEDBACK_RATINGS as bo, AuthorizationTypeEnum as br, InfiniteCollections as bt, getAccessRoles as c, defaultAgentFormValues as ca, mimeTypeAliases as ci, checkpointerTypeSchema as cn, EToolResources as co, vertexModelConfigSchema as cr, BASE_PRINCIPAL_CONFIG_SECTIONS as ct, getAvailablePlugins as d, eAnthropicEffortSchema as da, setFileConfigRegexCompiler as di, contextPruningSchema as dn, RunStatus as do, MCPOptionsSchema as dr, CohereConstants as dt, assistantSchema as ea, inferMimeType as ei, azureGroupSchema as en, tModelSpecPresetSchema as eo, toolApprovalHookConfigSchema as er, principalSchema as et, getConversationById as f, eImageDetailSchema as fa, supportedMimeTypes as fi, defaultAgentCapabilities as fn, StepStatus as fo, MCPServerUserInputSchema as fr, Constants as ft, getModels as g, eReasoningModeSchema as ga, REFILL_INTERVAL_UNITS as gi, defaultRetrievalModels as gn, defaultOrderQuery as go, StdioOptionsSchema as gr, ErrorTypes as gt, getMCPServerConnectionStatus as h, eReasoningEffortSchema as ha, videoMimeTypes as hi, defaultModels as hn, actionDomainSeparator as ho, SSEOptionsSchema as hr, EndpointURLs as ht, createPreset as i, compactAgentsBaseSchema as ia, isPermissiveMimeConfig as ii, bedrockGuardrailConfigSchema as in, tQueryParamsSchema as io, turnstileOptionsSchema as ir, AUTH_USER_DOC_BY_ID_PREFIX as it, updateTokenCount as j, imageDetailNumeric as ja, BedrockProviders as ji, langfuseConfigSchema as jn, extractVariableName as jo, audioMimeTypes as jr, SKILL_SYNC_MAX_DISCOVERY_DEPTH as jt, updateMessageContent as k, googleSchema as ka, AnthropicEffort as ki, interfaceSchema as kn, envVarRegex as ko, sharedFileDownload as kr, RetentionMode as kt, getAgentApiKeys as l, defaultAssistantFormValues as la, retrievalMimeTypes as li, cloudfrontConfigSchema as ln, FilePurpose as lo, visionModels as lr, CacheKeys as lt, getEffectivePermissions as m, eReasoningContextSchema as ma, textMimeTypes as mi, defaultEndpoints as mn, actionDelimiter as mo, MCP_USER_INPUT_FIELDS as mr, EImageOutputType as mt, clearAllConversations as n, cacheSubsetProviders as na, isAnthropicTextDocumentType as ni, baseEndpointSchema as nn, tPluginSchema as no, toolApprovalPolicySchema as nr, updateResourcePermissionsRequestSchema as nt, deleteAgentApiKey as o, compactAssistantSchema as oa, megabyte as oi, buildServerNameAliases as on, AnnotationTypes as oo, validateVisionModel as or, AuthKeys as ot, getCustomConfigSpeech as p, eModelEndpointSchema as pa, supportsFiles as pi, defaultAssistantsVersion as pn, Tools as po, MCPServersSchema as pr, DEFAULT_MEMORY_MAX_INPUT_TOKENS as pt, accessRoleSchema as q, removeNullishValues as qa, Verbosity as qi, skillSyncGitHubSourceSchema as qn, fileConfigSchema as qr, allowedAddressesSchema as qt, createAgentApiKey as r, coerceNumber as ra, isBedrockDocumentType as ri, bedrockEndpointSchema as rn, tPresetSchema as ro, transactionsSchema as rr, updateResourcePermissionsResponseSchema as rt, deletePreset as s, compactGoogleSchema as sa, mergeFileConfig as si, checkpointerSchema as sn, AssistantStreamEvents as so, vertexAISchema as sr, BASE_ONLY_CONFIG_SECTIONS as st, cancelMCPOAuth as t, authTypeSchema as ta, isAnthropicDocumentType as ti, balanceSchema as tn, tPluginAuthConfigSchema as to, toolApprovalModeSchema as tr, resourcePermissionsResponseSchema as tt, getAllEffectivePermissions as u, documentSupportedProviders as ua, retrievalMimeTypesList as ui, configSchema as un, MessageContentTypes as uo, webSearchSchema as ur, Capabilities as ut, getSharedLink as v, eReasoningResponseKeySchema as va, modelSpecSubagentsSchema as vi, endpointSchema as vn, hostImageNamePrefix as vo, WebSocketOptionsSchema as vr, ForkOptions as vt, revokeAllUserKeys as w, extendedModelEndpointSchema as wa, SettingTypes as wi, getDefaultParamsEndpoint as wn, feedbackSchema as wo, checkOpenAIStorage as wr, MAX_SUBAGENT_GRAPH_NODES as wt, reinitializeMCPServer as x, eThinkingLevelSchema as xa, MAX_SUBAGENTS as xi, fileStorageSchema as xn, FEEDBACK_REASON_KEYS as xo, TokenExchangeMethodEnum as xr, KnownEndpoints as xt, getSharedMessages as y, eReasoningSummarySchema as ya, specsConfigSchema as yi, excludedKeys as yn, isActionTool as yo, AuthTypeEnum as yr, ImageDetailCost as yt, DynamicQueryKeys as z, isOpenAILikeProvider as za, ReasoningContext as zi, ocrSchema as zn, defaultOCRMimeTypes as zr, SettingsTabValues as zt };
 
-//# sourceMappingURL=data-service-BsdHkdKS.mjs.map
+//# sourceMappingURL=data-service-pwrlWjJs.mjs.map