librechat-data-provider 0.8.509 → 0.8.522

package/dist/{data-service-BsdHkdKS.mjs → data-service-CaB7saTP.mjs}

@@ -1,4 +1,5 @@
 import { ZodArray, ZodError, ZodIssueCode, z } from "zod";
+import { RE2JS } from "re2js";
 import axios from "axios";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
@@ -77,6 +78,258 @@ function normalizeEndpointName(name = "") {
 	return name.toLowerCase() === "ollama" ? "ollama" : name;
 }
 //#endregion
+//#region src/filters.ts
+const FILTER_PII_STARTER_PATTERNS = [
+	"sk_prefix",
+	"bearer_header",
+	"api_key_header"
+];
+const MAX_PII_PATTERNS_PER_SOURCE = 256;
+const MAX_PII_PATTERN_LENGTH = 512;
+const MAX_PII_PATTERN_ID_LENGTH = 256;
+const MAX_PII_PATTERN_LABEL_LENGTH = 512;
+const MAX_PII_CUSTOM_REGEX_CHARACTERS = 8192;
+const MAX_PII_CUSTOM_REGEX_INSTRUCTIONS = 8192;
+const MAX_PII_CUSTOM_PATTERNS_TOTAL = 256;
+const MAX_PII_REGEX_SIZE_CACHE_ENTRIES = 512;
+const PII_REGEX_PROGRAM_SIZE_CACHE = /* @__PURE__ */ new Map();
+function getPiiRegexProgramSize(pattern) {
+	if (PII_REGEX_PROGRAM_SIZE_CACHE.has(pattern)) return PII_REGEX_PROGRAM_SIZE_CACHE.get(pattern) ?? null;
+	let programSize = null;
+	let compiled;
+	try {
+		compiled = RE2JS.compile(pattern);
+		const candidate = compiled.programSize();
+		if (Number.isSafeInteger(candidate) && candidate > 0) programSize = candidate;
+	} catch {
+		programSize = null;
+	} finally {
+		compiled?.reset();
+	}
+	if (PII_REGEX_PROGRAM_SIZE_CACHE.size >= MAX_PII_REGEX_SIZE_CACHE_ENTRIES) PII_REGEX_PROGRAM_SIZE_CACHE.clear();
+	PII_REGEX_PROGRAM_SIZE_CACHE.set(pattern, programSize);
+	return programSize;
+}
+const MESSAGE_FILTER_FIELDS = [
+	"name",
+	"text",
+	"summary",
+	"quote",
+	"answer",
+	"decision_response",
+	"decision_reason",
+	"content_part",
+	"attachment_reference",
+	"assembled_context"
+];
+const HITL_MESSAGE_FILTER_FIELDS = [
+	"answer",
+	"decision_response",
+	"decision_reason"
+];
+const REQUEST_ONLY_MESSAGE_FILTER_FIELDS = new Set(HITL_MESSAGE_FILTER_FIELDS);
+/** Message fields structurally recoverable without exact semantic provenance. */
+const STORED_MESSAGE_FILTER_FIELDS = MESSAGE_FILTER_FIELDS.filter((field) => !REQUEST_ONLY_MESSAGE_FILTER_FIELDS.has(field));
+const PROMPT_FILTER_FIELDS = [
+	"name",
+	"description",
+	"oneliner",
+	"category",
+	"command",
+	"text",
+	"preset_text",
+	"system",
+	"context",
+	"instructions",
+	"additional_instructions",
+	"greeting",
+	"example_input",
+	"example_output"
+];
+const AGENT_INSTRUCTION_FILTER_FIELDS = [
+	"name",
+	"category",
+	"description",
+	"instructions",
+	"additional_instructions",
+	"edge_description",
+	"edge_prompt",
+	"edge_prompt_key",
+	"artifacts",
+	"support_contact_name",
+	"support_contact_email"
+];
+const CONVERSATION_STARTER_FILTER_FIELDS = ["text"];
+const CONVERSATION_TITLE_FILTER_FIELDS = ["title"];
+const FEEDBACK_FILTER_FIELDS = ["text"];
+const SKILL_FILTER_FIELDS = [
+	"name",
+	"display_title",
+	"description",
+	"category",
+	"frontmatter",
+	"instructions",
+	"imported_text",
+	"file_name",
+	"file_text"
+];
+const MEMORY_FILTER_FIELDS = [
+	"key",
+	"value",
+	"summary"
+];
+const FILE_FILTER_FIELDS = [
+	"name",
+	"content",
+	"extracted_text",
+	"transcript",
+	"uri"
+];
+const TOOL_ARGUMENT_FILTER_FIELDS = [
+	"name",
+	"arguments",
+	"output"
+];
+const MODEL_PARAMETER_FILTER_FIELDS = [
+	"stop",
+	"request_fields",
+	"response_format",
+	"metadata"
+];
+const ACTION_METADATA_FILTER_FIELDS = [
+	"raw_spec",
+	"domain",
+	"privacy_policy_url",
+	"authorization_type",
+	"custom_auth_header",
+	"authorization_content_type",
+	"authorization_url",
+	"client_url",
+	"scope",
+	"token_exchange_method",
+	"api_key",
+	"oauth_client_id",
+	"oauth_client_secret"
+];
+const messageFilterFieldSchema = z.enum(MESSAGE_FILTER_FIELDS);
+const promptFilterFieldSchema = z.enum(PROMPT_FILTER_FIELDS);
+const agentInstructionFilterFieldSchema = z.enum(AGENT_INSTRUCTION_FILTER_FIELDS);
+const conversationStarterFilterFieldSchema = z.enum(CONVERSATION_STARTER_FILTER_FIELDS);
+const conversationTitleFilterFieldSchema = z.enum(CONVERSATION_TITLE_FILTER_FIELDS);
+const feedbackFilterFieldSchema = z.enum(FEEDBACK_FILTER_FIELDS);
+const skillFilterFieldSchema = z.enum(SKILL_FILTER_FIELDS);
+const memoryFilterFieldSchema = z.enum(MEMORY_FILTER_FIELDS);
+const fileFilterFieldSchema = z.enum(FILE_FILTER_FIELDS);
+const toolArgumentFilterFieldSchema = z.enum(TOOL_ARGUMENT_FILTER_FIELDS);
+const modelParameterFilterFieldSchema = z.enum(MODEL_PARAMETER_FILTER_FIELDS);
+const filterPiiStarterPatternSchema = z.enum(FILTER_PII_STARTER_PATTERNS);
+const filterPiiActionSchema = z.enum(["block", "audit"]);
+const actionMetadataFilterFieldSchema = z.enum(ACTION_METADATA_FILTER_FIELDS);
+const unattributedAssistantContentSchema = z.enum(["model_output", "inspect"]);
+const userSubmittedMessageFieldPathSchema = z.object({
+	path: z.string().startsWith("/").max(2048),
+	field: z.enum(HITL_MESSAGE_FILTER_FIELDS)
+}).strict();
+const UNINSPECTABLE_FILE_FIELDS = new Set([
+	"content",
+	"extracted_text",
+	"transcript"
+]);
+/**
+* An omitted starter selection enables the built-in catalog. An explicit
+* empty selection disables it, so a source is active only when custom rules
+* remain. This mirrors the documented filter semantics without compiling
+* regular expressions.
+*/
+function hasActivePiiPatterns(config) {
+	return config != null && (config.starterPatterns == null || config.starterPatterns.length > 0 || (config.customPatterns?.length ?? 0) > 0);
+}
+/** Returns whether an active PII rule can inspect at least one candidate field. */
+function hasActivePiiFields(config, candidates) {
+	return hasActivePiiPatterns(config) && (config?.fields == null || candidates.some((field) => config.fields?.includes(field)));
+}
+/**
+* Returns whether a parsed source-aware config can enforce any rule. An
+* explicit fail-close file policy remains active even without text patterns.
+*/
+function hasActiveFiltersConfig(filters) {
+	if (filters == null) return false;
+	if (filters.messages?.unattributedAssistantContent === "inspect") return true;
+	if ([
+		filters.messages?.pii,
+		filters.prompts?.pii,
+		filters.agentInstructions?.pii,
+		filters.conversationStarters?.pii,
+		filters.conversationTitles?.pii,
+		filters.feedback?.pii,
+		filters.skills?.pii,
+		filters.memories?.pii,
+		filters.files?.pii,
+		filters.toolArguments?.pii,
+		filters.modelParameters?.pii,
+		filters.actionMetadata?.pii
+	].some(hasActivePiiPatterns)) return true;
+	const filePii = filters.files?.pii;
+	return filePii?.uninspectable === "block" && (filePii.fields == null || filePii.fields.some((field) => UNINSPECTABLE_FILE_FIELDS.has(field)));
+}
+const filterPiiRegexSchema = z.string().min(1).max(512).refine((value) => getPiiRegexProgramSize(value) != null, { message: "Regex must use supported linear-time syntax" });
+const filterPiiCustomPatternSchema = z.object({
+	id: z.string().min(1).max(256),
+	label: z.string().min(1).max(512),
+	regex: filterPiiRegexSchema
+}).strict();
+function createPiiFilterSchema(fieldSchema) {
+	return z.object({
+		action: filterPiiActionSchema.optional(),
+		fields: z.array(fieldSchema).min(1).max(256).optional(),
+		starterPatterns: z.array(filterPiiStarterPatternSchema).max(256).optional(),
+		customPatterns: z.array(filterPiiCustomPatternSchema).max(256).optional()
+	}).strict();
+}
+function createSourceFilterSchema(fieldSchema) {
+	return z.object({ pii: createPiiFilterSchema(fieldSchema).optional() }).strict();
+}
+const messageSourceFilterSchema = z.object({
+	pii: createPiiFilterSchema(messageFilterFieldSchema).optional(),
+	unattributedAssistantContent: unattributedAssistantContentSchema.optional()
+}).strict();
+const fileSourceFilterSchema = z.object({ pii: createPiiFilterSchema(fileFilterFieldSchema).extend({ uninspectable: z.enum(["allow", "block"]).optional() }).optional() }).strict();
+const filtersConfigSchema = z.object({
+	messages: messageSourceFilterSchema.optional(),
+	prompts: createSourceFilterSchema(promptFilterFieldSchema).optional(),
+	agentInstructions: createSourceFilterSchema(agentInstructionFilterFieldSchema).optional(),
+	conversationStarters: createSourceFilterSchema(conversationStarterFilterFieldSchema).optional(),
+	conversationTitles: createSourceFilterSchema(conversationTitleFilterFieldSchema).optional(),
+	feedback: createSourceFilterSchema(feedbackFilterFieldSchema).optional(),
+	skills: createSourceFilterSchema(skillFilterFieldSchema).optional(),
+	memories: createSourceFilterSchema(memoryFilterFieldSchema).optional(),
+	files: fileSourceFilterSchema.optional(),
+	toolArguments: createSourceFilterSchema(toolArgumentFilterFieldSchema).optional(),
+	modelParameters: createSourceFilterSchema(modelParameterFilterFieldSchema).optional(),
+	actionMetadata: createSourceFilterSchema(actionMetadataFilterFieldSchema).optional()
+}).strict().superRefine((filters, context) => {
+	let customPatterns = 0;
+	let regexCharacters = 0;
+	let regexInstructions = 0;
+	for (const source of Object.values(filters)) for (const pattern of source?.pii?.customPatterns ?? []) {
+		customPatterns++;
+		regexCharacters += pattern.regex.length;
+		regexInstructions += getPiiRegexProgramSize(pattern.regex) ?? 0;
+	}
+	if (customPatterns > 256) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: `At most 256 custom PII patterns may be configured in total`
+	});
+	if (regexCharacters > 8192) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: `Custom PII regexes may contain at most ${MAX_PII_CUSTOM_REGEX_CHARACTERS} characters in total`
+	});
+	if (regexInstructions > 8192) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: `Custom PII regexes may compile to at most ${MAX_PII_CUSTOM_REGEX_INSTRUCTIONS} instructions in total`
+	});
+});
+//#endregion
 //#region src/feedback.ts
 const FEEDBACK_RATINGS = ["thumbsUp", "thumbsDown"];
 const FEEDBACK_REASON_KEYS = [
@@ -169,6 +422,9 @@ const feedbackSchema = z.object({
 	rating: feedbackRatingSchema,
 	tag: feedbackTagKeySchema,
 	text: z.string().max(1024).optional()
+}).refine(({ rating, tag }) => FEEDBACK_TAGS.some((feedbackTag) => feedbackTag.key === tag && feedbackTag.direction === rating), {
+	message: "Feedback tag does not match rating",
+	path: ["tag"]
 });
 function toMinimalFeedback(feedback) {
 	if (!feedback?.rating || !feedback?.tag || !feedback.tag.key) return;
@@ -183,6 +439,25 @@ function getTagByKey(key) {
 	return FEEDBACK_TAGS.find((tag) => tag.key === key);
 }
 //#endregion
+//#region src/stateful-code.ts
+const STATEFUL_CODE_ENVIRONMENTS = [
+	"user",
+	"agent-user",
+	"conversation"
+];
+/** Resolve a deployment allowlist in stable UI order. An omitted value preserves
+* the backward-compatible behavior where every environment is available. */
+function resolveAllowedStatefulCodeEnvironments(configured) {
+	if (configured == null) return [...STATEFUL_CODE_ENVIRONMENTS];
+	const configuredSet = new Set(configured);
+	return STATEFUL_CODE_ENVIRONMENTS.filter((environment) => configuredSet.has(environment));
+}
+/** Keep an allowed preference, otherwise select the first deployment-allowed scope. */
+function resolveStatefulCodeEnvironment(preferred, configured) {
+	const allowed = resolveAllowedStatefulCodeEnvironments(configured);
+	return preferred != null && allowed.includes(preferred) ? preferred : allowed[0];
+}
+//#endregion
 //#region src/types/assistants.ts
 let Tools = /* @__PURE__ */ function(Tools) {
 	Tools["execute_code"] = "execute_code";
@@ -464,6 +739,7 @@ let ReasoningEffort = /* @__PURE__ */ function(ReasoningEffort) {
 	ReasoningEffort["medium"] = "medium";
 	ReasoningEffort["high"] = "high";
 	ReasoningEffort["xhigh"] = "xhigh";
+	ReasoningEffort["max"] = "max";
 	return ReasoningEffort;
 }({});
 let ReasoningParameterFormat = /* @__PURE__ */ function(ReasoningParameterFormat) {
@@ -530,6 +806,21 @@ let ThinkingLevel = /* @__PURE__ */ function(ThinkingLevel) {
 	ThinkingLevel["high"] = "high";
 	return ThinkingLevel;
 }({});
+/** OpenAI Responses API `reasoning.mode` (GPT-5.6+). */
+let ReasoningMode = /* @__PURE__ */ function(ReasoningMode) {
+	ReasoningMode["unset"] = "";
+	ReasoningMode["standard"] = "standard";
+	ReasoningMode["pro"] = "pro";
+	return ReasoningMode;
+}({});
+/** OpenAI Responses API `reasoning.context` (GPT-5.6+). */
+let ReasoningContext = /* @__PURE__ */ function(ReasoningContext) {
+	ReasoningContext["unset"] = "";
+	ReasoningContext["auto"] = "auto";
+	ReasoningContext["current_turn"] = "current_turn";
+	ReasoningContext["all_turns"] = "all_turns";
+	return ReasoningContext;
+}({});
 const imageDetailNumeric = {
 	["low"]: 0,
 	["auto"]: 1,
@@ -549,6 +840,8 @@ const eThinkingDisplaySchema = z.nativeEnum(ThinkingDisplay);
 const eReasoningSummarySchema = z.nativeEnum(ReasoningSummary);
 const eVerbositySchema = z.nativeEnum(Verbosity);
 const eThinkingLevelSchema = z.nativeEnum(ThinkingLevel);
+const eReasoningModeSchema = z.nativeEnum(ReasoningMode);
+const eReasoningContextSchema = z.nativeEnum(ReasoningContext);
 const defaultAssistantFormValues = {
 	assistant: "",
 	id: "",
@@ -580,6 +873,9 @@ const defaultAgentFormValues = {
 	["execute_code"]: false,
 	["file_search"]: false,
 	["web_search"]: false,
+	["memory"]: false,
+	stateful_code_environment: "user",
+	code_environment_id: void 0,
 	category: "general",
 	support_contact: {
 		name: "",
@@ -591,8 +887,14 @@ const defaultAgentFormValues = {
 	/** Master toggle for skill use on this agent. `true` activates skills
 	*  (full catalog unless `skills` narrows it). Anything else = inactive. */
 	skills_enabled: void 0,
+	/** Enables runtime skill creation without exposing an existing skill catalog. */
+	skill_authoring_enabled: void 0,
+	/** Explicit catalog scope. Missing preserves the legacy enabled + empty = all behavior. */
+	skills_scope: void 0,
 	/** `undefined` = feature disabled by default (no subagent tool injected). */
-	subagents: void 0
+	subagents: void 0,
+	/** Memory partition: 'agent' isolates memories per (user, agent); default shared pool */
+	memory_scope: void 0
 };
 const ImageVisionTool = {
 	type: "function",
@@ -606,6 +908,8 @@ const ImageVisionTool = {
 		}
 	}
 };
+/** Structural on purpose: accepts assistants tools/tool calls and agents function tool
+*  calls alike — the check only ever reads `type` and `function.name`. */
 const isImageVisionTool = (tool) => tool.type === "function" && tool.function?.name === ImageVisionTool.function?.name;
 const openAISettings = {
 	model: { default: "gpt-4o-mini" },
@@ -664,8 +968,45 @@ const getGoogleMaxOutputTokens = (modelName) => {
 	}
 	return GOOGLE_LEGACY_MAX_OUTPUT;
 };
+/**
+* Per-model thinking budget bounds, documented in
+* `com_endpoint_google_thinking_budget`: Gemini 2.5 Pro accepts 128-32,768,
+* Flash accepts 0-24,576, and Flash Lite accepts 512-24,576. The generic
+* 32,000 in the shared definition both under-limits Pro and lets invalid
+* Flash values through.
+*
+* `-1` remains the "decide automatically" sentinel and is not part of these
+* floors. Callers must keep `range.min` at -1 and apply `min` only to
+* non-negative values.
+*/
+const GOOGLE_THINKING_BUDGET_PRO_MAX = 32768;
+const GOOGLE_THINKING_BUDGET_FLASH_MAX = 24576;
+const GOOGLE_THINKING_BUDGET_PRO_MIN = 128;
+const GOOGLE_THINKING_BUDGET_FLASH_MIN = 0;
+const GOOGLE_THINKING_BUDGET_FLASH_LITE_MIN = 512;
+const getGoogleThinkingBudgetBounds = (modelName) => {
+	if (!/gemini-2\.5/i.test(modelName)) return;
+	if (/flash[-_.]?lite/i.test(modelName)) return {
+		min: GOOGLE_THINKING_BUDGET_FLASH_LITE_MIN,
+		max: GOOGLE_THINKING_BUDGET_FLASH_MAX
+	};
+	if (/flash/i.test(modelName)) return {
+		min: GOOGLE_THINKING_BUDGET_FLASH_MIN,
+		max: GOOGLE_THINKING_BUDGET_FLASH_MAX
+	};
+	if (/pro/i.test(modelName)) return {
+		min: GOOGLE_THINKING_BUDGET_PRO_MIN,
+		max: GOOGLE_THINKING_BUDGET_PRO_MAX
+	};
+};
+const getGoogleThinkingBudgetMax = (modelName) => getGoogleThinkingBudgetBounds(modelName)?.max;
 const googleSettings = {
 	model: { default: "gemini-1.5-flash-latest" },
+	maxContextTokens: {
+		min: 10,
+		max: 2e6,
+		step: 1e3
+	},
 	maxOutputTokens: {
 		min: 1,
 		max: GOOGLE_MAX_OUTPUT,
@@ -712,6 +1053,7 @@ const CLAUDE_4_64K_MAX_OUTPUT = 64e3;
 const CLAUDE_32K_MAX_OUTPUT = 32e3;
 const DEFAULT_MAX_OUTPUT = 8192;
 const LEGACY_ANTHROPIC_MAX_OUTPUT = 4096;
+const CLAUDE_SONNET_128K_OUTPUT_PATTERN = /claude-sonnet[-.]?(?:4[-.]?(?:[6-9]|\d{2})|[5-9]|\d{2,})(?=$|[^0-9])/;
 /**
 * Claude "Mythos-class" model families — new top-level classes (peers of
 * `opus`/`sonnet`/`haiku`) that ship with the post-Opus-4.7 modern profile:
@@ -755,6 +1097,7 @@ const anthropicSettings = {
 		reset: (modelName) => {
 			if (isMythosClassModel(modelName)) return ANTHROPIC_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:4[-.]?(?:[6-9]|\d{2,})|[5-9]|\d{2,})/.test(modelName)) return ANTHROPIC_MAX_OUTPUT;
+			if (CLAUDE_SONNET_128K_OUTPUT_PATTERN.test(modelName)) return ANTHROPIC_MAX_OUTPUT;
 			if (/claude-(?:sonnet|haiku)[-.]?[4-9]/.test(modelName)) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:[5-9]|4[-.]?([5-9]|\d{2,}))/.test(modelName)) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?[4-9]/.test(modelName)) return CLAUDE_32K_MAX_OUTPUT;
@@ -769,6 +1112,10 @@ const anthropicSettings = {
 				if (value > ANTHROPIC_MAX_OUTPUT) return ANTHROPIC_MAX_OUTPUT;
 				return value;
 			}
+			if (CLAUDE_SONNET_128K_OUTPUT_PATTERN.test(modelName)) {
+				if (value > ANTHROPIC_MAX_OUTPUT) return ANTHROPIC_MAX_OUTPUT;
+				return value;
+			}
 			if (/claude-(?:sonnet|haiku)[-.]?[4-9]/.test(modelName) && value > CLAUDE_4_64K_MAX_OUTPUT) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:[5-9]|4[-.]?([5-9]|\d{2,}))/.test(modelName)) {
 				if (value > CLAUDE_4_64K_MAX_OUTPUT) return CLAUDE_4_64K_MAX_OUTPUT;
@@ -878,12 +1225,21 @@ const tPluginSchema = z.object({
 	authenticated: z.boolean().optional(),
 	chatMenu: z.boolean().optional(),
 	isButton: z.boolean().optional(),
-	toolkit: z.boolean().optional()
+	toolkit: z.boolean().optional(),
+	/** Raw upstream tool name when the model-facing key stripped a redundant
+	*  server-name prefix — proves upstream identity for legacy id migration. */
+	serverToolName: z.string().optional()
 });
 const tExampleSchema = z.object({
 	input: z.object({ content: z.string() }),
 	output: z.object({ content: z.string() })
 });
+/** Compact context-fading tier persisted beside a message's calibration ratio. */
+const agentFadingTierSchema = z.object({
+	v: z.literal(1),
+	budgetTokens: z.number().positive(),
+	masked: z.boolean()
+});
 const tMessageSchema = z.object({
 	messageId: z.string(),
 	endpoint: z.string().optional(),
@@ -900,6 +1256,12 @@ const tMessageSchema = z.object({
 	/** @deprecated */
 	generation: z.string().nullable().optional(),
 	isCreatedByUser: z.boolean(),
+	/** True when the complete stored row came from outside the model. */
+	isUserSubmitted: z.boolean().optional(),
+	/** JSON pointers to caller-authored fields in an otherwise mixed model response. */
+	userSubmittedPaths: z.array(z.string().startsWith("/")).optional(),
+	/** Exact HITL message-field identity for caller-authored values stored in mixed responses. */
+	userSubmittedMessageFieldPaths: z.array(userSubmittedMessageFieldPathSchema).optional(),
 	isTemporary: z.boolean().optional(),
 	expiredAt: z.string().nullable().optional(),
 	error: z.boolean().optional(),
@@ -919,7 +1281,9 @@ const tMessageSchema = z.object({
 	tokenCount: z.number().optional(),
 	contextMeta: z.object({
 		calibrationRatio: z.number().optional().describe("EMA ratio of provider-reported vs local token estimates; seeds the pruner on subsequent runs"),
-		encoding: z.string().optional().describe("Tokenizer encoding used when this ratio was computed (e.g. \"claude\", \"o200k_base\")")
+		encoding: z.string().optional().describe("Tokenizer encoding used when this ratio was computed (e.g. \"claude\", \"o200k_base\")"),
+		fading: agentFadingTierSchema.optional().describe("Latched context-fading tier of the default agent; seeds the next run so the provider projection of history keeps the same bytes"),
+		fadingTiers: z.array(agentFadingTierSchema.extend({ agentId: z.string().min(1) })).optional().describe("Latched context-fading tiers keyed by agent ID, stored as entries")
 	}).optional(),
 	/**
 	* Skill names the user invoked manually via the `$` popover on this turn.
@@ -947,6 +1311,29 @@ const tMessageSchema = z.object({
 	*/
 	quotes: z.array(z.string()).optional()
 });
+/**
+* Which memory partition an agent reads/writes.
+* `user` = the shared personal pool (default); `agent` = a partition
+* isolated per (user, agent) so the agent only sees its own memories.
+*/
+let MemoryScope = /* @__PURE__ */ function(MemoryScope) {
+	MemoryScope["user"] = "user";
+	MemoryScope["agent"] = "agent";
+	return MemoryScope;
+}({});
+/** Catalog exposure for a persisted agent with skills enabled. */
+let SkillsScope = /* @__PURE__ */ function(SkillsScope) {
+	SkillsScope["all"] = "all";
+	SkillsScope["selected"] = "selected";
+	SkillsScope["none"] = "none";
+	return SkillsScope;
+}({});
+/** Resolves explicit and legacy persisted-agent skill catalog states. */
+function resolveAgentSkillsScope(skills, enabled, scope) {
+	if (enabled !== true) return "none";
+	if (scope !== void 0) return scope;
+	return (skills ?? []).length > 0 ? "selected" : "all";
+}
 const coerceNumber = z.union([z.number(), z.string()]).transform((val) => {
 	if (typeof val === "string") return val.trim() === "" ? void 0 : parseFloat(val);
 	return val;
@@ -959,12 +1346,26 @@ const DocumentType = z.lazy(() => z.union([
 	z.array(z.lazy(() => DocumentType)),
 	z.record(z.lazy(() => DocumentType))
 ]));
+const subagentThreadLineageSchema = z.object({
+	rootConversationId: z.string().min(1),
+	parentConversationId: z.string().min(1),
+	parentMessageId: z.string().min(1),
+	parentToolCallId: z.string().min(1),
+	parentAgentId: z.string().min(1).optional(),
+	subagentType: z.string().min(1),
+	subagentKind: z.enum(["agent", "graph"]),
+	depth: z.number().int().positive()
+});
 const tConversationSchema = z.object({
 	conversationId: z.string().nullable(),
 	endpoint: eModelEndpointSchema.nullable(),
 	endpointType: eModelEndpointSchema.nullable().optional(),
 	isArchived: z.boolean().optional(),
+	/** When the chat was archived; absent on chats archived before this was recorded. */
+	archivedAt: z.string().nullable().optional(),
 	pinned: z.boolean().optional(),
+	/** Server-derived: an active shared link exists for this conversation. Not persisted. */
+	isShared: z.boolean().optional(),
 	title: z.string().nullable().or(z.literal("New Chat")).default("New Chat"),
 	user: z.string().optional(),
 	messages: z.array(z.string()).optional(),
@@ -1002,6 +1403,8 @@ const tConversationSchema = z.object({
 	imageDetail: eImageDetailSchema.optional(),
 	reasoning_effort: eReasoningEffortSchema.optional().nullable(),
 	reasoning_summary: eReasoningSummarySchema.optional().nullable(),
+	reasoning_mode: eReasoningModeSchema.optional().nullable(),
+	reasoning_context: eReasoningContextSchema.optional().nullable(),
 	verbosity: eVerbositySchema.optional().nullable(),
 	useResponsesApi: z.boolean().optional(),
 	effort: eAnthropicEffortSchema.optional().nullable(),
@@ -1011,6 +1414,8 @@ const tConversationSchema = z.object({
 	disableStreaming: z.boolean().optional(),
 	assistant_id: z.string().optional(),
 	agent_id: z.string().optional(),
+	/** Durable parent/child navigation for a subagent thread. */
+	subagentThread: subagentThreadLineageSchema.optional(),
 	region: z.string().optional(),
 	maxTokens: coerceNumber.optional(),
 	additionalModelRequestFields: DocumentType.optional(),
@@ -1093,6 +1498,10 @@ const tQueryParamsSchema = tConversationSchema.pick({
 	/** @endpoints openAI, custom, azureOpenAI */
 	reasoning_summary: true,
 	/** @endpoints openAI, custom, azureOpenAI */
+	reasoning_mode: true,
+	/** @endpoints openAI, custom, azureOpenAI */
+	reasoning_context: true,
+	/** @endpoints openAI, custom, azureOpenAI */
 	verbosity: true,
 	/** @endpoints openAI, custom, azureOpenAI */
 	useResponsesApi: true,
@@ -1162,6 +1571,26 @@ const tModelSpecPresetSchema = tPresetSchema.omit({
 	chatGptLabel: true,
 	presetOverride: true,
 	spec: true
+}).merge(z.object({ 
+/**
+* Optional here, unlike `tPresetSchema`, where the key is required (though
+* nullable). A preset naming an `agent_id` has an unambiguous endpoint, so
+* config may omit it and `resolveModelSpecEndpoint` infers `agents` when
+* specs are materialized at config load.
+*/
+endpoint: extendedModelEndpointSchema.nullish() })).superRefine((preset, ctx) => {
+	/**
+	* Omission is only legal when the endpoint is inferable, which requires a
+	* NON-EMPTY `agent_id` — form-backed writers persist untouched fields as
+	* `''`, which names no agent. An explicit `endpoint: null` stays accepted:
+	* it validated before the key became optional, so rejecting it now would
+	* break previously valid configs.
+	*/
+	if (preset.endpoint === void 0 && !preset.agent_id) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["endpoint"],
+		message: "endpoint is required unless the preset names a non-empty agent_id (the agents endpoint is then inferred)"
+	});
 });
 const tSharedLinkSchema = z.object({
 	conversationId: z.string(),
@@ -1190,6 +1619,7 @@ const googleBaseSchema = tConversationSchema.pick({
 	examples: true,
 	temperature: true,
 	maxOutputTokens: true,
+	resendFiles: true,
 	artifacts: true,
 	topP: true,
 	topK: true,
@@ -1348,6 +1778,8 @@ const openAIBaseSchema = tConversationSchema.pick({
 	max_tokens: true,
 	reasoning_effort: true,
 	reasoning_summary: true,
+	reasoning_mode: true,
+	reasoning_context: true,
 	verbosity: true,
 	useResponsesApi: true,
 	web_search: true,
@@ -1446,15 +1878,39 @@ const requiredSettingFields = [
 	"type",
 	"component"
 ];
+function clampSettingRange(value, range) {
+	if (range.positiveMin != null) {
+		/** The minimum carries its own meaning here (Google's -1 for automatic),
+		*  and the schema admits it outright, so it survives rather than being
+		*  lifted to the floor. It need not be negative to be the sentinel. */
+		if (value === range.min) return range.min;
+		/** Below the sentinel there is nothing admissible to lift to, so the value
+		*  resolves to it. Between the sentinel and the floor, the floor is the
+		*  nearest value the generated schema accepts. */
+		if (value < Math.max(range.min, 0)) return range.min;
+		return Math.min(Math.max(value, range.positiveMin), range.max);
+	}
+	return Math.min(Math.max(value, range.min), range.max);
+}
 function generateDynamicSchema(settings) {
 	const schemaFields = {};
 	for (const setting of settings) {
 		const { key, type, default: defaultValue, range, options, minText, maxText, minTags, maxTags } = setting;
 		if (type === "number") {
-			let schema = z.number();
+			let numberSchema = z.number();
 			if (range) {
-				schema = schema.min(range.min);
-				schema = schema.max(range.max);
+				numberSchema = numberSchema.min(range.min);
+				numberSchema = numberSchema.max(range.max);
+			}
+			/** Widened deliberately: refine returns ZodEffects, not ZodNumber, and
+			*  the number-specific chaining is already done above. */
+			let schema = numberSchema;
+			if (range?.positiveMin != null) {
+				/** Mirrors clampSettingRange so the generated schema and the clamp
+				*  agree: `min` only admits the sentinel, and any non-negative value
+				*  must clear the documented floor. */
+				const { positiveMin, min } = range;
+				schema = numberSchema.refine((value) => value === min || value >= positiveMin, `Expected ${min} or a value of at least ${positiveMin}`);
 			}
 			if (typeof defaultValue === "number") schemaFields[key] = schema.default(defaultValue);
 			else schemaFields[key] = schema;
@@ -1596,7 +2052,14 @@ function validateSettingDefinitions(settings) {
 			setting.includeInput = setting.type === "number" ? setting.includeInput ?? true : false;
 		}
 		if (setting.component === "slider" && setting.type === "number") {
-			if (setting.default === void 0 && setting.range) setting.default = Math.round((setting.range.min + setting.range.max) / 2);
+			if (setting.default === void 0 && setting.range) {
+				/** The midpoint of the admissible interval, which a positive floor
+				*  narrows: the span between the sentinel and that floor holds no value
+				*  the generated schema accepts, so a midpoint taken across it would
+				*  fail the validation below. */
+				const floor = Math.max(setting.range.min, setting.range.positiveMin ?? setting.range.min);
+				setting.default = Math.round((floor + setting.range.max) / 2);
+			}
 		}
 		if (setting.component === "checkbox" || setting.component === "switch") {
 			if (setting.options && setting.options.length > 2) errors.push({
@@ -1674,6 +2137,16 @@ function validateSettingDefinitions(settings) {
 			message: `Invalid default value for setting ${setting.key}. Must be within the range [${setting.range.min}, ${setting.range.max}].`,
 			path: ["default"]
 		});
+		if (setting.type === "number" && setting.range?.positiveMin != null && setting.range.positiveMin > setting.range.max) errors.push({
+			code: ZodIssueCode.custom,
+			message: `Invalid range for setting ${setting.key}. positiveMin (${setting.range.positiveMin}) cannot exceed max (${setting.range.max}).`,
+			path: ["range"]
+		});
+		if (setting.type === "number" && setting.range?.positiveMin != null && typeof setting.default === "number" && setting.default !== setting.range.min && setting.default < setting.range.positiveMin) errors.push({
+			code: ZodIssueCode.custom,
+			message: `Invalid default value for setting ${setting.key}. Must be ${setting.range.min} or at least ${setting.range.positiveMin}.`,
+			path: ["default"]
+		});
 		if (setting.enumMappings && setting.type === "enum" && setting.options) {
 			for (const option of setting.options) if (!(option in setting.enumMappings)) errors.push({
 				code: ZodIssueCode.custom,
@@ -1775,13 +2248,83 @@ const generateGoogleSchema = (customGoogle) => {
 //#region src/limits.ts
 /** Maximum number of explicit subagents per parent agent. UI + Zod schema share this. */
 const MAX_SUBAGENTS = 10;
+/** Hard upper bound for `endpoints.agents.maxSubagents`, keeping the request-validation
+*  cap bounded no matter what the config file says. */
+const MAX_SUBAGENTS_CEILING = 50;
+let maxSubagents = 10;
+/** Effective subagents-per-agent cap; initialized from `endpoints.agents.maxSubagents` at startup. */
+const getMaxSubagents = () => maxSubagents;
+/** Applies a configured cap; any missing or out-of-range value resets to the default. */
+const setMaxSubagents = (value) => {
+	maxSubagents = typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 50 ? value : 10;
+};
+/** Chat project field limits. The dialogs and the persistence layer share these,
+*  so the inputs stop at the same point the server would otherwise truncate. */
+const MAX_CHAT_PROJECT_NAME_LENGTH = 100;
+const MAX_CHAT_PROJECT_DESCRIPTION_LENGTH = 1e3;
+/** Mirrors the bounded graph-child member limit in `@librechat/agents`. */
+const MAX_GRAPH_SUBAGENT_MEMBERS = 32;
 //#endregion
 //#region src/models.ts
 const modelSpecSubagentsSchema = z.object({
 	enabled: z.boolean().optional(),
 	allowSelf: z.boolean().optional(),
-	agent_ids: z.array(z.string()).max(10).optional()
+	agent_ids: z.array(z.string()).optional()
+}).superRefine((subagents, ctx) => {
+	const maxSubagents = getMaxSubagents();
+	if ((subagents.agent_ids?.length ?? 0) > maxSubagents) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["agent_ids"],
+		message: `agent_ids must contain at most ${maxSubagents} item(s)`
+	});
 });
+function resolveModelSpecEndpoint(modelSpec) {
+	const preset = modelSpec?.preset;
+	if (preset?.endpoint != null) return preset.endpoint;
+	/**
+	* An explicit `endpoint: null` is a statement, not an omission — such specs
+	* validated (and were skipped downstream) before inference existed, so
+	* inferring here would silently activate them. Only an absent key infers,
+	* and only from a non-empty `agent_id`: form-backed writers persist
+	* untouched fields as `''`, which names no agent.
+	*/
+	if (preset?.endpoint === null) return;
+	return preset?.agent_id ? "agents" : void 0;
+}
+/**
+* Writes each spec's resolved endpoint back onto its preset so every consumer —
+* endpoint matching, the selector, access filters, startup presets, provider-key
+* reachability — reads a complete spec instead of re-deriving it. Apply once
+* where the effective config is assembled (YAML load and DB-override merge);
+* downstream code then needs no awareness of inference.
+*
+* Returns the original object, and the original spec objects, when nothing
+* needs filling in, so cached configs and memoized consumers see no new
+* identities.
+*/
+function materializeModelSpecEndpoints(modelSpecs) {
+	const list = modelSpecs?.list;
+	if (!list?.length) return modelSpecs;
+	let changed = false;
+	const materialized = list.map((spec) => {
+		if (spec?.preset == null || spec.preset.endpoint != null) return spec;
+		const endpoint = resolveModelSpecEndpoint(spec);
+		if (endpoint == null) return spec;
+		changed = true;
+		return {
+			...spec,
+			preset: {
+				...spec.preset,
+				endpoint
+			}
+		};
+	});
+	if (!changed) return modelSpecs;
+	return {
+		...modelSpecs,
+		list: materialized
+	};
+}
 const tModelSpecSchema = z.object({
 	name: z.string(),
 	label: z.string(),
@@ -1796,12 +2339,17 @@ const tModelSpecSchema = z.object({
 	showIconInHeader: z.boolean().optional(),
 	showOnLanding: z.boolean().optional(),
 	conversation_starters: z.array(z.string()).optional(),
+	showInMenu: z.boolean().optional(),
 	iconURL: z.union([z.string(), eModelEndpointSchema]).optional(),
 	authType: authTypeSchema.optional(),
 	hideBadgeRow: z.boolean().optional(),
 	webSearch: z.boolean().optional(),
 	fileSearch: z.boolean().optional(),
 	executeCode: z.boolean().optional(),
+	memory: z.boolean().optional(),
+	askUserQuestion: z.boolean().optional(),
+	runInBackground: z.union([z.boolean(), z.array(z.string())]).optional(),
+	describeIntent: z.union([z.boolean(), z.array(z.string())]).optional(),
 	artifacts: z.union([z.string(), z.boolean()]).optional(),
 	mcpServers: z.array(z.string()).optional(),
 	skills: z.union([z.boolean(), z.array(z.string())]).optional(),
@@ -1883,6 +2431,7 @@ const fullMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -1913,6 +2462,7 @@ const fullMimeTypesList = [
 	"application/vnd.oasis.opendocument.graphics",
 	"image/svg",
 	"image/svg+xml",
+	"message/rfc822",
 	"video/mp4",
 	"video/avi",
 	"video/mov",
@@ -1946,6 +2496,7 @@ const codeInterpreterMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -1978,6 +2529,7 @@ const retrievalMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -1999,11 +2551,34 @@ const bedrockDocumentFormats = {
 	"text/markdown": "md"
 };
 const isBedrockDocumentType = (mimeType) => mimeType != null && mimeType in bedrockDocumentFormats;
+/** MIME types Bedrock's Converse document path can send to the model (mirrors `bedrockDocumentFormats`). */
+const bedrockDocumentMimeTypes = Object.keys(bedrockDocumentFormats);
 /** File extensions accepted by Bedrock document uploads (for input accept attributes) */
 const bedrockDocumentExtensions = ".pdf,.csv,.doc,.docx,.xls,.xlsx,.html,.htm,.txt,.md,application/pdf,text/csv,application/csv,application/msword,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.ms-excel,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,text/html,text/plain,text/markdown";
+/** Textual `application/*` MIME types that can be decoded and sent as plain text */
+const textualApplicationTypes = new Set([
+	"application/json",
+	"application/xml",
+	"application/yaml",
+	"application/sql",
+	"application/typescript",
+	"application/x-sh",
+	"application/csv"
+]);
+/**
+* MIME types the Anthropic Messages API accepts as a plain-text document source
+* (`source.type: 'text'`)
+*/
+const isAnthropicTextDocumentType = (mimeType) => mimeType != null && (mimeType.startsWith("text/") || textualApplicationTypes.has(mimeType));
+/**
+* MIME types the Anthropic Messages API document path can send to the model
+* (mirrors `isBedrockDocumentType`): PDF via base64, textual types via a
+* plain-text document source. All other types are rejected with a provider 400.
+*/
+const isAnthropicDocumentType = (mimeType) => mimeType === "application/pdf" || isAnthropicTextDocumentType(mimeType);
 const excelMimeTypes = /^application\/(vnd\.ms-excel|msexcel|x-msexcel|x-ms-excel|x-excel|x-dos_ms_excel|xls|x-xls|vnd\.openxmlformats-officedocument\.spreadsheetml\.sheet)$/;
 const textMimeTypes = /^(text\/(x-c|x-csharp|tab-separated-values|x-c\+\+|x-h|x-java|html|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|css|vtt|javascript|csv|xml|calendar))$/;
-const applicationMimeTypes = /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|x-zip-compressed|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
+const applicationMimeTypes = /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|x-zip-compressed|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.(presentation|template)|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
 const imageMimeTypes = /^image\/(jpeg|gif|png|webp|heic|heif)$/;
 const audioMimeTypes = /^audio\/(mp3|mpeg|mpeg3|wav|wave|x-wav|ogg|vorbis|mp4|m4a|x-m4a|flac|x-flac|webm|aac|wma|opus)$/;
 const videoMimeTypes = /^video\/(mp4|avi|mov|wmv|flv|webm|mkv|m4v|3gp|ogv)$/;
@@ -2012,6 +2587,7 @@ const defaultOCRMimeTypes = [
 	excelMimeTypes,
 	/^application\/pdf$/,
 	/^application\/vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation)$/,
+	/^application\/vnd\.openxmlformats-officedocument\.presentationml\.template$/,
 	/^application\/vnd\.ms-(word|powerpoint)$/,
 	/^application\/epub\+zip$/,
 	/^application\/vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)$/
@@ -2033,7 +2609,8 @@ const supportedMimeTypes = [
 	imageMimeTypes,
 	videoMimeTypes,
 	audioMimeTypes,
-	/^image\/(svg|svg\+xml)$/
+	/^image\/(svg|svg\+xml)$/,
+	/^message\/rfc822$/
 ];
 const codeInterpreterMimeTypes = [
 	textMimeTypes,
@@ -2088,6 +2665,7 @@ const codeTypeMapping = {
 	cljs: "text/plain",
 	cljc: "text/plain",
 	elm: "text/plain",
+	eml: "message/rfc822",
 	erl: "text/plain",
 	hrl: "text/plain",
 	ex: "text/plain",
@@ -2159,6 +2737,13 @@ const codeTypeMapping = {
 	ods: "application/vnd.oasis.opendocument.spreadsheet",
 	odp: "application/vnd.oasis.opendocument.presentation",
 	odg: "application/vnd.oasis.opendocument.graphics",
+	doc: "application/msword",
+	docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+	xls: "application/vnd.ms-excel",
+	xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+	ppt: "application/vnd.ms-powerpoint",
+	pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	potx: "application/vnd.openxmlformats-officedocument.presentationml.template",
 	ics: "text/calendar",
 	ical: "text/calendar",
 	ifb: "text/calendar",
@@ -2173,7 +2758,11 @@ const imageTypeMapping = {
 const mimeTypeAliases = {
 	"application/x-zip-compressed": "application/zip",
 	"text/x-python-script": "text/x-python",
-	"text/x-markdown": "text/markdown"
+	"text/x-markdown": "text/markdown",
+	/** freedesktop shared-mime-info (Chrome on Linux) */
+	"application/x-shellscript": "application/x-sh",
+	/** libmagic, i.e. `file --mime-type` */
+	"text/x-shellscript": "application/x-sh"
 };
 /**
 * Infers the MIME type from a file's extension when the browser doesn't recognize it,
@@ -2187,7 +2776,7 @@ function inferMimeType(fileName, currentType) {
 	const extension = fileName.split(".").pop()?.toLowerCase() ?? "";
 	return codeTypeMapping[extension] || imageTypeMapping[extension] || currentType;
 }
-const retrievalMimeTypes = [/^(text\/(x-c|x-c\+\+|x-h|html|x-java|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|vtt|xml))$/, /^(application\/(json|pdf|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation)))$/];
+const retrievalMimeTypes = [/^(text\/(x-c|x-c\+\+|x-h|html|x-java|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|vtt|xml))$/, /^(application\/(json|pdf|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.(presentation|template))))$/];
 const megabyte = 1024 * 1024;
 /** Helper function to get megabytes value */
 const mbToBytes = (mb) => mb * megabyte;
@@ -2229,7 +2818,8 @@ const fileConfig = {
 		enabled: false,
 		maxWidth: 1900,
 		maxHeight: 1900,
-		quality: .92
+		quality: .92,
+		enforced: false
 	},
 	ocr: { supportedMimeTypes: defaultOCRMimeTypes },
 	text: { supportedMimeTypes: defaultTextMimeTypes },
@@ -2259,28 +2849,219 @@ const fileConfigSchema = z.object({
 	}).optional(),
 	clientImageResize: z.object({
 		enabled: z.boolean().optional(),
-		maxWidth: z.number().min(0).optional(),
-		maxHeight: z.number().min(0).optional(),
+		maxWidth: z.number().min(1).optional(),
+		maxHeight: z.number().min(1).optional(),
 		quality: z.number().min(0).max(1).optional()
 	}).optional(),
 	ocr: z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional(),
 	text: z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional()
 });
-/** Helper function to safely convert string patterns to RegExp objects */
-const convertStringsToRegex = (patterns) => patterns.reduce((acc, pattern) => {
-	try {
-		const regex = new RegExp(pattern);
-		acc.push(regex);
-	} catch (error) {
-		console.error(`Invalid regex pattern "${pattern}" skipped.`, error);
+/**
+* Compiler for admin-supplied MIME patterns. Defaults to native `RegExp`, which browser
+* builds keep so no extra dependency is bundled. The server swaps in a linear-time engine
+* via `setFileConfigRegexCompiler` so an admin-authored catastrophic-backtracking pattern
+* cannot ReDoS the shared event loop when tested against an uploaded file's MIME type.
+*/
+let compileMimeRegex = (pattern) => new RegExp(pattern);
+/** Override the MIME-pattern compiler; the server injects a linear-time engine at startup. */
+const setFileConfigRegexCompiler = (compile) => {
+	compileMimeRegex = compile;
+};
+/** Returned when every configured pattern fails to compile, so consumers that read an empty
+*  allowlist as "no restriction" fail closed instead of allowing every file. */
+const rejectAllMimeMatcher = { test: () => false };
+/** Helper function to safely convert string patterns to matcher objects */
+const convertStringsToRegex = (patterns) => {
+	const compiled = patterns.reduce((acc, pattern) => {
+		try {
+			acc.push(compileMimeRegex(pattern));
+		} catch (error) {
+			console.error(`Invalid regex pattern "${pattern}" skipped.`, error);
+		}
+		return acc;
+	}, []);
+	if (patterns.length > 0 && compiled.length === 0) {
+		console.error(`All ${patterns.length} MIME type pattern(s) were invalid and skipped; the resulting allowlist rejects every file.`);
+		return [rejectAllMimeMatcher];
 	}
-	return acc;
-}, []);
+	return compiled;
+};
 /** Detects whether the given MIME type patterns accept all file types (e.g., `.*` or `.+`). */
 const isPermissiveMimeConfig = (types) => {
 	if (!types || types.length === 0) return false;
 	return types.some((regex) => regex.test("x-librechat/x-probe"));
 };
+/** Media categories that collapse to a wildcard `accept` token when any member type is allowed. */
+const mimeAcceptCategories = [
+	{
+		/** Mirrors `imageMimeTypes` (+ the code-interpreter svg variants) so every accepted type is known. */
+		category: "image",
+		token: "image/*",
+		samples: [
+			"image/jpeg",
+			"image/gif",
+			"image/png",
+			"image/webp",
+			"image/heic",
+			"image/heif",
+			"image/svg",
+			"image/svg+xml"
+		],
+		extras: [".heif", ".heic"]
+	},
+	{
+		/** Mirrors `audioMimeTypes`. */
+		category: "audio",
+		token: "audio/*",
+		samples: [
+			"audio/mp3",
+			"audio/mpeg",
+			"audio/mpeg3",
+			"audio/wav",
+			"audio/wave",
+			"audio/x-wav",
+			"audio/ogg",
+			"audio/vorbis",
+			"audio/mp4",
+			"audio/m4a",
+			"audio/x-m4a",
+			"audio/flac",
+			"audio/x-flac",
+			"audio/webm",
+			"audio/aac",
+			"audio/wma",
+			"audio/opus"
+		]
+	},
+	{
+		/** Mirrors `videoMimeTypes`. */
+		category: "video",
+		token: "video/*",
+		samples: [
+			"video/mp4",
+			"video/avi",
+			"video/mov",
+			"video/wmv",
+			"video/flv",
+			"video/webm",
+			"video/mkv",
+			"video/m4v",
+			"video/3gp",
+			"video/ogv"
+		]
+	}
+];
+/** Document/text MIME types paired with the extension(s) browsers filter on in the file picker. */
+const documentMimeExtensions = [
+	["application/pdf", [".pdf"]],
+	["application/msword", [".doc"]],
+	["application/vnd.openxmlformats-officedocument.wordprocessingml.document", [".docx"]],
+	["application/vnd.ms-excel", [".xls"]],
+	["application/msexcel", [".xls"]],
+	["application/x-msexcel", [".xls"]],
+	["application/x-ms-excel", [".xls"]],
+	["application/x-excel", [".xls"]],
+	["application/x-dos_ms_excel", [".xls"]],
+	["application/xls", [".xls"]],
+	["application/x-xls", [".xls"]],
+	["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", [".xlsx"]],
+	["application/vnd.ms-powerpoint", [".ppt"]],
+	["application/vnd.openxmlformats-officedocument.presentationml.presentation", [".pptx"]],
+	["application/vnd.openxmlformats-officedocument.presentationml.template", [".potx"]],
+	["application/vnd.oasis.opendocument.text", [".odt"]],
+	["application/vnd.oasis.opendocument.spreadsheet", [".ods"]],
+	["application/vnd.oasis.opendocument.presentation", [".odp"]],
+	["application/vnd.oasis.opendocument.graphics", [".odg"]],
+	["application/rtf", [".rtf"]],
+	["application/json", [".json"]],
+	["application/xml", [".xml"]],
+	["application/yaml", [".yaml", ".yml"]],
+	["application/zip", [".zip"]],
+	["application/x-zip-compressed", [".zip"]],
+	["application/epub+zip", [".epub"]],
+	["application/x-parquet", [".parquet"]],
+	["application/vnd.apache.parquet", [".parquet"]],
+	["text/csv", [".csv"]],
+	["application/csv", [".csv"]],
+	["text/tab-separated-values", [".tsv"]],
+	["text/plain", [".txt"]],
+	["text/markdown", [".md"]],
+	["text/html", [".html", ".htm"]],
+	["text/calendar", [".ics"]],
+	["message/rfc822", [".eml"]]
+];
+const documentMimeSet = new Set(documentMimeExtensions.map(([mimeType]) => mimeType));
+/** Every MIME type LibreChat may accept, used to detect patterns that reach beyond the representable set. */
+const knownMimeUniverse = Array.from(new Set([
+	...fullMimeTypesList,
+	...documentMimeExtensions.map(([mimeType]) => mimeType),
+	...mimeAcceptCategories.flatMap((category) => category.samples)
+]));
+const categoryOf = (mimeType) => {
+	if (mimeType.startsWith("image/")) return "image";
+	if (mimeType.startsWith("audio/")) return "audio";
+	if (mimeType.startsWith("video/")) return "video";
+	return "document";
+};
+/** Media types are covered by their `<cat>/*` wildcard token; document types need an explicit entry. */
+const isRepresentable = (mimeType) => categoryOf(mimeType) !== "document" || documentMimeSet.has(mimeType);
+/**
+* Translates a finite MIME allowlist into a file-input `accept` string, intersected with what the
+* provider upload path can actually send. Returns `undefined` (keep the provider filter) when a
+* configured pattern matches a supported, path-handleable type that cannot be represented, so the
+* picker never hides a file the path would have accepted.
+*/
+const buildMimeAccept = (types, { categories, documentMimeTypes }) => {
+	const permittedSet = new Set(categories);
+	const documentAllowSet = documentMimeTypes ? new Set(documentMimeTypes) : null;
+	const emittedMedia = /* @__PURE__ */ new Set();
+	const emittedDocuments = /* @__PURE__ */ new Set();
+	if (!types.every((regex) => knownMimeUniverse.some((mimeType) => regex.test(mimeType)))) return;
+	for (const regex of types) for (const mimeType of knownMimeUniverse) {
+		if (!regex.test(mimeType)) continue;
+		const category = categoryOf(mimeType);
+		if (!permittedSet.has(category)) continue;
+		/** The path handles documents but drops this specific type (e.g. Bedrock ignores pptx/ODF). */
+		if (category === "document" && documentAllowSet && !documentAllowSet.has(mimeType)) continue;
+		if (!isRepresentable(mimeType)) return;
+		if (category === "document") emittedDocuments.add(mimeType);
+		else emittedMedia.add(category);
+	}
+	const tokens = [];
+	const seen = /* @__PURE__ */ new Set();
+	const push = (token) => {
+		if (!seen.has(token)) {
+			seen.add(token);
+			tokens.push(token);
+		}
+	};
+	for (const category of mimeAcceptCategories) if (emittedMedia.has(category.category)) {
+		push(category.token);
+		category.extras?.forEach(push);
+	}
+	for (const [mimeType, extensions] of documentMimeExtensions) if (emittedDocuments.has(mimeType)) {
+		extensions.forEach(push);
+		push(mimeType);
+	}
+	return tokens.length > 0 ? tokens.join(",") : void 0;
+};
+/**
+* Resolves the file-input `accept` value for a configured `supportedMimeTypes` allowlist, scoped to
+* what the current upload path (`capability`) can send to the model.
+* - `undefined` for the built-in default or a config that can't be represented safely, so callers
+*   keep their provider-specific filter.
+* - `''` for permissive configs (e.g. `.*`), leaving the picker unrestricted.
+* - a translated `accept` string for a recognized finite allowlist (images, PDFs, Office docs, etc.).
+*
+* The picker `accept` is a UX convenience, not a security boundary: the backend still enforces
+* `supportedMimeTypes` on upload.
+*/
+const getConfiguredMimeAccept = (types, capability) => {
+	/** Referential identity with the built-in list signals an unconfigured endpoint (keep provider filter). */
+	if (!types || types.length === 0 || types === supportedMimeTypes) return;
+	if (isPermissiveMimeConfig(types)) return "";
+	return buildMimeAccept(types, capability);
+};
 /**
 * Gets the appropriate endpoint file configuration with standardized lookup logic.
 *
@@ -2375,7 +3156,8 @@ function mergeFileConfig(dynamic) {
 	};
 	if (dynamic.clientImageResize !== void 0) mergedConfig.clientImageResize = {
 		...mergedConfig.clientImageResize,
-		...dynamic.clientImageResize
+		...dynamic.clientImageResize,
+		enforced: dynamic.clientImageResize.enabled !== void 0
 	};
 	if (dynamic.ocr !== void 0) {
 		const { supportedMimeTypes: ocrMimeTypes, ...ocrRest } = dynamic.ocr;
@@ -2436,9 +3218,14 @@ const buildQuery = (params) => {
 };
 const health = () => `${BASE_URL}/health`;
 const user = () => `${BASE_URL}/api/user`;
+const userPreferences = () => `${user()}/preferences`;
 const balance = () => `${BASE_URL}/api/balance`;
 const userPlugins = () => `${BASE_URL}/api/user/plugins`;
 const deleteUser$1 = () => `${BASE_URL}/api/user/delete`;
+const codeEnvironments = () => `${BASE_URL}/api/code-environments`;
+const codeEnvironmentPairings = () => `${codeEnvironments()}/pairings`;
+const codeEnvironmentById = (id) => `${codeEnvironments()}/${encodeURIComponent(id)}`;
+const codeEnvironmentSettings = (id) => `${codeEnvironmentById(id)}/settings`;
 const messagesRoot = `${BASE_URL}/api/messages`;
 const messages = (params) => {
 	const { conversationId, messageId, ...rest } = params;
@@ -2450,9 +3237,16 @@ const messagesArtifacts = (messageId) => `${messagesRoot}/artifact/${messageId}`
 const messagesBranch = () => `${messagesRoot}/branch`;
 const shareRoot = `${BASE_URL}/api/share`;
 const shareMessages = (shareId) => `${shareRoot}/${shareId}`;
+const forkSharedMessages = (shareId) => `${shareRoot}/${shareId}/fork`;
 const sharedStartupConfig = (shareId) => `${shareMessages(shareId)}/config`;
 const getSharedLink$1 = (conversationId) => `${shareRoot}/link/${conversationId}`;
-const getSharedLinks = (pageSize, sortBy, sortDirection, search, cursor) => `${shareRoot}?pageSize=${pageSize}&sortBy=${sortBy}&sortDirection=${sortDirection}${search ? `&search=${search}` : ""}${cursor ? `&cursor=${cursor}` : ""}`;
+const getSharedLinks = (pageSize, sortBy, sortDirection, search, cursor) => `${shareRoot}${buildQuery({
+	pageSize,
+	sortBy,
+	sortDirection,
+	search,
+	cursor
+})}`;
 const createSharedLink$1 = (conversationId) => `${shareRoot}/${conversationId}`;
 const updateSharedLink$1 = (shareId) => `${shareRoot}/${shareId}`;
 /** Share-scoped file routes: serve snapshotted files via shared-link permission. */
@@ -2472,9 +3266,17 @@ const conversations = (params) => {
 	return `${conversationsRoot}${buildQuery(params)}`;
 };
 const conversationById = (id) => `${conversationsRoot}/${id}`;
+const parentSubagents = (parentConversationId) => `${conversationsRoot}/${encodeURIComponent(parentConversationId)}/subagents`;
+const subagentThread = (parentConversationId, threadId, taskId, cursor) => {
+	const endpoint = `${conversationsRoot}/${encodeURIComponent(parentConversationId)}/subagents/${encodeURIComponent(threadId)}`;
+	if (taskId != null) return `${endpoint}?taskId=${encodeURIComponent(taskId)}`;
+	return cursor == null ? endpoint : `${endpoint}?cursor=${encodeURIComponent(cursor)}`;
+};
+const subagentControl = (parentConversationId, threadId) => `${conversationsRoot}/${encodeURIComponent(parentConversationId)}/subagents/${encodeURIComponent(threadId)}/control`;
 const genTitle$1 = (conversationId) => `${conversationsRoot}/gen_title/${encodeURIComponent(conversationId)}`;
 const updateConversation$1 = () => `${conversationsRoot}/update`;
 const archiveConversation$1 = () => `${conversationsRoot}/archive`;
+const archiveAllConversations$1 = () => `${conversationsRoot}/archive/all`;
 const pinConversation$1 = () => `${conversationsRoot}/pin`;
 const deleteConversation$1 = () => `${conversationsRoot}`;
 const deleteAllConversation = () => `${conversationsRoot}/all`;
@@ -2492,7 +3294,6 @@ const presets = () => `${BASE_URL}/api/presets`;
 const deletePreset$1 = () => `${BASE_URL}/api/presets/delete`;
 const aiEndpoints = () => `${BASE_URL}/api/endpoints`;
 const tokenConfig = () => `${BASE_URL}/api/endpoints/token-config`;
-const contextProjection = () => `${BASE_URL}/api/endpoints/context-projection`;
 const models = () => `${BASE_URL}/api/models`;
 const tokenizer = () => `${BASE_URL}/api/tokenizer`;
 const login$1 = () => `${BASE_URL}/api/auth/login`;
@@ -2531,6 +3332,7 @@ const mcpAuthValues = (serverName) => {
 const cancelMCPOAuth$1 = (serverName) => {
 	return `${BASE_URL}/api/mcp/oauth/cancel/${serverName}`;
 };
+const mcpOAuthStatus = (flowId) => `${BASE_URL}/api/mcp/oauth/status/${encodeURIComponent(flowId)}`;
 const mcpOAuthBind = (serverName) => `${BASE_URL}/api/mcp/${serverName}/oauth/bind`;
 const actionOAuthBind = (actionId) => `${BASE_URL}/api/actions/${actionId}/oauth/bind`;
 const config = (context) => `${BASE_URL}/api/config${buildQuery({ context })}`;
@@ -2559,6 +3361,14 @@ const agents = ({ path = "", options }) => {
 	return url;
 };
 const activeJobs = () => `${BASE_URL}/api/agents/chat/active`;
+const agentQueuedTurnsRoot = `${BASE_URL}/api/agents/chat/queued-turns`;
+const agentQueuedTurns = () => agentQueuedTurnsRoot;
+const agentQueuedTurnsByConversation = (conversationId, clientRequestIds = []) => {
+	const uniqueIds = Array.from(new Set(clientRequestIds)).slice(0, 100);
+	const knownIds = uniqueIds.length > 0 ? `&${uniqueIds.map((id) => `clientRequestIds=${encodeURIComponent(id)}`).join("&")}` : "";
+	return `${agentQueuedTurnsRoot}?conversationId=${encodeURIComponent(conversationId)}${knownIds}`;
+};
+const agentQueuedTurn = (queuedTurnId) => `${agentQueuedTurnsRoot}/${encodeURIComponent(queuedTurnId)}`;
 const mcp = {
 	tools: `${BASE_URL}/api/mcp/tools`,
 	servers: `${BASE_URL}/api/mcp/servers`
@@ -2567,6 +3377,8 @@ const mcpServer = (serverName) => `${BASE_URL}/api/mcp/servers/${serverName}`;
 const revertAgentVersion$1 = (agent_id) => `${agents({ path: `${agent_id}/revert` })}`;
 const files = () => `${BASE_URL}/api/files`;
 const filePreview = (fileId) => `${BASE_URL}/api/files/${encodeURIComponent(fileId)}/preview`;
+/** Owner-scoped usage touch so queued attachments outlive the upload-window TTL. */
+const fileUsage = () => `${BASE_URL}/api/files/usage`;
 const agentFiles = (agentId) => `${BASE_URL}/api/files/agent/${agentId}`;
 const images = () => `${files()}/images`;
 const avatar = () => `${images()}/avatar`;
@@ -2610,6 +3422,9 @@ const deletePrompt$1 = ({ _id, groupId }) => {
 };
 const getCategories$1 = () => `${BASE_URL}/api/categories`;
 const getAllPromptGroups$1 = () => `${prompts()}/all`;
+const schedules = () => `${BASE_URL}/api/schedules`;
+const schedule = (id) => `${schedules()}/${encodeURIComponent(id)}`;
+const runSchedule = (id) => `${schedule(id)}/run`;
 const skills = () => `${BASE_URL}/api/skills`;
 const importSkill$1 = () => `${skills()}/import`;
 const getSkill$1 = (id) => `${skills()}/${encodeURIComponent(id)}`;
@@ -2623,11 +3438,18 @@ const listSkillsWithFilters = (filter) => {
 };
 const skillFiles = (id) => `${getSkill$1(id)}/files`;
 const skillFile = (id, relativePath) => `${skillFiles(id)}/${encodeURIComponent(relativePath)}`;
+const insights = () => `${BASE_URL}/api/admin/insights`;
+const insightsAccess = () => `${insights()}/access`;
 const adminSkillsSync = () => `${BASE_URL}/api/admin/skills/sync`;
 const adminSkillsSyncStatus = () => `${adminSkillsSync()}/status`;
 const adminSkillsSyncRun = () => `${adminSkillsSync()}/run`;
 const adminSkillsSyncCredential = (credentialKey) => `${adminSkillsSync()}/credentials/${encodeURIComponent(credentialKey)}`;
 const skillStates = () => `${BASE_URL}/api/user/settings/skills/active`;
+const adminLangfuseConnection = () => `${BASE_URL}/api/admin/langfuse/connection`;
+const adminLangfuseConnectionTest = () => `${adminLangfuseConnection()}/test`;
+const adminLangfuseSessionLink = (conversationId) => `${adminLangfuseConnection()}/session/${encodeURIComponent(conversationId)}`;
+const toolFavorites = () => `${BASE_URL}/api/user/settings/favorites/tools`;
+const toolFavorite = (itemType, itemId) => `${toolFavorites()}/${itemType}/${encodeURIComponent(itemId)}`;
 const roles = () => `${BASE_URL}/api/roles`;
 const adminRoles = () => `${BASE_URL}/api/admin/roles`;
 const getRole$1 = (roleName) => `${roles()}/${encodeURIComponent(roleName)}`;
@@ -2652,7 +3474,8 @@ const disableTwoFactor$1 = () => `${BASE_URL}/api/auth/2fa/disable`;
 const regenerateBackupCodes$1 = () => `${BASE_URL}/api/auth/2fa/backup/regenerate`;
 const verifyTwoFactorTemp$1 = () => `${BASE_URL}/api/auth/2fa/verify-temp`;
 const memories = () => `${BASE_URL}/api/memories`;
-const memory = (key) => `${memories()}/${encodeURIComponent(key)}`;
+const memory = (key, agentId) => `${memories()}/${encodeURIComponent(key)}${agentId ? `?agentId=${encodeURIComponent(agentId)}` : ""}`;
+const memoryById = (id, agentId) => `${memories()}/id/${encodeURIComponent(id)}${agentId ? `?agentId=${encodeURIComponent(agentId)}` : ""}`;
 const memoryPreferences = () => `${memories()}/preferences`;
 const searchPrincipals$1 = (params) => {
 	const { q: query, limit, types } = params;
@@ -2830,9 +3653,11 @@ const UserOAuthOptionsSchema = OAuthOptionsBaseSchema.omit({
 const OboOptionsSchema = z.object({ 
 /** Scopes to request for the downstream MCP server (e.g., "api://<client-id>/Mcp.Tools.ReadWrite") */
 scopes: z.string().min(1) });
+const MCP_SERVER_TITLE_PATTERN = /* @__PURE__ */ new RegExp("^[\\p{L}\\p{N}][\\p{L}\\p{N}\\p{M}'’ -]*$", "u");
+const MCP_SERVER_TITLE_ERROR = "Title must start with a letter or number and can include spaces, hyphens, and apostrophes";
 const BaseOptionsSchema = z.object({
-	/** Display name for the MCP server - only letters, numbers, and spaces allowed */
-	title: z.string().regex(/^[a-zA-Z0-9 ]+$/, "Title can only contain letters, numbers, and spaces").optional(),
+	/** Display name for the MCP server */
+	title: z.string().regex(MCP_SERVER_TITLE_PATTERN, MCP_SERVER_TITLE_ERROR).optional(),
 	/** Description of the MCP server */
 	description: z.string().optional(),
 	/**
@@ -2847,7 +3672,14 @@ const BaseOptionsSchema = z.object({
 	/** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
 	sseReadTimeout: z.number().int().positive().optional(),
 	initTimeout: z.number().int().nonnegative().optional(),
-	/** Controls visibility in chat dropdown menu (MCPSelect) */
+	/**
+	* Whether the server is offered in chat.
+	*
+	* `false` hides it from the chat dropdown (MCPSelect) AND bars it from the
+	* chat selection a request carries, so a stale or hand-written request cannot
+	* reach it either. It does not restrict agents, nor a server a model spec
+	* pins through `mcpServers` — both are the operator's own choice.
+	*/
 	chatMenu: z.boolean().optional(),
 	/**
 	* Controls server instruction behavior:
@@ -2903,6 +3735,26 @@ const ProxyUrlSchema = z.string().transform((val) => extractEnvVariable(val)).pi
 	const protocol = new URL(val).protocol;
 	return protocol === "http:" || protocol === "https:" || protocol === "socks:" || protocol === "socks5:";
 }, { message: "Proxy URL must use http://, https://, socks://, or socks5://" });
+const PROCESS_MCP_SERVER_FIELDS = new Set([
+	"command",
+	"args",
+	"env",
+	"cwd",
+	"stderr"
+]);
+function isProcessMCPServerField(field) {
+	return PROCESS_MCP_SERVER_FIELDS.has(field);
+}
+function isProcessMCPServerConfig(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return false;
+	const config = value;
+	if (config.type === "stdio") return true;
+	return Object.keys(config).some(isProcessMCPServerField);
+}
+function hasProcessMCPServerConfig(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.values(value).some(isProcessMCPServerConfig);
+}
 const StdioOptionsSchema = BaseOptionsSchema.extend({
 	type: z.literal("stdio").default("stdio"),
 	obo: z.undefined().optional(),
@@ -2935,7 +3787,12 @@ const StdioOptionsSchema = BaseOptionsSchema.extend({
 		"pipe",
 		"ignore",
 		"inherit"
-	]), z.number().int().nonnegative()]).optional()
+	]), z.number().int().nonnegative()]).optional(),
+	/**
+	* Working directory for the spawned process. Supplied by Agent Plugins
+	* packages, which resolve and contain the path before it reaches this schema.
+	*/
+	cwd: z.string().optional()
 });
 const WebSocketOptionsSchema = BaseOptionsSchema.extend({
 	type: z.literal("websocket").default("websocket"),
@@ -3070,7 +3927,10 @@ const defaultSocialLogins = [
 	"discord",
 	"saml"
 ];
-const BASE_ONLY_CONFIG_SECTIONS = [];
+const BASE_ONLY_CONFIG_SECTIONS = ["filters"];
+/** Sections that may be stored in the tenant's base config document but must
+* not be overridden or tombstoned by role, group, or user config documents. */
+const BASE_PRINCIPAL_CONFIG_SECTIONS = ["langfuse"];
 const defaultRetrievalModels = [
 	"gpt-4o",
 	"o1-preview-2024-09-12",
@@ -3095,6 +3955,12 @@ const defaultRetrievalModels = [
 ];
 const excludedKeys = new Set([
 	"conversationId",
+	"agentEventBinding",
+	"agentEventActor",
+	"agentEventActorReconciliations",
+	"agentEventActorEpoch",
+	"agentEventActorLegacyTurn",
+	"subagentThread",
 	"title",
 	"iconURL",
 	"greeting",
@@ -3106,6 +3972,8 @@ const excludedKeys = new Set([
 	"isTemporary",
 	"messages",
 	"isArchived",
+	"pinned",
+	"archivedAt",
 	"tags",
 	"user",
 	"__v",
@@ -3154,6 +4022,32 @@ function isPrivateIPv4Literal(value) {
 	if (a >= 224) return true;
 	return false;
 }
+/**
+* Mirrors `hasPrivateEmbeddedIPv4` in `@librechat/api`'s ip helpers: 6to4, NAT64, and Teredo
+* carry an IPv4 address inside the IPv6 one, and the runtime guard blocks those when the
+* embedded address is private. Kept in sync so an operator can exempt what the runtime blocks.
+*/
+function hasPrivateEmbeddedIPv4Literal(value) {
+	const is6to4 = value.startsWith("2002:");
+	const isNat64 = value.startsWith("64:ff9b::");
+	const isTeredo = value.startsWith("2001::");
+	if (!is6to4 && !isNat64 && !isTeredo) return false;
+	const segments = value.split(":").filter((segment) => segment !== "");
+	const pair = is6to4 ? segments.slice(1, 3) : segments.slice(-2);
+	if (pair.length !== 2) return false;
+	const hi = parseInt(pair[0], 16);
+	const lo = parseInt(pair[1], 16);
+	if (isNaN(hi) || isNaN(lo)) return false;
+	/** RFC 4380: Teredo stores the external IPv4 as a bitwise complement. */
+	const high = isTeredo ? ~hi : hi;
+	const low = isTeredo ? ~lo : lo;
+	return isPrivateIPv4Literal([
+		high >> 8 & 255,
+		high & 255,
+		low >> 8 & 255,
+		low & 255
+	].join("."));
+}
 function isPrivateIPv6Literal(value) {
 	if (!value.includes(":")) return false;
 	if (value === "::1" || value === "::") return true;
@@ -3164,7 +4058,7 @@ function isPrivateIPv6Literal(value) {
 	}
 	const mappedMatch = value.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
 	if (mappedMatch) return isPrivateIPv4Literal(mappedMatch[1]);
-	return false;
+	return hasPrivateEmbeddedIPv4Literal(value);
 }
 /**
 * Mirrors the allowedAddresses parser in `@librechat/api`'s auth helpers.
@@ -3381,6 +4275,7 @@ let AgentCapabilities = /* @__PURE__ */ function(AgentCapabilities) {
 	AgentCapabilities["end_after_tools"] = "end_after_tools";
 	AgentCapabilities["deferred_tools"] = "deferred_tools";
 	AgentCapabilities["execute_code"] = "execute_code";
+	AgentCapabilities["stateful_code_sessions"] = "stateful_code_sessions";
 	AgentCapabilities["file_search"] = "file_search";
 	AgentCapabilities["web_search"] = "web_search";
 	AgentCapabilities["artifacts"] = "artifacts";
@@ -3388,9 +4283,13 @@ let AgentCapabilities = /* @__PURE__ */ function(AgentCapabilities) {
 	AgentCapabilities["actions"] = "actions";
 	AgentCapabilities["context"] = "context";
 	AgentCapabilities["skills"] = "skills";
+	AgentCapabilities["memory"] = "memory";
+	AgentCapabilities["ask_user_question"] = "ask_user_question";
 	AgentCapabilities["tools"] = "tools";
 	AgentCapabilities["chain"] = "chain";
 	AgentCapabilities["ocr"] = "ocr";
+	AgentCapabilities["run_in_background"] = "run_in_background";
+	AgentCapabilities["tool_intents"] = "tool_intents";
 	return AgentCapabilities;
 }({});
 const defaultAssistantsVersion = {
@@ -3398,7 +4297,14 @@ const defaultAssistantsVersion = {
 	["azureAssistants"]: 1
 };
 const baseEndpointSchema = z.object({
-	streamRate: z.number().optional(),
+	/**
+	* Milliseconds between visible streamed chunks. Agents SDK-backed
+	* providers (openAI, custom, anthropic, google, bedrock, agents) smooth
+	* adaptively at 25ms by default; set to override the cadence, 0 to
+	* disable smoothing. Legacy Assistants and Ollama paths instead sleep
+	* this long per provider chunk (default 1ms), with no adaptive smoothing.
+	*/
+	streamRate: z.number().min(0).optional(),
 	baseURL: z.string().optional(),
 	/**
 	* Custom request headers forwarded to the provider on every request. Values
@@ -3426,6 +4332,53 @@ const baseEndpointSchema = z.object({
 	* completes (legacy behavior).
 	*/
 	titleTiming: z.union([z.literal("immediate"), z.literal("final")]).optional(),
+	/**
+	* Agent activity groups: collapse each contiguous block of reasoning and
+	* tool calls under a generated one-line header. Mirrors the title options
+	* above — `activityLabel` enables it (like `titleConvo`), the rest tune
+	* the fast model that writes the label.
+	*
+	* NOTE: fields added here reach `endpoints.all` automatically (that schema
+	* is `baseEndpointSchema.omit({ baseURL })`), but NOT Azure — see the
+	* enumerated `.pick()` in `azureEndpointSchema` below.
+	*/
+	activityLabel: z.boolean().optional(),
+	/** Model used to write activity labels. Defaults to `titleModel`, then the agent's model. */
+	activityModel: z.string().optional(),
+	/** Endpoint whose credentials the label model runs on. Defaults to the agent's endpoint. */
+	activityEndpoint: z.string().optional(),
+	/** Overrides the system prompt used to write activity labels. */
+	activityPrompt: z.string().optional(),
+	/** Cost cap: maximum labels generated per run. Default 20. */
+	activityMaxPerRun: z.number().int().positive().optional(),
+	/** Per-entry truncation of tool input/output in the label prompt. Default 600. */
+	activityCharLimit: z.number().int().positive().optional(),
+	/** Generates one parent summary for each run phase containing 2+ activities. */
+	activityPhaseLabel: z.boolean().optional(),
+	/** Model used for phase summaries. Defaults to activityModel, titleModel, then the run model. */
+	activityPhaseModel: z.string().optional(),
+	/** Endpoint whose credentials the phase summary model uses. Defaults to activityEndpoint. */
+	activityPhaseEndpoint: z.string().optional(),
+	/** Overrides the dedicated phase-summary system prompt. */
+	activityPhasePrompt: z.string().optional(),
+	/** Cost cap: maximum phase summaries generated per run. Default 5. */
+	activityPhaseMaxPerRun: z.number().int().positive().optional(),
+	/** Generates a live orientation label for sufficiently long top-level response reasoning. */
+	reasoningLabel: z.boolean().optional(),
+	/** Model used for reasoning labels. Defaults to activityModel, titleModel, then run model. */
+	reasoningLabelModel: z.string().optional(),
+	/** Endpoint receiving the bounded visible-reasoning snapshot. Defaults to activityEndpoint. */
+	reasoningLabelEndpoint: z.string().optional(),
+	/** Overrides the dedicated reasoning-label system prompt. */
+	reasoningLabelPrompt: z.string().optional(),
+	/** Characters required before the first reasoning label. Default 500. */
+	reasoningLabelMinChars: z.number().int().positive().optional(),
+	/** New characters required between streaming revisions. Default 400. */
+	reasoningLabelUpdateChars: z.number().int().positive().optional(),
+	/** Minimum milliseconds between streaming revisions. Default 3000. */
+	reasoningLabelUpdateIntervalMs: z.number().int().nonnegative().optional(),
+	/** Cost cap: maximum reasoning-label provider calls attempted per run. Default 8. */
+	reasoningLabelMaxPerRun: z.number().int().positive().optional(),
 	/** Maximum characters allowed in a single tool result before truncation. */
 	maxToolResultChars: z.number().positive().optional()
 });
@@ -3466,6 +4419,11 @@ const assistantEndpointSchema = baseEndpointSchema.merge(z.object({
 		"tools"
 	]),
 	apiKey: z.string().optional(),
+	/** Masked preview of the API key, stored at write time so admin
+	* reads can show which key is configured without returning the secret.
+	* Shared by both `endpoints.assistants` and `endpoints.azureAssistants`,
+	* which both use this schema. */
+	apiKeyPreview: z.string().optional(),
 	models: z.object({
 		default: z.array(modelItemSchema).min(1),
 		fetch: z.boolean().optional(),
@@ -3483,6 +4441,8 @@ const defaultAgentCapabilities = [
 	"actions",
 	"context",
 	"skills",
+	"memory",
+	"ask_user_question",
 	"tools",
 	"chain",
 	"ocr"
@@ -3528,23 +4488,304 @@ const remoteApiAuthSchema = z.object({
 	oidc: remoteApiOidcSchema.optional()
 });
 const remoteApiSchema = z.object({ auth: remoteApiAuthSchema.optional() });
+/**
+* Permission mode applied to a tool call. Mirrors `@librechat/agents`'s
+* `ToolPolicyMode` 1:1.
+*
+* - `default`: ask the user about anything not explicitly allowed (default-on).
+* - `dontAsk`: deny anything not explicitly allowed (headless / API-key flows).
+* - `bypass`: auto-approve everything that isn't explicitly denied
+*   (the user-facing "stop asking me" toggle).
+*
+* Subagents inherit the parent's mode; this is enforced by the SDK and not
+* overridable per-subagent.
+*/
+const toolApprovalModeSchema = z.enum([
+	"default",
+	"dontAsk",
+	"bypass"
+]);
+/**
+* Per-endpoint tool-approval policy.
+*
+* Shape mirrors `@librechat/agents`'s `ToolPolicyConfig` so the host can map it
+* directly into `createToolPolicyHook(config)`. The SDK does the evaluation
+* (`deny → ask → allow → bypass → dontAsk → fallthrough(ask)`); this config
+* just describes the surface.
+*
+* Conventions:
+* - All list entries are matched as globs (`*`). Use `mcp:server:*` to scope
+*   a rule to every tool from a single MCP server.
+* - `deny` always wins, including under `bypass`.
+* - `enabled: false` is a LibreChat-only kill switch that disables the entire
+*   HITL machinery for this endpoint (no checkpointer, no hooks, no prompts).
+*   This is admin-level; users toggle prompting via `mode: 'bypass'` instead.
+*/
+/**
+* A programmatic tool-approval hook loaded from a module at startup.
+*
+* The referenced module's default export must be a builder
+* `(options?) => ToolApprovalHookFactory` (see `@librechat/api`'s `registerToolApprovalHook`).
+* Hooks compose with the static `allow`/`deny`/`ask` policy above and can only TIGHTEN it
+* (the SDK folds decisions `deny → ask → allow`). This is admin-level config — the module is
+* dynamically imported and executed in-process, so only reference trusted code.
+*/
+const toolApprovalHookConfigSchema = z.object({
+	/**
+	* Module specifier to import: a bare package name (e.g. `@acme/approval-hooks`) or a path —
+	* absolute, or relative to the app root. Its default export is the hook builder.
+	*/
+	module: z.string().min(1),
+	/** Optional regex matched against the tool name; omit to run for every tool. */
+	matcher: z.string().optional(),
+	/** Static options forwarded to the module's builder; the hook's own per-call config. */
+	options: z.record(z.unknown()).optional()
+});
+const toolApprovalPolicySchema = z.object({
+	enabled: z.boolean().optional(),
+	mode: toolApprovalModeSchema.optional(),
+	allow: z.array(z.string()).optional(),
+	deny: z.array(z.string()).optional(),
+	ask: z.array(z.string()).optional(),
+	/** Optional reason template surfaced in the prompt; `{tool}` is interpolated. */
+	reason: z.string().optional(),
+	/**
+	* Programmatic policy hooks loaded from modules at startup. They layer on top of the
+	* static lists above for dynamic, context-aware decisions the lists can't express
+	* (per-args, per-agent, per-user). See {@link toolApprovalHookConfigSchema}.
+	*
+	* BASE-CONFIG ONLY: hooks are imported + registered once, process-wide, at server
+	* startup — they are NOT reloaded from per-role/user/tenant admin overrides. Encode
+	* per-user/tenant behavior INSIDE the hook (via its runtime context), not by varying the
+	* module list per override. Honored only when `enabled` is true.
+	*/
+	hooks: z.array(toolApprovalHookConfigSchema).optional()
+}).optional();
+/**
+* Durable checkpointer backing human-in-the-loop resume.
+*
+* When `toolApproval.enabled` is true, a run that pauses for review suspends its
+* LangGraph state to a checkpoint; resuming rebuilds that state on a *fresh* `Run`
+* — possibly on a different replica, or the same worker after a restart. That only
+* works if the checkpoint outlives the original request, so HITL needs a durable
+* saver, not the SDK's process-local `MemorySaver` fallback.
+*
+* Defaults are zero-config: with `toolApproval.enabled` on and no `checkpointer`
+* block, LibreChat persists checkpoints to its primary MongoDB, so resume works
+* across replicas out of the box.
+*
+* - `type: 'mongo'` (default) — persist to the app database; survives restarts and
+*   resolves on any replica. A TTL index reclaims runs that are never resolved.
+* - `type: 'memory'` — process-local only. Paused runs do NOT survive a restart and
+*   can only be resolved on the originating worker. Single-process / dev only.
+*/
+const checkpointerTypeSchema = z.enum(["mongo", "memory"]);
+const checkpointerSchema = z.object({
+	type: checkpointerTypeSchema.optional(),
+	/**
+	* Approval window, in seconds: how long a paused run waits for a decision
+	* before it is reclaimed. Drives both the Mongo TTL index on checkpoints and
+	* the pending-action expiry, keeping the two layers in lockstep. Defaults to
+	* 86400 (24h). Raise it for longer review windows.
+	*/
+	ttl: z.number().int().positive().optional(),
+	/** Advanced: override the Mongo collection names used for checkpoints. */
+	checkpointCollectionName: z.string().optional(),
+	checkpointWritesCollectionName: z.string().optional()
+}).optional();
+const codeEnvironmentBaseURLSchema = z.string().trim().url().refine((value) => {
+	try {
+		const url = new URL(value);
+		return (url.protocol === "http:" || url.protocol === "https:") && !value.includes("?") && !value.includes("#") && url.search.length === 0 && url.hash.length === 0;
+	} catch {
+		return false;
+	}
+}, { message: "Code environment baseURL must be an HTTP(S) base URL without query or fragment" });
+function isSecureCodeEnvironmentControlURL(baseURL) {
+	try {
+		const url = new URL(baseURL.trim());
+		if (url.protocol === "https:") return true;
+		if (url.protocol !== "http:") return false;
+		return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+	} catch {
+		return false;
+	}
+}
+const codeEnvironmentPermissionDecisionSchema = z.enum([
+	"allow",
+	"ask",
+	"deny"
+]);
+const codeEnvironmentPermissionFieldSchema = z.object({
+	allowed: z.array(codeEnvironmentPermissionDecisionSchema).min(1),
+	default: codeEnvironmentPermissionDecisionSchema.optional().default("ask")
+}).strict().superRefine((field, context) => {
+	if (!field.allowed.includes(field.default)) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["default"],
+		message: "Permission default must be included in allowed values"
+	});
+});
+/**
+* Typed user-tunable surface for one attached code environment. Omitted fields
+* remain fixed at LibreChat's safe baseline. Isolation, networking, mounts,
+* privileged execution, and secrets are deliberately not representable here.
+*/
+const codeEnvironmentUserConfigSchema = z.object({ permissions: z.object({
+	fileWrite: codeEnvironmentPermissionFieldSchema.optional(),
+	commandExecution: codeEnvironmentPermissionFieldSchema.optional()
+}).strict().optional() }).strict();
+const codeEnvironmentUserSettingsSchema = z.object({ permissions: z.object({
+	fileWrite: codeEnvironmentPermissionDecisionSchema.optional(),
+	commandExecution: codeEnvironmentPermissionDecisionSchema.optional()
+}).strict().optional() }).strict();
 const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(z.object({
 	recursionLimit: z.number().optional(),
 	disableBuilder: z.boolean().optional().default(false),
 	maxRecursionLimit: z.number().optional(),
+	/** Max cumulative bytes a single streamed tool call's arguments may reach before the run
+	* aborts. Defaults to 64 KiB in the agents SDK; `0` disables the guard. */
+	maxToolCallArgBytes: z.number().optional(),
+	/** Max streamed chunk events per model generation before the run aborts. Off by default. */
+	maxDeltaEventsPerTurn: z.number().optional(),
+	/** Per-tool overrides of `maxToolCallArgBytes`, keyed by model-facing tool name; `0`
+	* disables the guard for that tool only. Merged over LibreChat's shipped default of
+	* `{ create_file: 131072 }`. */
+	maxToolCallArgBytesByTool: z.record(z.number()).optional(),
 	maxCitations: z.number().min(1).max(50).optional().default(30),
 	maxCitationsPerFile: z.number().min(1).max(10).optional().default(7),
 	minRelevanceScore: z.number().min(0).max(1).optional().default(.45),
+	/** Maximum explicit subagents per agent (`agent_ids` and `graphs`); raised from
+	* the shipped default of 10 for orchestration-heavy deployments, bounded by
+	* `MAX_SUBAGENTS_CEILING`. */
+	maxSubagents: z.number().int().min(1).max(50).optional().default(10),
 	allowedProviders: z.array(z.union([z.string(), eModelEndpointSchema])).optional(),
 	capabilities: z.array(z.nativeEnum(AgentCapabilities)).optional().default(defaultAgentCapabilities),
+	/** Controls which workspace-sharing scopes users may select for stateful code sessions.
+	*  Omit this block to preserve the legacy behavior of allowing every scope. */
+	statefulCodeSessions: z.object({
+		allowedEnvironments: z.array(z.enum(STATEFUL_CODE_ENVIRONMENTS)).min(1),
+		/** Operator-managed execution environments. Attached entries route to a
+		* Code API deployment backed by an outbound librechat-code worker. */
+		environments: z.array(z.object({
+			id: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/),
+			name: z.string().min(1).max(100),
+			type: z.enum(["managed", "attached"]),
+			baseURL: codeEnvironmentBaseURLSchema,
+			default: z.boolean().optional(),
+			/** Server-only outbound worker route. Removed from public config. */
+			workerId: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/).optional(),
+			/** Distinguishes operator policy from a principal-authorized
+			* environment merged into request-scoped server config. */
+			owner: z.enum(["deployment", "principal"]).optional().default("deployment"),
+			/** Administrator-controlled user-tunable settings. Only fields
+			* represented here may be changed by a principal. */
+			configSchema: codeEnvironmentUserConfigSchema.optional(),
+			/** Request-scoped effective settings for a principal-owned environment.
+			* Deployment config should define defaults through configSchema instead. */
+			settings: codeEnvironmentUserSettingsSchema.optional(),
+			/** Server-only enrollment metadata. `tokenEnv` names an
+			* environment variable and never contains the token itself. */
+			pairing: z.object({
+				workerId: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/).optional(),
+				allowPrincipalWorkers: z.boolean().optional().default(false),
+				tokenEnv: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/)
+			}).superRefine((pairing, pairingContext) => {
+				if (pairing.workerId != null || pairing.allowPrincipalWorkers === true) return;
+				pairingContext.addIssue({
+					code: z.ZodIssueCode.custom,
+					message: "Pairing requires a workerId or principal workers"
+				});
+			}).optional()
+		})).optional()
+	}).superRefine((value, context) => {
+		if (!value?.environments) return;
+		const ids = /* @__PURE__ */ new Set();
+		let defaults = 0;
+		let executableEnvironments = 0;
+		for (const environment of value.environments) {
+			const pairingOnly = environment.pairing?.allowPrincipalWorkers === true && environment.pairing.workerId == null && environment.workerId == null;
+			if (environment.pairing != null && environment.type !== "attached") context.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "Only attached code environments may configure pairing",
+				path: [
+					"environments",
+					environment.id,
+					"pairing"
+				]
+			});
+			if (environment.pairing != null && environment.owner !== "deployment") context.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "Only deployment-owned code environments may configure pairing",
+				path: [
+					"environments",
+					environment.id,
+					"pairing"
+				]
+			});
+			if (environment.pairing != null && !isSecureCodeEnvironmentControlURL(environment.baseURL)) context.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "Paired code environments require HTTPS outside loopback development",
+				path: [
+					"environments",
+					environment.id,
+					"baseURL"
+				]
+			});
+			if (environment.workerId != null && environment.pairing?.workerId != null && environment.workerId !== environment.pairing.workerId) context.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "Code environment workerId must match pairing.workerId",
+				path: [
+					"environments",
+					environment.id,
+					"workerId"
+				]
+			});
+			if (pairingOnly && environment.default === true) context.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "Pairing-only code control planes cannot be execution defaults",
+				path: [
+					"environments",
+					environment.id,
+					"default"
+				]
+			});
+			if (ids.has(environment.id)) context.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: `Duplicate code environment id: ${environment.id}`,
+				path: ["environments"]
+			});
+			ids.add(environment.id);
+			if (!pairingOnly) {
+				executableEnvironments += 1;
+				if (environment.default === true) defaults += 1;
+			}
+		}
+		if (executableEnvironments > 0 && defaults !== 1) context.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "Exactly one stateful code environment must be the default",
+			path: ["environments"]
+		});
+	}).optional(),
+	/** Optional trusted origin for in-process agent event delivery. */
+	eventDriven: z.object({ selfUrl: z.string().url().optional() }).optional(),
+	/** Conversational background-task delivery policy. Automatic completion wakeups are
+	* enabled unless an administrator explicitly restores poll-only behavior. */
+	backgroundTasks: z.object({ completionWakeups: z.boolean().optional().default(true) }).optional(),
 	skills: z.object({ maxCatalogSkills: z.number().int().min(1).max(100).optional() }).optional(),
-	remoteApi: remoteApiSchema.optional()
+	remoteApi: remoteApiSchema.optional(),
+	/** Human-in-the-loop tool approval policy. Off by default. */
+	toolApproval: toolApprovalPolicySchema,
+	/** Durable checkpointer backing tool-approval and Ask User resume.
+	*  Defaults to the app's MongoDB when either flow needs it. */
+	checkpointer: checkpointerSchema
 })).default({
 	disableBuilder: false,
 	capabilities: defaultAgentCapabilities,
 	maxCitations: 30,
 	maxCitationsPerFile: 7,
-	minRelevanceScore: .45
+	minRelevanceScore: .45,
+	maxSubagents: 10
 });
 const paramDefinitionSchema = z.object({
 	key: z.string(),
@@ -3562,7 +4803,11 @@ const paramDefinitionSchema = z.object({
 	range: z.object({
 		min: z.number(),
 		max: z.number(),
-		step: z.number().optional()
+		step: z.number().optional(),
+		positiveMin: z.number().optional()
+	}).refine((value) => value.positiveMin == null || value.positiveMin <= value.max, {
+		message: "range.positiveMin cannot exceed range.max",
+		path: ["positiveMin"]
 	}).optional(),
 	enumMappings: z.record(z.union([
 		z.number(),
@@ -3597,6 +4842,9 @@ const paramDefinitionSchema = z.object({
 const endpointSchema = baseEndpointSchema.merge(z.object({
 	name: z.string().refine((value) => !eModelEndpointSchema.safeParse(value).success, { message: `Value cannot be one of the default endpoint (EModelEndpoint) values: ${Object.values(EModelEndpoint).join(", ")}` }),
 	apiKey: z.string(),
+	/** Masked preview of the API key, stored at write time so admin
+	* reads can show which key is configured without returning the secret. */
+	apiKeyPreview: z.string().optional(),
 	baseURL: z.string(),
 	models: z.object({
 		default: z.array(modelItemSchema).min(1),
@@ -3644,15 +4892,43 @@ const endpointSchema = baseEndpointSchema.merge(z.object({
 const azureEndpointSchema = z.object({
 	groups: azureGroupConfigsSchema,
 	assistants: z.boolean().optional()
-}).and(endpointSchema.pick({
-	streamRate: true,
-	titleConvo: true,
-	titleMethod: true,
-	titleModel: true,
-	titlePrompt: true,
-	titleTiming: true,
-	titlePromptTemplate: true
-}).partial());
+}).and(
+	/**
+	* Azure carries only the base-endpoint fields enumerated here. This is a
+	* `.pick()`, NOT an omit, so a field added to `baseEndpointSchema` is
+	* silently unavailable on Azure endpoints until it is listed below —
+	* unlike `endpoints.all`, which omits and therefore inherits new fields
+	* automatically. Keep this list in sync when adding endpoint options.
+	*/
+	endpointSchema.pick({
+		streamRate: true,
+		titleConvo: true,
+		titleMethod: true,
+		titleModel: true,
+		titlePrompt: true,
+		titleTiming: true,
+		titlePromptTemplate: true,
+		activityLabel: true,
+		activityModel: true,
+		activityEndpoint: true,
+		activityPrompt: true,
+		activityMaxPerRun: true,
+		activityCharLimit: true,
+		activityPhaseLabel: true,
+		activityPhaseModel: true,
+		activityPhaseEndpoint: true,
+		activityPhasePrompt: true,
+		activityPhaseMaxPerRun: true,
+		reasoningLabel: true,
+		reasoningLabelModel: true,
+		reasoningLabelEndpoint: true,
+		reasoningLabelPrompt: true,
+		reasoningLabelMinChars: true,
+		reasoningLabelUpdateChars: true,
+		reasoningLabelUpdateIntervalMs: true,
+		reasoningLabelMaxPerRun: true
+	}).partial()
+);
 /**
 * Vertex AI model configuration - similar to Azure model config
 * Allows specifying deployment name for each model
@@ -3688,15 +4964,20 @@ const anthropicEndpointSchema = baseEndpointSchema.merge(z.object({
 	/** Optional: List of available models */
 	models: z.array(z.string()).optional()
 }));
+/** Masked preview of the API key, stored at write time so admin
+* reads can show which key is configured without returning the secret. */
+const apiKeyPreviewSchema = z.string().optional();
 const ttsOpenaiSchema = z.object({
 	url: z.string().optional(),
 	apiKey: z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: z.string(),
 	voices: z.array(z.string())
 });
 const ttsAzureOpenAISchema = z.object({
 	instanceName: z.string(),
 	apiKey: z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	deploymentName: z.string(),
 	apiVersion: z.string(),
 	model: z.string(),
@@ -3706,6 +4987,7 @@ const ttsElevenLabsSchema = z.object({
 	url: z.string().optional(),
 	websocketUrl: z.string().optional(),
 	apiKey: z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: z.string(),
 	voices: z.array(z.string()),
 	voice_settings: z.object({
@@ -3719,10 +5001,12 @@ const ttsElevenLabsSchema = z.object({
 const ttsLocalaiSchema = z.object({
 	url: z.string(),
 	apiKey: z.string().optional(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	voices: z.array(z.string()),
 	backend: z.string()
 });
 const ttsSchema = z.object({
+	allowedAddresses: allowedAddressesSchema,
 	openai: ttsOpenaiSchema.optional(),
 	azureOpenAI: ttsAzureOpenAISchema.optional(),
 	elevenlabs: ttsElevenLabsSchema.optional(),
@@ -3731,15 +5015,18 @@ const ttsSchema = z.object({
 const sttOpenaiSchema = z.object({
 	url: z.string().optional(),
 	apiKey: z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: z.string()
 });
 const sttAzureOpenAISchema = z.object({
 	instanceName: z.string(),
 	apiKey: z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	deploymentName: z.string(),
 	apiVersion: z.string()
 });
 const sttSchema = z.object({
+	allowedAddresses: allowedAddressesSchema,
 	openai: sttOpenaiSchema.optional(),
 	azureOpenAI: sttAzureOpenAISchema.optional()
 });
@@ -3747,16 +5034,23 @@ const speechTab = z.object({
 	conversationMode: z.boolean().optional(),
 	advancedMode: z.boolean().optional(),
 	speechToText: z.boolean().optional().or(z.object({
-		/** Keep in sync with STTProviders enum (defined below — cannot reference due to eval order) */
-		engineSTT: z.enum(["openai", "azureOpenAI"]).optional(),
+		/** Provider names remain valid for backward compatibility and are normalized for clients. */
+		engineSTT: z.enum([
+			"browser",
+			"external",
+			"openai",
+			"azureOpenAI"
+		]).optional(),
 		languageSTT: z.string().optional(),
 		autoTranscribeAudio: z.boolean().optional(),
 		decibelValue: z.number().optional(),
 		autoSendText: z.number().optional()
 	})).optional(),
 	textToSpeech: z.boolean().optional().or(z.object({
-		/** Keep in sync with TTSProviders enum (defined below — cannot reference due to eval order) */
+		/** Provider names remain valid for backward compatibility and are normalized for clients. */
 		engineTTS: z.enum([
+			"browser",
+			"external",
 			"openai",
 			"azureOpenAI",
 			"elevenlabs",
@@ -3777,6 +5071,10 @@ let RateLimitPrefix = /* @__PURE__ */ function(RateLimitPrefix) {
 	return RateLimitPrefix;
 }({});
 const rateLimitSchema = z.object({
+	agentEvents: z.object({
+		userMax: z.number().int().positive().optional(),
+		userWindowInMinutes: z.number().positive().optional()
+	}).optional(),
 	fileUploads: z.object({
 		ipMax: z.number().optional(),
 		ipWindowInMinutes: z.number().optional(),
@@ -3868,6 +5166,7 @@ const interfaceSchema = z.object({
 	webSearch: z.boolean().optional(),
 	contextUsage: z.boolean().optional(),
 	contextCost: z.boolean().optional(),
+	feedback: z.boolean().optional(),
 	currency: z.object({
 		code: z.string(),
 		rate: z.number().positive()
@@ -3901,6 +5200,23 @@ const interfaceSchema = z.object({
 		share: z.boolean().optional(),
 		public: z.boolean().optional(),
 		snapshotFiles: z.boolean().optional()
+	})]).optional(),
+	schedules: z.union([z.boolean(), z.object({
+		use: z.boolean().optional(),
+		create: z.boolean().optional(),
+		maxPerUser: z.number().int().min(0).optional(),
+		minIntervalMinutes: z.number().int().min(1).optional(),
+		autoDisableAfterFailures: z.number().int().min(1).optional(),
+		fireConcurrency: z.number().int().min(1).optional(),
+		/** Refuse schedules that are not filed under a chat project. Enforced on
+		*  create/update AND at every fire, so raising it later stops schedules
+		*  that predate the policy instead of grandfathering them. */
+		requireProject: z.boolean().optional(),
+		/** Pins every scheduled run to ONE chat project, ignoring any client
+		*  choice. Implies `requireProject`. The project must belong to the
+		*  schedule's owner, so a deployment-wide value only makes sense with a
+		*  per-user/per-role config override. */
+		projectId: z.string().trim().min(1).optional()
 	})]).optional()
 }).default({
 	modelSelect: true,
@@ -3927,6 +5243,7 @@ const interfaceSchema = z.object({
 	webSearch: true,
 	contextUsage: true,
 	contextCost: false,
+	feedback: true,
 	peoplePicker: {
 		users: true,
 		groups: true,
@@ -3996,12 +5313,14 @@ let SearchProviders = /* @__PURE__ */ function(SearchProviders) {
 	SearchProviders["SERPER"] = "serper";
 	SearchProviders["SEARXNG"] = "searxng";
 	SearchProviders["TAVILY"] = "tavily";
+	SearchProviders["KEENABLE"] = "keenable";
 	return SearchProviders;
 }({});
 let ScraperProviders = /* @__PURE__ */ function(ScraperProviders) {
 	ScraperProviders["FIRECRAWL"] = "firecrawl";
 	ScraperProviders["SERPER"] = "serper";
 	ScraperProviders["TAVILY"] = "tavily";
+	ScraperProviders["KEENABLE"] = "keenable";
 	return ScraperProviders;
 }({});
 let RerankerTypes = /* @__PURE__ */ function(RerankerTypes) {
@@ -4016,19 +5335,39 @@ let SafeSearchTypes = /* @__PURE__ */ function(SafeSearchTypes) {
 	SafeSearchTypes[SafeSearchTypes["STRICT"] = 2] = "STRICT";
 	return SafeSearchTypes;
 }({});
+/**
+* Normalizes a SearXNG engine list into the comma-separated form the API expects.
+* Accepts the YAML list or comma-separated string an operator may write, and is
+* applied both at the schema boundary and when loading the runtime config, since
+* `loadCustomConfig` returns the raw YAML object rather than the parsed result.
+*/
+function normalizeSearxngEngines(engines) {
+	if (engines == null) return;
+	const normalized = (Array.isArray(engines) ? engines : engines.split(",")).map((engine) => engine.trim()).filter(Boolean);
+	return normalized.length ? normalized.join(",") : void 0;
+}
 const webSearchSchema = z.object({
+	allowedAddresses: allowedAddressesSchema,
 	serperApiKey: z.string().optional().default("${SERPER_API_KEY}"),
+	serperApiKeyPreview: apiKeyPreviewSchema,
 	searxngInstanceUrl: z.string().optional().default("${SEARXNG_INSTANCE_URL}"),
 	searxngApiKey: z.string().optional().default("${SEARXNG_API_KEY}"),
+	searxngApiKeyPreview: apiKeyPreviewSchema,
 	firecrawlApiKey: z.string().optional().default("${FIRECRAWL_API_KEY}"),
+	firecrawlApiKeyPreview: apiKeyPreviewSchema,
 	firecrawlApiUrl: z.string().optional().default("${FIRECRAWL_API_URL}"),
 	firecrawlVersion: z.string().optional().default("${FIRECRAWL_VERSION}"),
 	tavilyApiKey: z.string().optional().default("${TAVILY_API_KEY}"),
+	tavilyApiKeyPreview: apiKeyPreviewSchema,
 	tavilySearchUrl: z.string().optional().default("${TAVILY_SEARCH_URL}"),
 	tavilyExtractUrl: z.string().optional().default("${TAVILY_EXTRACT_URL}"),
+	keenableApiKey: z.string().optional().default("${KEENABLE_API_KEY}"),
+	keenableApiUrl: z.string().optional().default("${KEENABLE_API_URL}"),
 	jinaApiKey: z.string().optional().default("${JINA_API_KEY}"),
+	jinaApiKeyPreview: apiKeyPreviewSchema,
 	jinaApiUrl: z.string().optional().default("${JINA_API_URL}"),
 	cohereApiKey: z.string().optional().default("${COHERE_API_KEY}"),
+	cohereApiKeyPreview: apiKeyPreviewSchema,
 	searchProvider: z.nativeEnum(SearchProviders).optional(),
 	scraperProvider: z.nativeEnum(ScraperProviders).optional(),
 	rerankerType: z.nativeEnum(RerankerTypes).optional(),
@@ -4061,6 +5400,16 @@ const webSearchSchema = z.object({
 			tag: z.string().nullable().optional()
 		}).optional()
 	}).optional(),
+	searxngSearchOptions: z.object({
+		engines: z.union([z.string(), z.array(z.string())]).transform(normalizeSearxngEngines).optional(),
+		language: z.string().optional(),
+		timeRange: z.enum([
+			"day",
+			"month",
+			"year"
+		]).optional(),
+		timeout: z.number().int().positive().max(12e4).optional()
+	}).optional(),
 	tavilySearchOptions: z.object({
 		searchDepth: z.enum([
 			"basic",
@@ -4101,11 +5450,23 @@ const webSearchSchema = z.object({
 		includeFavicon: z.boolean().optional(),
 		format: z.enum(["markdown", "text"]).optional(),
 		timeout: z.number().int().nonnegative().max(12e4).optional()
+	}).optional(),
+	keenableSearchOptions: z.object({
+		maxResults: z.number().int().min(1).max(20).optional(),
+		site: z.string().optional(),
+		attributionTitle: z.string().optional(),
+		timeout: z.number().int().nonnegative().max(12e4).optional()
+	}).optional(),
+	keenableScraperOptions: z.object({
+		attributionTitle: z.string().optional(),
+		timeout: z.number().int().nonnegative().max(12e4).optional()
 	}).optional()
 });
 const ocrSchema = z.object({
+	allowedAddresses: allowedAddressesSchema,
 	mistralModel: z.string().optional(),
 	apiKey: z.string().optional().default("${OCR_API_KEY}"),
+	apiKeyPreview: apiKeyPreviewSchema,
 	baseURL: z.string().optional().default("${OCR_BASEURL}"),
 	strategy: z.nativeEnum(OCRStrategy).default("mistral_ocr")
 });
@@ -4163,6 +5524,10 @@ const contextPruningSchema = z.object({
 	hardClearRatio: z.number().min(0).max(1).optional(),
 	minPrunableToolChars: z.number().min(0).optional()
 });
+const retainRecentConfigSchema = z.object({
+	turns: z.number().min(0).max(20).optional(),
+	tokens: z.number().positive().optional()
+});
 const summarizationConfigSchema = z.object({
 	enabled: z.boolean().optional(),
 	provider: z.string().optional(),
@@ -4178,31 +5543,102 @@ const summarizationConfigSchema = z.object({
 	updatePrompt: z.string().optional(),
 	reserveRatio: z.number().min(0).max(1).optional(),
 	maxSummaryTokens: z.number().positive().optional(),
-	contextPruning: contextPruningSchema.optional()
+	contextPruning: contextPruningSchema.optional(),
+	retainRecent: retainRecentConfigSchema.optional()
 });
 const customEndpointsSchema = z.array(endpointSchema.partial()).optional();
+let messageFilterRegexValidator = (value) => {
+	try {
+		new RegExp(value, "g");
+		return true;
+	} catch {
+		return false;
+	}
+};
+const setMessageFilterRegexValidator = (validate) => {
+	messageFilterRegexValidator = validate;
+};
 const messageFilterPiiCustomPatternSchema = z.object({
-	id: z.string().min(1),
-	label: z.string().min(1),
-	regex: z.string().min(1).refine((value) => {
-		try {
-			new RegExp(value, "g");
-			return true;
-		} catch {
-			return false;
-		}
-	}, { message: "Invalid regex" })
+	id: z.string().min(1).max(256),
+	label: z.string().min(1).max(512),
+	regex: z.string().min(1).max(512)
 });
 const messageFilterPiiSchema = z.object({
-	starterPatterns: z.array(z.string()).optional(),
-	customPatterns: z.array(messageFilterPiiCustomPatternSchema).optional()
+	starterPatterns: z.array(z.string().max(256)).max(256).optional(),
+	customPatterns: z.array(messageFilterPiiCustomPatternSchema).max(256).optional()
+}).superRefine((pii, context) => {
+	let regexCharacters = 0;
+	let regexInstructions = 0;
+	for (let index = 0; index < (pii.customPatterns?.length ?? 0); index++) {
+		const pattern = pii.customPatterns?.[index];
+		if (pattern == null) continue;
+		regexCharacters += pattern.regex.length;
+		const result = messageFilterRegexValidator(pattern.regex);
+		if (!(typeof result === "boolean" ? result : result.supported)) {
+			context.addIssue({
+				code: z.ZodIssueCode.custom,
+				path: [
+					"customPatterns",
+					index,
+					"regex"
+				],
+				message: "Unsupported regex: not compatible with the RE2 engine (no backreferences, lookaround, or control escapes)"
+			});
+			continue;
+		}
+		if (typeof result !== "boolean" && result.programSize != null) regexInstructions += result.programSize;
+	}
+	if (regexCharacters > 8192) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["customPatterns"],
+		message: `Custom PII regexes may contain at most ${MAX_PII_CUSTOM_REGEX_CHARACTERS} characters in total`
+	});
+	if (regexInstructions > 8192) context.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["customPatterns"],
+		message: `Custom PII regexes may compile to at most ${MAX_PII_CUSTOM_REGEX_INSTRUCTIONS} instructions in total`
+	});
 });
 const messageFilterSchema = z.object({ pii: messageFilterPiiSchema.optional() });
+const langfuseConfigSchema = z.object({
+	enabled: z.boolean().optional(),
+	publicKey: z.string().optional(),
+	secretKey: z.string().optional(),
+	/** Stable Langfuse project identity returned when credentials are verified. */
+	projectId: z.string().optional(),
+	/** Masked preview of the secret key, stored at write time so
+	* admin reads can show which secret key is configured without returning the secret. */
+	secretKeyPreview: z.string().optional(),
+	/** Routing key for one of the deployment-configured tenant Langfuse destinations. */
+	destination: z.string().optional(),
+	/**
+	* Custom request headers sent on every outbound Langfuse request — trace and
+	* media export, feedback scores, and credential verification — for
+	* self-hosted instances behind an authenticating proxy or gateway. Values
+	* support `${ENV_VAR}` interpolation.
+	*
+	* Deployment-level only. Trace export batches spans from every user through
+	* one exporter, so unlike endpoint headers these cannot carry per-user
+	* placeholders. Headers referencing an unset variable, naming an
+	* infrastructure secret, or carrying an invalid HTTP field name are dropped
+	* with a warning rather than sent.
+	*
+	* Sent only when the deployment configures exactly one Langfuse origin, and
+	* only to that origin. The map cannot say which endpoint it authenticates
+	* to, so with several configured origins any choice of recipient would risk
+	* disclosing a gateway credential to the others; a warning is logged instead.
+	* Multi-destination deployments need per-destination headers, which this
+	* schema does not yet express — and note the fanout collector forwards only
+	* `Authorization` upstream regardless.
+	*/
+	headers: z.record(z.string()).optional()
+});
 const configSchema = z.object({
 	version: z.string(),
 	cache: z.boolean().default(true),
 	ocr: ocrSchema.optional(),
 	webSearch: webSearchSchema.optional(),
+	langfuse: langfuseConfigSchema.optional(),
 	memory: memorySchema.optional(),
 	summarization: summarizationConfigSchema.optional(),
 	skillSync: skillSyncConfigSchema,
@@ -4238,9 +5674,17 @@ const configSchema = z.object({
 	rateLimits: rateLimitSchema.optional(),
 	fileConfig: fileConfigSchema.optional(),
 	modelSpecs: specsConfigSchema.optional(),
+	filters: filtersConfigSchema.optional(),
 	messageFilter: messageFilterSchema.optional(),
 	endpoints: z.object({
 		allowedAddresses: allowedAddressesSchema,
+		/**
+		* Defaults applied to every endpoint. Omit-based, so options added to
+		* `baseEndpointSchema` are inherited here automatically — no list to
+		* maintain (contrast `azureEndpointSchema`, which enumerates via
+		* `.pick()`). Resolution order at read sites is `all` > the named
+		* endpoint > a custom endpoint's own config.
+		*/
 		all: baseEndpointSchema.omit({ baseURL: true }).optional(),
 		["openAI"]: baseEndpointSchema.optional(),
 		["google"]: baseEndpointSchema.optional(),
@@ -4310,6 +5754,9 @@ const alternateName = {
 	["helicone"]: "Helicone"
 };
 const sharedOpenAIModels = [
+	"gpt-5.6",
+	"gpt-5.6-terra",
+	"gpt-5.6-luna",
 	"gpt-5.5",
 	"gpt-5.5-pro",
 	"chat-latest",
@@ -4333,9 +5780,12 @@ const sharedOpenAIModels = [
 	"gpt-4o"
 ];
 const sharedAnthropicModels = [
+	"claude-fable-5-1",
 	"claude-fable-5",
+	"claude-opus-5",
 	"claude-opus-4-8",
 	"claude-opus-4-7",
+	"claude-sonnet-5",
 	"claude-sonnet-4-6",
 	"claude-opus-4-6",
 	"claude-sonnet-4-5",
@@ -4356,18 +5806,26 @@ const sharedAnthropicModels = [
 	"claude-3-5-sonnet-20240620",
 	"claude-3-5-sonnet-latest"
 ];
+/**
+* Claude 4+ models are not invocable on-demand by their bare foundation-model
+* ID on the Converse path — Bedrock rejects those with "Invocation of model ID
+* ... with on-demand throughput isn't supported. Retry your request with the ID
+* or ARN of an inference profile that contains this model." Default to the
+* `global.` cross-region profile (no regional pricing premium, widest
+* availability); Opus 4.1 has no global profile, so it uses `us.`.
+*/
 const bedrockModels = [
-	"anthropic.claude-fable-5",
-	"anthropic.claude-opus-4-8",
-	"anthropic.claude-opus-4-7",
-	"anthropic.claude-sonnet-4-6",
-	"anthropic.claude-opus-4-6-v1",
-	"anthropic.claude-sonnet-4-5-20250929-v1:0",
-	"anthropic.claude-haiku-4-5-20251001-v1:0",
-	"anthropic.claude-opus-4-1-20250805-v1:0",
-	"anthropic.claude-3-5-sonnet-20241022-v2:0",
-	"anthropic.claude-3-5-sonnet-20240620-v1:0",
-	"anthropic.claude-3-5-haiku-20241022-v1:0",
+	"global.anthropic.claude-fable-5-1",
+	"global.anthropic.claude-fable-5",
+	"global.anthropic.claude-opus-5",
+	"global.anthropic.claude-opus-4-8",
+	"global.anthropic.claude-opus-4-7",
+	"global.anthropic.claude-sonnet-5",
+	"global.anthropic.claude-sonnet-4-6",
+	"global.anthropic.claude-opus-4-6-v1",
+	"global.anthropic.claude-sonnet-4-5-20250929-v1:0",
+	"global.anthropic.claude-haiku-4-5-20251001-v1:0",
+	"us.anthropic.claude-opus-4-1-20250805-v1:0",
 	"cohere.command-r-v1:0",
 	"cohere.command-r-plus-v1:0",
 	"meta.llama2-13b-chat-v1",
@@ -4392,7 +5850,11 @@ const defaultModels = {
 	["assistants"]: [...sharedOpenAIModels, "chatgpt-4o-latest"],
 	["agents"]: sharedOpenAIModels,
 	["google"]: [
+		"gemini-3.8-flash",
+		"gemini-3.7-flash",
+		"gemini-3.6-flash",
 		"gemini-3.5-flash",
+		"gemini-3.5-flash-lite",
 		"gemini-3.1-pro-preview",
 		"gemini-3.1-pro-preview-customtools",
 		"gemini-3.1-flash-lite-preview",
@@ -4552,6 +6014,18 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	*/
 	CacheKeys["ROLES"] = "ROLES";
 	/**
+	* Key for cached group memberships used to resolve ACL user principals.
+	*/
+	CacheKeys["USER_PRINCIPALS"] = "USER_PRINCIPALS";
+	/**
+	* Key for cached prompt group access ID sets (accessible, public, owned).
+	*/
+	CacheKeys["PROMPT_GROUPS_ACCESS"] = "PROMPT_GROUPS_ACCESS";
+	/**
+	* Key for per-conversation stateful code sandbox prewarm/warm state.
+	*/
+	CacheKeys["SANDBOX_PREWARM"] = "SANDBOX_PREWARM";
+	/**
 	* Key for the title generation cache.
 	*/
 	CacheKeys["GEN_TITLE"] = "GEN_TITLE";
@@ -4621,6 +6095,10 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	*/
 	CacheKeys["OPENID_EXCHANGED_TOKENS"] = "OPENID_EXCHANGED_TOKENS";
 	/**
+	* Key for cached authenticated user documents.
+	*/
+	CacheKeys["AUTH_USER_DOC"] = "AUTH_USER_DOC";
+	/**
 	* Key for OpenID session.
 	*/
 	CacheKeys["OPENID_SESSION"] = "OPENID_SESSION";
@@ -4634,6 +6112,7 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	CacheKeys["ADMIN_OAUTH_EXCHANGE"] = "ADMIN_OAUTH_EXCHANGE";
 	return CacheKeys;
 }({});
+const AUTH_USER_DOC_BY_ID_PREFIX = "auth-user-doc-byid";
 /**
 * Enum for violation types, used to identify, log, and cache violations.
 */
@@ -4757,6 +6236,18 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	*/
 	ErrorTypes["GOOGLE_TOOL_CONFLICT"] = "google_tool_conflict";
 	/**
+	* Google provider could not process a linked video (most often longer than the model accepts)
+	*/
+	ErrorTypes["GOOGLE_VIDEO_UNPROCESSABLE"] = "google_video_unprocessable";
+	/**
+	* Required CodeAPI resources could not be restored before model invocation.
+	*/
+	ErrorTypes["RESOURCE_RECOVERY_REQUIRED"] = "resource_recovery_required";
+	/**
+	* Agent selected a stateful Code API workspace scope disabled by the deployment.
+	*/
+	ErrorTypes["STATEFUL_CODE_ENVIRONMENT_NOT_ALLOWED"] = "stateful_code_environment_not_allowed";
+	/**
 	* Invalid Agent Provider (excluded by Admin)
 	*/
 	ErrorTypes["INVALID_AGENT_PROVIDER"] = "invalid_agent_provider";
@@ -4777,6 +6268,14 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	*/
 	ErrorTypes["AUTH_FAILED"] = "auth_failed";
 	/**
+	* Authentication rejected by a rate limiter
+	*/
+	ErrorTypes["AUTH_RATE_LIMITED"] = "auth_rate_limited";
+	/**
+	* Authentication rejected because the account or IP is banned
+	*/
+	ErrorTypes["AUTH_BANNED"] = "auth_banned";
+	/**
 	* Model refused to respond (content policy violation)
 	*/
 	ErrorTypes["REFUSAL"] = "refusal";
@@ -4784,6 +6283,14 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	* SSE stream 404 — job completed, expired, or was deleted before the subscriber connected
 	*/
 	ErrorTypes["STREAM_EXPIRED"] = "stream_expired";
+	/**
+	* Provider does not serve the requested model
+	*/
+	ErrorTypes["MODEL_NOT_FOUND"] = "model_not_found";
+	/**
+	* Provider throttled or refused the request for exceeding a rate/spend allowance
+	*/
+	ErrorTypes["MODEL_RATE_LIMIT"] = "model_rate_limit";
 	return ErrorTypes;
 }({});
 /**
@@ -4849,6 +6356,10 @@ let SettingsTabValues = /* @__PURE__ */ function(SettingsTabValues) {
 	*/
 	SettingsTabValues["SPEECH"] = "speech";
 	/**
+	* Tab for Langfuse Settings
+	*/
+	SettingsTabValues["LANGFUSE"] = "langfuse";
+	/**
 	* Tab for Beta Features
 	*/
 	SettingsTabValues["BETA"] = "beta";
@@ -4911,7 +6422,7 @@ let TTSProviders = /* @__PURE__ */ function(TTSProviders) {
 /** Enum for app-wide constants */
 let Constants = /* @__PURE__ */ function(Constants) {
 	/**
-	* Key for the app's version. The placeholder `v0.8.7` is
+	* Key for the app's version. The placeholder `v0.8.8-rc2` is
 	* swapped in by `@rollup/plugin-replace` during `npm run build:data-provider`
 	* using the value of the root `package.json`'s `version` field. Consumers
 	* always import this via the built dist bundle (see `main` field in
@@ -4919,9 +6430,9 @@ let Constants = /* @__PURE__ */ function(Constants) {
 	* substituted value. Only tests that import the TypeScript source directly
 	* would observe the raw placeholder.
 	*/
-	Constants["VERSION"] = "v0.8.7";
+	Constants["VERSION"] = "v0.8.8-rc2";
 	/** Key for the Custom Config's version (librechat.yaml). */
-	Constants["CONFIG_VERSION"] = "1.3.13";
+	Constants["CONFIG_VERSION"] = "1.3.15";
 	/** Standard value for the first message's `parentMessageId` value, to indicate no parent exists. */
 	Constants["NO_PARENT"] = "00000000-0000-0000-0000-000000000000";
 	/** Standard value to use whatever the submission prelim. `responseMessageId` is */
@@ -4973,8 +6484,224 @@ let Constants = /* @__PURE__ */ function(Constants) {
 	Constants["BASH_PROGRAMMATIC_TOOL_CALLING"] = "run_tools_with_bash";
 	/** Subagent spawn tool name (must match `@librechat/agents` `Constants.SUBAGENT`). */
 	Constants["SUBAGENT"] = "subagent";
+	/** Poll tool for retrieving the status/result of a backgrounded tool call. */
+	Constants["CHECK_BACKGROUND_TASK"] = "check_background_task";
+	/**
+	* `finish_reason` stamped on an assistant message whose turn ended because the
+	* agent exhausted its per-turn graph step budget (`recursionLimit`) rather than
+	* because the model chose to stop. Distinct from a user abort: nothing failed and
+	* nothing was cancelled, the turn simply ran out of room. The UI keys its
+	* "tool call limit reached" notice off this value. The hover Continue control
+	* is withheld for this reason because the notice already offers the way forward.
+	*/
+	Constants["TOOL_CALL_LIMIT_FINISH_REASON"] = "tool_call_limit";
 	return Constants;
 }({});
+/**
+* Normalizes a server name into the character set tool keys are built from.
+* Tool keys embed this output, so any candidate list matched against a key must
+* be normalized the same way.
+*/
+function normalizeServerName(serverName) {
+	if (/^[a-zA-Z0-9_.-]+$/.test(serverName)) return serverName;
+	const normalized = serverName.replace(/[^a-zA-Z0-9_.-]/g, "_").replace(/^_+|_+$/g, "");
+	if (normalized) return normalized;
+	/** All characters were stripped; hash the original so the name stays unique. */
+	let hash = 0;
+	for (let i = 0; i < serverName.length; i++) {
+		hash = (hash << 5) - hash + serverName.charCodeAt(i);
+		hash |= 0;
+	}
+	return `server_${Math.abs(hash)}`;
+}
+/**
+* Splits a combined MCP tool key (`${rawToolName}${mcp_delimiter}${serverName}`)
+* back into its two parts.
+*
+* Both halves can legitimately contain the delimiter, so position alone cannot
+* identify the boundary. Raw tool names come from the upstream server and are
+* untrusted (`get_mcp_server_version`, or a gateway-prefixed
+* `gitlab-get_mcp_server_version`), and `normalizeServerName` preserves
+* underscores, so a configured server may be named `Google_mcp_Workspace`.
+*
+* When `knownServerNames` is supplied the boundary is resolved against it: the
+* longest configured name the key actually ends with wins. Otherwise this falls
+* back to the last delimiter, which is correct whenever only the tool half
+* contains one and matches `.split()` when neither does.
+*
+* One case stays undecidable from the key alone: if both `bar` and `foo_mcp_bar`
+* are configured, `tool_mcp_foo_mcp_bar` is a valid key for either. Longest match
+* is the deterministic tiebreak; resolving it properly needs the tool/server
+* mapping carried alongside the key rather than re-derived from the string.
+*/
+/**
+* Maps each configured server name's normalized form back to the raw config
+* name. Model-facing tool keys embed `normalizeServerName(server)`, while the
+* registry, config maps, tool cache, and plugin-auth rows are keyed by the raw
+* name — any consumer that parses a server out of a tool key must resolve it
+* through this map before those lookups. Identity entries are included so
+* `aliases.get(name) ?? name` works uniformly.
+*
+* When two configured names normalize to the same value their tool keys are
+* inherently ambiguous; the FIRST configured name wins deterministically here,
+* and `resolveMCPServerContext` warns about the collision so the operator can
+* rename one server.
+*/
+function buildServerNameAliases(rawServerNames) {
+	const aliases = /* @__PURE__ */ new Map();
+	/** Identity entries claim their slot FIRST regardless of configuration
+	*  order: a server literally named `foo` must never have its keys rerouted
+	*  to a `foo!` whose normalized form collides with it. */
+	for (const raw of rawServerNames) if (raw && normalizeServerName(raw) === raw) aliases.set(raw, raw);
+	for (const raw of rawServerNames) {
+		if (!raw) continue;
+		const normalized = normalizeServerName(raw);
+		if (!aliases.has(normalized)) aliases.set(normalized, raw);
+	}
+	return aliases;
+}
+/**
+* Rewrites a tool key's server segment into the normalized form model-facing
+* keys carry, resolving the boundary against the configured raw names (longest
+* suffix wins, mirroring {@link splitMCPToolKey}). Returns the key unchanged
+* when no configured raw name matches — already-normalized keys, placeholder
+* tokens, and keys for servers that are no longer configured all pass through.
+* Idempotent: a normalized segment never matches a raw candidate that needs
+* rewriting.
+*/
+function normalizeMCPToolKey(toolKey, rawServerNames) {
+	let matched;
+	for (let i = 0; i < rawServerNames.length; i++) {
+		const raw = rawServerNames[i];
+		if (!raw || raw.length <= (matched?.length ?? 0)) continue;
+		if (toolKey.endsWith(`_mcp_${raw}`)) matched = raw;
+	}
+	if (matched == null) return toolKey;
+	const normalized = normalizeServerName(matched);
+	if (normalized === matched) return toolKey;
+	return `${toolKey.slice(0, toolKey.length - matched.length)}${normalized}`;
+}
+/**
+* Strips a redundant leading server-name prefix from a raw upstream tool name
+* before it is embedded into a model-facing key, so the key doesn't carry the
+* server twice (`acme_trace_..._mcp_acme`) and push long tool names
+* past provider function-name limits (64 chars). The match is case-insensitive
+* because display-cased server names ("Acme") conventionally prefix their
+* tools in lowercase. Ingestion that strips must record the original name
+* (`serverToolName` on the cached definition) — tool calls send THAT name back
+* to the server, never the stripped one. Catalog producers must not call this
+* directly: only {@link stripServerNamePrefixes} sees the whole sibling set and
+* can keep colliding results apart.
+*/
+function stripServerNamePrefix(toolName, normalizedServerName) {
+	const prefixLength = normalizedServerName.length + 1;
+	if (toolName.length <= prefixLength) return toolName;
+	if (toolName.slice(0, prefixLength).toLowerCase() !== `${normalizedServerName.toLowerCase()}_`) return toolName;
+	const stripped = toolName.slice(prefixLength);
+	if (isReservedMCPToolName(stripped)) return toolName;
+	/** `isActionTool` classifies keys by the RELATIVE position of `_action_`
+	*  and `_mcp_`; stripping moves the first `_mcp_` earlier, so a server
+	*  whose normalized name contains `_action_` could see a real MCP tool
+	*  reclassified as an OpenAPI action (bypassing MCP authorization). Never
+	*  produce a key whose classification differs from the raw key's. */
+	const keySuffix = `_mcp_${normalizedServerName}`;
+	if (isActionTool(`${stripped}${keySuffix}`) !== isActionTool(`${toolName}${keySuffix}`)) return toolName;
+	return stripped;
+}
+/**
+* Synthetic markers consumed by prefix (`isMCPAllPlaceholder`, the server-pin
+* skip, the client's OAuth stream classification), so each reserves BOTH its
+* exact name and its `${marker}${mcp_delimiter}` namespace: a stripped
+* remainder inside any of them would turn a real upstream tool into the
+* server-wide wildcard, the UI pin placeholder, or a synthetic OAuth call.
+*/
+const RESERVED_MCP_TOOL_MARKERS = [
+	`sys__all__sys`,
+	`sys__server__sys`,
+	"oauth"
+];
+function isReservedMCPToolName(toolName) {
+	/** `mcp_` opens the server-scoped pluginKey namespace (`mcp_${serverName}`),
+	*  and `lc_transfer_to_` opens the agent-handoff namespace (the client
+	*  renders such calls as handoffs; the background and intent passes exclude
+	*  them) — pre-strip tool keys could never enter either, since they always
+	*  began with the server name itself. */
+	if (toolName.startsWith(`mcp_`) || toolName.startsWith(`lc_transfer_to_`)) return true;
+	return RESERVED_MCP_TOOL_MARKERS.some((marker) => toolName === marker || toolName.startsWith(`${marker}_mcp_`));
+}
+/**
+* Maps every raw tool name in a server's catalog to its model-facing name,
+* stripping redundant server-name prefixes collision-free: when two names
+* yield the same result — a bare `foo` next to `<server>_foo`, or the
+* case-variant pair `<server>_Foo` / `<Server>_Foo` under the case-insensitive
+* prefix match — every collider keeps its raw name, so two distinct upstream
+* tools can never collapse onto one key. Unprefixed names count against the
+* result set through their identity mapping, which is what makes the bare-name
+* case fall out of the same counter.
+*/
+function stripServerNamePrefixes(toolNames, normalizedServerName) {
+	const rawNames = new Set(toolNames);
+	const finalNames = new Map(toolNames.map((name) => {
+		const stripped = stripServerNamePrefix(name, normalizedServerName);
+		/** Every sibling's RAW name is reserved even when that sibling itself
+		*  strips away: keys persisted BEFORE stripping embed raw names, so a
+		*  stripped result landing on another sibling's raw name would route
+		*  that sibling's legacy references to the wrong upstream tool. */
+		return [name, stripped !== name && rawNames.has(stripped) ? name : stripped];
+	}));
+	/** Reverting a collider to its raw name can itself collide with ANOTHER
+	*  sibling's stripped result (`foo` / `acme_foo` / `acme_acme_foo`), so the
+	*  guard iterates to a fixpoint. Each pass converts at least one stripped
+	*  result back to its unique raw name, so it terminates within the catalog
+	*  size. */
+	let changed = true;
+	while (changed) {
+		changed = false;
+		const counts = /* @__PURE__ */ new Map();
+		finalNames.forEach((result) => {
+			counts.set(result, (counts.get(result) ?? 0) + 1);
+		});
+		finalNames.forEach((result, raw) => {
+			if (result !== raw && (counts.get(result) ?? 0) > 1) {
+				finalNames.set(raw, raw);
+				changed = true;
+			}
+		});
+	}
+	return finalNames;
+}
+function splitMCPToolKey(toolKey, knownServerNames) {
+	if (knownServerNames?.length) {
+		let matched;
+		for (let i = 0; i < knownServerNames.length; i++) {
+			const serverName = knownServerNames[i];
+			if (!serverName || serverName.length <= (matched?.length ?? 0)) continue;
+			if (toolKey.endsWith(`_mcp_${serverName}`)) matched = serverName;
+		}
+		if (matched != null) return [toolKey.slice(0, toolKey.length - matched.length - 5), matched];
+	}
+	const idx = toolKey.lastIndexOf("_mcp_");
+	if (idx === -1) return [toolKey, void 0];
+	return [toolKey.slice(0, idx), toolKey.slice(idx + 5)];
+}
+/**
+* Splits a tool-call name for display, where the key may be a synthetic MCP OAuth
+* call (`oauth${mcp_delimiter}${serverName}`) rather than a real tool key.
+*
+* A configured server name is authoritative when one matches, because a real tool key
+* always ends in its server. Only when none matches does the `oauth` prefix decide,
+* which keeps a genuine upstream tool named `oauth${mcp_delimiter}...` from being read
+* as a synthetic call while still resolving OAuth prompts for unconfigured servers.
+*/
+function splitToolCallName(toolCallName, knownServerNames) {
+	if (knownServerNames?.length) {
+		const [toolName, serverName] = splitMCPToolKey(toolCallName, knownServerNames);
+		if (serverName != null && knownServerNames.includes(serverName)) return [toolName, serverName];
+	}
+	const oauthPrefix = `oauth_mcp_`;
+	if (toolCallName.startsWith(oauthPrefix)) return ["oauth", toolCallName.slice(oauthPrefix.length)];
+	return splitMCPToolKey(toolCallName, knownServerNames);
+}
 /** Maximum explicit subagent hops allowed from any root agent at runtime. */
 const MAX_SUBAGENT_DEPTH = 5;
 /** Maximum unique explicit subagent targets that may be loaded at runtime. */
@@ -5026,6 +6753,8 @@ let LocalStorageKeys = /* @__PURE__ */ function(LocalStorageKeys) {
 	LocalStorageKeys["LAST_ARTIFACTS_TOGGLE_"] = "LAST_ARTIFACTS_TOGGLE_";
 	/** Last checked toggle for Skills per conversation ID */
 	LocalStorageKeys["LAST_SKILLS_TOGGLE_"] = "LAST_SKILLS_TOGGLE_";
+	/** Last checked toggle for Memory per conversation ID */
+	LocalStorageKeys["LAST_MEMORY_TOGGLE_"] = "LAST_MEMORY_TOGGLE_";
 	/** Key for the last selected agent provider */
 	LocalStorageKeys["LAST_AGENT_PROVIDER"] = "lastAgentProvider";
 	/** Key for the last selected agent model */
@@ -5160,6 +6889,7 @@ let PrincipalModel = /* @__PURE__ */ function(PrincipalModel) {
 */
 let ResourceType = /* @__PURE__ */ function(ResourceType) {
 	ResourceType["AGENT"] = "agent";
+	ResourceType["CODE_ENVIRONMENT"] = "codeEnvironment";
 	ResourceType["PROMPTGROUP"] = "promptGroup";
 	ResourceType["MCPSERVER"] = "mcpServer";
 	ResourceType["REMOTE_AGENT"] = "remoteAgent";
@@ -5188,6 +6918,9 @@ let AccessRoleIds = /* @__PURE__ */ function(AccessRoleIds) {
 	AccessRoleIds["AGENT_VIEWER"] = "agent_viewer";
 	AccessRoleIds["AGENT_EDITOR"] = "agent_editor";
 	AccessRoleIds["AGENT_OWNER"] = "agent_owner";
+	AccessRoleIds["CODE_ENVIRONMENT_VIEWER"] = "codeEnvironment_viewer";
+	AccessRoleIds["CODE_ENVIRONMENT_EDITOR"] = "codeEnvironment_editor";
+	AccessRoleIds["CODE_ENVIRONMENT_OWNER"] = "codeEnvironment_owner";
 	AccessRoleIds["PROMPTGROUP_VIEWER"] = "promptGroup_viewer";
 	AccessRoleIds["PROMPTGROUP_EDITOR"] = "promptGroup_editor";
 	AccessRoleIds["PROMPTGROUP_OWNER"] = "promptGroup_owner";
@@ -5304,17 +7037,20 @@ function permBitsToAccessLevel(permBits) {
 function accessRoleToPermBits(accessRoleId) {
 	switch (accessRoleId) {
 		case "agent_viewer":
+		case "codeEnvironment_viewer":
 		case "promptGroup_viewer":
 		case "mcpServer_viewer":
 		case "remoteAgent_viewer":
 		case "skill_viewer":
 		case "sharedLink_viewer": return 1;
 		case "agent_editor":
+		case "codeEnvironment_editor":
 		case "promptGroup_editor":
 		case "mcpServer_editor":
 		case "remoteAgent_editor":
 		case "skill_editor": return 3;
 		case "agent_owner":
+		case "codeEnvironment_owner":
 		case "promptGroup_owner":
 		case "mcpServer_owner":
 		case "remoteAgent_owner":
@@ -5341,21 +7077,25 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["sharedLinks"] = "sharedLinks";
 	QueryKeys["allConversations"] = "allConversations";
 	QueryKeys["archivedConversations"] = "archivedConversations";
+	QueryKeys["pinnedConversations"] = "pinnedConversations";
 	QueryKeys["searchConversations"] = "searchConversations";
 	QueryKeys["conversation"] = "conversation";
 	QueryKeys["searchEnabled"] = "searchEnabled";
+	QueryKeys["langfuseConnection"] = "langfuseConnection";
+	QueryKeys["langfuseSessionLink"] = "langfuseSessionLink";
 	QueryKeys["user"] = "user";
 	QueryKeys["name"] = "name";
 	QueryKeys["models"] = "models";
 	QueryKeys["balance"] = "balance";
 	QueryKeys["endpoints"] = "endpoints";
 	QueryKeys["tokenConfig"] = "tokenConfig";
-	QueryKeys["contextProjection"] = "contextProjection";
 	QueryKeys["presets"] = "presets";
 	QueryKeys["searchResults"] = "searchResults";
 	QueryKeys["tokenCount"] = "tokenCount";
 	QueryKeys["availablePlugins"] = "availablePlugins";
 	QueryKeys["startupConfig"] = "startupConfig";
+	QueryKeys["insights"] = "insights";
+	QueryKeys["insightsAccess"] = "insightsAccess";
 	QueryKeys["assistants"] = "assistants";
 	QueryKeys["assistant"] = "assistant";
 	QueryKeys["agents"] = "agents";
@@ -5410,17 +7150,29 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["skillFileContent"] = "skillFileContent";
 	QueryKeys["skillTree"] = "skillTree";
 	QueryKeys["skillNodeContent"] = "skillNodeContent";
-	QueryKeys["skillFavorites"] = "skillFavorites";
+	QueryKeys["toolFavorites"] = "toolFavorites";
 	QueryKeys["skillStates"] = "skillStates";
 	QueryKeys["favorites"] = "favorites";
+	QueryKeys["schedules"] = "schedules";
+	QueryKeys["schedule"] = "schedule";
+	QueryKeys["parentSubagents"] = "parentSubagents";
+	QueryKeys["subagentThread"] = "subagentThread";
+	QueryKeys["codeEnvironments"] = "codeEnvironments";
+	QueryKeys["agentQueuedTurns"] = "agentQueuedTurns";
 	return QueryKeys;
 }({});
 const DynamicQueryKeys = { agentFiles: (agentId) => ["agentFiles", agentId] };
 let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
+	MutationKeys["subagentControl"] = "subagentControl";
+	MutationKeys["enqueueAgentQueuedTurn"] = "enqueueAgentQueuedTurn";
+	MutationKeys["cancelAgentQueuedTurn"] = "cancelAgentQueuedTurn";
+	MutationKeys["updateLangfuseConnection"] = "updateLangfuseConnection";
+	MutationKeys["testLangfuseConnection"] = "testLangfuseConnection";
 	MutationKeys["createAgentApiKey"] = "createAgentApiKey";
 	MutationKeys["deleteAgentApiKey"] = "deleteAgentApiKey";
 	MutationKeys["fileUpload"] = "fileUpload";
 	MutationKeys["fileDelete"] = "fileDelete";
+	MutationKeys["fileUsage"] = "fileUsage";
 	MutationKeys["updatePreset"] = "updatePreset";
 	MutationKeys["deletePreset"] = "deletePreset";
 	MutationKeys["loginUser"] = "loginUser";
@@ -5437,6 +7189,7 @@ let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
 	MutationKeys["deleteAgentAction"] = "deleteAgentAction";
 	MutationKeys["revertAgentVersion"] = "revertAgentVersion";
 	MutationKeys["deleteUser"] = "deleteUser";
+	MutationKeys["updateUserPreferences"] = "updateUserPreferences";
 	MutationKeys["updateRole"] = "updateRole";
 	MutationKeys["enableTwoFactor"] = "enableTwoFactor";
 	MutationKeys["verifyTwoFactor"] = "verifyTwoFactor";
@@ -5450,6 +7203,14 @@ let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
 	MutationKeys["deleteSkillNode"] = "deleteSkillNode";
 	MutationKeys["updateSkillNodeContent"] = "updateSkillNodeContent";
 	MutationKeys["convoPin"] = "convoPin";
+	MutationKeys["archiveAllConversations"] = "archiveAllConversations";
+	MutationKeys["createSchedule"] = "createSchedule";
+	MutationKeys["updateSchedule"] = "updateSchedule";
+	MutationKeys["deleteSchedule"] = "deleteSchedule";
+	MutationKeys["runSchedule"] = "runSchedule";
+	MutationKeys["pairCodeEnvironment"] = "pairCodeEnvironment";
+	MutationKeys["updateCodeEnvironmentSettings"] = "updateCodeEnvironmentSettings";
+	MutationKeys["deleteCodeEnvironment"] = "deleteCodeEnvironment";
 	return MutationKeys;
 }({});
 //#endregion
@@ -5509,6 +7270,7 @@ const TOKEN_REFRESH_BUFFER_MS = 120 * 1e3;
 const refreshToken = (retry) => _post(refreshToken$1(retry));
 const SHARE_PAGE_PATH_REGEX = /^\/share\/[^/]+\/?$/;
 const SHARED_MESSAGES_PATH_REGEX = /^\/api\/share\/[^/]+$/;
+const SHARE_FORK_PATH_REGEX = /^\/api\/share\/[^/]+\/fork$/;
 const normalizePathname = (pathname) => pathname.startsWith("/") ? pathname : `/${pathname}`;
 const stripBasePath = (pathname) => {
 	const normalizedPathname = normalizePathname(pathname);
@@ -5528,6 +7290,11 @@ const getRequestPathname = (url) => {
 	}
 };
 const isSharedMessagesRequest = (url, method) => method?.toLowerCase() === "get" && SHARED_MESSAGES_PATH_REGEX.test(stripBasePath(getRequestPathname(url)));
+/** The "continue this chat" fork is a deliberate authenticated action initiated
+*  from a share page, so it must reach auth recovery/redirect like the shared
+*  data request — otherwise a logged-out (or cold-loaded) viewer's 401 is
+*  rejected silently instead of routing them through login. */
+const isShareForkRequest = (url, method) => method?.toLowerCase() === "post" && SHARE_FORK_PATH_REGEX.test(stripBasePath(getRequestPathname(url)));
 const dispatchTokenUpdatedEvent = (token) => {
 	setTokenHeader(token);
 	clearAuthRedirectStartedAt();
@@ -5626,16 +7393,42 @@ const shouldRefreshBeforeRequest = (url) => {
 	const timeUntilExpiry = expiresAt - Date.now();
 	return timeUntilExpiry > 0 && timeUntilExpiry <= TOKEN_REFRESH_BUFFER_MS;
 };
+const refreshBeforeRequest = async (url) => {
+	const state = getAuthRecoveryState();
+	if (state.refreshPromise && !isAuthRecoveryEndpoint(url)) return state.refreshPromise.catch(() => null);
+	if (!shouldRefreshBeforeRequest(url)) return null;
+	return startAuthRecovery(false).catch(() => null);
+};
+const withAuthorization = (options, token) => {
+	const headers = new Headers(options?.headers);
+	if (token) headers.set("Authorization", `Bearer ${token}`);
+	return {
+		...options,
+		headers
+	};
+};
+async function _authenticatedFetch(url, options) {
+	if (typeof window === "undefined") return fetch(url, options);
+	const token = await refreshBeforeRequest(url) ?? getBearerToken();
+	const response = await fetch(url, withAuthorization(options, token));
+	if (response.status !== 401 || isAuthRecoveryEndpoint(url) || isAuthRedirectInProgress() || !getBearerToken()) return response;
+	let refreshedToken;
+	try {
+		refreshedToken = await startAuthRecovery(false);
+	} catch {
+		redirectToLoginOnce();
+		return response;
+	}
+	if (!refreshedToken) {
+		redirectToLoginOnce();
+		return response;
+	}
+	await response.body?.cancel().catch(() => void 0);
+	return fetch(url, withAuthorization(options, refreshedToken));
+}
 if (typeof window !== "undefined") {
 	axios.interceptors.request.use(async (config) => {
-		const state = getAuthRecoveryState();
-		if (state.refreshPromise && !isAuthRecoveryEndpoint(config.url)) {
-			const token = await state.refreshPromise.catch(() => null);
-			if (token) setRequestAuthorizationHeader(config, token);
-			return config;
-		}
-		if (!shouldRefreshBeforeRequest(config.url)) return config;
-		const token = await startAuthRecovery(false).catch(() => null);
+		const token = await refreshBeforeRequest(config.url);
 		if (token) setRequestAuthorizationHeader(config, token);
 		return config;
 	});
@@ -5649,7 +7442,7 @@ if (typeof window !== "undefined") {
 		/** Skip refresh when the Authorization header has been cleared (e.g. during logout),
 		*  but allow the shared link data request to proceed so private shares can still
 		*  recover auth/redirect without unrelated share-page queries forcing login. */
-		if (!axios.defaults.headers.common["Authorization"] && !(isSharePage() && isSharedMessagesRequest(originalRequest.url, originalRequest.method))) return Promise.reject(error);
+		if (!axios.defaults.headers.common["Authorization"] && !(isSharePage() && (isSharedMessagesRequest(originalRequest.url, originalRequest.method) || isShareForkRequest(originalRequest.url, originalRequest.method)))) return Promise.reject(error);
 		if (isAuthRedirectInProgress()) return Promise.reject(error);
 		if (error.response.status === 401 && !originalRequest._retry) {
 			if (!(getAuthRecoveryState().refreshPromise != null)) console.warn("401 error, refreshing token");
@@ -5662,8 +7455,12 @@ if (typeof window !== "undefined") {
 				}
 				redirectToLoginOnce();
 				return Promise.reject(error);
-			} catch (err) {
-				return Promise.reject(err);
+			} catch {
+				/** A rejected refresh (stale/invalid session → 401/403) must route to
+				*  login just like an empty-token refresh, otherwise the original 401
+				*  surfaces to the caller (e.g. the share fork button) with no redirect. */
+				redirectToLoginOnce();
+				return Promise.reject(error);
 			}
 		}
 		return Promise.reject(error);
@@ -5679,24 +7476,154 @@ var request_default = {
 	delete: _delete,
 	deleteWithOptions: _deleteWithOptions,
 	patch: _patch,
+	authenticatedFetch: _authenticatedFetch,
 	refreshToken,
 	dispatchTokenUpdatedEvent
 };
 //#endregion
+//#region src/upload.ts
+const EVENT_STREAM_MEDIA_TYPE = "text/event-stream";
+const HEARTBEAT_TIMEOUT_MS = 15e3;
+var FileUploadError = class extends Error {
+	constructor(message, fileId, toolResource, displayToUser = false, code = 0) {
+		super(message);
+		this.name = "CustomAppError";
+		this.code = code;
+		this.file_id = fileId;
+		this.tool_resource = toolResource;
+		this.display_to_user = displayToUser;
+		this.response = { data: { message: displayToUser ? message : "" } };
+	}
+};
+var UploadCanceledError = class extends Error {
+	constructor(..._args) {
+		super(..._args);
+		this.code = "ERR_CANCELED";
+	}
+};
+const getFileId = (formData) => String(formData.get("file_id") ?? "");
+const getToolResource = (formData) => formData.get("tool_resource") ?? void 0;
+const parseEvent = (message) => {
+	let type = "message";
+	const data = [];
+	for (const line of message.split(/\r?\n/)) {
+		if (line.startsWith("event:")) {
+			type = line.slice(6).trim();
+			continue;
+		}
+		if (line.startsWith("data:")) data.push(line.slice(5).trimStart());
+	}
+	return {
+		type,
+		data: data.join("\n")
+	};
+};
+const createHttpError = async (response, formData) => {
+	let message = `Server responded with status: ${response.status}`;
+	try {
+		message = (await response.json()).message || message;
+	} catch {}
+	return new FileUploadError(message, getFileId(formData), getToolResource(formData), true, response.status);
+};
+const createStreamError = (data, formData) => {
+	let error;
+	try {
+		error = JSON.parse(data);
+	} catch {
+		error = { message: data };
+	}
+	return new FileUploadError(error.message || "File upload failed.", error.temp_file_id || getFileId(formData), error.tool_resource || getToolResource(formData), error.display_to_user ?? false, error.code ?? 0);
+};
+const readEventStream = async (stream, formData) => {
+	const reader = stream.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	let result = null;
+	let streamEnded = false;
+	let timeoutError = null;
+	let heartbeatTimer;
+	const resetHeartbeatTimer = () => {
+		clearTimeout(heartbeatTimer);
+		heartbeatTimer = setTimeout(() => {
+			timeoutError = /* @__PURE__ */ new Error("Upload connection timed out waiting for a heartbeat.");
+			reader.cancel(timeoutError);
+		}, HEARTBEAT_TIMEOUT_MS);
+	};
+	resetHeartbeatTimer();
+	try {
+		while (true) {
+			const { value, done } = await reader.read();
+			if (done) {
+				streamEnded = true;
+				if (timeoutError) throw timeoutError;
+				if (result) return result;
+				throw new Error("Upload connection closed before completion.");
+			}
+			buffer += decoder.decode(value, { stream: true });
+			const messages = buffer.split(/\r?\n\r?\n/);
+			buffer = messages.pop() ?? "";
+			for (const message of messages) {
+				const event = parseEvent(message);
+				if (event.type === "heartbeat") {
+					resetHeartbeatTimer();
+					continue;
+				}
+				if (event.type === "error") throw createStreamError(event.data, formData);
+				if (event.type === "data") {
+					result = JSON.parse(event.data);
+					continue;
+				}
+				if (event.type === "close") {
+					if (result) return result;
+					throw new Error("Upload stream closed without a result.");
+				}
+			}
+		}
+	} catch (error) {
+		if (error instanceof Error && error.name === "AbortError") throw new UploadCanceledError("Upload canceled.");
+		throw error;
+	} finally {
+		clearTimeout(heartbeatTimer);
+		if (!streamEnded) await reader.cancel().catch(() => void 0);
+		reader.releaseLock();
+	}
+};
+async function uploadEventStream(url, formData, signal) {
+	try {
+		const response = await request_default.authenticatedFetch(url, {
+			method: "POST",
+			body: formData,
+			headers: { Accept: EVENT_STREAM_MEDIA_TYPE },
+			signal: signal ?? void 0
+		});
+		if (!response.ok) throw await createHttpError(response, formData);
+		if (!(response.headers.get("Content-Type")?.toLowerCase() ?? "").includes(EVENT_STREAM_MEDIA_TYPE)) return await response.json();
+		if (!response.body) throw new Error("No upload response body received.");
+		return await readEventStream(response.body, formData);
+	} catch (error) {
+		if (signal?.aborted || error instanceof Error && error.name === "AbortError") throw new UploadCanceledError("Upload canceled.");
+		throw error;
+	}
+}
+//#endregion
 //#region src/data-service.ts
 var data_service_exports = /* @__PURE__ */ __exportAll({
 	acceptTerms: () => acceptTerms,
 	addPromptToGroup: () => addPromptToGroup,
 	addTagToConversation: () => addTagToConversation,
+	addToolFavorite: () => addToolFavorite,
+	archiveAllConversations: () => archiveAllConversations,
 	archiveConversation: () => archiveConversation,
 	assignConversationToProject: () => assignConversationToProject,
 	bindActionOAuth: () => bindActionOAuth,
 	bindMCPOAuth: () => bindMCPOAuth,
 	branchMessage: () => branchMessage,
 	callTool: () => callTool,
+	cancelAgentQueuedTurn: () => cancelAgentQueuedTurn,
 	cancelMCPOAuth: () => cancelMCPOAuth,
 	clearAllConversations: () => clearAllConversations,
 	confirmTwoFactor: () => confirmTwoFactor,
+	controlSubagentTask: () => controlSubagentTask,
 	createAgent: () => createAgent,
 	createAgentApiKey: () => createAgentApiKey,
 	createAssistant: () => createAssistant,
@@ -5706,6 +7633,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	createPreset: () => createPreset,
 	createProject: () => createProject,
 	createPrompt: () => createPrompt,
+	createSchedule: () => createSchedule,
 	createSharedLink: () => createSharedLink,
 	createSkill: () => createSkill,
 	createSkillNode: () => createSkillNode,
@@ -5714,16 +7642,19 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	deleteAgentAction: () => deleteAgentAction,
 	deleteAgentApiKey: () => deleteAgentApiKey,
 	deleteAssistant: () => deleteAssistant,
+	deleteCodeEnvironment: () => deleteCodeEnvironment,
 	deleteConversation: () => deleteConversation,
 	deleteConversationTag: () => deleteConversationTag,
 	deleteFiles: () => deleteFiles,
 	deleteGitHubSkillSyncCredential: () => deleteGitHubSkillSyncCredential,
 	deleteMCPServer: () => deleteMCPServer,
 	deleteMemory: () => deleteMemory,
+	deleteMemoryById: () => deleteMemoryById,
 	deletePreset: () => deletePreset,
 	deleteProject: () => deleteProject,
 	deletePrompt: () => deletePrompt,
 	deletePromptGroup: () => deletePromptGroup,
+	deleteSchedule: () => deleteSchedule,
 	deleteSharedLink: () => deleteSharedLink,
 	deleteSkill: () => deleteSkill,
 	deleteSkillFile: () => deleteSkillFile,
@@ -5734,7 +7665,9 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	duplicateConversation: () => duplicateConversation,
 	editArtifact: () => editArtifact,
 	enableTwoFactor: () => enableTwoFactor,
+	enqueueAgentQueuedTurn: () => enqueueAgentQueuedTurn,
 	forkConversation: () => forkConversation,
+	forkSharedConversation: () => forkSharedConversation,
 	genTitle: () => genTitle,
 	getAIEndpoints: () => getAIEndpoints,
 	getAccessRoles: () => getAccessRoles,
@@ -5744,6 +7677,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getAgentById: () => getAgentById,
 	getAgentCategories: () => getAgentCategories,
 	getAgentFiles: () => getAgentFiles,
+	getAgentVersions: () => getAgentVersions,
 	getAllEffectivePermissions: () => getAllEffectivePermissions,
 	getAllPromptGroups: () => getAllPromptGroups,
 	getAssistantById: () => getAssistantById,
@@ -5753,8 +7687,8 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getAvailableTools: () => getAvailableTools,
 	getBanner: () => getBanner,
 	getCategories: () => getCategories,
+	getCodeEnvironments: () => getCodeEnvironments,
 	getCodeOutputDownload: () => getCodeOutputDownload,
-	getContextProjection: () => getContextProjection,
 	getConversationById: () => getConversationById,
 	getConversationTags: () => getConversationTags,
 	getConversations: () => getConversations,
@@ -5770,17 +7704,24 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getFiles: () => getFiles,
 	getGitHubSkillSyncStatus: () => getGitHubSkillSyncStatus,
 	getGraphApiToken: () => getGraphApiToken,
+	getInsights: () => getInsights,
+	getInsightsAccess: () => getInsightsAccess,
+	getLangfuseConnection: () => getLangfuseConnection,
+	getLangfuseSessionLink: () => getLangfuseSessionLink,
 	getLoginGoogle: () => getLoginGoogle,
 	getMCPAuthValues: () => getMCPAuthValues,
 	getMCPConnectionStatus: () => getMCPConnectionStatus,
+	getMCPOAuthStatus: () => getMCPOAuthStatus,
 	getMCPServer: () => getMCPServer,
 	getMCPServerConnectionStatus: () => getMCPServerConnectionStatus,
 	getMCPServers: () => getMCPServers,
 	getMCPTools: () => getMCPTools,
 	getMarketplaceAgents: () => getMarketplaceAgents,
 	getMemories: () => getMemories,
+	getMessageById: () => getMessageById,
 	getMessagesByConvoId: () => getMessagesByConvoId,
 	getModels: () => getModels,
+	getParentSubagents: () => getParentSubagents,
 	getPresets: () => getPresets,
 	getProjectById: () => getProjectById,
 	getPrompt: () => getPrompt,
@@ -5790,6 +7731,8 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getRandomPrompts: () => getRandomPrompts,
 	getResourcePermissions: () => getResourcePermissions,
 	getRole: () => getRole,
+	getSchedule: () => getSchedule,
+	getSchedules: () => getSchedules,
 	getSearchEnabled: () => getSearchEnabled,
 	getSharedFileDownload: () => getSharedFileDownload,
 	getSharedFilePreview: () => getSharedFilePreview,
@@ -5797,14 +7740,15 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getSharedMessages: () => getSharedMessages,
 	getSharedStartupConfig: () => getSharedStartupConfig,
 	getSkill: () => getSkill,
-	getSkillFavorites: () => getSkillFavorites,
 	getSkillFileContent: () => getSkillFileContent,
 	getSkillNodeContent: () => getSkillNodeContent,
 	getSkillStates: () => getSkillStates,
 	getSkillTree: () => getSkillTree,
 	getStartupConfig: () => getStartupConfig,
+	getSubagentThread: () => getSubagentThread,
 	getTokenConfig: () => getTokenConfig,
 	getToolCalls: () => getToolCalls,
+	getToolFavorites: () => getToolFavorites,
 	getUser: () => getUser,
 	getUserBalance: () => getUserBalance,
 	getUserTerms: () => getUserTerms,
@@ -5813,6 +7757,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	healthCheck: () => healthCheck,
 	importConversationsFile: () => importConversationsFile,
 	importSkill: () => importSkill,
+	listAgentQueuedTurns: () => listAgentQueuedTurns,
 	listAgents: () => listAgents,
 	listAssistants: () => listAssistants,
 	listConversations: () => listConversations,
@@ -5825,12 +7770,15 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	login: () => login,
 	logout: () => logout,
 	makePromptProduction: () => makePromptProduction,
+	markFilesUsage: () => markFilesUsage,
+	pairCodeEnvironment: () => pairCodeEnvironment,
 	pinConversation: () => pinConversation,
 	rebuildConversationTags: () => rebuildConversationTags,
 	recordPromptGroupUsage: () => recordPromptGroupUsage,
 	regenerateBackupCodes: () => regenerateBackupCodes,
 	register: () => register,
 	reinitializeMCPServer: () => reinitializeMCPServer,
+	removeToolFavorite: () => removeToolFavorite,
 	requestPasswordReset: () => requestPasswordReset,
 	resendVerificationEmail: () => resendVerificationEmail,
 	resetPassword: () => resetPassword,
@@ -5838,23 +7786,28 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	revokeAllUserKeys: () => revokeAllUserKeys,
 	revokeUserKey: () => revokeUserKey,
 	runGitHubSkillSync: () => runGitHubSkillSync,
+	runScheduleNow: () => runScheduleNow,
 	searchPrincipals: () => searchPrincipals,
 	setGitHubSkillSyncCredential: () => setGitHubSkillSyncCredential,
 	speechToText: () => speechToText,
+	testLangfuseConnection: () => testLangfuseConnection,
 	textToSpeech: () => textToSpeech,
 	updateAction: () => updateAction,
 	updateAgent: () => updateAgent,
 	updateAgentAction: () => updateAgentAction,
 	updateAgentPermissions: () => updateAgentPermissions,
 	updateAssistant: () => updateAssistant,
+	updateCodeEnvironmentSettings: () => updateCodeEnvironmentSettings,
 	updateConversation: () => updateConversation,
 	updateConversationTag: () => updateConversationTag,
 	updateFavorites: () => updateFavorites,
 	updateFeedback: () => updateFeedback,
+	updateLangfuseConnection: () => updateLangfuseConnection,
 	updateMCPServer: () => updateMCPServer,
 	updateMCPServersPermissions: () => updateMCPServersPermissions,
 	updateMarketplacePermissions: () => updateMarketplacePermissions,
 	updateMemory: () => updateMemory,
+	updateMemoryById: () => updateMemoryById,
 	updateMemoryPermissions: () => updateMemoryPermissions,
 	updateMemoryPreferences: () => updateMemoryPreferences,
 	updateMessage: () => updateMessage,
@@ -5867,9 +7820,9 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	updatePromptPermissions: () => updatePromptPermissions,
 	updateRemoteAgentsPermissions: () => updateRemoteAgentsPermissions,
 	updateResourcePermissions: () => updateResourcePermissions,
+	updateSchedule: () => updateSchedule,
 	updateSharedLink: () => updateSharedLink,
 	updateSkill: () => updateSkill,
-	updateSkillFavorites: () => updateSkillFavorites,
 	updateSkillNode: () => updateSkillNode,
 	updateSkillNodeContent: () => updateSkillNodeContent,
 	updateSkillPermissions: () => updateSkillPermissions,
@@ -5877,6 +7830,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	updateTokenCount: () => updateTokenCount,
 	updateUserKey: () => updateUserKey,
 	updateUserPlugins: () => updateUserPlugins,
+	updateUserPreferences: () => updateUserPreferences,
 	uploadAgentAvatar: () => uploadAgentAvatar,
 	uploadAssistantAvatar: () => uploadAssistantAvatar,
 	uploadAvatar: () => uploadAvatar,
@@ -5888,6 +7842,27 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	verifyTwoFactor: () => verifyTwoFactor,
 	verifyTwoFactorTemp: () => verifyTwoFactorTemp
 });
+function getInsights(params = {}) {
+	const query = new URLSearchParams();
+	for (const [key, value] of Object.entries(params)) if (value !== void 0 && value !== null && value !== "") query.set(key, String(value));
+	const suffix = query.toString() ? `?${query.toString()}` : "";
+	return request_default.get(`${insights()}${suffix}`);
+}
+function getInsightsAccess() {
+	return request_default.get(insightsAccess());
+}
+function getLangfuseConnection() {
+	return request_default.get(adminLangfuseConnection());
+}
+function updateLangfuseConnection(payload) {
+	return request_default.put(adminLangfuseConnection(), payload);
+}
+function testLangfuseConnection(payload) {
+	return request_default.post(adminLangfuseConnectionTest(), payload);
+}
+function getLangfuseSessionLink(conversationId) {
+	return request_default.get(adminLangfuseSessionLink(conversationId));
+}
 function revokeUserKey(name) {
 	return request_default.delete(revokeUserKey$1(name));
 }
@@ -5897,22 +7872,33 @@ function revokeAllUserKeys() {
 function deleteUser(payload) {
 	return request_default.deleteWithOptions(deleteUser$1(), { data: payload });
 }
+function getCodeEnvironments() {
+	return request_default.get(codeEnvironments());
+}
+function pairCodeEnvironment(payload) {
+	return request_default.post(codeEnvironmentPairings(), payload);
+}
+function deleteCodeEnvironment(id) {
+	return request_default.delete(codeEnvironmentById(id));
+}
+function updateCodeEnvironmentSettings({ id, settings }) {
+	return request_default.patch(codeEnvironmentSettings(id), { settings });
+}
 function getFavorites() {
 	return request_default.get(`${apiBaseUrl()}/api/user/settings/favorites`);
 }
 function updateFavorites(favorites) {
 	return request_default.post(`${apiBaseUrl()}/api/user/settings/favorites`, { favorites });
 }
-/**
-* Skill favorites (star-a-skill). The backend route is phase 2 — see the
-* original UI PR for the client surface. Until then, these resolve with
-* an empty list so the UI hooks compile and the Star button is a no-op.
-*/
-function getSkillFavorites() {
-	return Promise.resolve([]);
+/** Tool favorites — starred marketplace items (builtins, tools, MCP servers, skills). */
+function getToolFavorites() {
+	return request_default.get(toolFavorites());
+}
+function addToolFavorite(favorite) {
+	return request_default.put(toolFavorite(favorite.itemType, favorite.itemId));
 }
-function updateSkillFavorites(skillFavorites) {
-	return Promise.resolve(skillFavorites);
+function removeToolFavorite(favorite) {
+	return request_default.delete(toolFavorite(favorite.itemType, favorite.itemId));
 }
 /** Per-user skill active/inactive overrides. */
 function getSkillStates() {
@@ -5981,6 +7967,9 @@ function getSearchEnabled() {
 function getUser() {
 	return request_default.get(user());
 }
+function updateUserPreferences(preferences) {
+	return request_default.patch(userPreferences(), preferences);
+}
 function getUserBalance() {
 	return request_default.get(balance());
 }
@@ -6039,6 +8028,9 @@ const getMCPAuthValues = (serverName) => {
 function cancelMCPOAuth(serverName) {
 	return request_default.post(cancelMCPOAuth$1(serverName), {});
 }
+function getMCPOAuthStatus(flowId) {
+	return request_default.get(mcpOAuthStatus(flowId));
+}
 const getStartupConfig = (options) => {
 	return request_default.get(config(options?.context));
 };
@@ -6048,9 +8040,6 @@ const getAIEndpoints = () => {
 const getTokenConfig = () => {
 	return request_default.get(tokenConfig());
 };
-const getContextProjection = (payload) => {
-	return request_default.post(contextProjection(), payload);
-};
 const getModels = async () => {
 	return request_default.get(models());
 };
@@ -6150,14 +8139,24 @@ const getAgentFiles = (agentId) => {
 const getFileConfig = () => {
 	return request_default.get(`${files()}/config`);
 };
-const uploadImage = (data, signal) => {
+const uploadImage = (data, signal, sseEnabled = false) => {
 	const requestConfig = signal ? { signal } : void 0;
+	if (sseEnabled) return uploadEventStream(images(), data, signal);
 	return request_default.postMultiPart(images(), data, requestConfig);
 };
-const uploadFile = (data, signal) => {
+const uploadFile = (data, signal, sseEnabled = false) => {
 	const requestConfig = signal ? { signal } : void 0;
+	if (sseEnabled) return uploadEventStream(files(), data, signal);
 	return request_default.postMultiPart(files(), data, requestConfig);
 };
+/**
+* Marks uploaded files as used (owner-scoped TTL touch) so the upload-window
+* TTL cannot reap attachments held in a client-side queue during a long run.
+* Best-effort: callers fire-and-forget — send-time marking is the backstop.
+*/
+const markFilesUsage = (body) => {
+	return request_default.post(fileUsage(), body);
+};
 const updateAction = (data) => {
 	const { assistant_id, version, ...body } = data;
 	return request_default.post(assistants({
@@ -6185,6 +8184,9 @@ const getAgentById = ({ agent_id }) => {
 const getExpandedAgentById = ({ agent_id }) => {
 	return request_default.get(agents({ path: `${agent_id}/expanded` }));
 };
+const getAgentVersions = ({ agent_id }) => {
+	return request_default.get(agents({ path: `${agent_id}/versions` }));
+};
 const updateAgent = ({ agent_id, data }) => {
 	return request_default.patch(agents({ path: agent_id }), data);
 };
@@ -6319,6 +8321,12 @@ function duplicateConversation(payload) {
 function forkConversation(payload) {
 	return request_default.post(forkConversation$1(), payload);
 }
+function forkSharedConversation(shareId, targetMessageIndex, shareRevision) {
+	return request_default.post(forkSharedMessages(shareId), {
+		targetMessageIndex,
+		shareRevision
+	});
+}
 function deleteConversation(payload) {
 	return request_default.deleteWithOptions(deleteConversation$1(), { data: { arg: payload } });
 }
@@ -6340,6 +8348,9 @@ function updateConversation(payload) {
 function archiveConversation(payload) {
 	return request_default.post(archiveConversation$1(), { arg: payload });
 }
+function archiveAllConversations() {
+	return request_default.post(archiveAllConversations$1(), {});
+}
 function listProjects(params) {
 	return request_default.get(projects(params ?? {}));
 }
@@ -6398,6 +8409,21 @@ function getMessagesByConvoId(conversationId) {
 	if (conversationId === "new" || conversationId === "PENDING") return Promise.resolve([]);
 	return request_default.get(messages({ conversationId }));
 }
+function getMessageById(conversationId, messageId) {
+	return request_default.get(messages({
+		conversationId,
+		messageId
+	}));
+}
+function getParentSubagents(parentConversationId) {
+	return request_default.get(parentSubagents(parentConversationId));
+}
+function getSubagentThread(parentConversationId, threadId, taskId, cursor) {
+	return request_default.get(subagentThread(parentConversationId, threadId, taskId, cursor));
+}
+function controlSubagentTask(parentConversationId, threadId, body) {
+	return request_default.post(subagentControl(parentConversationId, threadId), body);
+}
 function getPrompt(id) {
 	return request_default.get(getPrompt$1(id));
 }
@@ -6446,6 +8472,33 @@ function getRandomPrompts(variables) {
 function listSkills(params) {
 	return request_default.get(listSkillsWithFilters(params ?? {}));
 }
+function getSchedules() {
+	return request_default.get(schedules());
+}
+function enqueueAgentQueuedTurn(payload) {
+	return request_default.post(agentQueuedTurns(), payload);
+}
+function listAgentQueuedTurns(conversationId, clientRequestIds) {
+	return request_default.get(agentQueuedTurnsByConversation(conversationId, clientRequestIds));
+}
+function cancelAgentQueuedTurn(queuedTurnId) {
+	return request_default.delete(agentQueuedTurn(queuedTurnId));
+}
+function getSchedule(id) {
+	return request_default.get(schedule(id));
+}
+function createSchedule(payload) {
+	return request_default.post(schedules(), payload);
+}
+function updateSchedule(id, payload) {
+	return request_default.patch(schedule(id), payload);
+}
+function deleteSchedule(id) {
+	return request_default.delete(schedule(id));
+}
+function runScheduleNow(id) {
+	return request_default.post(runSchedule(id), {});
+}
 function getSkill(id) {
 	return request_default.get(getSkill$1(id));
 }
@@ -6633,15 +8686,24 @@ function verifyTwoFactorTemp(payload) {
 const getMemories = () => {
 	return request_default.get(memories());
 };
-const deleteMemory = (key) => {
-	return request_default.delete(memory(key));
+const deleteMemory = (key, agentId) => {
+	return request_default.delete(memory(key, agentId));
 };
-const updateMemory = (key, value, originalKey) => {
-	return request_default.patch(memory(originalKey || key), {
+const deleteMemoryById = (id, agentId) => {
+	return request_default.delete(memoryById(id, agentId));
+};
+const updateMemory = (key, value, originalKey, agentId) => {
+	return request_default.patch(memory(originalKey || key, agentId), {
 		key,
 		value
 	});
 };
+const updateMemoryById = (id, value, key, agentId) => {
+	return request_default.patch(memoryById(id, agentId), {
+		value,
+		...key ? { key } : {}
+	});
+};
 const updateMemoryPreferences = (preferences) => {
 	return request_default.patch(memoryPreferences(), preferences);
 };
@@ -6676,6 +8738,6 @@ const getActiveJobs = () => {
 	return request_default.get(activeJobs());
 };
 //#endregion
-export { permissionEntrySchema as $, feedbackSchema as $a, extendedModelEndpointSchema as $i, MCP_USER_INPUT_FIELDS as $n, specsConfigSchema as $r, balanceSchema as $t, updateResourcePermissions as A, tPluginAuthConfigSchema as Aa, anthropicSettings as Ai, modularEndpoints as An, fileConfig as Ar, SKILL_SYNC_MAX_INTERVAL_MINUTES as At, MutationKeys as B, RunStatus as Ba, defaultAssistantFormValues as Bi, summarizationTriggerSchema as Bn, mbToBytes as Br, TTSProviders as Bt, resetPassword as C, tBannerSchema as Ca, ThinkingLevel as Ci, initialModelsConfig as Cn, defaultOCRMimeTypes as Cr, MAX_SUBAGENT_RUN_CONFIGS as Ct, updateFeedback as D, tExampleSchema as Da, agentsSettings as Di, messageFilterPiiSchema as Dn, endpointFileConfigSchema as Dr, RetentionMode as Dt, searchPrincipals as E, tConvoUpdateSchema as Ea, agentsSchema as Ei, memorySchema as En, documentParserMimeTypes as Er, RerankerTypes as Et, request_default as F, AnnotationTypes as Fa, compactAgentsBaseSchema as Fi, resolveEndpointType as Fn, imageMimeTypes as Fr, SearchCategories as Ft, PrincipalType as G, defaultOrderQuery as Ga, eReasoningEffortSchema as Gi, validateVisionModel as Gn, retrievalMimeTypesList as Gr, allowedAddressesSchema as Gt, AccessRoleIds as H, Tools as Ha, eAnthropicEffortSchema as Hi, transactionsSchema as Hn, mergeFileConfig as Hr, ViolationTypes as Ht, getTokenHeader as I, AssistantStreamEvents as Ia, compactAgentsSchema as Ii, skillSyncConfigSchema as In, imageTypeMapping as Ir, SearchProviders as It, accessRoleToPermBits as J, isActionTool as Ja, eReasoningSummarySchema as Ji, visionModels as Jn, textMimeTypes as Jr, assistantEndpointSchema as Jt, ResourceType as K, hostImageIdSuffix as Ka, eReasoningParameterFormatSchema as Ki, vertexAISchema as Kn, supportedMimeTypes as Kr, alternateName as Kt, setAcceptLanguageHeader as L, EToolResources as La, compactAssistantSchema as Li, skillSyncGitHubSourceSchema as Ln, inferMimeType as Lr, SettingsTabValues as Lt, updateUserKey as M, tPresetSchema as Ma, authTypeSchema as Mi, paramDefinitionSchema as Mn, fullMimeTypesList as Mr, STTProviders as Mt, updateUserPlugins as N, tQueryParamsSchema as Na, cacheSubsetProviders as Ni, providerEndpointMap as Nn, getEndpointFileConfig as Nr, SafeSearchTypes as Nt, updateMessage as O, tMessageSchema as Oa, anthropicBaseSchema as Oi, messageFilterSchema as On, excelFileTypes as Or, SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH as Ot, userKeyQuery as P, tSharedLinkSchema as Pa, coerceNumber as Pi, rateLimitSchema as Pn, imageExtRegex as Pr, ScraperProviders as Pt, permBitsToAccessLevel as Q, feedbackRatingSchema as Qa, endpointSettings as Qi, MCPServersSchema as Qn, modelSpecSubagentsSchema as Qr, azureGroupSchema as Qt, setTokenHeader as R, FilePurpose as Ra, compactGoogleSchema as Ri, specialVariables as Rn, isBedrockDocumentType as Rr, SettingsViews as Rt, requestPasswordReset as S, removeNullishValues as Sa, ThinkingDisplay as Si, imageGenTools as Sn, convertStringsToRegex as Sr, MAX_SUBAGENT_GRAPH_NODES as St, revokeUserKey as T, tConversationTagSchema as Ta, agentsBaseSchema as Ti, isRemoteOidcUrlAllowed as Tn, defaultTextMimeTypes as Tr, RateLimitPrefix as Tt, PermissionBits as U, actionDelimiter as Ua, eImageDetailSchema as Ui, turnstileOptionsSchema as Un, mimeTypeAliases as Ur, VisionModes as Ut, QueryKeys as V, StepStatus as Va, documentSupportedProviders as Vi, supportsBalanceCheck as Vn, megabyte as Vr, Time as Vt, PrincipalModel as W, actionDomainSeparator as Wa, eModelEndpointSchema as Wi, turnstileSchema as Wn, retrievalMimeTypes as Wr, agentsEndpointSchema as Wt, getResourcePermissionsResponseSchema as X, FEEDBACK_REASON_KEYS as Xa, eThinkingLevelSchema as Xi, MCPOptionsSchema as Xn, REFILL_INTERVAL_UNITS as Xr, azureEndpointSchema as Xt, effectivePermissionsResponseSchema as Y, FEEDBACK_RATINGS as Ya, eThinkingDisplaySchema as Yi, webSearchSchema as Yn, videoMimeTypes as Yr, azureBaseSchema as Yt, hasPermissions as Z, FEEDBACK_TAGS as Za, eVerbositySchema as Zi, MCPServerUserInputSchema as Zn, getRefillEligibilityDate as Zr, azureGroupConfigsSchema as Zt, getResourcePermissions as _, openAIBaseSchema as _a, Providers as _i, fileStrategiesSchema as _n, bedrockDocumentExtensions as _r, ImageDetailCost as _t, data_service_exports as a, googleSettings as aa, generateDynamicSchema as ai, configSchema as an, extractEnvVariable as ao, AuthorizationTypeEnum as ar, AuthKeys as at, register as b, openRouterSchema as ba, ReasoningResponseKey as bi, getEndpointField as bn, codeInterpreterMimeTypesList as br, LocalStorageKeys as bt, getAccessRoles as c, inputTokensIncludesCache as ca, validateSettingDefinitions as ci, defaultAssistantsVersion as cn, normalizeEndpointName as co, FileSources as cr, Capabilities as ct, getAvailablePlugins as d, isDocumentSupportedProvider as da, BedrockProviders as di, defaultRetrievalModels as dn, buildLoginRedirectUrl as dr, DEFAULT_MEMORY_MAX_INPUT_TOKENS as dt, getModelKey as ea, tModelSpecSchema as ei, baseEndpointSchema as en, feedbackTagKeySchema as eo, SSEOptionsSchema as er, principalSchema as et, getConversationById as f, isImageVisionTool as fa, BedrockReasoningConfig as fi, defaultSocialLogins as fn, loginPage as fr, EImageOutputType as ft, getModels as g, isUUID as ga, MYTHOS_CLASS_FAMILIES as gi, fileStorageSchema as gn, audioMimeTypes as gr, ForkOptions as gt, getMCPServerConnectionStatus as h, isParamEndpoint as ha, ImageVisionTool as hi, fileSourceSchema as hn, applicationMimeTypes as hr, FetchTokenConfig as ht, createPreset as i, googleSchema as ia, SettingTypes as ii, cloudfrontConfigSchema as in, envVarRegex as io, AuthTypeEnum as ir, AgentCapabilities as it, updateTokenCount as j, tPluginSchema as ja, assistantSchema as ji, ocrSchema as jn, fileConfigSchema as jr, SKILL_SYNC_MIN_INTERVAL_MINUTES as jt, updateMessageContent as k, tModelSpecPresetSchema as ka, anthropicSchema as ki, modelConfigSchema as kn, excelMimeTypes as kr, SKILL_SYNC_MAX_DISCOVERY_DEPTH as kt, getAgentApiKeys as l, isAgentsEndpoint as la, AnthropicEffort as li, defaultEndpoints as ln, checkOpenAIStorage as lr, CohereConstants as lt, getEffectivePermissions as m, isOpenAILikeProvider as ma, ImageDetail as mi, excludedKeys as mn, sharedFileDownload as mr, ErrorTypes as mt, clearAllConversations as n, googleBaseSchema as na, ComponentTypes as ni, bedrockGuardrailConfigSchema as nn, getTagsForRating as no, StreamableHTTPOptionsSchema as nr, updateResourcePermissionsRequestSchema as nt, deleteAgentApiKey as o, imageDetailNumeric as oa, generateGoogleSchema as oi, contextPruningSchema as on, extractVariableName as oo, TokenExchangeMethodEnum as or, BASE_ONLY_CONFIG_SECTIONS as ot, getCustomConfigSpeech as p, isMythosClassModel as pa, EModelEndpoint as pi, endpointSchema as pn, registerPage as pr, EndpointURLs as pt, accessRoleSchema as q, hostImageNamePrefix as qa, eReasoningResponseKeySchema as qi, vertexModelConfigSchema as qn, supportsFiles as qr, anthropicEndpointSchema as qt, createAgentApiKey as r, googleGenConfigSchema as ra, OptionTypes as ri, bedrockModels as rn, toMinimalFeedback as ro, WebSocketOptionsSchema as rr, updateResourcePermissionsResponseSchema as rt, deletePreset as s, imageDetailValue as sa, generateOpenAISchema as si, defaultAgentCapabilities as sn, isSensitiveEnvVar as so, FileContext as sr, CacheKeys as st, cancelMCPOAuth as t, getSettingsKeys as ta, MAX_SUBAGENTS as ti, bedrockEndpointSchema as tn, getTagByKey as to, StdioOptionsSchema as tr, resourcePermissionsResponseSchema as tt, getAllEffectivePermissions as u, isAssistantsEndpoint as ua, AuthType as ui, defaultModels as un, apiBaseUrl as ur, Constants as ut, getSharedLink as v, openAISchema as va, ReasoningEffort as vi, getConfigDefaults as vn, bedrockDocumentFormats as vr, InfiniteCollections as vt, revokeAllUserKeys as w, tConversationSchema as wa, Verbosity as wi, interfaceSchema as wn, defaultSTTMimeTypes as wr, OCRStrategy as wt, reinitializeMCPServer as x, paramEndpoints as xa, ReasoningSummary as xi, getSchemaDefaults as xn, codeTypeMapping as xr, MAX_SUBAGENT_DEPTH as xt, getSharedMessages as y, openAISettings as ya, ReasoningParameterFormat as yi, getDefaultParamsEndpoint as yn, codeInterpreterMimeTypes as yr, KnownEndpoints as yt, DynamicQueryKeys as z, MessageContentTypes as za, defaultAgentFormValues as zi, summarizationConfigSchema as zn, isPermissiveMimeConfig as zr, SystemCategories as zt };
+export { permissionEntrySchema as $, googleSchema as $a, BedrockReasoningConfig as $i, specialVariables as $n, feedbackSchema as $o, defaultTextMimeTypes as $r, normalizeEndpointName as $s, azureGroupConfigsSchema as $t, updateResourcePermissions as A, defaultAgentFormValues as Aa, materializeModelSpecEndpoints as Ai, imageGenTools as An, tQueryParamsSchema as Ao, isProcessMCPServerField as Ar, feedbackFilterFieldSchema as As, SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH as At, MutationKeys as B, eReasoningResponseKeySchema as Ba, getMaxSubagents as Bi, modularEndpoints as Bn, actionDelimiter as Bo, registerPage as Br, hasActivePiiPatterns as Bs, SettingsViews as Bt, resetPassword as C, authTypeSchema as Ca, setFileConfigRegexCompiler as Ci, fileSourceSchema as Cn, tConvoUpdateSchema as Co, MCP_USER_INPUT_FIELDS as Cr, SKILL_FILTER_FIELDS as Cs, MAX_SUBAGENT_DEPTH as Ct, updateFeedback as D, compactAgentsSchema as Da, videoMimeTypes as Di, getDefaultParamsEndpoint as Dn, tPluginAuthConfigSchema as Do, WebSocketOptionsSchema as Dr, agentInstructionFilterFieldSchema as Ds, RateLimitPrefix as Dt, searchPrincipals as E, compactAgentsBaseSchema as Ea, textMimeTypes as Ei, getConfigDefaults as En, tModelSpecPresetSchema as Eo, StreamableHTTPOptionsSchema as Er, actionMetadataFilterFieldSchema as Es, OCRStrategy as Et, request_default as F, eModelEndpointSchema as Fa, MAX_CHAT_PROJECT_DESCRIPTION_LENGTH as Fi, langfuseConfigSchema as Fn, FilePurpose as Fo, FileSources as Fr, filterPiiStarterPatternSchema as Fs, SafeSearchTypes as Ft, PrincipalType as G, endpointSettings as Ga, clampSettingRange as Gi, paramDefinitionSchema as Gn, isActionTool as Go, bedrockDocumentFormats as Gr, skillFilterFieldSchema as Gs, VisionModes as Gt, AccessRoleIds as H, eThinkingDisplaySchema as Ha, ComponentTypes as Hi, normalizeSearxngEngines as Hn, defaultOrderQuery as Ho, applicationMimeTypes as Hr, messageFilterFieldSchema as Hs, TTSProviders as Ht, getTokenHeader as I, eReasoningContextSchema as Ia, MAX_CHAT_PROJECT_NAME_LENGTH as Ii, memorySchema as In, MessageContentTypes as Io, checkOpenAIStorage as Ir, filtersConfigSchema as Is, ScraperProviders as It, accessRoleToPermBits as J, getGoogleThinkingBudgetMax as Ja, generateOpenAISchema as Ji, resolveEndpointType as Jn, resolveStatefulCodeEnvironment as Jo, codeInterpreterMimeTypesList as Jr, userSubmittedMessageFieldPathSchema as Js, alternateName as Jt, ResourceType as K, extendedModelEndpointSchema as Ka, generateDynamicSchema as Ki, providerEndpointMap as Kn, STATEFUL_CODE_ENVIRONMENTS as Ko, bedrockDocumentMimeTypes as Kr, toolArgumentFilterFieldSchema as Ks, agentsEndpointSchema as Kt, setAcceptLanguageHeader as L, eReasoningEffortSchema as La, MAX_GRAPH_SUBAGENT_MEMBERS as Li, messageFilterPiiSchema as Ln, RunStatus as Lo, apiBaseUrl as Lr, getPiiRegexProgramSize as Ls, SearchCategories as Lt, updateUserKey as M, documentSupportedProviders as Ma, resolveModelSpecEndpoint as Mi, interfaceSchema as Mn, AnnotationTypes as Mo, AuthorizationTypeEnum as Mr, filterPiiActionSchema as Ms, SKILL_SYNC_MAX_INTERVAL_MINUTES as Mt, updateUserPlugins as N, eAnthropicEffortSchema as Na, specsConfigSchema as Ni, isRemoteOidcUrlAllowed as Nn, AssistantStreamEvents as No, TokenExchangeMethodEnum as Nr, filterPiiCustomPatternSchema as Ns, SKILL_SYNC_MIN_INTERVAL_MINUTES as Nt, updateMessage as O, compactAssistantSchema as Oa, REFILL_INTERVAL_UNITS as Oi, getEndpointField as On, tPluginSchema as Oo, hasProcessMCPServerConfig as Or, conversationStarterFilterFieldSchema as Os, RerankerTypes as Ot, userKeyQuery as P, eImageDetailSchema as Pa, tModelSpecSchema as Pi, isSecureCodeEnvironmentControlURL as Pn, EToolResources as Po, FileContext as Pr, filterPiiRegexSchema as Ps, STTProviders as Pt, permBitsToAccessLevel as Q, googleGenConfigSchema as Qa, BedrockProviders as Qi, skillSyncGitHubSourceSchema as Qn, feedbackRatingSchema as Qo, defaultSTTMimeTypes as Qr, isSensitiveEnvVar as Qs, azureEndpointSchema as Qt, setTokenHeader as R, eReasoningModeSchema as Ra, MAX_SUBAGENTS as Ri, messageFilterSchema as Rn, StepStatus as Ro, buildLoginRedirectUrl as Rr, hasActiveFiltersConfig as Rs, SearchProviders as Rt, requestPasswordReset as S, assistantSchema as Sa, retrievalMimeTypesList as Si, excludedKeys as Sn, tConversationTagSchema as So, MCP_SERVER_TITLE_PATTERN as Sr, PROMPT_FILTER_FIELDS as Ss, LocalStorageKeys as St, revokeUserKey as T, coerceNumber as Ta, supportsFiles as Ti, fileStrategiesSchema as Tn, tMessageSchema as To, StdioOptionsSchema as Tr, TOOL_ARGUMENT_FILTER_FIELDS as Ts, MAX_SUBAGENT_RUN_CONFIGS as Tt, PermissionBits as U, eThinkingLevelSchema as Ua, OptionTypes as Ui, normalizeServerName as Un, hostImageIdSuffix as Uo, audioMimeTypes as Ur, modelParameterFilterFieldSchema as Us, Time as Ut, QueryKeys as V, eReasoningSummarySchema as Va, setMaxSubagents as Vi, normalizeMCPToolKey as Vn, actionDomainSeparator as Vo, sharedFileDownload as Vr, memoryFilterFieldSchema as Vs, SystemCategories as Vt, PrincipalModel as W, eVerbositySchema as Wa, SettingTypes as Wi, ocrSchema as Wn, hostImageNamePrefix as Wo, bedrockDocumentExtensions as Wr, promptFilterFieldSchema as Ws, ViolationTypes as Wt, getResourcePermissionsResponseSchema as X, getSettingsKeys as Xa, AnthropicEffort as Xi, setMessageFilterRegexValidator as Xn, FEEDBACK_REASON_KEYS as Xo, convertStringsToRegex as Xr, extractEnvVariable as Xs, assistantEndpointSchema as Xt, effectivePermissionsResponseSchema as Y, getModelKey as Ya, validateSettingDefinitions as Yi, retainRecentConfigSchema as Yn, FEEDBACK_RATINGS as Yo, codeTypeMapping as Yr, envVarRegex as Ys, anthropicEndpointSchema as Yt, hasPermissions as Z, googleBaseSchema as Za, AuthType as Zi, skillSyncConfigSchema as Zn, FEEDBACK_TAGS as Zo, defaultOCRMimeTypes as Zr, extractVariableName as Zs, azureBaseSchema as Zt, getResourcePermissions as _, agentsSchema as _a, mbToBytes as _i, defaultEndpoints as _n, removeNullishValues as _o, webSearchSchema as _r, MAX_PII_PATTERN_LABEL_LENGTH as _s, FetchTokenConfig as _t, data_service_exports as a, Providers as aa, fileConfigSchema as ai, bedrockModels as an, isAssistantsEndpoint as ao, summarizationTriggerSchema as ar, AGENT_INSTRUCTION_FILTER_FIELDS as as, AgentCapabilities as at, register as b, anthropicSchema as ba, mimeTypeAliases as bi, defaultSocialLogins as bn, tBannerSchema as bo, MCPServersSchema as br, MESSAGE_FILTER_FIELDS as bs, InfiniteCollections as bt, getAccessRoles as c, ReasoningMode as ca, getEndpointFileConfig as ci, checkpointerTypeSchema as cn, isMythosClassModel as co, toolApprovalModeSchema as cr, FEEDBACK_FILTER_FIELDS as cs, BASE_PRINCIPAL_CONFIG_SECTIONS as ct, getAvailablePlugins as d, ReasoningSummary as da, imageTypeMapping as di, codeEnvironmentUserConfigSchema as dn, isUUID as do, turnstileOptionsSchema as dr, HITL_MESSAGE_FILTER_FIELDS as ds, CohereConstants as dt, EModelEndpoint as ea, documentParserMimeTypes as ei, azureGroupSchema as en, googleSettings as eo, splitMCPToolKey as er, feedbackTagKeySchema as es, principalSchema as et, getConversationById as f, SkillsScope as fa, inferMimeType as fi, codeEnvironmentUserSettingsSchema as fn, openAIBaseSchema as fo, turnstileSchema as fr, MAX_PII_CUSTOM_PATTERNS_TOTAL as fs, Constants as ft, getModels as g, agentsBaseSchema as ga, isPermissiveMimeConfig as gi, defaultAssistantsVersion as gn, paramEndpoints as go, visionModels as gr, MAX_PII_PATTERN_ID_LENGTH as gs, ErrorTypes as gt, getMCPServerConnectionStatus as h, Verbosity as ha, isBedrockDocumentType as hi, defaultAgentCapabilities as hn, openRouterSchema as ho, vertexModelConfigSchema as hr, MAX_PII_PATTERNS_PER_SOURCE as hs, EndpointURLs as ht, createPreset as i, MemoryScope as ia, fileConfig as ii, bedrockGuardrailConfigSchema as in, isAgentsEndpoint as io, summarizationConfigSchema as ir, ACTION_METADATA_FILTER_FIELDS as is, AUTH_USER_DOC_BY_ID_PREFIX as it, updateTokenCount as j, defaultAssistantFormValues as ja, modelSpecSubagentsSchema as ji, initialModelsConfig as jn, tSharedLinkSchema as jo, AuthTypeEnum as jr, fileFilterFieldSchema as js, SKILL_SYNC_MAX_DISCOVERY_DEPTH as jt, updateMessageContent as k, compactGoogleSchema as ka, getRefillEligibilityDate as ki, getSchemaDefaults as kn, tPresetSchema as ko, isProcessMCPServerConfig as kr, conversationTitleFilterFieldSchema as ks, RetentionMode as kt, getAgentApiKeys as l, ReasoningParameterFormat as la, imageExtRegex as li, cloudfrontConfigSchema as ln, isOpenAILikeProvider as lo, toolApprovalPolicySchema as lr, FILE_FILTER_FIELDS as ls, CacheKeys as lt, getEffectivePermissions as m, ThinkingLevel as ma, isAnthropicTextDocumentType as mi, contextPruningSchema as mn, openAISettings as mo, vertexAISchema as mr, MAX_PII_CUSTOM_REGEX_INSTRUCTIONS as ms, EImageOutputType as mt, clearAllConversations as n, ImageVisionTool as na, excelFileTypes as ni, baseEndpointSchema as nn, imageDetailValue as no, stripServerNamePrefix as nr, getTagsForRating as ns, updateResourcePermissionsRequestSchema as nt, deleteAgentApiKey as o, ReasoningContext as oa, fullMimeTypesList as oi, buildServerNameAliases as on, isDocumentSupportedProvider as oo, supportsBalanceCheck as or, CONVERSATION_STARTER_FILTER_FIELDS as os, AuthKeys as ot, getCustomConfigSpeech as p, ThinkingDisplay as pa, isAnthropicDocumentType as pi, configSchema as pn, openAISchema as po, validateVisionModel as pr, MAX_PII_CUSTOM_REGEX_CHARACTERS as ps, DEFAULT_MEMORY_MAX_INPUT_TOKENS as pt, accessRoleSchema as q, getGoogleThinkingBudgetBounds as qa, generateGoogleSchema as qi, rateLimitSchema as qn, resolveAllowedStatefulCodeEnvironments as qo, codeInterpreterMimeTypes as qr, unattributedAssistantContentSchema as qs, allowedAddressesSchema as qt, createAgentApiKey as r, MYTHOS_CLASS_FAMILIES as ra, excelMimeTypes as ri, bedrockEndpointSchema as rn, inputTokensIncludesCache as ro, stripServerNamePrefixes as rr, toMinimalFeedback as rs, updateResourcePermissionsResponseSchema as rt, deletePreset as s, ReasoningEffort as sa, getConfiguredMimeAccept as si, checkpointerSchema as sn, isImageVisionTool as so, toolApprovalHookConfigSchema as sr, CONVERSATION_TITLE_FILTER_FIELDS as ss, BASE_ONLY_CONFIG_SECTIONS as st, cancelMCPOAuth as t, ImageDetail as ta, endpointFileConfigSchema as ti, balanceSchema as tn, imageDetailNumeric as to, splitToolCallName as tr, getTagByKey as ts, resourcePermissionsResponseSchema as tt, getAllEffectivePermissions as u, ReasoningResponseKey as ua, imageMimeTypes as ui, codeEnvironmentPermissionDecisionSchema as un, isParamEndpoint as uo, transactionsSchema as ur, FILTER_PII_STARTER_PATTERNS as us, Capabilities as ut, getSharedLink as v, agentsSettings as va, megabyte as vi, defaultModels as vn, resolveAgentSkillsScope as vo, MCPOptionsSchema as vr, MAX_PII_PATTERN_LENGTH as vs, ForkOptions as vt, revokeAllUserKeys as w, cacheSubsetProviders as wa, supportedMimeTypes as wi, fileStorageSchema as wn, tExampleSchema as wo, SSEOptionsSchema as wr, STORED_MESSAGE_FILTER_FIELDS as ws, MAX_SUBAGENT_GRAPH_NODES as wt, reinitializeMCPServer as x, anthropicSettings as xa, retrievalMimeTypes as xi, endpointSchema as xn, tConversationSchema as xo, MCP_SERVER_TITLE_ERROR as xr, MODEL_PARAMETER_FILTER_FIELDS as xs, KnownEndpoints as xt, getSharedMessages as y, anthropicBaseSchema as ya, mergeFileConfig as yi, defaultRetrievalModels as yn, subagentThreadLineageSchema as yo, MCPServerUserInputSchema as yr, MEMORY_FILTER_FIELDS as ys, ImageDetailCost as yt, DynamicQueryKeys as z, eReasoningParameterFormatSchema as za, MAX_SUBAGENTS_CEILING as zi, modelConfigSchema as zn, Tools as zo, loginPage as zr, hasActivePiiFields as zs, SettingsTabValues as zt };
 
-//# sourceMappingURL=data-service-BsdHkdKS.mjs.map
+//# sourceMappingURL=data-service-CaB7saTP.mjs.map