librechat-data-provider 0.8.509 → 0.8.522

package/dist/{data-service-XTxx76uB.js → data-service-D5kHzBt-.js}

@@ -30,6 +30,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 //#endregion
 let zod = require("zod");
+let re2js = require("re2js");
 let axios = require("axios");
 axios = __toESM(axios);
 //#region src/utils.ts
@@ -97,6 +98,258 @@ function normalizeEndpointName(name = "") {
 	return name.toLowerCase() === "ollama" ? "ollama" : name;
 }
 //#endregion
+//#region src/filters.ts
+const FILTER_PII_STARTER_PATTERNS = [
+	"sk_prefix",
+	"bearer_header",
+	"api_key_header"
+];
+const MAX_PII_PATTERNS_PER_SOURCE = 256;
+const MAX_PII_PATTERN_LENGTH = 512;
+const MAX_PII_PATTERN_ID_LENGTH = 256;
+const MAX_PII_PATTERN_LABEL_LENGTH = 512;
+const MAX_PII_CUSTOM_REGEX_CHARACTERS = 8192;
+const MAX_PII_CUSTOM_REGEX_INSTRUCTIONS = 8192;
+const MAX_PII_CUSTOM_PATTERNS_TOTAL = 256;
+const MAX_PII_REGEX_SIZE_CACHE_ENTRIES = 512;
+const PII_REGEX_PROGRAM_SIZE_CACHE = /* @__PURE__ */ new Map();
+function getPiiRegexProgramSize(pattern) {
+	if (PII_REGEX_PROGRAM_SIZE_CACHE.has(pattern)) return PII_REGEX_PROGRAM_SIZE_CACHE.get(pattern) ?? null;
+	let programSize = null;
+	let compiled;
+	try {
+		compiled = re2js.RE2JS.compile(pattern);
+		const candidate = compiled.programSize();
+		if (Number.isSafeInteger(candidate) && candidate > 0) programSize = candidate;
+	} catch {
+		programSize = null;
+	} finally {
+		compiled?.reset();
+	}
+	if (PII_REGEX_PROGRAM_SIZE_CACHE.size >= MAX_PII_REGEX_SIZE_CACHE_ENTRIES) PII_REGEX_PROGRAM_SIZE_CACHE.clear();
+	PII_REGEX_PROGRAM_SIZE_CACHE.set(pattern, programSize);
+	return programSize;
+}
+const MESSAGE_FILTER_FIELDS = [
+	"name",
+	"text",
+	"summary",
+	"quote",
+	"answer",
+	"decision_response",
+	"decision_reason",
+	"content_part",
+	"attachment_reference",
+	"assembled_context"
+];
+const HITL_MESSAGE_FILTER_FIELDS = [
+	"answer",
+	"decision_response",
+	"decision_reason"
+];
+const REQUEST_ONLY_MESSAGE_FILTER_FIELDS = new Set(HITL_MESSAGE_FILTER_FIELDS);
+/** Message fields structurally recoverable without exact semantic provenance. */
+const STORED_MESSAGE_FILTER_FIELDS = MESSAGE_FILTER_FIELDS.filter((field) => !REQUEST_ONLY_MESSAGE_FILTER_FIELDS.has(field));
+const PROMPT_FILTER_FIELDS = [
+	"name",
+	"description",
+	"oneliner",
+	"category",
+	"command",
+	"text",
+	"preset_text",
+	"system",
+	"context",
+	"instructions",
+	"additional_instructions",
+	"greeting",
+	"example_input",
+	"example_output"
+];
+const AGENT_INSTRUCTION_FILTER_FIELDS = [
+	"name",
+	"category",
+	"description",
+	"instructions",
+	"additional_instructions",
+	"edge_description",
+	"edge_prompt",
+	"edge_prompt_key",
+	"artifacts",
+	"support_contact_name",
+	"support_contact_email"
+];
+const CONVERSATION_STARTER_FILTER_FIELDS = ["text"];
+const CONVERSATION_TITLE_FILTER_FIELDS = ["title"];
+const FEEDBACK_FILTER_FIELDS = ["text"];
+const SKILL_FILTER_FIELDS = [
+	"name",
+	"display_title",
+	"description",
+	"category",
+	"frontmatter",
+	"instructions",
+	"imported_text",
+	"file_name",
+	"file_text"
+];
+const MEMORY_FILTER_FIELDS = [
+	"key",
+	"value",
+	"summary"
+];
+const FILE_FILTER_FIELDS = [
+	"name",
+	"content",
+	"extracted_text",
+	"transcript",
+	"uri"
+];
+const TOOL_ARGUMENT_FILTER_FIELDS = [
+	"name",
+	"arguments",
+	"output"
+];
+const MODEL_PARAMETER_FILTER_FIELDS = [
+	"stop",
+	"request_fields",
+	"response_format",
+	"metadata"
+];
+const ACTION_METADATA_FILTER_FIELDS = [
+	"raw_spec",
+	"domain",
+	"privacy_policy_url",
+	"authorization_type",
+	"custom_auth_header",
+	"authorization_content_type",
+	"authorization_url",
+	"client_url",
+	"scope",
+	"token_exchange_method",
+	"api_key",
+	"oauth_client_id",
+	"oauth_client_secret"
+];
+const messageFilterFieldSchema = zod.z.enum(MESSAGE_FILTER_FIELDS);
+const promptFilterFieldSchema = zod.z.enum(PROMPT_FILTER_FIELDS);
+const agentInstructionFilterFieldSchema = zod.z.enum(AGENT_INSTRUCTION_FILTER_FIELDS);
+const conversationStarterFilterFieldSchema = zod.z.enum(CONVERSATION_STARTER_FILTER_FIELDS);
+const conversationTitleFilterFieldSchema = zod.z.enum(CONVERSATION_TITLE_FILTER_FIELDS);
+const feedbackFilterFieldSchema = zod.z.enum(FEEDBACK_FILTER_FIELDS);
+const skillFilterFieldSchema = zod.z.enum(SKILL_FILTER_FIELDS);
+const memoryFilterFieldSchema = zod.z.enum(MEMORY_FILTER_FIELDS);
+const fileFilterFieldSchema = zod.z.enum(FILE_FILTER_FIELDS);
+const toolArgumentFilterFieldSchema = zod.z.enum(TOOL_ARGUMENT_FILTER_FIELDS);
+const modelParameterFilterFieldSchema = zod.z.enum(MODEL_PARAMETER_FILTER_FIELDS);
+const filterPiiStarterPatternSchema = zod.z.enum(FILTER_PII_STARTER_PATTERNS);
+const filterPiiActionSchema = zod.z.enum(["block", "audit"]);
+const actionMetadataFilterFieldSchema = zod.z.enum(ACTION_METADATA_FILTER_FIELDS);
+const unattributedAssistantContentSchema = zod.z.enum(["model_output", "inspect"]);
+const userSubmittedMessageFieldPathSchema = zod.z.object({
+	path: zod.z.string().startsWith("/").max(2048),
+	field: zod.z.enum(HITL_MESSAGE_FILTER_FIELDS)
+}).strict();
+const UNINSPECTABLE_FILE_FIELDS = new Set([
+	"content",
+	"extracted_text",
+	"transcript"
+]);
+/**
+* An omitted starter selection enables the built-in catalog. An explicit
+* empty selection disables it, so a source is active only when custom rules
+* remain. This mirrors the documented filter semantics without compiling
+* regular expressions.
+*/
+function hasActivePiiPatterns(config) {
+	return config != null && (config.starterPatterns == null || config.starterPatterns.length > 0 || (config.customPatterns?.length ?? 0) > 0);
+}
+/** Returns whether an active PII rule can inspect at least one candidate field. */
+function hasActivePiiFields(config, candidates) {
+	return hasActivePiiPatterns(config) && (config?.fields == null || candidates.some((field) => config.fields?.includes(field)));
+}
+/**
+* Returns whether a parsed source-aware config can enforce any rule. An
+* explicit fail-close file policy remains active even without text patterns.
+*/
+function hasActiveFiltersConfig(filters) {
+	if (filters == null) return false;
+	if (filters.messages?.unattributedAssistantContent === "inspect") return true;
+	if ([
+		filters.messages?.pii,
+		filters.prompts?.pii,
+		filters.agentInstructions?.pii,
+		filters.conversationStarters?.pii,
+		filters.conversationTitles?.pii,
+		filters.feedback?.pii,
+		filters.skills?.pii,
+		filters.memories?.pii,
+		filters.files?.pii,
+		filters.toolArguments?.pii,
+		filters.modelParameters?.pii,
+		filters.actionMetadata?.pii
+	].some(hasActivePiiPatterns)) return true;
+	const filePii = filters.files?.pii;
+	return filePii?.uninspectable === "block" && (filePii.fields == null || filePii.fields.some((field) => UNINSPECTABLE_FILE_FIELDS.has(field)));
+}
+const filterPiiRegexSchema = zod.z.string().min(1).max(512).refine((value) => getPiiRegexProgramSize(value) != null, { message: "Regex must use supported linear-time syntax" });
+const filterPiiCustomPatternSchema = zod.z.object({
+	id: zod.z.string().min(1).max(256),
+	label: zod.z.string().min(1).max(512),
+	regex: filterPiiRegexSchema
+}).strict();
+function createPiiFilterSchema(fieldSchema) {
+	return zod.z.object({
+		action: filterPiiActionSchema.optional(),
+		fields: zod.z.array(fieldSchema).min(1).max(256).optional(),
+		starterPatterns: zod.z.array(filterPiiStarterPatternSchema).max(256).optional(),
+		customPatterns: zod.z.array(filterPiiCustomPatternSchema).max(256).optional()
+	}).strict();
+}
+function createSourceFilterSchema(fieldSchema) {
+	return zod.z.object({ pii: createPiiFilterSchema(fieldSchema).optional() }).strict();
+}
+const messageSourceFilterSchema = zod.z.object({
+	pii: createPiiFilterSchema(messageFilterFieldSchema).optional(),
+	unattributedAssistantContent: unattributedAssistantContentSchema.optional()
+}).strict();
+const fileSourceFilterSchema = zod.z.object({ pii: createPiiFilterSchema(fileFilterFieldSchema).extend({ uninspectable: zod.z.enum(["allow", "block"]).optional() }).optional() }).strict();
+const filtersConfigSchema = zod.z.object({
+	messages: messageSourceFilterSchema.optional(),
+	prompts: createSourceFilterSchema(promptFilterFieldSchema).optional(),
+	agentInstructions: createSourceFilterSchema(agentInstructionFilterFieldSchema).optional(),
+	conversationStarters: createSourceFilterSchema(conversationStarterFilterFieldSchema).optional(),
+	conversationTitles: createSourceFilterSchema(conversationTitleFilterFieldSchema).optional(),
+	feedback: createSourceFilterSchema(feedbackFilterFieldSchema).optional(),
+	skills: createSourceFilterSchema(skillFilterFieldSchema).optional(),
+	memories: createSourceFilterSchema(memoryFilterFieldSchema).optional(),
+	files: fileSourceFilterSchema.optional(),
+	toolArguments: createSourceFilterSchema(toolArgumentFilterFieldSchema).optional(),
+	modelParameters: createSourceFilterSchema(modelParameterFilterFieldSchema).optional(),
+	actionMetadata: createSourceFilterSchema(actionMetadataFilterFieldSchema).optional()
+}).strict().superRefine((filters, context) => {
+	let customPatterns = 0;
+	let regexCharacters = 0;
+	let regexInstructions = 0;
+	for (const source of Object.values(filters)) for (const pattern of source?.pii?.customPatterns ?? []) {
+		customPatterns++;
+		regexCharacters += pattern.regex.length;
+		regexInstructions += getPiiRegexProgramSize(pattern.regex) ?? 0;
+	}
+	if (customPatterns > 256) context.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		message: `At most 256 custom PII patterns may be configured in total`
+	});
+	if (regexCharacters > 8192) context.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		message: `Custom PII regexes may contain at most ${MAX_PII_CUSTOM_REGEX_CHARACTERS} characters in total`
+	});
+	if (regexInstructions > 8192) context.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		message: `Custom PII regexes may compile to at most ${MAX_PII_CUSTOM_REGEX_INSTRUCTIONS} instructions in total`
+	});
+});
+//#endregion
 //#region src/feedback.ts
 const FEEDBACK_RATINGS = ["thumbsUp", "thumbsDown"];
 const FEEDBACK_REASON_KEYS = [
@@ -189,6 +442,9 @@ const feedbackSchema = zod.z.object({
 	rating: feedbackRatingSchema,
 	tag: feedbackTagKeySchema,
 	text: zod.z.string().max(1024).optional()
+}).refine(({ rating, tag }) => FEEDBACK_TAGS.some((feedbackTag) => feedbackTag.key === tag && feedbackTag.direction === rating), {
+	message: "Feedback tag does not match rating",
+	path: ["tag"]
 });
 function toMinimalFeedback(feedback) {
 	if (!feedback?.rating || !feedback?.tag || !feedback.tag.key) return;
@@ -203,6 +459,25 @@ function getTagByKey(key) {
 	return FEEDBACK_TAGS.find((tag) => tag.key === key);
 }
 //#endregion
+//#region src/stateful-code.ts
+const STATEFUL_CODE_ENVIRONMENTS = [
+	"user",
+	"agent-user",
+	"conversation"
+];
+/** Resolve a deployment allowlist in stable UI order. An omitted value preserves
+* the backward-compatible behavior where every environment is available. */
+function resolveAllowedStatefulCodeEnvironments(configured) {
+	if (configured == null) return [...STATEFUL_CODE_ENVIRONMENTS];
+	const configuredSet = new Set(configured);
+	return STATEFUL_CODE_ENVIRONMENTS.filter((environment) => configuredSet.has(environment));
+}
+/** Keep an allowed preference, otherwise select the first deployment-allowed scope. */
+function resolveStatefulCodeEnvironment(preferred, configured) {
+	const allowed = resolveAllowedStatefulCodeEnvironments(configured);
+	return preferred != null && allowed.includes(preferred) ? preferred : allowed[0];
+}
+//#endregion
 //#region src/types/assistants.ts
 let Tools = /* @__PURE__ */ function(Tools) {
 	Tools["execute_code"] = "execute_code";
@@ -484,6 +759,7 @@ let ReasoningEffort = /* @__PURE__ */ function(ReasoningEffort) {
 	ReasoningEffort["medium"] = "medium";
 	ReasoningEffort["high"] = "high";
 	ReasoningEffort["xhigh"] = "xhigh";
+	ReasoningEffort["max"] = "max";
 	return ReasoningEffort;
 }({});
 let ReasoningParameterFormat = /* @__PURE__ */ function(ReasoningParameterFormat) {
@@ -550,6 +826,21 @@ let ThinkingLevel = /* @__PURE__ */ function(ThinkingLevel) {
 	ThinkingLevel["high"] = "high";
 	return ThinkingLevel;
 }({});
+/** OpenAI Responses API `reasoning.mode` (GPT-5.6+). */
+let ReasoningMode = /* @__PURE__ */ function(ReasoningMode) {
+	ReasoningMode["unset"] = "";
+	ReasoningMode["standard"] = "standard";
+	ReasoningMode["pro"] = "pro";
+	return ReasoningMode;
+}({});
+/** OpenAI Responses API `reasoning.context` (GPT-5.6+). */
+let ReasoningContext = /* @__PURE__ */ function(ReasoningContext) {
+	ReasoningContext["unset"] = "";
+	ReasoningContext["auto"] = "auto";
+	ReasoningContext["current_turn"] = "current_turn";
+	ReasoningContext["all_turns"] = "all_turns";
+	return ReasoningContext;
+}({});
 const imageDetailNumeric = {
 	["low"]: 0,
 	["auto"]: 1,
@@ -569,6 +860,8 @@ const eThinkingDisplaySchema = zod.z.nativeEnum(ThinkingDisplay);
 const eReasoningSummarySchema = zod.z.nativeEnum(ReasoningSummary);
 const eVerbositySchema = zod.z.nativeEnum(Verbosity);
 const eThinkingLevelSchema = zod.z.nativeEnum(ThinkingLevel);
+const eReasoningModeSchema = zod.z.nativeEnum(ReasoningMode);
+const eReasoningContextSchema = zod.z.nativeEnum(ReasoningContext);
 const defaultAssistantFormValues = {
 	assistant: "",
 	id: "",
@@ -600,6 +893,9 @@ const defaultAgentFormValues = {
 	["execute_code"]: false,
 	["file_search"]: false,
 	["web_search"]: false,
+	["memory"]: false,
+	stateful_code_environment: "user",
+	code_environment_id: void 0,
 	category: "general",
 	support_contact: {
 		name: "",
@@ -611,8 +907,14 @@ const defaultAgentFormValues = {
 	/** Master toggle for skill use on this agent. `true` activates skills
 	*  (full catalog unless `skills` narrows it). Anything else = inactive. */
 	skills_enabled: void 0,
+	/** Enables runtime skill creation without exposing an existing skill catalog. */
+	skill_authoring_enabled: void 0,
+	/** Explicit catalog scope. Missing preserves the legacy enabled + empty = all behavior. */
+	skills_scope: void 0,
 	/** `undefined` = feature disabled by default (no subagent tool injected). */
-	subagents: void 0
+	subagents: void 0,
+	/** Memory partition: 'agent' isolates memories per (user, agent); default shared pool */
+	memory_scope: void 0
 };
 const ImageVisionTool = {
 	type: "function",
@@ -626,6 +928,8 @@ const ImageVisionTool = {
 		}
 	}
 };
+/** Structural on purpose: accepts assistants tools/tool calls and agents function tool
+*  calls alike — the check only ever reads `type` and `function.name`. */
 const isImageVisionTool = (tool) => tool.type === "function" && tool.function?.name === ImageVisionTool.function?.name;
 const openAISettings = {
 	model: { default: "gpt-4o-mini" },
@@ -684,8 +988,45 @@ const getGoogleMaxOutputTokens = (modelName) => {
 	}
 	return GOOGLE_LEGACY_MAX_OUTPUT;
 };
+/**
+* Per-model thinking budget bounds, documented in
+* `com_endpoint_google_thinking_budget`: Gemini 2.5 Pro accepts 128-32,768,
+* Flash accepts 0-24,576, and Flash Lite accepts 512-24,576. The generic
+* 32,000 in the shared definition both under-limits Pro and lets invalid
+* Flash values through.
+*
+* `-1` remains the "decide automatically" sentinel and is not part of these
+* floors. Callers must keep `range.min` at -1 and apply `min` only to
+* non-negative values.
+*/
+const GOOGLE_THINKING_BUDGET_PRO_MAX = 32768;
+const GOOGLE_THINKING_BUDGET_FLASH_MAX = 24576;
+const GOOGLE_THINKING_BUDGET_PRO_MIN = 128;
+const GOOGLE_THINKING_BUDGET_FLASH_MIN = 0;
+const GOOGLE_THINKING_BUDGET_FLASH_LITE_MIN = 512;
+const getGoogleThinkingBudgetBounds = (modelName) => {
+	if (!/gemini-2\.5/i.test(modelName)) return;
+	if (/flash[-_.]?lite/i.test(modelName)) return {
+		min: GOOGLE_THINKING_BUDGET_FLASH_LITE_MIN,
+		max: GOOGLE_THINKING_BUDGET_FLASH_MAX
+	};
+	if (/flash/i.test(modelName)) return {
+		min: GOOGLE_THINKING_BUDGET_FLASH_MIN,
+		max: GOOGLE_THINKING_BUDGET_FLASH_MAX
+	};
+	if (/pro/i.test(modelName)) return {
+		min: GOOGLE_THINKING_BUDGET_PRO_MIN,
+		max: GOOGLE_THINKING_BUDGET_PRO_MAX
+	};
+};
+const getGoogleThinkingBudgetMax = (modelName) => getGoogleThinkingBudgetBounds(modelName)?.max;
 const googleSettings = {
 	model: { default: "gemini-1.5-flash-latest" },
+	maxContextTokens: {
+		min: 10,
+		max: 2e6,
+		step: 1e3
+	},
 	maxOutputTokens: {
 		min: 1,
 		max: GOOGLE_MAX_OUTPUT,
@@ -732,6 +1073,7 @@ const CLAUDE_4_64K_MAX_OUTPUT = 64e3;
 const CLAUDE_32K_MAX_OUTPUT = 32e3;
 const DEFAULT_MAX_OUTPUT = 8192;
 const LEGACY_ANTHROPIC_MAX_OUTPUT = 4096;
+const CLAUDE_SONNET_128K_OUTPUT_PATTERN = /claude-sonnet[-.]?(?:4[-.]?(?:[6-9]|\d{2})|[5-9]|\d{2,})(?=$|[^0-9])/;
 /**
 * Claude "Mythos-class" model families — new top-level classes (peers of
 * `opus`/`sonnet`/`haiku`) that ship with the post-Opus-4.7 modern profile:
@@ -775,6 +1117,7 @@ const anthropicSettings = {
 		reset: (modelName) => {
 			if (isMythosClassModel(modelName)) return ANTHROPIC_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:4[-.]?(?:[6-9]|\d{2,})|[5-9]|\d{2,})/.test(modelName)) return ANTHROPIC_MAX_OUTPUT;
+			if (CLAUDE_SONNET_128K_OUTPUT_PATTERN.test(modelName)) return ANTHROPIC_MAX_OUTPUT;
 			if (/claude-(?:sonnet|haiku)[-.]?[4-9]/.test(modelName)) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:[5-9]|4[-.]?([5-9]|\d{2,}))/.test(modelName)) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?[4-9]/.test(modelName)) return CLAUDE_32K_MAX_OUTPUT;
@@ -789,6 +1132,10 @@ const anthropicSettings = {
 				if (value > ANTHROPIC_MAX_OUTPUT) return ANTHROPIC_MAX_OUTPUT;
 				return value;
 			}
+			if (CLAUDE_SONNET_128K_OUTPUT_PATTERN.test(modelName)) {
+				if (value > ANTHROPIC_MAX_OUTPUT) return ANTHROPIC_MAX_OUTPUT;
+				return value;
+			}
 			if (/claude-(?:sonnet|haiku)[-.]?[4-9]/.test(modelName) && value > CLAUDE_4_64K_MAX_OUTPUT) return CLAUDE_4_64K_MAX_OUTPUT;
 			if (/claude-opus[-.]?(?:[5-9]|4[-.]?([5-9]|\d{2,}))/.test(modelName)) {
 				if (value > CLAUDE_4_64K_MAX_OUTPUT) return CLAUDE_4_64K_MAX_OUTPUT;
@@ -898,12 +1245,21 @@ const tPluginSchema = zod.z.object({
 	authenticated: zod.z.boolean().optional(),
 	chatMenu: zod.z.boolean().optional(),
 	isButton: zod.z.boolean().optional(),
-	toolkit: zod.z.boolean().optional()
+	toolkit: zod.z.boolean().optional(),
+	/** Raw upstream tool name when the model-facing key stripped a redundant
+	*  server-name prefix — proves upstream identity for legacy id migration. */
+	serverToolName: zod.z.string().optional()
 });
 const tExampleSchema = zod.z.object({
 	input: zod.z.object({ content: zod.z.string() }),
 	output: zod.z.object({ content: zod.z.string() })
 });
+/** Compact context-fading tier persisted beside a message's calibration ratio. */
+const agentFadingTierSchema = zod.z.object({
+	v: zod.z.literal(1),
+	budgetTokens: zod.z.number().positive(),
+	masked: zod.z.boolean()
+});
 const tMessageSchema = zod.z.object({
 	messageId: zod.z.string(),
 	endpoint: zod.z.string().optional(),
@@ -920,6 +1276,12 @@ const tMessageSchema = zod.z.object({
 	/** @deprecated */
 	generation: zod.z.string().nullable().optional(),
 	isCreatedByUser: zod.z.boolean(),
+	/** True when the complete stored row came from outside the model. */
+	isUserSubmitted: zod.z.boolean().optional(),
+	/** JSON pointers to caller-authored fields in an otherwise mixed model response. */
+	userSubmittedPaths: zod.z.array(zod.z.string().startsWith("/")).optional(),
+	/** Exact HITL message-field identity for caller-authored values stored in mixed responses. */
+	userSubmittedMessageFieldPaths: zod.z.array(userSubmittedMessageFieldPathSchema).optional(),
 	isTemporary: zod.z.boolean().optional(),
 	expiredAt: zod.z.string().nullable().optional(),
 	error: zod.z.boolean().optional(),
@@ -939,7 +1301,9 @@ const tMessageSchema = zod.z.object({
 	tokenCount: zod.z.number().optional(),
 	contextMeta: zod.z.object({
 		calibrationRatio: zod.z.number().optional().describe("EMA ratio of provider-reported vs local token estimates; seeds the pruner on subsequent runs"),
-		encoding: zod.z.string().optional().describe("Tokenizer encoding used when this ratio was computed (e.g. \"claude\", \"o200k_base\")")
+		encoding: zod.z.string().optional().describe("Tokenizer encoding used when this ratio was computed (e.g. \"claude\", \"o200k_base\")"),
+		fading: agentFadingTierSchema.optional().describe("Latched context-fading tier of the default agent; seeds the next run so the provider projection of history keeps the same bytes"),
+		fadingTiers: zod.z.array(agentFadingTierSchema.extend({ agentId: zod.z.string().min(1) })).optional().describe("Latched context-fading tiers keyed by agent ID, stored as entries")
 	}).optional(),
 	/**
 	* Skill names the user invoked manually via the `$` popover on this turn.
@@ -967,6 +1331,29 @@ const tMessageSchema = zod.z.object({
 	*/
 	quotes: zod.z.array(zod.z.string()).optional()
 });
+/**
+* Which memory partition an agent reads/writes.
+* `user` = the shared personal pool (default); `agent` = a partition
+* isolated per (user, agent) so the agent only sees its own memories.
+*/
+let MemoryScope = /* @__PURE__ */ function(MemoryScope) {
+	MemoryScope["user"] = "user";
+	MemoryScope["agent"] = "agent";
+	return MemoryScope;
+}({});
+/** Catalog exposure for a persisted agent with skills enabled. */
+let SkillsScope = /* @__PURE__ */ function(SkillsScope) {
+	SkillsScope["all"] = "all";
+	SkillsScope["selected"] = "selected";
+	SkillsScope["none"] = "none";
+	return SkillsScope;
+}({});
+/** Resolves explicit and legacy persisted-agent skill catalog states. */
+function resolveAgentSkillsScope(skills, enabled, scope) {
+	if (enabled !== true) return "none";
+	if (scope !== void 0) return scope;
+	return (skills ?? []).length > 0 ? "selected" : "all";
+}
 const coerceNumber = zod.z.union([zod.z.number(), zod.z.string()]).transform((val) => {
 	if (typeof val === "string") return val.trim() === "" ? void 0 : parseFloat(val);
 	return val;
@@ -979,12 +1366,26 @@ const DocumentType = zod.z.lazy(() => zod.z.union([
 	zod.z.array(zod.z.lazy(() => DocumentType)),
 	zod.z.record(zod.z.lazy(() => DocumentType))
 ]));
+const subagentThreadLineageSchema = zod.z.object({
+	rootConversationId: zod.z.string().min(1),
+	parentConversationId: zod.z.string().min(1),
+	parentMessageId: zod.z.string().min(1),
+	parentToolCallId: zod.z.string().min(1),
+	parentAgentId: zod.z.string().min(1).optional(),
+	subagentType: zod.z.string().min(1),
+	subagentKind: zod.z.enum(["agent", "graph"]),
+	depth: zod.z.number().int().positive()
+});
 const tConversationSchema = zod.z.object({
 	conversationId: zod.z.string().nullable(),
 	endpoint: eModelEndpointSchema.nullable(),
 	endpointType: eModelEndpointSchema.nullable().optional(),
 	isArchived: zod.z.boolean().optional(),
+	/** When the chat was archived; absent on chats archived before this was recorded. */
+	archivedAt: zod.z.string().nullable().optional(),
 	pinned: zod.z.boolean().optional(),
+	/** Server-derived: an active shared link exists for this conversation. Not persisted. */
+	isShared: zod.z.boolean().optional(),
 	title: zod.z.string().nullable().or(zod.z.literal("New Chat")).default("New Chat"),
 	user: zod.z.string().optional(),
 	messages: zod.z.array(zod.z.string()).optional(),
@@ -1022,6 +1423,8 @@ const tConversationSchema = zod.z.object({
 	imageDetail: eImageDetailSchema.optional(),
 	reasoning_effort: eReasoningEffortSchema.optional().nullable(),
 	reasoning_summary: eReasoningSummarySchema.optional().nullable(),
+	reasoning_mode: eReasoningModeSchema.optional().nullable(),
+	reasoning_context: eReasoningContextSchema.optional().nullable(),
 	verbosity: eVerbositySchema.optional().nullable(),
 	useResponsesApi: zod.z.boolean().optional(),
 	effort: eAnthropicEffortSchema.optional().nullable(),
@@ -1031,6 +1434,8 @@ const tConversationSchema = zod.z.object({
 	disableStreaming: zod.z.boolean().optional(),
 	assistant_id: zod.z.string().optional(),
 	agent_id: zod.z.string().optional(),
+	/** Durable parent/child navigation for a subagent thread. */
+	subagentThread: subagentThreadLineageSchema.optional(),
 	region: zod.z.string().optional(),
 	maxTokens: coerceNumber.optional(),
 	additionalModelRequestFields: DocumentType.optional(),
@@ -1113,6 +1518,10 @@ const tQueryParamsSchema = tConversationSchema.pick({
 	/** @endpoints openAI, custom, azureOpenAI */
 	reasoning_summary: true,
 	/** @endpoints openAI, custom, azureOpenAI */
+	reasoning_mode: true,
+	/** @endpoints openAI, custom, azureOpenAI */
+	reasoning_context: true,
+	/** @endpoints openAI, custom, azureOpenAI */
 	verbosity: true,
 	/** @endpoints openAI, custom, azureOpenAI */
 	useResponsesApi: true,
@@ -1182,6 +1591,26 @@ const tModelSpecPresetSchema = tPresetSchema.omit({
 	chatGptLabel: true,
 	presetOverride: true,
 	spec: true
+}).merge(zod.z.object({ 
+/**
+* Optional here, unlike `tPresetSchema`, where the key is required (though
+* nullable). A preset naming an `agent_id` has an unambiguous endpoint, so
+* config may omit it and `resolveModelSpecEndpoint` infers `agents` when
+* specs are materialized at config load.
+*/
+endpoint: extendedModelEndpointSchema.nullish() })).superRefine((preset, ctx) => {
+	/**
+	* Omission is only legal when the endpoint is inferable, which requires a
+	* NON-EMPTY `agent_id` — form-backed writers persist untouched fields as
+	* `''`, which names no agent. An explicit `endpoint: null` stays accepted:
+	* it validated before the key became optional, so rejecting it now would
+	* break previously valid configs.
+	*/
+	if (preset.endpoint === void 0 && !preset.agent_id) ctx.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		path: ["endpoint"],
+		message: "endpoint is required unless the preset names a non-empty agent_id (the agents endpoint is then inferred)"
+	});
 });
 const tSharedLinkSchema = zod.z.object({
 	conversationId: zod.z.string(),
@@ -1210,6 +1639,7 @@ const googleBaseSchema = tConversationSchema.pick({
 	examples: true,
 	temperature: true,
 	maxOutputTokens: true,
+	resendFiles: true,
 	artifacts: true,
 	topP: true,
 	topK: true,
@@ -1368,6 +1798,8 @@ const openAIBaseSchema = tConversationSchema.pick({
 	max_tokens: true,
 	reasoning_effort: true,
 	reasoning_summary: true,
+	reasoning_mode: true,
+	reasoning_context: true,
 	verbosity: true,
 	useResponsesApi: true,
 	web_search: true,
@@ -1466,15 +1898,39 @@ const requiredSettingFields = [
 	"type",
 	"component"
 ];
+function clampSettingRange(value, range) {
+	if (range.positiveMin != null) {
+		/** The minimum carries its own meaning here (Google's -1 for automatic),
+		*  and the schema admits it outright, so it survives rather than being
+		*  lifted to the floor. It need not be negative to be the sentinel. */
+		if (value === range.min) return range.min;
+		/** Below the sentinel there is nothing admissible to lift to, so the value
+		*  resolves to it. Between the sentinel and the floor, the floor is the
+		*  nearest value the generated schema accepts. */
+		if (value < Math.max(range.min, 0)) return range.min;
+		return Math.min(Math.max(value, range.positiveMin), range.max);
+	}
+	return Math.min(Math.max(value, range.min), range.max);
+}
 function generateDynamicSchema(settings) {
 	const schemaFields = {};
 	for (const setting of settings) {
 		const { key, type, default: defaultValue, range, options, minText, maxText, minTags, maxTags } = setting;
 		if (type === "number") {
-			let schema = zod.z.number();
+			let numberSchema = zod.z.number();
 			if (range) {
-				schema = schema.min(range.min);
-				schema = schema.max(range.max);
+				numberSchema = numberSchema.min(range.min);
+				numberSchema = numberSchema.max(range.max);
+			}
+			/** Widened deliberately: refine returns ZodEffects, not ZodNumber, and
+			*  the number-specific chaining is already done above. */
+			let schema = numberSchema;
+			if (range?.positiveMin != null) {
+				/** Mirrors clampSettingRange so the generated schema and the clamp
+				*  agree: `min` only admits the sentinel, and any non-negative value
+				*  must clear the documented floor. */
+				const { positiveMin, min } = range;
+				schema = numberSchema.refine((value) => value === min || value >= positiveMin, `Expected ${min} or a value of at least ${positiveMin}`);
 			}
 			if (typeof defaultValue === "number") schemaFields[key] = schema.default(defaultValue);
 			else schemaFields[key] = schema;
@@ -1616,7 +2072,14 @@ function validateSettingDefinitions(settings) {
 			setting.includeInput = setting.type === "number" ? setting.includeInput ?? true : false;
 		}
 		if (setting.component === "slider" && setting.type === "number") {
-			if (setting.default === void 0 && setting.range) setting.default = Math.round((setting.range.min + setting.range.max) / 2);
+			if (setting.default === void 0 && setting.range) {
+				/** The midpoint of the admissible interval, which a positive floor
+				*  narrows: the span between the sentinel and that floor holds no value
+				*  the generated schema accepts, so a midpoint taken across it would
+				*  fail the validation below. */
+				const floor = Math.max(setting.range.min, setting.range.positiveMin ?? setting.range.min);
+				setting.default = Math.round((floor + setting.range.max) / 2);
+			}
 		}
 		if (setting.component === "checkbox" || setting.component === "switch") {
 			if (setting.options && setting.options.length > 2) errors.push({
@@ -1694,6 +2157,16 @@ function validateSettingDefinitions(settings) {
 			message: `Invalid default value for setting ${setting.key}. Must be within the range [${setting.range.min}, ${setting.range.max}].`,
 			path: ["default"]
 		});
+		if (setting.type === "number" && setting.range?.positiveMin != null && setting.range.positiveMin > setting.range.max) errors.push({
+			code: zod.ZodIssueCode.custom,
+			message: `Invalid range for setting ${setting.key}. positiveMin (${setting.range.positiveMin}) cannot exceed max (${setting.range.max}).`,
+			path: ["range"]
+		});
+		if (setting.type === "number" && setting.range?.positiveMin != null && typeof setting.default === "number" && setting.default !== setting.range.min && setting.default < setting.range.positiveMin) errors.push({
+			code: zod.ZodIssueCode.custom,
+			message: `Invalid default value for setting ${setting.key}. Must be ${setting.range.min} or at least ${setting.range.positiveMin}.`,
+			path: ["default"]
+		});
 		if (setting.enumMappings && setting.type === "enum" && setting.options) {
 			for (const option of setting.options) if (!(option in setting.enumMappings)) errors.push({
 				code: zod.ZodIssueCode.custom,
@@ -1795,13 +2268,83 @@ const generateGoogleSchema = (customGoogle) => {
 //#region src/limits.ts
 /** Maximum number of explicit subagents per parent agent. UI + Zod schema share this. */
 const MAX_SUBAGENTS = 10;
+/** Hard upper bound for `endpoints.agents.maxSubagents`, keeping the request-validation
+*  cap bounded no matter what the config file says. */
+const MAX_SUBAGENTS_CEILING = 50;
+let maxSubagents = 10;
+/** Effective subagents-per-agent cap; initialized from `endpoints.agents.maxSubagents` at startup. */
+const getMaxSubagents = () => maxSubagents;
+/** Applies a configured cap; any missing or out-of-range value resets to the default. */
+const setMaxSubagents = (value) => {
+	maxSubagents = typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 50 ? value : 10;
+};
+/** Chat project field limits. The dialogs and the persistence layer share these,
+*  so the inputs stop at the same point the server would otherwise truncate. */
+const MAX_CHAT_PROJECT_NAME_LENGTH = 100;
+const MAX_CHAT_PROJECT_DESCRIPTION_LENGTH = 1e3;
+/** Mirrors the bounded graph-child member limit in `@librechat/agents`. */
+const MAX_GRAPH_SUBAGENT_MEMBERS = 32;
 //#endregion
 //#region src/models.ts
 const modelSpecSubagentsSchema = zod.z.object({
 	enabled: zod.z.boolean().optional(),
 	allowSelf: zod.z.boolean().optional(),
-	agent_ids: zod.z.array(zod.z.string()).max(10).optional()
+	agent_ids: zod.z.array(zod.z.string()).optional()
+}).superRefine((subagents, ctx) => {
+	const maxSubagents = getMaxSubagents();
+	if ((subagents.agent_ids?.length ?? 0) > maxSubagents) ctx.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		path: ["agent_ids"],
+		message: `agent_ids must contain at most ${maxSubagents} item(s)`
+	});
 });
+function resolveModelSpecEndpoint(modelSpec) {
+	const preset = modelSpec?.preset;
+	if (preset?.endpoint != null) return preset.endpoint;
+	/**
+	* An explicit `endpoint: null` is a statement, not an omission — such specs
+	* validated (and were skipped downstream) before inference existed, so
+	* inferring here would silently activate them. Only an absent key infers,
+	* and only from a non-empty `agent_id`: form-backed writers persist
+	* untouched fields as `''`, which names no agent.
+	*/
+	if (preset?.endpoint === null) return;
+	return preset?.agent_id ? "agents" : void 0;
+}
+/**
+* Writes each spec's resolved endpoint back onto its preset so every consumer —
+* endpoint matching, the selector, access filters, startup presets, provider-key
+* reachability — reads a complete spec instead of re-deriving it. Apply once
+* where the effective config is assembled (YAML load and DB-override merge);
+* downstream code then needs no awareness of inference.
+*
+* Returns the original object, and the original spec objects, when nothing
+* needs filling in, so cached configs and memoized consumers see no new
+* identities.
+*/
+function materializeModelSpecEndpoints(modelSpecs) {
+	const list = modelSpecs?.list;
+	if (!list?.length) return modelSpecs;
+	let changed = false;
+	const materialized = list.map((spec) => {
+		if (spec?.preset == null || spec.preset.endpoint != null) return spec;
+		const endpoint = resolveModelSpecEndpoint(spec);
+		if (endpoint == null) return spec;
+		changed = true;
+		return {
+			...spec,
+			preset: {
+				...spec.preset,
+				endpoint
+			}
+		};
+	});
+	if (!changed) return modelSpecs;
+	return {
+		...modelSpecs,
+		list: materialized
+	};
+}
 const tModelSpecSchema = zod.z.object({
 	name: zod.z.string(),
 	label: zod.z.string(),
@@ -1816,12 +2359,17 @@ const tModelSpecSchema = zod.z.object({
 	showIconInHeader: zod.z.boolean().optional(),
 	showOnLanding: zod.z.boolean().optional(),
 	conversation_starters: zod.z.array(zod.z.string()).optional(),
+	showInMenu: zod.z.boolean().optional(),
 	iconURL: zod.z.union([zod.z.string(), eModelEndpointSchema]).optional(),
 	authType: authTypeSchema.optional(),
 	hideBadgeRow: zod.z.boolean().optional(),
 	webSearch: zod.z.boolean().optional(),
 	fileSearch: zod.z.boolean().optional(),
 	executeCode: zod.z.boolean().optional(),
+	memory: zod.z.boolean().optional(),
+	askUserQuestion: zod.z.boolean().optional(),
+	runInBackground: zod.z.union([zod.z.boolean(), zod.z.array(zod.z.string())]).optional(),
+	describeIntent: zod.z.union([zod.z.boolean(), zod.z.array(zod.z.string())]).optional(),
 	artifacts: zod.z.union([zod.z.string(), zod.z.boolean()]).optional(),
 	mcpServers: zod.z.array(zod.z.string()).optional(),
 	skills: zod.z.union([zod.z.boolean(), zod.z.array(zod.z.string())]).optional(),
@@ -1903,6 +2451,7 @@ const fullMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -1933,6 +2482,7 @@ const fullMimeTypesList = [
 	"application/vnd.oasis.opendocument.graphics",
 	"image/svg",
 	"image/svg+xml",
+	"message/rfc822",
 	"video/mp4",
 	"video/avi",
 	"video/mov",
@@ -1966,6 +2516,7 @@ const codeInterpreterMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -1998,6 +2549,7 @@ const retrievalMimeTypesList = [
 	"application/pdf",
 	"text/x-php",
 	"application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	"application/vnd.openxmlformats-officedocument.presentationml.template",
 	"text/x-python",
 	"text/x-script.python",
 	"text/x-ruby",
@@ -2019,11 +2571,34 @@ const bedrockDocumentFormats = {
 	"text/markdown": "md"
 };
 const isBedrockDocumentType = (mimeType) => mimeType != null && mimeType in bedrockDocumentFormats;
+/** MIME types Bedrock's Converse document path can send to the model (mirrors `bedrockDocumentFormats`). */
+const bedrockDocumentMimeTypes = Object.keys(bedrockDocumentFormats);
 /** File extensions accepted by Bedrock document uploads (for input accept attributes) */
 const bedrockDocumentExtensions = ".pdf,.csv,.doc,.docx,.xls,.xlsx,.html,.htm,.txt,.md,application/pdf,text/csv,application/csv,application/msword,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.ms-excel,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,text/html,text/plain,text/markdown";
+/** Textual `application/*` MIME types that can be decoded and sent as plain text */
+const textualApplicationTypes = new Set([
+	"application/json",
+	"application/xml",
+	"application/yaml",
+	"application/sql",
+	"application/typescript",
+	"application/x-sh",
+	"application/csv"
+]);
+/**
+* MIME types the Anthropic Messages API accepts as a plain-text document source
+* (`source.type: 'text'`)
+*/
+const isAnthropicTextDocumentType = (mimeType) => mimeType != null && (mimeType.startsWith("text/") || textualApplicationTypes.has(mimeType));
+/**
+* MIME types the Anthropic Messages API document path can send to the model
+* (mirrors `isBedrockDocumentType`): PDF via base64, textual types via a
+* plain-text document source. All other types are rejected with a provider 400.
+*/
+const isAnthropicDocumentType = (mimeType) => mimeType === "application/pdf" || isAnthropicTextDocumentType(mimeType);
 const excelMimeTypes = /^application\/(vnd\.ms-excel|msexcel|x-msexcel|x-ms-excel|x-excel|x-dos_ms_excel|xls|x-xls|vnd\.openxmlformats-officedocument\.spreadsheetml\.sheet)$/;
 const textMimeTypes = /^(text\/(x-c|x-csharp|tab-separated-values|x-c\+\+|x-h|x-java|html|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|css|vtt|javascript|csv|xml|calendar))$/;
-const applicationMimeTypes = /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|x-zip-compressed|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
+const applicationMimeTypes = /^(application\/(epub\+zip|csv|json|msword|pdf|x-tar|x-sh|x-zip-compressed|typescript|sql|yaml|x-parquet|vnd\.apache\.parquet|vnd\.coffeescript|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.(presentation|template)|spreadsheetml\.sheet)|vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)|xml|zip))$/;
 const imageMimeTypes = /^image\/(jpeg|gif|png|webp|heic|heif)$/;
 const audioMimeTypes = /^audio\/(mp3|mpeg|mpeg3|wav|wave|x-wav|ogg|vorbis|mp4|m4a|x-m4a|flac|x-flac|webm|aac|wma|opus)$/;
 const videoMimeTypes = /^video\/(mp4|avi|mov|wmv|flv|webm|mkv|m4v|3gp|ogv)$/;
@@ -2032,6 +2607,7 @@ const defaultOCRMimeTypes = [
 	excelMimeTypes,
 	/^application\/pdf$/,
 	/^application\/vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation)$/,
+	/^application\/vnd\.openxmlformats-officedocument\.presentationml\.template$/,
 	/^application\/vnd\.ms-(word|powerpoint)$/,
 	/^application\/epub\+zip$/,
 	/^application\/vnd\.oasis\.opendocument\.(text|spreadsheet|presentation|graphics)$/
@@ -2053,7 +2629,8 @@ const supportedMimeTypes = [
 	imageMimeTypes,
 	videoMimeTypes,
 	audioMimeTypes,
-	/^image\/(svg|svg\+xml)$/
+	/^image\/(svg|svg\+xml)$/,
+	/^message\/rfc822$/
 ];
 const codeInterpreterMimeTypes = [
 	textMimeTypes,
@@ -2108,6 +2685,7 @@ const codeTypeMapping = {
 	cljs: "text/plain",
 	cljc: "text/plain",
 	elm: "text/plain",
+	eml: "message/rfc822",
 	erl: "text/plain",
 	hrl: "text/plain",
 	ex: "text/plain",
@@ -2179,6 +2757,13 @@ const codeTypeMapping = {
 	ods: "application/vnd.oasis.opendocument.spreadsheet",
 	odp: "application/vnd.oasis.opendocument.presentation",
 	odg: "application/vnd.oasis.opendocument.graphics",
+	doc: "application/msword",
+	docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+	xls: "application/vnd.ms-excel",
+	xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+	ppt: "application/vnd.ms-powerpoint",
+	pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	potx: "application/vnd.openxmlformats-officedocument.presentationml.template",
 	ics: "text/calendar",
 	ical: "text/calendar",
 	ifb: "text/calendar",
@@ -2193,7 +2778,11 @@ const imageTypeMapping = {
 const mimeTypeAliases = {
 	"application/x-zip-compressed": "application/zip",
 	"text/x-python-script": "text/x-python",
-	"text/x-markdown": "text/markdown"
+	"text/x-markdown": "text/markdown",
+	/** freedesktop shared-mime-info (Chrome on Linux) */
+	"application/x-shellscript": "application/x-sh",
+	/** libmagic, i.e. `file --mime-type` */
+	"text/x-shellscript": "application/x-sh"
 };
 /**
 * Infers the MIME type from a file's extension when the browser doesn't recognize it,
@@ -2207,7 +2796,7 @@ function inferMimeType(fileName, currentType) {
 	const extension = fileName.split(".").pop()?.toLowerCase() ?? "";
 	return codeTypeMapping[extension] || imageTypeMapping[extension] || currentType;
 }
-const retrievalMimeTypes = [/^(text\/(x-c|x-c\+\+|x-h|html|x-java|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|vtt|xml))$/, /^(application\/(json|pdf|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.presentation)))$/];
+const retrievalMimeTypes = [/^(text\/(x-c|x-c\+\+|x-h|html|x-java|markdown|x-php|x-python|x-script\.python|x-ruby|x-tex|plain|vtt|xml))$/, /^(application\/(json|pdf|vnd\.openxmlformats-officedocument\.(wordprocessingml\.document|presentationml\.(presentation|template))))$/];
 const megabyte = 1024 * 1024;
 /** Helper function to get megabytes value */
 const mbToBytes = (mb) => mb * megabyte;
@@ -2249,7 +2838,8 @@ const fileConfig = {
 		enabled: false,
 		maxWidth: 1900,
 		maxHeight: 1900,
-		quality: .92
+		quality: .92,
+		enforced: false
 	},
 	ocr: { supportedMimeTypes: defaultOCRMimeTypes },
 	text: { supportedMimeTypes: defaultTextMimeTypes },
@@ -2279,28 +2869,219 @@ const fileConfigSchema = zod.z.object({
 	}).optional(),
 	clientImageResize: zod.z.object({
 		enabled: zod.z.boolean().optional(),
-		maxWidth: zod.z.number().min(0).optional(),
-		maxHeight: zod.z.number().min(0).optional(),
+		maxWidth: zod.z.number().min(1).optional(),
+		maxHeight: zod.z.number().min(1).optional(),
 		quality: zod.z.number().min(0).max(1).optional()
 	}).optional(),
 	ocr: zod.z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional(),
 	text: zod.z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional()
 });
-/** Helper function to safely convert string patterns to RegExp objects */
-const convertStringsToRegex = (patterns) => patterns.reduce((acc, pattern) => {
-	try {
-		const regex = new RegExp(pattern);
-		acc.push(regex);
-	} catch (error) {
-		console.error(`Invalid regex pattern "${pattern}" skipped.`, error);
+/**
+* Compiler for admin-supplied MIME patterns. Defaults to native `RegExp`, which browser
+* builds keep so no extra dependency is bundled. The server swaps in a linear-time engine
+* via `setFileConfigRegexCompiler` so an admin-authored catastrophic-backtracking pattern
+* cannot ReDoS the shared event loop when tested against an uploaded file's MIME type.
+*/
+let compileMimeRegex = (pattern) => new RegExp(pattern);
+/** Override the MIME-pattern compiler; the server injects a linear-time engine at startup. */
+const setFileConfigRegexCompiler = (compile) => {
+	compileMimeRegex = compile;
+};
+/** Returned when every configured pattern fails to compile, so consumers that read an empty
+*  allowlist as "no restriction" fail closed instead of allowing every file. */
+const rejectAllMimeMatcher = { test: () => false };
+/** Helper function to safely convert string patterns to matcher objects */
+const convertStringsToRegex = (patterns) => {
+	const compiled = patterns.reduce((acc, pattern) => {
+		try {
+			acc.push(compileMimeRegex(pattern));
+		} catch (error) {
+			console.error(`Invalid regex pattern "${pattern}" skipped.`, error);
+		}
+		return acc;
+	}, []);
+	if (patterns.length > 0 && compiled.length === 0) {
+		console.error(`All ${patterns.length} MIME type pattern(s) were invalid and skipped; the resulting allowlist rejects every file.`);
+		return [rejectAllMimeMatcher];
 	}
-	return acc;
-}, []);
+	return compiled;
+};
 /** Detects whether the given MIME type patterns accept all file types (e.g., `.*` or `.+`). */
 const isPermissiveMimeConfig = (types) => {
 	if (!types || types.length === 0) return false;
 	return types.some((regex) => regex.test("x-librechat/x-probe"));
 };
+/** Media categories that collapse to a wildcard `accept` token when any member type is allowed. */
+const mimeAcceptCategories = [
+	{
+		/** Mirrors `imageMimeTypes` (+ the code-interpreter svg variants) so every accepted type is known. */
+		category: "image",
+		token: "image/*",
+		samples: [
+			"image/jpeg",
+			"image/gif",
+			"image/png",
+			"image/webp",
+			"image/heic",
+			"image/heif",
+			"image/svg",
+			"image/svg+xml"
+		],
+		extras: [".heif", ".heic"]
+	},
+	{
+		/** Mirrors `audioMimeTypes`. */
+		category: "audio",
+		token: "audio/*",
+		samples: [
+			"audio/mp3",
+			"audio/mpeg",
+			"audio/mpeg3",
+			"audio/wav",
+			"audio/wave",
+			"audio/x-wav",
+			"audio/ogg",
+			"audio/vorbis",
+			"audio/mp4",
+			"audio/m4a",
+			"audio/x-m4a",
+			"audio/flac",
+			"audio/x-flac",
+			"audio/webm",
+			"audio/aac",
+			"audio/wma",
+			"audio/opus"
+		]
+	},
+	{
+		/** Mirrors `videoMimeTypes`. */
+		category: "video",
+		token: "video/*",
+		samples: [
+			"video/mp4",
+			"video/avi",
+			"video/mov",
+			"video/wmv",
+			"video/flv",
+			"video/webm",
+			"video/mkv",
+			"video/m4v",
+			"video/3gp",
+			"video/ogv"
+		]
+	}
+];
+/** Document/text MIME types paired with the extension(s) browsers filter on in the file picker. */
+const documentMimeExtensions = [
+	["application/pdf", [".pdf"]],
+	["application/msword", [".doc"]],
+	["application/vnd.openxmlformats-officedocument.wordprocessingml.document", [".docx"]],
+	["application/vnd.ms-excel", [".xls"]],
+	["application/msexcel", [".xls"]],
+	["application/x-msexcel", [".xls"]],
+	["application/x-ms-excel", [".xls"]],
+	["application/x-excel", [".xls"]],
+	["application/x-dos_ms_excel", [".xls"]],
+	["application/xls", [".xls"]],
+	["application/x-xls", [".xls"]],
+	["application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", [".xlsx"]],
+	["application/vnd.ms-powerpoint", [".ppt"]],
+	["application/vnd.openxmlformats-officedocument.presentationml.presentation", [".pptx"]],
+	["application/vnd.openxmlformats-officedocument.presentationml.template", [".potx"]],
+	["application/vnd.oasis.opendocument.text", [".odt"]],
+	["application/vnd.oasis.opendocument.spreadsheet", [".ods"]],
+	["application/vnd.oasis.opendocument.presentation", [".odp"]],
+	["application/vnd.oasis.opendocument.graphics", [".odg"]],
+	["application/rtf", [".rtf"]],
+	["application/json", [".json"]],
+	["application/xml", [".xml"]],
+	["application/yaml", [".yaml", ".yml"]],
+	["application/zip", [".zip"]],
+	["application/x-zip-compressed", [".zip"]],
+	["application/epub+zip", [".epub"]],
+	["application/x-parquet", [".parquet"]],
+	["application/vnd.apache.parquet", [".parquet"]],
+	["text/csv", [".csv"]],
+	["application/csv", [".csv"]],
+	["text/tab-separated-values", [".tsv"]],
+	["text/plain", [".txt"]],
+	["text/markdown", [".md"]],
+	["text/html", [".html", ".htm"]],
+	["text/calendar", [".ics"]],
+	["message/rfc822", [".eml"]]
+];
+const documentMimeSet = new Set(documentMimeExtensions.map(([mimeType]) => mimeType));
+/** Every MIME type LibreChat may accept, used to detect patterns that reach beyond the representable set. */
+const knownMimeUniverse = Array.from(new Set([
+	...fullMimeTypesList,
+	...documentMimeExtensions.map(([mimeType]) => mimeType),
+	...mimeAcceptCategories.flatMap((category) => category.samples)
+]));
+const categoryOf = (mimeType) => {
+	if (mimeType.startsWith("image/")) return "image";
+	if (mimeType.startsWith("audio/")) return "audio";
+	if (mimeType.startsWith("video/")) return "video";
+	return "document";
+};
+/** Media types are covered by their `<cat>/*` wildcard token; document types need an explicit entry. */
+const isRepresentable = (mimeType) => categoryOf(mimeType) !== "document" || documentMimeSet.has(mimeType);
+/**
+* Translates a finite MIME allowlist into a file-input `accept` string, intersected with what the
+* provider upload path can actually send. Returns `undefined` (keep the provider filter) when a
+* configured pattern matches a supported, path-handleable type that cannot be represented, so the
+* picker never hides a file the path would have accepted.
+*/
+const buildMimeAccept = (types, { categories, documentMimeTypes }) => {
+	const permittedSet = new Set(categories);
+	const documentAllowSet = documentMimeTypes ? new Set(documentMimeTypes) : null;
+	const emittedMedia = /* @__PURE__ */ new Set();
+	const emittedDocuments = /* @__PURE__ */ new Set();
+	if (!types.every((regex) => knownMimeUniverse.some((mimeType) => regex.test(mimeType)))) return;
+	for (const regex of types) for (const mimeType of knownMimeUniverse) {
+		if (!regex.test(mimeType)) continue;
+		const category = categoryOf(mimeType);
+		if (!permittedSet.has(category)) continue;
+		/** The path handles documents but drops this specific type (e.g. Bedrock ignores pptx/ODF). */
+		if (category === "document" && documentAllowSet && !documentAllowSet.has(mimeType)) continue;
+		if (!isRepresentable(mimeType)) return;
+		if (category === "document") emittedDocuments.add(mimeType);
+		else emittedMedia.add(category);
+	}
+	const tokens = [];
+	const seen = /* @__PURE__ */ new Set();
+	const push = (token) => {
+		if (!seen.has(token)) {
+			seen.add(token);
+			tokens.push(token);
+		}
+	};
+	for (const category of mimeAcceptCategories) if (emittedMedia.has(category.category)) {
+		push(category.token);
+		category.extras?.forEach(push);
+	}
+	for (const [mimeType, extensions] of documentMimeExtensions) if (emittedDocuments.has(mimeType)) {
+		extensions.forEach(push);
+		push(mimeType);
+	}
+	return tokens.length > 0 ? tokens.join(",") : void 0;
+};
+/**
+* Resolves the file-input `accept` value for a configured `supportedMimeTypes` allowlist, scoped to
+* what the current upload path (`capability`) can send to the model.
+* - `undefined` for the built-in default or a config that can't be represented safely, so callers
+*   keep their provider-specific filter.
+* - `''` for permissive configs (e.g. `.*`), leaving the picker unrestricted.
+* - a translated `accept` string for a recognized finite allowlist (images, PDFs, Office docs, etc.).
+*
+* The picker `accept` is a UX convenience, not a security boundary: the backend still enforces
+* `supportedMimeTypes` on upload.
+*/
+const getConfiguredMimeAccept = (types, capability) => {
+	/** Referential identity with the built-in list signals an unconfigured endpoint (keep provider filter). */
+	if (!types || types.length === 0 || types === supportedMimeTypes) return;
+	if (isPermissiveMimeConfig(types)) return "";
+	return buildMimeAccept(types, capability);
+};
 /**
 * Gets the appropriate endpoint file configuration with standardized lookup logic.
 *
@@ -2395,7 +3176,8 @@ function mergeFileConfig(dynamic) {
 	};
 	if (dynamic.clientImageResize !== void 0) mergedConfig.clientImageResize = {
 		...mergedConfig.clientImageResize,
-		...dynamic.clientImageResize
+		...dynamic.clientImageResize,
+		enforced: dynamic.clientImageResize.enabled !== void 0
 	};
 	if (dynamic.ocr !== void 0) {
 		const { supportedMimeTypes: ocrMimeTypes, ...ocrRest } = dynamic.ocr;
@@ -2456,9 +3238,14 @@ const buildQuery = (params) => {
 };
 const health = () => `${BASE_URL}/health`;
 const user = () => `${BASE_URL}/api/user`;
+const userPreferences = () => `${user()}/preferences`;
 const balance = () => `${BASE_URL}/api/balance`;
 const userPlugins = () => `${BASE_URL}/api/user/plugins`;
 const deleteUser$1 = () => `${BASE_URL}/api/user/delete`;
+const codeEnvironments = () => `${BASE_URL}/api/code-environments`;
+const codeEnvironmentPairings = () => `${codeEnvironments()}/pairings`;
+const codeEnvironmentById = (id) => `${codeEnvironments()}/${encodeURIComponent(id)}`;
+const codeEnvironmentSettings = (id) => `${codeEnvironmentById(id)}/settings`;
 const messagesRoot = `${BASE_URL}/api/messages`;
 const messages = (params) => {
 	const { conversationId, messageId, ...rest } = params;
@@ -2470,9 +3257,16 @@ const messagesArtifacts = (messageId) => `${messagesRoot}/artifact/${messageId}`
 const messagesBranch = () => `${messagesRoot}/branch`;
 const shareRoot = `${BASE_URL}/api/share`;
 const shareMessages = (shareId) => `${shareRoot}/${shareId}`;
+const forkSharedMessages = (shareId) => `${shareRoot}/${shareId}/fork`;
 const sharedStartupConfig = (shareId) => `${shareMessages(shareId)}/config`;
 const getSharedLink$1 = (conversationId) => `${shareRoot}/link/${conversationId}`;
-const getSharedLinks = (pageSize, sortBy, sortDirection, search, cursor) => `${shareRoot}?pageSize=${pageSize}&sortBy=${sortBy}&sortDirection=${sortDirection}${search ? `&search=${search}` : ""}${cursor ? `&cursor=${cursor}` : ""}`;
+const getSharedLinks = (pageSize, sortBy, sortDirection, search, cursor) => `${shareRoot}${buildQuery({
+	pageSize,
+	sortBy,
+	sortDirection,
+	search,
+	cursor
+})}`;
 const createSharedLink$1 = (conversationId) => `${shareRoot}/${conversationId}`;
 const updateSharedLink$1 = (shareId) => `${shareRoot}/${shareId}`;
 /** Share-scoped file routes: serve snapshotted files via shared-link permission. */
@@ -2492,9 +3286,17 @@ const conversations = (params) => {
 	return `${conversationsRoot}${buildQuery(params)}`;
 };
 const conversationById = (id) => `${conversationsRoot}/${id}`;
+const parentSubagents = (parentConversationId) => `${conversationsRoot}/${encodeURIComponent(parentConversationId)}/subagents`;
+const subagentThread = (parentConversationId, threadId, taskId, cursor) => {
+	const endpoint = `${conversationsRoot}/${encodeURIComponent(parentConversationId)}/subagents/${encodeURIComponent(threadId)}`;
+	if (taskId != null) return `${endpoint}?taskId=${encodeURIComponent(taskId)}`;
+	return cursor == null ? endpoint : `${endpoint}?cursor=${encodeURIComponent(cursor)}`;
+};
+const subagentControl = (parentConversationId, threadId) => `${conversationsRoot}/${encodeURIComponent(parentConversationId)}/subagents/${encodeURIComponent(threadId)}/control`;
 const genTitle$1 = (conversationId) => `${conversationsRoot}/gen_title/${encodeURIComponent(conversationId)}`;
 const updateConversation$1 = () => `${conversationsRoot}/update`;
 const archiveConversation$1 = () => `${conversationsRoot}/archive`;
+const archiveAllConversations$1 = () => `${conversationsRoot}/archive/all`;
 const pinConversation$1 = () => `${conversationsRoot}/pin`;
 const deleteConversation$1 = () => `${conversationsRoot}`;
 const deleteAllConversation = () => `${conversationsRoot}/all`;
@@ -2512,7 +3314,6 @@ const presets = () => `${BASE_URL}/api/presets`;
 const deletePreset$1 = () => `${BASE_URL}/api/presets/delete`;
 const aiEndpoints = () => `${BASE_URL}/api/endpoints`;
 const tokenConfig = () => `${BASE_URL}/api/endpoints/token-config`;
-const contextProjection = () => `${BASE_URL}/api/endpoints/context-projection`;
 const models = () => `${BASE_URL}/api/models`;
 const tokenizer = () => `${BASE_URL}/api/tokenizer`;
 const login$1 = () => `${BASE_URL}/api/auth/login`;
@@ -2551,6 +3352,7 @@ const mcpAuthValues = (serverName) => {
 const cancelMCPOAuth$1 = (serverName) => {
 	return `${BASE_URL}/api/mcp/oauth/cancel/${serverName}`;
 };
+const mcpOAuthStatus = (flowId) => `${BASE_URL}/api/mcp/oauth/status/${encodeURIComponent(flowId)}`;
 const mcpOAuthBind = (serverName) => `${BASE_URL}/api/mcp/${serverName}/oauth/bind`;
 const actionOAuthBind = (actionId) => `${BASE_URL}/api/actions/${actionId}/oauth/bind`;
 const config = (context) => `${BASE_URL}/api/config${buildQuery({ context })}`;
@@ -2579,6 +3381,14 @@ const agents = ({ path = "", options }) => {
 	return url;
 };
 const activeJobs = () => `${BASE_URL}/api/agents/chat/active`;
+const agentQueuedTurnsRoot = `${BASE_URL}/api/agents/chat/queued-turns`;
+const agentQueuedTurns = () => agentQueuedTurnsRoot;
+const agentQueuedTurnsByConversation = (conversationId, clientRequestIds = []) => {
+	const uniqueIds = Array.from(new Set(clientRequestIds)).slice(0, 100);
+	const knownIds = uniqueIds.length > 0 ? `&${uniqueIds.map((id) => `clientRequestIds=${encodeURIComponent(id)}`).join("&")}` : "";
+	return `${agentQueuedTurnsRoot}?conversationId=${encodeURIComponent(conversationId)}${knownIds}`;
+};
+const agentQueuedTurn = (queuedTurnId) => `${agentQueuedTurnsRoot}/${encodeURIComponent(queuedTurnId)}`;
 const mcp = {
 	tools: `${BASE_URL}/api/mcp/tools`,
 	servers: `${BASE_URL}/api/mcp/servers`
@@ -2587,6 +3397,8 @@ const mcpServer = (serverName) => `${BASE_URL}/api/mcp/servers/${serverName}`;
 const revertAgentVersion$1 = (agent_id) => `${agents({ path: `${agent_id}/revert` })}`;
 const files = () => `${BASE_URL}/api/files`;
 const filePreview = (fileId) => `${BASE_URL}/api/files/${encodeURIComponent(fileId)}/preview`;
+/** Owner-scoped usage touch so queued attachments outlive the upload-window TTL. */
+const fileUsage = () => `${BASE_URL}/api/files/usage`;
 const agentFiles = (agentId) => `${BASE_URL}/api/files/agent/${agentId}`;
 const images = () => `${files()}/images`;
 const avatar = () => `${images()}/avatar`;
@@ -2630,6 +3442,9 @@ const deletePrompt$1 = ({ _id, groupId }) => {
 };
 const getCategories$1 = () => `${BASE_URL}/api/categories`;
 const getAllPromptGroups$1 = () => `${prompts()}/all`;
+const schedules = () => `${BASE_URL}/api/schedules`;
+const schedule = (id) => `${schedules()}/${encodeURIComponent(id)}`;
+const runSchedule = (id) => `${schedule(id)}/run`;
 const skills = () => `${BASE_URL}/api/skills`;
 const importSkill$1 = () => `${skills()}/import`;
 const getSkill$1 = (id) => `${skills()}/${encodeURIComponent(id)}`;
@@ -2643,11 +3458,18 @@ const listSkillsWithFilters = (filter) => {
 };
 const skillFiles = (id) => `${getSkill$1(id)}/files`;
 const skillFile = (id, relativePath) => `${skillFiles(id)}/${encodeURIComponent(relativePath)}`;
+const insights = () => `${BASE_URL}/api/admin/insights`;
+const insightsAccess = () => `${insights()}/access`;
 const adminSkillsSync = () => `${BASE_URL}/api/admin/skills/sync`;
 const adminSkillsSyncStatus = () => `${adminSkillsSync()}/status`;
 const adminSkillsSyncRun = () => `${adminSkillsSync()}/run`;
 const adminSkillsSyncCredential = (credentialKey) => `${adminSkillsSync()}/credentials/${encodeURIComponent(credentialKey)}`;
 const skillStates = () => `${BASE_URL}/api/user/settings/skills/active`;
+const adminLangfuseConnection = () => `${BASE_URL}/api/admin/langfuse/connection`;
+const adminLangfuseConnectionTest = () => `${adminLangfuseConnection()}/test`;
+const adminLangfuseSessionLink = (conversationId) => `${adminLangfuseConnection()}/session/${encodeURIComponent(conversationId)}`;
+const toolFavorites = () => `${BASE_URL}/api/user/settings/favorites/tools`;
+const toolFavorite = (itemType, itemId) => `${toolFavorites()}/${itemType}/${encodeURIComponent(itemId)}`;
 const roles = () => `${BASE_URL}/api/roles`;
 const adminRoles = () => `${BASE_URL}/api/admin/roles`;
 const getRole$1 = (roleName) => `${roles()}/${encodeURIComponent(roleName)}`;
@@ -2672,7 +3494,8 @@ const disableTwoFactor$1 = () => `${BASE_URL}/api/auth/2fa/disable`;
 const regenerateBackupCodes$1 = () => `${BASE_URL}/api/auth/2fa/backup/regenerate`;
 const verifyTwoFactorTemp$1 = () => `${BASE_URL}/api/auth/2fa/verify-temp`;
 const memories = () => `${BASE_URL}/api/memories`;
-const memory = (key) => `${memories()}/${encodeURIComponent(key)}`;
+const memory = (key, agentId) => `${memories()}/${encodeURIComponent(key)}${agentId ? `?agentId=${encodeURIComponent(agentId)}` : ""}`;
+const memoryById = (id, agentId) => `${memories()}/id/${encodeURIComponent(id)}${agentId ? `?agentId=${encodeURIComponent(agentId)}` : ""}`;
 const memoryPreferences = () => `${memories()}/preferences`;
 const searchPrincipals$1 = (params) => {
 	const { q: query, limit, types } = params;
@@ -2850,9 +3673,11 @@ const UserOAuthOptionsSchema = OAuthOptionsBaseSchema.omit({
 const OboOptionsSchema = zod.z.object({ 
 /** Scopes to request for the downstream MCP server (e.g., "api://<client-id>/Mcp.Tools.ReadWrite") */
 scopes: zod.z.string().min(1) });
+const MCP_SERVER_TITLE_PATTERN = /* @__PURE__ */ new RegExp("^[\\p{L}\\p{N}][\\p{L}\\p{N}\\p{M}'’ -]*$", "u");
+const MCP_SERVER_TITLE_ERROR = "Title must start with a letter or number and can include spaces, hyphens, and apostrophes";
 const BaseOptionsSchema = zod.z.object({
-	/** Display name for the MCP server - only letters, numbers, and spaces allowed */
-	title: zod.z.string().regex(/^[a-zA-Z0-9 ]+$/, "Title can only contain letters, numbers, and spaces").optional(),
+	/** Display name for the MCP server */
+	title: zod.z.string().regex(MCP_SERVER_TITLE_PATTERN, MCP_SERVER_TITLE_ERROR).optional(),
 	/** Description of the MCP server */
 	description: zod.z.string().optional(),
 	/**
@@ -2867,7 +3692,14 @@ const BaseOptionsSchema = zod.z.object({
 	/** Timeout (ms) for the long-lived SSE GET stream body before undici aborts it. Default: 300_000 (5 min). */
 	sseReadTimeout: zod.z.number().int().positive().optional(),
 	initTimeout: zod.z.number().int().nonnegative().optional(),
-	/** Controls visibility in chat dropdown menu (MCPSelect) */
+	/**
+	* Whether the server is offered in chat.
+	*
+	* `false` hides it from the chat dropdown (MCPSelect) AND bars it from the
+	* chat selection a request carries, so a stale or hand-written request cannot
+	* reach it either. It does not restrict agents, nor a server a model spec
+	* pins through `mcpServers` — both are the operator's own choice.
+	*/
 	chatMenu: zod.z.boolean().optional(),
 	/**
 	* Controls server instruction behavior:
@@ -2923,6 +3755,26 @@ const ProxyUrlSchema = zod.z.string().transform((val) => extractEnvVariable(val)
 	const protocol = new URL(val).protocol;
 	return protocol === "http:" || protocol === "https:" || protocol === "socks:" || protocol === "socks5:";
 }, { message: "Proxy URL must use http://, https://, socks://, or socks5://" });
+const PROCESS_MCP_SERVER_FIELDS = new Set([
+	"command",
+	"args",
+	"env",
+	"cwd",
+	"stderr"
+]);
+function isProcessMCPServerField(field) {
+	return PROCESS_MCP_SERVER_FIELDS.has(field);
+}
+function isProcessMCPServerConfig(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return false;
+	const config = value;
+	if (config.type === "stdio") return true;
+	return Object.keys(config).some(isProcessMCPServerField);
+}
+function hasProcessMCPServerConfig(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.values(value).some(isProcessMCPServerConfig);
+}
 const StdioOptionsSchema = BaseOptionsSchema.extend({
 	type: zod.z.literal("stdio").default("stdio"),
 	obo: zod.z.undefined().optional(),
@@ -2955,7 +3807,12 @@ const StdioOptionsSchema = BaseOptionsSchema.extend({
 		"pipe",
 		"ignore",
 		"inherit"
-	]), zod.z.number().int().nonnegative()]).optional()
+	]), zod.z.number().int().nonnegative()]).optional(),
+	/**
+	* Working directory for the spawned process. Supplied by Agent Plugins
+	* packages, which resolve and contain the path before it reaches this schema.
+	*/
+	cwd: zod.z.string().optional()
 });
 const WebSocketOptionsSchema = BaseOptionsSchema.extend({
 	type: zod.z.literal("websocket").default("websocket"),
@@ -3090,7 +3947,10 @@ const defaultSocialLogins = [
 	"discord",
 	"saml"
 ];
-const BASE_ONLY_CONFIG_SECTIONS = [];
+const BASE_ONLY_CONFIG_SECTIONS = ["filters"];
+/** Sections that may be stored in the tenant's base config document but must
+* not be overridden or tombstoned by role, group, or user config documents. */
+const BASE_PRINCIPAL_CONFIG_SECTIONS = ["langfuse"];
 const defaultRetrievalModels = [
 	"gpt-4o",
 	"o1-preview-2024-09-12",
@@ -3115,6 +3975,12 @@ const defaultRetrievalModels = [
 ];
 const excludedKeys = new Set([
 	"conversationId",
+	"agentEventBinding",
+	"agentEventActor",
+	"agentEventActorReconciliations",
+	"agentEventActorEpoch",
+	"agentEventActorLegacyTurn",
+	"subagentThread",
 	"title",
 	"iconURL",
 	"greeting",
@@ -3126,6 +3992,8 @@ const excludedKeys = new Set([
 	"isTemporary",
 	"messages",
 	"isArchived",
+	"pinned",
+	"archivedAt",
 	"tags",
 	"user",
 	"__v",
@@ -3174,6 +4042,32 @@ function isPrivateIPv4Literal(value) {
 	if (a >= 224) return true;
 	return false;
 }
+/**
+* Mirrors `hasPrivateEmbeddedIPv4` in `@librechat/api`'s ip helpers: 6to4, NAT64, and Teredo
+* carry an IPv4 address inside the IPv6 one, and the runtime guard blocks those when the
+* embedded address is private. Kept in sync so an operator can exempt what the runtime blocks.
+*/
+function hasPrivateEmbeddedIPv4Literal(value) {
+	const is6to4 = value.startsWith("2002:");
+	const isNat64 = value.startsWith("64:ff9b::");
+	const isTeredo = value.startsWith("2001::");
+	if (!is6to4 && !isNat64 && !isTeredo) return false;
+	const segments = value.split(":").filter((segment) => segment !== "");
+	const pair = is6to4 ? segments.slice(1, 3) : segments.slice(-2);
+	if (pair.length !== 2) return false;
+	const hi = parseInt(pair[0], 16);
+	const lo = parseInt(pair[1], 16);
+	if (isNaN(hi) || isNaN(lo)) return false;
+	/** RFC 4380: Teredo stores the external IPv4 as a bitwise complement. */
+	const high = isTeredo ? ~hi : hi;
+	const low = isTeredo ? ~lo : lo;
+	return isPrivateIPv4Literal([
+		high >> 8 & 255,
+		high & 255,
+		low >> 8 & 255,
+		low & 255
+	].join("."));
+}
 function isPrivateIPv6Literal(value) {
 	if (!value.includes(":")) return false;
 	if (value === "::1" || value === "::") return true;
@@ -3184,7 +4078,7 @@ function isPrivateIPv6Literal(value) {
 	}
 	const mappedMatch = value.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
 	if (mappedMatch) return isPrivateIPv4Literal(mappedMatch[1]);
-	return false;
+	return hasPrivateEmbeddedIPv4Literal(value);
 }
 /**
 * Mirrors the allowedAddresses parser in `@librechat/api`'s auth helpers.
@@ -3401,6 +4295,7 @@ let AgentCapabilities = /* @__PURE__ */ function(AgentCapabilities) {
 	AgentCapabilities["end_after_tools"] = "end_after_tools";
 	AgentCapabilities["deferred_tools"] = "deferred_tools";
 	AgentCapabilities["execute_code"] = "execute_code";
+	AgentCapabilities["stateful_code_sessions"] = "stateful_code_sessions";
 	AgentCapabilities["file_search"] = "file_search";
 	AgentCapabilities["web_search"] = "web_search";
 	AgentCapabilities["artifacts"] = "artifacts";
@@ -3408,9 +4303,13 @@ let AgentCapabilities = /* @__PURE__ */ function(AgentCapabilities) {
 	AgentCapabilities["actions"] = "actions";
 	AgentCapabilities["context"] = "context";
 	AgentCapabilities["skills"] = "skills";
+	AgentCapabilities["memory"] = "memory";
+	AgentCapabilities["ask_user_question"] = "ask_user_question";
 	AgentCapabilities["tools"] = "tools";
 	AgentCapabilities["chain"] = "chain";
 	AgentCapabilities["ocr"] = "ocr";
+	AgentCapabilities["run_in_background"] = "run_in_background";
+	AgentCapabilities["tool_intents"] = "tool_intents";
 	return AgentCapabilities;
 }({});
 const defaultAssistantsVersion = {
@@ -3418,7 +4317,14 @@ const defaultAssistantsVersion = {
 	["azureAssistants"]: 1
 };
 const baseEndpointSchema = zod.z.object({
-	streamRate: zod.z.number().optional(),
+	/**
+	* Milliseconds between visible streamed chunks. Agents SDK-backed
+	* providers (openAI, custom, anthropic, google, bedrock, agents) smooth
+	* adaptively at 25ms by default; set to override the cadence, 0 to
+	* disable smoothing. Legacy Assistants and Ollama paths instead sleep
+	* this long per provider chunk (default 1ms), with no adaptive smoothing.
+	*/
+	streamRate: zod.z.number().min(0).optional(),
 	baseURL: zod.z.string().optional(),
 	/**
 	* Custom request headers forwarded to the provider on every request. Values
@@ -3446,6 +4352,53 @@ const baseEndpointSchema = zod.z.object({
 	* completes (legacy behavior).
 	*/
 	titleTiming: zod.z.union([zod.z.literal("immediate"), zod.z.literal("final")]).optional(),
+	/**
+	* Agent activity groups: collapse each contiguous block of reasoning and
+	* tool calls under a generated one-line header. Mirrors the title options
+	* above — `activityLabel` enables it (like `titleConvo`), the rest tune
+	* the fast model that writes the label.
+	*
+	* NOTE: fields added here reach `endpoints.all` automatically (that schema
+	* is `baseEndpointSchema.omit({ baseURL })`), but NOT Azure — see the
+	* enumerated `.pick()` in `azureEndpointSchema` below.
+	*/
+	activityLabel: zod.z.boolean().optional(),
+	/** Model used to write activity labels. Defaults to `titleModel`, then the agent's model. */
+	activityModel: zod.z.string().optional(),
+	/** Endpoint whose credentials the label model runs on. Defaults to the agent's endpoint. */
+	activityEndpoint: zod.z.string().optional(),
+	/** Overrides the system prompt used to write activity labels. */
+	activityPrompt: zod.z.string().optional(),
+	/** Cost cap: maximum labels generated per run. Default 20. */
+	activityMaxPerRun: zod.z.number().int().positive().optional(),
+	/** Per-entry truncation of tool input/output in the label prompt. Default 600. */
+	activityCharLimit: zod.z.number().int().positive().optional(),
+	/** Generates one parent summary for each run phase containing 2+ activities. */
+	activityPhaseLabel: zod.z.boolean().optional(),
+	/** Model used for phase summaries. Defaults to activityModel, titleModel, then the run model. */
+	activityPhaseModel: zod.z.string().optional(),
+	/** Endpoint whose credentials the phase summary model uses. Defaults to activityEndpoint. */
+	activityPhaseEndpoint: zod.z.string().optional(),
+	/** Overrides the dedicated phase-summary system prompt. */
+	activityPhasePrompt: zod.z.string().optional(),
+	/** Cost cap: maximum phase summaries generated per run. Default 5. */
+	activityPhaseMaxPerRun: zod.z.number().int().positive().optional(),
+	/** Generates a live orientation label for sufficiently long top-level response reasoning. */
+	reasoningLabel: zod.z.boolean().optional(),
+	/** Model used for reasoning labels. Defaults to activityModel, titleModel, then run model. */
+	reasoningLabelModel: zod.z.string().optional(),
+	/** Endpoint receiving the bounded visible-reasoning snapshot. Defaults to activityEndpoint. */
+	reasoningLabelEndpoint: zod.z.string().optional(),
+	/** Overrides the dedicated reasoning-label system prompt. */
+	reasoningLabelPrompt: zod.z.string().optional(),
+	/** Characters required before the first reasoning label. Default 500. */
+	reasoningLabelMinChars: zod.z.number().int().positive().optional(),
+	/** New characters required between streaming revisions. Default 400. */
+	reasoningLabelUpdateChars: zod.z.number().int().positive().optional(),
+	/** Minimum milliseconds between streaming revisions. Default 3000. */
+	reasoningLabelUpdateIntervalMs: zod.z.number().int().nonnegative().optional(),
+	/** Cost cap: maximum reasoning-label provider calls attempted per run. Default 8. */
+	reasoningLabelMaxPerRun: zod.z.number().int().positive().optional(),
 	/** Maximum characters allowed in a single tool result before truncation. */
 	maxToolResultChars: zod.z.number().positive().optional()
 });
@@ -3486,6 +4439,11 @@ const assistantEndpointSchema = baseEndpointSchema.merge(zod.z.object({
 		"tools"
 	]),
 	apiKey: zod.z.string().optional(),
+	/** Masked preview of the API key, stored at write time so admin
+	* reads can show which key is configured without returning the secret.
+	* Shared by both `endpoints.assistants` and `endpoints.azureAssistants`,
+	* which both use this schema. */
+	apiKeyPreview: zod.z.string().optional(),
 	models: zod.z.object({
 		default: zod.z.array(modelItemSchema).min(1),
 		fetch: zod.z.boolean().optional(),
@@ -3503,6 +4461,8 @@ const defaultAgentCapabilities = [
 	"actions",
 	"context",
 	"skills",
+	"memory",
+	"ask_user_question",
 	"tools",
 	"chain",
 	"ocr"
@@ -3548,23 +4508,304 @@ const remoteApiAuthSchema = zod.z.object({
 	oidc: remoteApiOidcSchema.optional()
 });
 const remoteApiSchema = zod.z.object({ auth: remoteApiAuthSchema.optional() });
+/**
+* Permission mode applied to a tool call. Mirrors `@librechat/agents`'s
+* `ToolPolicyMode` 1:1.
+*
+* - `default`: ask the user about anything not explicitly allowed (default-on).
+* - `dontAsk`: deny anything not explicitly allowed (headless / API-key flows).
+* - `bypass`: auto-approve everything that isn't explicitly denied
+*   (the user-facing "stop asking me" toggle).
+*
+* Subagents inherit the parent's mode; this is enforced by the SDK and not
+* overridable per-subagent.
+*/
+const toolApprovalModeSchema = zod.z.enum([
+	"default",
+	"dontAsk",
+	"bypass"
+]);
+/**
+* Per-endpoint tool-approval policy.
+*
+* Shape mirrors `@librechat/agents`'s `ToolPolicyConfig` so the host can map it
+* directly into `createToolPolicyHook(config)`. The SDK does the evaluation
+* (`deny → ask → allow → bypass → dontAsk → fallthrough(ask)`); this config
+* just describes the surface.
+*
+* Conventions:
+* - All list entries are matched as globs (`*`). Use `mcp:server:*` to scope
+*   a rule to every tool from a single MCP server.
+* - `deny` always wins, including under `bypass`.
+* - `enabled: false` is a LibreChat-only kill switch that disables the entire
+*   HITL machinery for this endpoint (no checkpointer, no hooks, no prompts).
+*   This is admin-level; users toggle prompting via `mode: 'bypass'` instead.
+*/
+/**
+* A programmatic tool-approval hook loaded from a module at startup.
+*
+* The referenced module's default export must be a builder
+* `(options?) => ToolApprovalHookFactory` (see `@librechat/api`'s `registerToolApprovalHook`).
+* Hooks compose with the static `allow`/`deny`/`ask` policy above and can only TIGHTEN it
+* (the SDK folds decisions `deny → ask → allow`). This is admin-level config — the module is
+* dynamically imported and executed in-process, so only reference trusted code.
+*/
+const toolApprovalHookConfigSchema = zod.z.object({
+	/**
+	* Module specifier to import: a bare package name (e.g. `@acme/approval-hooks`) or a path —
+	* absolute, or relative to the app root. Its default export is the hook builder.
+	*/
+	module: zod.z.string().min(1),
+	/** Optional regex matched against the tool name; omit to run for every tool. */
+	matcher: zod.z.string().optional(),
+	/** Static options forwarded to the module's builder; the hook's own per-call config. */
+	options: zod.z.record(zod.z.unknown()).optional()
+});
+const toolApprovalPolicySchema = zod.z.object({
+	enabled: zod.z.boolean().optional(),
+	mode: toolApprovalModeSchema.optional(),
+	allow: zod.z.array(zod.z.string()).optional(),
+	deny: zod.z.array(zod.z.string()).optional(),
+	ask: zod.z.array(zod.z.string()).optional(),
+	/** Optional reason template surfaced in the prompt; `{tool}` is interpolated. */
+	reason: zod.z.string().optional(),
+	/**
+	* Programmatic policy hooks loaded from modules at startup. They layer on top of the
+	* static lists above for dynamic, context-aware decisions the lists can't express
+	* (per-args, per-agent, per-user). See {@link toolApprovalHookConfigSchema}.
+	*
+	* BASE-CONFIG ONLY: hooks are imported + registered once, process-wide, at server
+	* startup — they are NOT reloaded from per-role/user/tenant admin overrides. Encode
+	* per-user/tenant behavior INSIDE the hook (via its runtime context), not by varying the
+	* module list per override. Honored only when `enabled` is true.
+	*/
+	hooks: zod.z.array(toolApprovalHookConfigSchema).optional()
+}).optional();
+/**
+* Durable checkpointer backing human-in-the-loop resume.
+*
+* When `toolApproval.enabled` is true, a run that pauses for review suspends its
+* LangGraph state to a checkpoint; resuming rebuilds that state on a *fresh* `Run`
+* — possibly on a different replica, or the same worker after a restart. That only
+* works if the checkpoint outlives the original request, so HITL needs a durable
+* saver, not the SDK's process-local `MemorySaver` fallback.
+*
+* Defaults are zero-config: with `toolApproval.enabled` on and no `checkpointer`
+* block, LibreChat persists checkpoints to its primary MongoDB, so resume works
+* across replicas out of the box.
+*
+* - `type: 'mongo'` (default) — persist to the app database; survives restarts and
+*   resolves on any replica. A TTL index reclaims runs that are never resolved.
+* - `type: 'memory'` — process-local only. Paused runs do NOT survive a restart and
+*   can only be resolved on the originating worker. Single-process / dev only.
+*/
+const checkpointerTypeSchema = zod.z.enum(["mongo", "memory"]);
+const checkpointerSchema = zod.z.object({
+	type: checkpointerTypeSchema.optional(),
+	/**
+	* Approval window, in seconds: how long a paused run waits for a decision
+	* before it is reclaimed. Drives both the Mongo TTL index on checkpoints and
+	* the pending-action expiry, keeping the two layers in lockstep. Defaults to
+	* 86400 (24h). Raise it for longer review windows.
+	*/
+	ttl: zod.z.number().int().positive().optional(),
+	/** Advanced: override the Mongo collection names used for checkpoints. */
+	checkpointCollectionName: zod.z.string().optional(),
+	checkpointWritesCollectionName: zod.z.string().optional()
+}).optional();
+const codeEnvironmentBaseURLSchema = zod.z.string().trim().url().refine((value) => {
+	try {
+		const url = new URL(value);
+		return (url.protocol === "http:" || url.protocol === "https:") && !value.includes("?") && !value.includes("#") && url.search.length === 0 && url.hash.length === 0;
+	} catch {
+		return false;
+	}
+}, { message: "Code environment baseURL must be an HTTP(S) base URL without query or fragment" });
+function isSecureCodeEnvironmentControlURL(baseURL) {
+	try {
+		const url = new URL(baseURL.trim());
+		if (url.protocol === "https:") return true;
+		if (url.protocol !== "http:") return false;
+		return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+	} catch {
+		return false;
+	}
+}
+const codeEnvironmentPermissionDecisionSchema = zod.z.enum([
+	"allow",
+	"ask",
+	"deny"
+]);
+const codeEnvironmentPermissionFieldSchema = zod.z.object({
+	allowed: zod.z.array(codeEnvironmentPermissionDecisionSchema).min(1),
+	default: codeEnvironmentPermissionDecisionSchema.optional().default("ask")
+}).strict().superRefine((field, context) => {
+	if (!field.allowed.includes(field.default)) context.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		path: ["default"],
+		message: "Permission default must be included in allowed values"
+	});
+});
+/**
+* Typed user-tunable surface for one attached code environment. Omitted fields
+* remain fixed at LibreChat's safe baseline. Isolation, networking, mounts,
+* privileged execution, and secrets are deliberately not representable here.
+*/
+const codeEnvironmentUserConfigSchema = zod.z.object({ permissions: zod.z.object({
+	fileWrite: codeEnvironmentPermissionFieldSchema.optional(),
+	commandExecution: codeEnvironmentPermissionFieldSchema.optional()
+}).strict().optional() }).strict();
+const codeEnvironmentUserSettingsSchema = zod.z.object({ permissions: zod.z.object({
+	fileWrite: codeEnvironmentPermissionDecisionSchema.optional(),
+	commandExecution: codeEnvironmentPermissionDecisionSchema.optional()
+}).strict().optional() }).strict();
 const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(zod.z.object({
 	recursionLimit: zod.z.number().optional(),
 	disableBuilder: zod.z.boolean().optional().default(false),
 	maxRecursionLimit: zod.z.number().optional(),
+	/** Max cumulative bytes a single streamed tool call's arguments may reach before the run
+	* aborts. Defaults to 64 KiB in the agents SDK; `0` disables the guard. */
+	maxToolCallArgBytes: zod.z.number().optional(),
+	/** Max streamed chunk events per model generation before the run aborts. Off by default. */
+	maxDeltaEventsPerTurn: zod.z.number().optional(),
+	/** Per-tool overrides of `maxToolCallArgBytes`, keyed by model-facing tool name; `0`
+	* disables the guard for that tool only. Merged over LibreChat's shipped default of
+	* `{ create_file: 131072 }`. */
+	maxToolCallArgBytesByTool: zod.z.record(zod.z.number()).optional(),
 	maxCitations: zod.z.number().min(1).max(50).optional().default(30),
 	maxCitationsPerFile: zod.z.number().min(1).max(10).optional().default(7),
 	minRelevanceScore: zod.z.number().min(0).max(1).optional().default(.45),
+	/** Maximum explicit subagents per agent (`agent_ids` and `graphs`); raised from
+	* the shipped default of 10 for orchestration-heavy deployments, bounded by
+	* `MAX_SUBAGENTS_CEILING`. */
+	maxSubagents: zod.z.number().int().min(1).max(50).optional().default(10),
 	allowedProviders: zod.z.array(zod.z.union([zod.z.string(), eModelEndpointSchema])).optional(),
 	capabilities: zod.z.array(zod.z.nativeEnum(AgentCapabilities)).optional().default(defaultAgentCapabilities),
+	/** Controls which workspace-sharing scopes users may select for stateful code sessions.
+	*  Omit this block to preserve the legacy behavior of allowing every scope. */
+	statefulCodeSessions: zod.z.object({
+		allowedEnvironments: zod.z.array(zod.z.enum(STATEFUL_CODE_ENVIRONMENTS)).min(1),
+		/** Operator-managed execution environments. Attached entries route to a
+		* Code API deployment backed by an outbound librechat-code worker. */
+		environments: zod.z.array(zod.z.object({
+			id: zod.z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/),
+			name: zod.z.string().min(1).max(100),
+			type: zod.z.enum(["managed", "attached"]),
+			baseURL: codeEnvironmentBaseURLSchema,
+			default: zod.z.boolean().optional(),
+			/** Server-only outbound worker route. Removed from public config. */
+			workerId: zod.z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/).optional(),
+			/** Distinguishes operator policy from a principal-authorized
+			* environment merged into request-scoped server config. */
+			owner: zod.z.enum(["deployment", "principal"]).optional().default("deployment"),
+			/** Administrator-controlled user-tunable settings. Only fields
+			* represented here may be changed by a principal. */
+			configSchema: codeEnvironmentUserConfigSchema.optional(),
+			/** Request-scoped effective settings for a principal-owned environment.
+			* Deployment config should define defaults through configSchema instead. */
+			settings: codeEnvironmentUserSettingsSchema.optional(),
+			/** Server-only enrollment metadata. `tokenEnv` names an
+			* environment variable and never contains the token itself. */
+			pairing: zod.z.object({
+				workerId: zod.z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/).optional(),
+				allowPrincipalWorkers: zod.z.boolean().optional().default(false),
+				tokenEnv: zod.z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/)
+			}).superRefine((pairing, pairingContext) => {
+				if (pairing.workerId != null || pairing.allowPrincipalWorkers === true) return;
+				pairingContext.addIssue({
+					code: zod.z.ZodIssueCode.custom,
+					message: "Pairing requires a workerId or principal workers"
+				});
+			}).optional()
+		})).optional()
+	}).superRefine((value, context) => {
+		if (!value?.environments) return;
+		const ids = /* @__PURE__ */ new Set();
+		let defaults = 0;
+		let executableEnvironments = 0;
+		for (const environment of value.environments) {
+			const pairingOnly = environment.pairing?.allowPrincipalWorkers === true && environment.pairing.workerId == null && environment.workerId == null;
+			if (environment.pairing != null && environment.type !== "attached") context.addIssue({
+				code: zod.z.ZodIssueCode.custom,
+				message: "Only attached code environments may configure pairing",
+				path: [
+					"environments",
+					environment.id,
+					"pairing"
+				]
+			});
+			if (environment.pairing != null && environment.owner !== "deployment") context.addIssue({
+				code: zod.z.ZodIssueCode.custom,
+				message: "Only deployment-owned code environments may configure pairing",
+				path: [
+					"environments",
+					environment.id,
+					"pairing"
+				]
+			});
+			if (environment.pairing != null && !isSecureCodeEnvironmentControlURL(environment.baseURL)) context.addIssue({
+				code: zod.z.ZodIssueCode.custom,
+				message: "Paired code environments require HTTPS outside loopback development",
+				path: [
+					"environments",
+					environment.id,
+					"baseURL"
+				]
+			});
+			if (environment.workerId != null && environment.pairing?.workerId != null && environment.workerId !== environment.pairing.workerId) context.addIssue({
+				code: zod.z.ZodIssueCode.custom,
+				message: "Code environment workerId must match pairing.workerId",
+				path: [
+					"environments",
+					environment.id,
+					"workerId"
+				]
+			});
+			if (pairingOnly && environment.default === true) context.addIssue({
+				code: zod.z.ZodIssueCode.custom,
+				message: "Pairing-only code control planes cannot be execution defaults",
+				path: [
+					"environments",
+					environment.id,
+					"default"
+				]
+			});
+			if (ids.has(environment.id)) context.addIssue({
+				code: zod.z.ZodIssueCode.custom,
+				message: `Duplicate code environment id: ${environment.id}`,
+				path: ["environments"]
+			});
+			ids.add(environment.id);
+			if (!pairingOnly) {
+				executableEnvironments += 1;
+				if (environment.default === true) defaults += 1;
+			}
+		}
+		if (executableEnvironments > 0 && defaults !== 1) context.addIssue({
+			code: zod.z.ZodIssueCode.custom,
+			message: "Exactly one stateful code environment must be the default",
+			path: ["environments"]
+		});
+	}).optional(),
+	/** Optional trusted origin for in-process agent event delivery. */
+	eventDriven: zod.z.object({ selfUrl: zod.z.string().url().optional() }).optional(),
+	/** Conversational background-task delivery policy. Automatic completion wakeups are
+	* enabled unless an administrator explicitly restores poll-only behavior. */
+	backgroundTasks: zod.z.object({ completionWakeups: zod.z.boolean().optional().default(true) }).optional(),
 	skills: zod.z.object({ maxCatalogSkills: zod.z.number().int().min(1).max(100).optional() }).optional(),
-	remoteApi: remoteApiSchema.optional()
+	remoteApi: remoteApiSchema.optional(),
+	/** Human-in-the-loop tool approval policy. Off by default. */
+	toolApproval: toolApprovalPolicySchema,
+	/** Durable checkpointer backing tool-approval and Ask User resume.
+	*  Defaults to the app's MongoDB when either flow needs it. */
+	checkpointer: checkpointerSchema
 })).default({
 	disableBuilder: false,
 	capabilities: defaultAgentCapabilities,
 	maxCitations: 30,
 	maxCitationsPerFile: 7,
-	minRelevanceScore: .45
+	minRelevanceScore: .45,
+	maxSubagents: 10
 });
 const paramDefinitionSchema = zod.z.object({
 	key: zod.z.string(),
@@ -3582,7 +4823,11 @@ const paramDefinitionSchema = zod.z.object({
 	range: zod.z.object({
 		min: zod.z.number(),
 		max: zod.z.number(),
-		step: zod.z.number().optional()
+		step: zod.z.number().optional(),
+		positiveMin: zod.z.number().optional()
+	}).refine((value) => value.positiveMin == null || value.positiveMin <= value.max, {
+		message: "range.positiveMin cannot exceed range.max",
+		path: ["positiveMin"]
 	}).optional(),
 	enumMappings: zod.z.record(zod.z.union([
 		zod.z.number(),
@@ -3617,6 +4862,9 @@ const paramDefinitionSchema = zod.z.object({
 const endpointSchema = baseEndpointSchema.merge(zod.z.object({
 	name: zod.z.string().refine((value) => !eModelEndpointSchema.safeParse(value).success, { message: `Value cannot be one of the default endpoint (EModelEndpoint) values: ${Object.values(EModelEndpoint).join(", ")}` }),
 	apiKey: zod.z.string(),
+	/** Masked preview of the API key, stored at write time so admin
+	* reads can show which key is configured without returning the secret. */
+	apiKeyPreview: zod.z.string().optional(),
 	baseURL: zod.z.string(),
 	models: zod.z.object({
 		default: zod.z.array(modelItemSchema).min(1),
@@ -3664,15 +4912,43 @@ const endpointSchema = baseEndpointSchema.merge(zod.z.object({
 const azureEndpointSchema = zod.z.object({
 	groups: azureGroupConfigsSchema,
 	assistants: zod.z.boolean().optional()
-}).and(endpointSchema.pick({
-	streamRate: true,
-	titleConvo: true,
-	titleMethod: true,
-	titleModel: true,
-	titlePrompt: true,
-	titleTiming: true,
-	titlePromptTemplate: true
-}).partial());
+}).and(
+	/**
+	* Azure carries only the base-endpoint fields enumerated here. This is a
+	* `.pick()`, NOT an omit, so a field added to `baseEndpointSchema` is
+	* silently unavailable on Azure endpoints until it is listed below —
+	* unlike `endpoints.all`, which omits and therefore inherits new fields
+	* automatically. Keep this list in sync when adding endpoint options.
+	*/
+	endpointSchema.pick({
+		streamRate: true,
+		titleConvo: true,
+		titleMethod: true,
+		titleModel: true,
+		titlePrompt: true,
+		titleTiming: true,
+		titlePromptTemplate: true,
+		activityLabel: true,
+		activityModel: true,
+		activityEndpoint: true,
+		activityPrompt: true,
+		activityMaxPerRun: true,
+		activityCharLimit: true,
+		activityPhaseLabel: true,
+		activityPhaseModel: true,
+		activityPhaseEndpoint: true,
+		activityPhasePrompt: true,
+		activityPhaseMaxPerRun: true,
+		reasoningLabel: true,
+		reasoningLabelModel: true,
+		reasoningLabelEndpoint: true,
+		reasoningLabelPrompt: true,
+		reasoningLabelMinChars: true,
+		reasoningLabelUpdateChars: true,
+		reasoningLabelUpdateIntervalMs: true,
+		reasoningLabelMaxPerRun: true
+	}).partial()
+);
 /**
 * Vertex AI model configuration - similar to Azure model config
 * Allows specifying deployment name for each model
@@ -3708,15 +4984,20 @@ const anthropicEndpointSchema = baseEndpointSchema.merge(zod.z.object({
 	/** Optional: List of available models */
 	models: zod.z.array(zod.z.string()).optional()
 }));
+/** Masked preview of the API key, stored at write time so admin
+* reads can show which key is configured without returning the secret. */
+const apiKeyPreviewSchema = zod.z.string().optional();
 const ttsOpenaiSchema = zod.z.object({
 	url: zod.z.string().optional(),
 	apiKey: zod.z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: zod.z.string(),
 	voices: zod.z.array(zod.z.string())
 });
 const ttsAzureOpenAISchema = zod.z.object({
 	instanceName: zod.z.string(),
 	apiKey: zod.z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	deploymentName: zod.z.string(),
 	apiVersion: zod.z.string(),
 	model: zod.z.string(),
@@ -3726,6 +5007,7 @@ const ttsElevenLabsSchema = zod.z.object({
 	url: zod.z.string().optional(),
 	websocketUrl: zod.z.string().optional(),
 	apiKey: zod.z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: zod.z.string(),
 	voices: zod.z.array(zod.z.string()),
 	voice_settings: zod.z.object({
@@ -3739,10 +5021,12 @@ const ttsElevenLabsSchema = zod.z.object({
 const ttsLocalaiSchema = zod.z.object({
 	url: zod.z.string(),
 	apiKey: zod.z.string().optional(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	voices: zod.z.array(zod.z.string()),
 	backend: zod.z.string()
 });
 const ttsSchema = zod.z.object({
+	allowedAddresses: allowedAddressesSchema,
 	openai: ttsOpenaiSchema.optional(),
 	azureOpenAI: ttsAzureOpenAISchema.optional(),
 	elevenlabs: ttsElevenLabsSchema.optional(),
@@ -3751,15 +5035,18 @@ const ttsSchema = zod.z.object({
 const sttOpenaiSchema = zod.z.object({
 	url: zod.z.string().optional(),
 	apiKey: zod.z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	model: zod.z.string()
 });
 const sttAzureOpenAISchema = zod.z.object({
 	instanceName: zod.z.string(),
 	apiKey: zod.z.string(),
+	apiKeyPreview: apiKeyPreviewSchema,
 	deploymentName: zod.z.string(),
 	apiVersion: zod.z.string()
 });
 const sttSchema = zod.z.object({
+	allowedAddresses: allowedAddressesSchema,
 	openai: sttOpenaiSchema.optional(),
 	azureOpenAI: sttAzureOpenAISchema.optional()
 });
@@ -3767,16 +5054,23 @@ const speechTab = zod.z.object({
 	conversationMode: zod.z.boolean().optional(),
 	advancedMode: zod.z.boolean().optional(),
 	speechToText: zod.z.boolean().optional().or(zod.z.object({
-		/** Keep in sync with STTProviders enum (defined below — cannot reference due to eval order) */
-		engineSTT: zod.z.enum(["openai", "azureOpenAI"]).optional(),
+		/** Provider names remain valid for backward compatibility and are normalized for clients. */
+		engineSTT: zod.z.enum([
+			"browser",
+			"external",
+			"openai",
+			"azureOpenAI"
+		]).optional(),
 		languageSTT: zod.z.string().optional(),
 		autoTranscribeAudio: zod.z.boolean().optional(),
 		decibelValue: zod.z.number().optional(),
 		autoSendText: zod.z.number().optional()
 	})).optional(),
 	textToSpeech: zod.z.boolean().optional().or(zod.z.object({
-		/** Keep in sync with TTSProviders enum (defined below — cannot reference due to eval order) */
+		/** Provider names remain valid for backward compatibility and are normalized for clients. */
 		engineTTS: zod.z.enum([
+			"browser",
+			"external",
 			"openai",
 			"azureOpenAI",
 			"elevenlabs",
@@ -3797,6 +5091,10 @@ let RateLimitPrefix = /* @__PURE__ */ function(RateLimitPrefix) {
 	return RateLimitPrefix;
 }({});
 const rateLimitSchema = zod.z.object({
+	agentEvents: zod.z.object({
+		userMax: zod.z.number().int().positive().optional(),
+		userWindowInMinutes: zod.z.number().positive().optional()
+	}).optional(),
 	fileUploads: zod.z.object({
 		ipMax: zod.z.number().optional(),
 		ipWindowInMinutes: zod.z.number().optional(),
@@ -3888,6 +5186,7 @@ const interfaceSchema = zod.z.object({
 	webSearch: zod.z.boolean().optional(),
 	contextUsage: zod.z.boolean().optional(),
 	contextCost: zod.z.boolean().optional(),
+	feedback: zod.z.boolean().optional(),
 	currency: zod.z.object({
 		code: zod.z.string(),
 		rate: zod.z.number().positive()
@@ -3921,6 +5220,23 @@ const interfaceSchema = zod.z.object({
 		share: zod.z.boolean().optional(),
 		public: zod.z.boolean().optional(),
 		snapshotFiles: zod.z.boolean().optional()
+	})]).optional(),
+	schedules: zod.z.union([zod.z.boolean(), zod.z.object({
+		use: zod.z.boolean().optional(),
+		create: zod.z.boolean().optional(),
+		maxPerUser: zod.z.number().int().min(0).optional(),
+		minIntervalMinutes: zod.z.number().int().min(1).optional(),
+		autoDisableAfterFailures: zod.z.number().int().min(1).optional(),
+		fireConcurrency: zod.z.number().int().min(1).optional(),
+		/** Refuse schedules that are not filed under a chat project. Enforced on
+		*  create/update AND at every fire, so raising it later stops schedules
+		*  that predate the policy instead of grandfathering them. */
+		requireProject: zod.z.boolean().optional(),
+		/** Pins every scheduled run to ONE chat project, ignoring any client
+		*  choice. Implies `requireProject`. The project must belong to the
+		*  schedule's owner, so a deployment-wide value only makes sense with a
+		*  per-user/per-role config override. */
+		projectId: zod.z.string().trim().min(1).optional()
 	})]).optional()
 }).default({
 	modelSelect: true,
@@ -3947,6 +5263,7 @@ const interfaceSchema = zod.z.object({
 	webSearch: true,
 	contextUsage: true,
 	contextCost: false,
+	feedback: true,
 	peoplePicker: {
 		users: true,
 		groups: true,
@@ -4016,12 +5333,14 @@ let SearchProviders = /* @__PURE__ */ function(SearchProviders) {
 	SearchProviders["SERPER"] = "serper";
 	SearchProviders["SEARXNG"] = "searxng";
 	SearchProviders["TAVILY"] = "tavily";
+	SearchProviders["KEENABLE"] = "keenable";
 	return SearchProviders;
 }({});
 let ScraperProviders = /* @__PURE__ */ function(ScraperProviders) {
 	ScraperProviders["FIRECRAWL"] = "firecrawl";
 	ScraperProviders["SERPER"] = "serper";
 	ScraperProviders["TAVILY"] = "tavily";
+	ScraperProviders["KEENABLE"] = "keenable";
 	return ScraperProviders;
 }({});
 let RerankerTypes = /* @__PURE__ */ function(RerankerTypes) {
@@ -4036,19 +5355,39 @@ let SafeSearchTypes = /* @__PURE__ */ function(SafeSearchTypes) {
 	SafeSearchTypes[SafeSearchTypes["STRICT"] = 2] = "STRICT";
 	return SafeSearchTypes;
 }({});
+/**
+* Normalizes a SearXNG engine list into the comma-separated form the API expects.
+* Accepts the YAML list or comma-separated string an operator may write, and is
+* applied both at the schema boundary and when loading the runtime config, since
+* `loadCustomConfig` returns the raw YAML object rather than the parsed result.
+*/
+function normalizeSearxngEngines(engines) {
+	if (engines == null) return;
+	const normalized = (Array.isArray(engines) ? engines : engines.split(",")).map((engine) => engine.trim()).filter(Boolean);
+	return normalized.length ? normalized.join(",") : void 0;
+}
 const webSearchSchema = zod.z.object({
+	allowedAddresses: allowedAddressesSchema,
 	serperApiKey: zod.z.string().optional().default("${SERPER_API_KEY}"),
+	serperApiKeyPreview: apiKeyPreviewSchema,
 	searxngInstanceUrl: zod.z.string().optional().default("${SEARXNG_INSTANCE_URL}"),
 	searxngApiKey: zod.z.string().optional().default("${SEARXNG_API_KEY}"),
+	searxngApiKeyPreview: apiKeyPreviewSchema,
 	firecrawlApiKey: zod.z.string().optional().default("${FIRECRAWL_API_KEY}"),
+	firecrawlApiKeyPreview: apiKeyPreviewSchema,
 	firecrawlApiUrl: zod.z.string().optional().default("${FIRECRAWL_API_URL}"),
 	firecrawlVersion: zod.z.string().optional().default("${FIRECRAWL_VERSION}"),
 	tavilyApiKey: zod.z.string().optional().default("${TAVILY_API_KEY}"),
+	tavilyApiKeyPreview: apiKeyPreviewSchema,
 	tavilySearchUrl: zod.z.string().optional().default("${TAVILY_SEARCH_URL}"),
 	tavilyExtractUrl: zod.z.string().optional().default("${TAVILY_EXTRACT_URL}"),
+	keenableApiKey: zod.z.string().optional().default("${KEENABLE_API_KEY}"),
+	keenableApiUrl: zod.z.string().optional().default("${KEENABLE_API_URL}"),
 	jinaApiKey: zod.z.string().optional().default("${JINA_API_KEY}"),
+	jinaApiKeyPreview: apiKeyPreviewSchema,
 	jinaApiUrl: zod.z.string().optional().default("${JINA_API_URL}"),
 	cohereApiKey: zod.z.string().optional().default("${COHERE_API_KEY}"),
+	cohereApiKeyPreview: apiKeyPreviewSchema,
 	searchProvider: zod.z.nativeEnum(SearchProviders).optional(),
 	scraperProvider: zod.z.nativeEnum(ScraperProviders).optional(),
 	rerankerType: zod.z.nativeEnum(RerankerTypes).optional(),
@@ -4081,6 +5420,16 @@ const webSearchSchema = zod.z.object({
 			tag: zod.z.string().nullable().optional()
 		}).optional()
 	}).optional(),
+	searxngSearchOptions: zod.z.object({
+		engines: zod.z.union([zod.z.string(), zod.z.array(zod.z.string())]).transform(normalizeSearxngEngines).optional(),
+		language: zod.z.string().optional(),
+		timeRange: zod.z.enum([
+			"day",
+			"month",
+			"year"
+		]).optional(),
+		timeout: zod.z.number().int().positive().max(12e4).optional()
+	}).optional(),
 	tavilySearchOptions: zod.z.object({
 		searchDepth: zod.z.enum([
 			"basic",
@@ -4121,11 +5470,23 @@ const webSearchSchema = zod.z.object({
 		includeFavicon: zod.z.boolean().optional(),
 		format: zod.z.enum(["markdown", "text"]).optional(),
 		timeout: zod.z.number().int().nonnegative().max(12e4).optional()
+	}).optional(),
+	keenableSearchOptions: zod.z.object({
+		maxResults: zod.z.number().int().min(1).max(20).optional(),
+		site: zod.z.string().optional(),
+		attributionTitle: zod.z.string().optional(),
+		timeout: zod.z.number().int().nonnegative().max(12e4).optional()
+	}).optional(),
+	keenableScraperOptions: zod.z.object({
+		attributionTitle: zod.z.string().optional(),
+		timeout: zod.z.number().int().nonnegative().max(12e4).optional()
 	}).optional()
 });
 const ocrSchema = zod.z.object({
+	allowedAddresses: allowedAddressesSchema,
 	mistralModel: zod.z.string().optional(),
 	apiKey: zod.z.string().optional().default("${OCR_API_KEY}"),
+	apiKeyPreview: apiKeyPreviewSchema,
 	baseURL: zod.z.string().optional().default("${OCR_BASEURL}"),
 	strategy: zod.z.nativeEnum(OCRStrategy).default("mistral_ocr")
 });
@@ -4183,6 +5544,10 @@ const contextPruningSchema = zod.z.object({
 	hardClearRatio: zod.z.number().min(0).max(1).optional(),
 	minPrunableToolChars: zod.z.number().min(0).optional()
 });
+const retainRecentConfigSchema = zod.z.object({
+	turns: zod.z.number().min(0).max(20).optional(),
+	tokens: zod.z.number().positive().optional()
+});
 const summarizationConfigSchema = zod.z.object({
 	enabled: zod.z.boolean().optional(),
 	provider: zod.z.string().optional(),
@@ -4198,32 +5563,103 @@ const summarizationConfigSchema = zod.z.object({
 	updatePrompt: zod.z.string().optional(),
 	reserveRatio: zod.z.number().min(0).max(1).optional(),
 	maxSummaryTokens: zod.z.number().positive().optional(),
-	contextPruning: contextPruningSchema.optional()
+	contextPruning: contextPruningSchema.optional(),
+	retainRecent: retainRecentConfigSchema.optional()
 });
 const customEndpointsSchema = zod.z.array(endpointSchema.partial()).optional();
+let messageFilterRegexValidator = (value) => {
+	try {
+		new RegExp(value, "g");
+		return true;
+	} catch {
+		return false;
+	}
+};
+const setMessageFilterRegexValidator = (validate) => {
+	messageFilterRegexValidator = validate;
+};
 const messageFilterPiiCustomPatternSchema = zod.z.object({
-	id: zod.z.string().min(1),
-	label: zod.z.string().min(1),
-	regex: zod.z.string().min(1).refine((value) => {
-		try {
-			new RegExp(value, "g");
-			return true;
-		} catch {
-			return false;
-		}
-	}, { message: "Invalid regex" })
+	id: zod.z.string().min(1).max(256),
+	label: zod.z.string().min(1).max(512),
+	regex: zod.z.string().min(1).max(512)
 });
 const messageFilterPiiSchema = zod.z.object({
-	starterPatterns: zod.z.array(zod.z.string()).optional(),
-	customPatterns: zod.z.array(messageFilterPiiCustomPatternSchema).optional()
-});
-const messageFilterSchema = zod.z.object({ pii: messageFilterPiiSchema.optional() });
-const configSchema = zod.z.object({
-	version: zod.z.string(),
-	cache: zod.z.boolean().default(true),
-	ocr: ocrSchema.optional(),
-	webSearch: webSearchSchema.optional(),
-	memory: memorySchema.optional(),
+	starterPatterns: zod.z.array(zod.z.string().max(256)).max(256).optional(),
+	customPatterns: zod.z.array(messageFilterPiiCustomPatternSchema).max(256).optional()
+}).superRefine((pii, context) => {
+	let regexCharacters = 0;
+	let regexInstructions = 0;
+	for (let index = 0; index < (pii.customPatterns?.length ?? 0); index++) {
+		const pattern = pii.customPatterns?.[index];
+		if (pattern == null) continue;
+		regexCharacters += pattern.regex.length;
+		const result = messageFilterRegexValidator(pattern.regex);
+		if (!(typeof result === "boolean" ? result : result.supported)) {
+			context.addIssue({
+				code: zod.z.ZodIssueCode.custom,
+				path: [
+					"customPatterns",
+					index,
+					"regex"
+				],
+				message: "Unsupported regex: not compatible with the RE2 engine (no backreferences, lookaround, or control escapes)"
+			});
+			continue;
+		}
+		if (typeof result !== "boolean" && result.programSize != null) regexInstructions += result.programSize;
+	}
+	if (regexCharacters > 8192) context.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		path: ["customPatterns"],
+		message: `Custom PII regexes may contain at most ${MAX_PII_CUSTOM_REGEX_CHARACTERS} characters in total`
+	});
+	if (regexInstructions > 8192) context.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		path: ["customPatterns"],
+		message: `Custom PII regexes may compile to at most ${MAX_PII_CUSTOM_REGEX_INSTRUCTIONS} instructions in total`
+	});
+});
+const messageFilterSchema = zod.z.object({ pii: messageFilterPiiSchema.optional() });
+const langfuseConfigSchema = zod.z.object({
+	enabled: zod.z.boolean().optional(),
+	publicKey: zod.z.string().optional(),
+	secretKey: zod.z.string().optional(),
+	/** Stable Langfuse project identity returned when credentials are verified. */
+	projectId: zod.z.string().optional(),
+	/** Masked preview of the secret key, stored at write time so
+	* admin reads can show which secret key is configured without returning the secret. */
+	secretKeyPreview: zod.z.string().optional(),
+	/** Routing key for one of the deployment-configured tenant Langfuse destinations. */
+	destination: zod.z.string().optional(),
+	/**
+	* Custom request headers sent on every outbound Langfuse request — trace and
+	* media export, feedback scores, and credential verification — for
+	* self-hosted instances behind an authenticating proxy or gateway. Values
+	* support `${ENV_VAR}` interpolation.
+	*
+	* Deployment-level only. Trace export batches spans from every user through
+	* one exporter, so unlike endpoint headers these cannot carry per-user
+	* placeholders. Headers referencing an unset variable, naming an
+	* infrastructure secret, or carrying an invalid HTTP field name are dropped
+	* with a warning rather than sent.
+	*
+	* Sent only when the deployment configures exactly one Langfuse origin, and
+	* only to that origin. The map cannot say which endpoint it authenticates
+	* to, so with several configured origins any choice of recipient would risk
+	* disclosing a gateway credential to the others; a warning is logged instead.
+	* Multi-destination deployments need per-destination headers, which this
+	* schema does not yet express — and note the fanout collector forwards only
+	* `Authorization` upstream regardless.
+	*/
+	headers: zod.z.record(zod.z.string()).optional()
+});
+const configSchema = zod.z.object({
+	version: zod.z.string(),
+	cache: zod.z.boolean().default(true),
+	ocr: ocrSchema.optional(),
+	webSearch: webSearchSchema.optional(),
+	langfuse: langfuseConfigSchema.optional(),
+	memory: memorySchema.optional(),
 	summarization: summarizationConfigSchema.optional(),
 	skillSync: skillSyncConfigSchema,
 	secureImageLinks: zod.z.boolean().optional(),
@@ -4258,9 +5694,17 @@ const configSchema = zod.z.object({
 	rateLimits: rateLimitSchema.optional(),
 	fileConfig: fileConfigSchema.optional(),
 	modelSpecs: specsConfigSchema.optional(),
+	filters: filtersConfigSchema.optional(),
 	messageFilter: messageFilterSchema.optional(),
 	endpoints: zod.z.object({
 		allowedAddresses: allowedAddressesSchema,
+		/**
+		* Defaults applied to every endpoint. Omit-based, so options added to
+		* `baseEndpointSchema` are inherited here automatically — no list to
+		* maintain (contrast `azureEndpointSchema`, which enumerates via
+		* `.pick()`). Resolution order at read sites is `all` > the named
+		* endpoint > a custom endpoint's own config.
+		*/
 		all: baseEndpointSchema.omit({ baseURL: true }).optional(),
 		["openAI"]: baseEndpointSchema.optional(),
 		["google"]: baseEndpointSchema.optional(),
@@ -4330,6 +5774,9 @@ const alternateName = {
 	["helicone"]: "Helicone"
 };
 const sharedOpenAIModels = [
+	"gpt-5.6",
+	"gpt-5.6-terra",
+	"gpt-5.6-luna",
 	"gpt-5.5",
 	"gpt-5.5-pro",
 	"chat-latest",
@@ -4353,9 +5800,12 @@ const sharedOpenAIModels = [
 	"gpt-4o"
 ];
 const sharedAnthropicModels = [
+	"claude-fable-5-1",
 	"claude-fable-5",
+	"claude-opus-5",
 	"claude-opus-4-8",
 	"claude-opus-4-7",
+	"claude-sonnet-5",
 	"claude-sonnet-4-6",
 	"claude-opus-4-6",
 	"claude-sonnet-4-5",
@@ -4376,18 +5826,26 @@ const sharedAnthropicModels = [
 	"claude-3-5-sonnet-20240620",
 	"claude-3-5-sonnet-latest"
 ];
+/**
+* Claude 4+ models are not invocable on-demand by their bare foundation-model
+* ID on the Converse path — Bedrock rejects those with "Invocation of model ID
+* ... with on-demand throughput isn't supported. Retry your request with the ID
+* or ARN of an inference profile that contains this model." Default to the
+* `global.` cross-region profile (no regional pricing premium, widest
+* availability); Opus 4.1 has no global profile, so it uses `us.`.
+*/
 const bedrockModels = [
-	"anthropic.claude-fable-5",
-	"anthropic.claude-opus-4-8",
-	"anthropic.claude-opus-4-7",
-	"anthropic.claude-sonnet-4-6",
-	"anthropic.claude-opus-4-6-v1",
-	"anthropic.claude-sonnet-4-5-20250929-v1:0",
-	"anthropic.claude-haiku-4-5-20251001-v1:0",
-	"anthropic.claude-opus-4-1-20250805-v1:0",
-	"anthropic.claude-3-5-sonnet-20241022-v2:0",
-	"anthropic.claude-3-5-sonnet-20240620-v1:0",
-	"anthropic.claude-3-5-haiku-20241022-v1:0",
+	"global.anthropic.claude-fable-5-1",
+	"global.anthropic.claude-fable-5",
+	"global.anthropic.claude-opus-5",
+	"global.anthropic.claude-opus-4-8",
+	"global.anthropic.claude-opus-4-7",
+	"global.anthropic.claude-sonnet-5",
+	"global.anthropic.claude-sonnet-4-6",
+	"global.anthropic.claude-opus-4-6-v1",
+	"global.anthropic.claude-sonnet-4-5-20250929-v1:0",
+	"global.anthropic.claude-haiku-4-5-20251001-v1:0",
+	"us.anthropic.claude-opus-4-1-20250805-v1:0",
 	"cohere.command-r-v1:0",
 	"cohere.command-r-plus-v1:0",
 	"meta.llama2-13b-chat-v1",
@@ -4412,7 +5870,11 @@ const defaultModels = {
 	["assistants"]: [...sharedOpenAIModels, "chatgpt-4o-latest"],
 	["agents"]: sharedOpenAIModels,
 	["google"]: [
+		"gemini-3.8-flash",
+		"gemini-3.7-flash",
+		"gemini-3.6-flash",
 		"gemini-3.5-flash",
+		"gemini-3.5-flash-lite",
 		"gemini-3.1-pro-preview",
 		"gemini-3.1-pro-preview-customtools",
 		"gemini-3.1-flash-lite-preview",
@@ -4572,6 +6034,18 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	*/
 	CacheKeys["ROLES"] = "ROLES";
 	/**
+	* Key for cached group memberships used to resolve ACL user principals.
+	*/
+	CacheKeys["USER_PRINCIPALS"] = "USER_PRINCIPALS";
+	/**
+	* Key for cached prompt group access ID sets (accessible, public, owned).
+	*/
+	CacheKeys["PROMPT_GROUPS_ACCESS"] = "PROMPT_GROUPS_ACCESS";
+	/**
+	* Key for per-conversation stateful code sandbox prewarm/warm state.
+	*/
+	CacheKeys["SANDBOX_PREWARM"] = "SANDBOX_PREWARM";
+	/**
 	* Key for the title generation cache.
 	*/
 	CacheKeys["GEN_TITLE"] = "GEN_TITLE";
@@ -4641,6 +6115,10 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	*/
 	CacheKeys["OPENID_EXCHANGED_TOKENS"] = "OPENID_EXCHANGED_TOKENS";
 	/**
+	* Key for cached authenticated user documents.
+	*/
+	CacheKeys["AUTH_USER_DOC"] = "AUTH_USER_DOC";
+	/**
 	* Key for OpenID session.
 	*/
 	CacheKeys["OPENID_SESSION"] = "OPENID_SESSION";
@@ -4654,6 +6132,7 @@ let CacheKeys = /* @__PURE__ */ function(CacheKeys) {
 	CacheKeys["ADMIN_OAUTH_EXCHANGE"] = "ADMIN_OAUTH_EXCHANGE";
 	return CacheKeys;
 }({});
+const AUTH_USER_DOC_BY_ID_PREFIX = "auth-user-doc-byid";
 /**
 * Enum for violation types, used to identify, log, and cache violations.
 */
@@ -4777,6 +6256,18 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	*/
 	ErrorTypes["GOOGLE_TOOL_CONFLICT"] = "google_tool_conflict";
 	/**
+	* Google provider could not process a linked video (most often longer than the model accepts)
+	*/
+	ErrorTypes["GOOGLE_VIDEO_UNPROCESSABLE"] = "google_video_unprocessable";
+	/**
+	* Required CodeAPI resources could not be restored before model invocation.
+	*/
+	ErrorTypes["RESOURCE_RECOVERY_REQUIRED"] = "resource_recovery_required";
+	/**
+	* Agent selected a stateful Code API workspace scope disabled by the deployment.
+	*/
+	ErrorTypes["STATEFUL_CODE_ENVIRONMENT_NOT_ALLOWED"] = "stateful_code_environment_not_allowed";
+	/**
 	* Invalid Agent Provider (excluded by Admin)
 	*/
 	ErrorTypes["INVALID_AGENT_PROVIDER"] = "invalid_agent_provider";
@@ -4797,6 +6288,14 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	*/
 	ErrorTypes["AUTH_FAILED"] = "auth_failed";
 	/**
+	* Authentication rejected by a rate limiter
+	*/
+	ErrorTypes["AUTH_RATE_LIMITED"] = "auth_rate_limited";
+	/**
+	* Authentication rejected because the account or IP is banned
+	*/
+	ErrorTypes["AUTH_BANNED"] = "auth_banned";
+	/**
 	* Model refused to respond (content policy violation)
 	*/
 	ErrorTypes["REFUSAL"] = "refusal";
@@ -4804,6 +6303,14 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	* SSE stream 404 — job completed, expired, or was deleted before the subscriber connected
 	*/
 	ErrorTypes["STREAM_EXPIRED"] = "stream_expired";
+	/**
+	* Provider does not serve the requested model
+	*/
+	ErrorTypes["MODEL_NOT_FOUND"] = "model_not_found";
+	/**
+	* Provider throttled or refused the request for exceeding a rate/spend allowance
+	*/
+	ErrorTypes["MODEL_RATE_LIMIT"] = "model_rate_limit";
 	return ErrorTypes;
 }({});
 /**
@@ -4869,6 +6376,10 @@ let SettingsTabValues = /* @__PURE__ */ function(SettingsTabValues) {
 	*/
 	SettingsTabValues["SPEECH"] = "speech";
 	/**
+	* Tab for Langfuse Settings
+	*/
+	SettingsTabValues["LANGFUSE"] = "langfuse";
+	/**
 	* Tab for Beta Features
 	*/
 	SettingsTabValues["BETA"] = "beta";
@@ -4931,7 +6442,7 @@ let TTSProviders = /* @__PURE__ */ function(TTSProviders) {
 /** Enum for app-wide constants */
 let Constants = /* @__PURE__ */ function(Constants) {
 	/**
-	* Key for the app's version. The placeholder `v0.8.7` is
+	* Key for the app's version. The placeholder `v0.8.8-rc2` is
 	* swapped in by `@rollup/plugin-replace` during `npm run build:data-provider`
 	* using the value of the root `package.json`'s `version` field. Consumers
 	* always import this via the built dist bundle (see `main` field in
@@ -4939,9 +6450,9 @@ let Constants = /* @__PURE__ */ function(Constants) {
 	* substituted value. Only tests that import the TypeScript source directly
 	* would observe the raw placeholder.
 	*/
-	Constants["VERSION"] = "v0.8.7";
+	Constants["VERSION"] = "v0.8.8-rc2";
 	/** Key for the Custom Config's version (librechat.yaml). */
-	Constants["CONFIG_VERSION"] = "1.3.13";
+	Constants["CONFIG_VERSION"] = "1.3.15";
 	/** Standard value for the first message's `parentMessageId` value, to indicate no parent exists. */
 	Constants["NO_PARENT"] = "00000000-0000-0000-0000-000000000000";
 	/** Standard value to use whatever the submission prelim. `responseMessageId` is */
@@ -4993,8 +6504,224 @@ let Constants = /* @__PURE__ */ function(Constants) {
 	Constants["BASH_PROGRAMMATIC_TOOL_CALLING"] = "run_tools_with_bash";
 	/** Subagent spawn tool name (must match `@librechat/agents` `Constants.SUBAGENT`). */
 	Constants["SUBAGENT"] = "subagent";
+	/** Poll tool for retrieving the status/result of a backgrounded tool call. */
+	Constants["CHECK_BACKGROUND_TASK"] = "check_background_task";
+	/**
+	* `finish_reason` stamped on an assistant message whose turn ended because the
+	* agent exhausted its per-turn graph step budget (`recursionLimit`) rather than
+	* because the model chose to stop. Distinct from a user abort: nothing failed and
+	* nothing was cancelled, the turn simply ran out of room. The UI keys its
+	* "tool call limit reached" notice off this value. The hover Continue control
+	* is withheld for this reason because the notice already offers the way forward.
+	*/
+	Constants["TOOL_CALL_LIMIT_FINISH_REASON"] = "tool_call_limit";
 	return Constants;
 }({});
+/**
+* Normalizes a server name into the character set tool keys are built from.
+* Tool keys embed this output, so any candidate list matched against a key must
+* be normalized the same way.
+*/
+function normalizeServerName(serverName) {
+	if (/^[a-zA-Z0-9_.-]+$/.test(serverName)) return serverName;
+	const normalized = serverName.replace(/[^a-zA-Z0-9_.-]/g, "_").replace(/^_+|_+$/g, "");
+	if (normalized) return normalized;
+	/** All characters were stripped; hash the original so the name stays unique. */
+	let hash = 0;
+	for (let i = 0; i < serverName.length; i++) {
+		hash = (hash << 5) - hash + serverName.charCodeAt(i);
+		hash |= 0;
+	}
+	return `server_${Math.abs(hash)}`;
+}
+/**
+* Splits a combined MCP tool key (`${rawToolName}${mcp_delimiter}${serverName}`)
+* back into its two parts.
+*
+* Both halves can legitimately contain the delimiter, so position alone cannot
+* identify the boundary. Raw tool names come from the upstream server and are
+* untrusted (`get_mcp_server_version`, or a gateway-prefixed
+* `gitlab-get_mcp_server_version`), and `normalizeServerName` preserves
+* underscores, so a configured server may be named `Google_mcp_Workspace`.
+*
+* When `knownServerNames` is supplied the boundary is resolved against it: the
+* longest configured name the key actually ends with wins. Otherwise this falls
+* back to the last delimiter, which is correct whenever only the tool half
+* contains one and matches `.split()` when neither does.
+*
+* One case stays undecidable from the key alone: if both `bar` and `foo_mcp_bar`
+* are configured, `tool_mcp_foo_mcp_bar` is a valid key for either. Longest match
+* is the deterministic tiebreak; resolving it properly needs the tool/server
+* mapping carried alongside the key rather than re-derived from the string.
+*/
+/**
+* Maps each configured server name's normalized form back to the raw config
+* name. Model-facing tool keys embed `normalizeServerName(server)`, while the
+* registry, config maps, tool cache, and plugin-auth rows are keyed by the raw
+* name — any consumer that parses a server out of a tool key must resolve it
+* through this map before those lookups. Identity entries are included so
+* `aliases.get(name) ?? name` works uniformly.
+*
+* When two configured names normalize to the same value their tool keys are
+* inherently ambiguous; the FIRST configured name wins deterministically here,
+* and `resolveMCPServerContext` warns about the collision so the operator can
+* rename one server.
+*/
+function buildServerNameAliases(rawServerNames) {
+	const aliases = /* @__PURE__ */ new Map();
+	/** Identity entries claim their slot FIRST regardless of configuration
+	*  order: a server literally named `foo` must never have its keys rerouted
+	*  to a `foo!` whose normalized form collides with it. */
+	for (const raw of rawServerNames) if (raw && normalizeServerName(raw) === raw) aliases.set(raw, raw);
+	for (const raw of rawServerNames) {
+		if (!raw) continue;
+		const normalized = normalizeServerName(raw);
+		if (!aliases.has(normalized)) aliases.set(normalized, raw);
+	}
+	return aliases;
+}
+/**
+* Rewrites a tool key's server segment into the normalized form model-facing
+* keys carry, resolving the boundary against the configured raw names (longest
+* suffix wins, mirroring {@link splitMCPToolKey}). Returns the key unchanged
+* when no configured raw name matches — already-normalized keys, placeholder
+* tokens, and keys for servers that are no longer configured all pass through.
+* Idempotent: a normalized segment never matches a raw candidate that needs
+* rewriting.
+*/
+function normalizeMCPToolKey(toolKey, rawServerNames) {
+	let matched;
+	for (let i = 0; i < rawServerNames.length; i++) {
+		const raw = rawServerNames[i];
+		if (!raw || raw.length <= (matched?.length ?? 0)) continue;
+		if (toolKey.endsWith(`_mcp_${raw}`)) matched = raw;
+	}
+	if (matched == null) return toolKey;
+	const normalized = normalizeServerName(matched);
+	if (normalized === matched) return toolKey;
+	return `${toolKey.slice(0, toolKey.length - matched.length)}${normalized}`;
+}
+/**
+* Strips a redundant leading server-name prefix from a raw upstream tool name
+* before it is embedded into a model-facing key, so the key doesn't carry the
+* server twice (`acme_trace_..._mcp_acme`) and push long tool names
+* past provider function-name limits (64 chars). The match is case-insensitive
+* because display-cased server names ("Acme") conventionally prefix their
+* tools in lowercase. Ingestion that strips must record the original name
+* (`serverToolName` on the cached definition) — tool calls send THAT name back
+* to the server, never the stripped one. Catalog producers must not call this
+* directly: only {@link stripServerNamePrefixes} sees the whole sibling set and
+* can keep colliding results apart.
+*/
+function stripServerNamePrefix(toolName, normalizedServerName) {
+	const prefixLength = normalizedServerName.length + 1;
+	if (toolName.length <= prefixLength) return toolName;
+	if (toolName.slice(0, prefixLength).toLowerCase() !== `${normalizedServerName.toLowerCase()}_`) return toolName;
+	const stripped = toolName.slice(prefixLength);
+	if (isReservedMCPToolName(stripped)) return toolName;
+	/** `isActionTool` classifies keys by the RELATIVE position of `_action_`
+	*  and `_mcp_`; stripping moves the first `_mcp_` earlier, so a server
+	*  whose normalized name contains `_action_` could see a real MCP tool
+	*  reclassified as an OpenAPI action (bypassing MCP authorization). Never
+	*  produce a key whose classification differs from the raw key's. */
+	const keySuffix = `_mcp_${normalizedServerName}`;
+	if (isActionTool(`${stripped}${keySuffix}`) !== isActionTool(`${toolName}${keySuffix}`)) return toolName;
+	return stripped;
+}
+/**
+* Synthetic markers consumed by prefix (`isMCPAllPlaceholder`, the server-pin
+* skip, the client's OAuth stream classification), so each reserves BOTH its
+* exact name and its `${marker}${mcp_delimiter}` namespace: a stripped
+* remainder inside any of them would turn a real upstream tool into the
+* server-wide wildcard, the UI pin placeholder, or a synthetic OAuth call.
+*/
+const RESERVED_MCP_TOOL_MARKERS = [
+	`sys__all__sys`,
+	`sys__server__sys`,
+	"oauth"
+];
+function isReservedMCPToolName(toolName) {
+	/** `mcp_` opens the server-scoped pluginKey namespace (`mcp_${serverName}`),
+	*  and `lc_transfer_to_` opens the agent-handoff namespace (the client
+	*  renders such calls as handoffs; the background and intent passes exclude
+	*  them) — pre-strip tool keys could never enter either, since they always
+	*  began with the server name itself. */
+	if (toolName.startsWith(`mcp_`) || toolName.startsWith(`lc_transfer_to_`)) return true;
+	return RESERVED_MCP_TOOL_MARKERS.some((marker) => toolName === marker || toolName.startsWith(`${marker}_mcp_`));
+}
+/**
+* Maps every raw tool name in a server's catalog to its model-facing name,
+* stripping redundant server-name prefixes collision-free: when two names
+* yield the same result — a bare `foo` next to `<server>_foo`, or the
+* case-variant pair `<server>_Foo` / `<Server>_Foo` under the case-insensitive
+* prefix match — every collider keeps its raw name, so two distinct upstream
+* tools can never collapse onto one key. Unprefixed names count against the
+* result set through their identity mapping, which is what makes the bare-name
+* case fall out of the same counter.
+*/
+function stripServerNamePrefixes(toolNames, normalizedServerName) {
+	const rawNames = new Set(toolNames);
+	const finalNames = new Map(toolNames.map((name) => {
+		const stripped = stripServerNamePrefix(name, normalizedServerName);
+		/** Every sibling's RAW name is reserved even when that sibling itself
+		*  strips away: keys persisted BEFORE stripping embed raw names, so a
+		*  stripped result landing on another sibling's raw name would route
+		*  that sibling's legacy references to the wrong upstream tool. */
+		return [name, stripped !== name && rawNames.has(stripped) ? name : stripped];
+	}));
+	/** Reverting a collider to its raw name can itself collide with ANOTHER
+	*  sibling's stripped result (`foo` / `acme_foo` / `acme_acme_foo`), so the
+	*  guard iterates to a fixpoint. Each pass converts at least one stripped
+	*  result back to its unique raw name, so it terminates within the catalog
+	*  size. */
+	let changed = true;
+	while (changed) {
+		changed = false;
+		const counts = /* @__PURE__ */ new Map();
+		finalNames.forEach((result) => {
+			counts.set(result, (counts.get(result) ?? 0) + 1);
+		});
+		finalNames.forEach((result, raw) => {
+			if (result !== raw && (counts.get(result) ?? 0) > 1) {
+				finalNames.set(raw, raw);
+				changed = true;
+			}
+		});
+	}
+	return finalNames;
+}
+function splitMCPToolKey(toolKey, knownServerNames) {
+	if (knownServerNames?.length) {
+		let matched;
+		for (let i = 0; i < knownServerNames.length; i++) {
+			const serverName = knownServerNames[i];
+			if (!serverName || serverName.length <= (matched?.length ?? 0)) continue;
+			if (toolKey.endsWith(`_mcp_${serverName}`)) matched = serverName;
+		}
+		if (matched != null) return [toolKey.slice(0, toolKey.length - matched.length - 5), matched];
+	}
+	const idx = toolKey.lastIndexOf("_mcp_");
+	if (idx === -1) return [toolKey, void 0];
+	return [toolKey.slice(0, idx), toolKey.slice(idx + 5)];
+}
+/**
+* Splits a tool-call name for display, where the key may be a synthetic MCP OAuth
+* call (`oauth${mcp_delimiter}${serverName}`) rather than a real tool key.
+*
+* A configured server name is authoritative when one matches, because a real tool key
+* always ends in its server. Only when none matches does the `oauth` prefix decide,
+* which keeps a genuine upstream tool named `oauth${mcp_delimiter}...` from being read
+* as a synthetic call while still resolving OAuth prompts for unconfigured servers.
+*/
+function splitToolCallName(toolCallName, knownServerNames) {
+	if (knownServerNames?.length) {
+		const [toolName, serverName] = splitMCPToolKey(toolCallName, knownServerNames);
+		if (serverName != null && knownServerNames.includes(serverName)) return [toolName, serverName];
+	}
+	const oauthPrefix = `oauth_mcp_`;
+	if (toolCallName.startsWith(oauthPrefix)) return ["oauth", toolCallName.slice(oauthPrefix.length)];
+	return splitMCPToolKey(toolCallName, knownServerNames);
+}
 /** Maximum explicit subagent hops allowed from any root agent at runtime. */
 const MAX_SUBAGENT_DEPTH = 5;
 /** Maximum unique explicit subagent targets that may be loaded at runtime. */
@@ -5046,6 +6773,8 @@ let LocalStorageKeys = /* @__PURE__ */ function(LocalStorageKeys) {
 	LocalStorageKeys["LAST_ARTIFACTS_TOGGLE_"] = "LAST_ARTIFACTS_TOGGLE_";
 	/** Last checked toggle for Skills per conversation ID */
 	LocalStorageKeys["LAST_SKILLS_TOGGLE_"] = "LAST_SKILLS_TOGGLE_";
+	/** Last checked toggle for Memory per conversation ID */
+	LocalStorageKeys["LAST_MEMORY_TOGGLE_"] = "LAST_MEMORY_TOGGLE_";
 	/** Key for the last selected agent provider */
 	LocalStorageKeys["LAST_AGENT_PROVIDER"] = "lastAgentProvider";
 	/** Key for the last selected agent model */
@@ -5180,6 +6909,7 @@ let PrincipalModel = /* @__PURE__ */ function(PrincipalModel) {
 */
 let ResourceType = /* @__PURE__ */ function(ResourceType) {
 	ResourceType["AGENT"] = "agent";
+	ResourceType["CODE_ENVIRONMENT"] = "codeEnvironment";
 	ResourceType["PROMPTGROUP"] = "promptGroup";
 	ResourceType["MCPSERVER"] = "mcpServer";
 	ResourceType["REMOTE_AGENT"] = "remoteAgent";
@@ -5208,6 +6938,9 @@ let AccessRoleIds = /* @__PURE__ */ function(AccessRoleIds) {
 	AccessRoleIds["AGENT_VIEWER"] = "agent_viewer";
 	AccessRoleIds["AGENT_EDITOR"] = "agent_editor";
 	AccessRoleIds["AGENT_OWNER"] = "agent_owner";
+	AccessRoleIds["CODE_ENVIRONMENT_VIEWER"] = "codeEnvironment_viewer";
+	AccessRoleIds["CODE_ENVIRONMENT_EDITOR"] = "codeEnvironment_editor";
+	AccessRoleIds["CODE_ENVIRONMENT_OWNER"] = "codeEnvironment_owner";
 	AccessRoleIds["PROMPTGROUP_VIEWER"] = "promptGroup_viewer";
 	AccessRoleIds["PROMPTGROUP_EDITOR"] = "promptGroup_editor";
 	AccessRoleIds["PROMPTGROUP_OWNER"] = "promptGroup_owner";
@@ -5324,17 +7057,20 @@ function permBitsToAccessLevel(permBits) {
 function accessRoleToPermBits(accessRoleId) {
 	switch (accessRoleId) {
 		case "agent_viewer":
+		case "codeEnvironment_viewer":
 		case "promptGroup_viewer":
 		case "mcpServer_viewer":
 		case "remoteAgent_viewer":
 		case "skill_viewer":
 		case "sharedLink_viewer": return 1;
 		case "agent_editor":
+		case "codeEnvironment_editor":
 		case "promptGroup_editor":
 		case "mcpServer_editor":
 		case "remoteAgent_editor":
 		case "skill_editor": return 3;
 		case "agent_owner":
+		case "codeEnvironment_owner":
 		case "promptGroup_owner":
 		case "mcpServer_owner":
 		case "remoteAgent_owner":
@@ -5361,21 +7097,25 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["sharedLinks"] = "sharedLinks";
 	QueryKeys["allConversations"] = "allConversations";
 	QueryKeys["archivedConversations"] = "archivedConversations";
+	QueryKeys["pinnedConversations"] = "pinnedConversations";
 	QueryKeys["searchConversations"] = "searchConversations";
 	QueryKeys["conversation"] = "conversation";
 	QueryKeys["searchEnabled"] = "searchEnabled";
+	QueryKeys["langfuseConnection"] = "langfuseConnection";
+	QueryKeys["langfuseSessionLink"] = "langfuseSessionLink";
 	QueryKeys["user"] = "user";
 	QueryKeys["name"] = "name";
 	QueryKeys["models"] = "models";
 	QueryKeys["balance"] = "balance";
 	QueryKeys["endpoints"] = "endpoints";
 	QueryKeys["tokenConfig"] = "tokenConfig";
-	QueryKeys["contextProjection"] = "contextProjection";
 	QueryKeys["presets"] = "presets";
 	QueryKeys["searchResults"] = "searchResults";
 	QueryKeys["tokenCount"] = "tokenCount";
 	QueryKeys["availablePlugins"] = "availablePlugins";
 	QueryKeys["startupConfig"] = "startupConfig";
+	QueryKeys["insights"] = "insights";
+	QueryKeys["insightsAccess"] = "insightsAccess";
 	QueryKeys["assistants"] = "assistants";
 	QueryKeys["assistant"] = "assistant";
 	QueryKeys["agents"] = "agents";
@@ -5430,17 +7170,29 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["skillFileContent"] = "skillFileContent";
 	QueryKeys["skillTree"] = "skillTree";
 	QueryKeys["skillNodeContent"] = "skillNodeContent";
-	QueryKeys["skillFavorites"] = "skillFavorites";
+	QueryKeys["toolFavorites"] = "toolFavorites";
 	QueryKeys["skillStates"] = "skillStates";
 	QueryKeys["favorites"] = "favorites";
+	QueryKeys["schedules"] = "schedules";
+	QueryKeys["schedule"] = "schedule";
+	QueryKeys["parentSubagents"] = "parentSubagents";
+	QueryKeys["subagentThread"] = "subagentThread";
+	QueryKeys["codeEnvironments"] = "codeEnvironments";
+	QueryKeys["agentQueuedTurns"] = "agentQueuedTurns";
 	return QueryKeys;
 }({});
 const DynamicQueryKeys = { agentFiles: (agentId) => ["agentFiles", agentId] };
 let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
+	MutationKeys["subagentControl"] = "subagentControl";
+	MutationKeys["enqueueAgentQueuedTurn"] = "enqueueAgentQueuedTurn";
+	MutationKeys["cancelAgentQueuedTurn"] = "cancelAgentQueuedTurn";
+	MutationKeys["updateLangfuseConnection"] = "updateLangfuseConnection";
+	MutationKeys["testLangfuseConnection"] = "testLangfuseConnection";
 	MutationKeys["createAgentApiKey"] = "createAgentApiKey";
 	MutationKeys["deleteAgentApiKey"] = "deleteAgentApiKey";
 	MutationKeys["fileUpload"] = "fileUpload";
 	MutationKeys["fileDelete"] = "fileDelete";
+	MutationKeys["fileUsage"] = "fileUsage";
 	MutationKeys["updatePreset"] = "updatePreset";
 	MutationKeys["deletePreset"] = "deletePreset";
 	MutationKeys["loginUser"] = "loginUser";
@@ -5457,6 +7209,7 @@ let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
 	MutationKeys["deleteAgentAction"] = "deleteAgentAction";
 	MutationKeys["revertAgentVersion"] = "revertAgentVersion";
 	MutationKeys["deleteUser"] = "deleteUser";
+	MutationKeys["updateUserPreferences"] = "updateUserPreferences";
 	MutationKeys["updateRole"] = "updateRole";
 	MutationKeys["enableTwoFactor"] = "enableTwoFactor";
 	MutationKeys["verifyTwoFactor"] = "verifyTwoFactor";
@@ -5470,6 +7223,14 @@ let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
 	MutationKeys["deleteSkillNode"] = "deleteSkillNode";
 	MutationKeys["updateSkillNodeContent"] = "updateSkillNodeContent";
 	MutationKeys["convoPin"] = "convoPin";
+	MutationKeys["archiveAllConversations"] = "archiveAllConversations";
+	MutationKeys["createSchedule"] = "createSchedule";
+	MutationKeys["updateSchedule"] = "updateSchedule";
+	MutationKeys["deleteSchedule"] = "deleteSchedule";
+	MutationKeys["runSchedule"] = "runSchedule";
+	MutationKeys["pairCodeEnvironment"] = "pairCodeEnvironment";
+	MutationKeys["updateCodeEnvironmentSettings"] = "updateCodeEnvironmentSettings";
+	MutationKeys["deleteCodeEnvironment"] = "deleteCodeEnvironment";
 	return MutationKeys;
 }({});
 //#endregion
@@ -5529,6 +7290,7 @@ const TOKEN_REFRESH_BUFFER_MS = 120 * 1e3;
 const refreshToken = (retry) => _post(refreshToken$1(retry));
 const SHARE_PAGE_PATH_REGEX = /^\/share\/[^/]+\/?$/;
 const SHARED_MESSAGES_PATH_REGEX = /^\/api\/share\/[^/]+$/;
+const SHARE_FORK_PATH_REGEX = /^\/api\/share\/[^/]+\/fork$/;
 const normalizePathname = (pathname) => pathname.startsWith("/") ? pathname : `/${pathname}`;
 const stripBasePath = (pathname) => {
 	const normalizedPathname = normalizePathname(pathname);
@@ -5548,6 +7310,11 @@ const getRequestPathname = (url) => {
 	}
 };
 const isSharedMessagesRequest = (url, method) => method?.toLowerCase() === "get" && SHARED_MESSAGES_PATH_REGEX.test(stripBasePath(getRequestPathname(url)));
+/** The "continue this chat" fork is a deliberate authenticated action initiated
+*  from a share page, so it must reach auth recovery/redirect like the shared
+*  data request — otherwise a logged-out (or cold-loaded) viewer's 401 is
+*  rejected silently instead of routing them through login. */
+const isShareForkRequest = (url, method) => method?.toLowerCase() === "post" && SHARE_FORK_PATH_REGEX.test(stripBasePath(getRequestPathname(url)));
 const dispatchTokenUpdatedEvent = (token) => {
 	setTokenHeader(token);
 	clearAuthRedirectStartedAt();
@@ -5646,16 +7413,42 @@ const shouldRefreshBeforeRequest = (url) => {
 	const timeUntilExpiry = expiresAt - Date.now();
 	return timeUntilExpiry > 0 && timeUntilExpiry <= TOKEN_REFRESH_BUFFER_MS;
 };
+const refreshBeforeRequest = async (url) => {
+	const state = getAuthRecoveryState();
+	if (state.refreshPromise && !isAuthRecoveryEndpoint(url)) return state.refreshPromise.catch(() => null);
+	if (!shouldRefreshBeforeRequest(url)) return null;
+	return startAuthRecovery(false).catch(() => null);
+};
+const withAuthorization = (options, token) => {
+	const headers = new Headers(options?.headers);
+	if (token) headers.set("Authorization", `Bearer ${token}`);
+	return {
+		...options,
+		headers
+	};
+};
+async function _authenticatedFetch(url, options) {
+	if (typeof window === "undefined") return fetch(url, options);
+	const token = await refreshBeforeRequest(url) ?? getBearerToken();
+	const response = await fetch(url, withAuthorization(options, token));
+	if (response.status !== 401 || isAuthRecoveryEndpoint(url) || isAuthRedirectInProgress() || !getBearerToken()) return response;
+	let refreshedToken;
+	try {
+		refreshedToken = await startAuthRecovery(false);
+	} catch {
+		redirectToLoginOnce();
+		return response;
+	}
+	if (!refreshedToken) {
+		redirectToLoginOnce();
+		return response;
+	}
+	await response.body?.cancel().catch(() => void 0);
+	return fetch(url, withAuthorization(options, refreshedToken));
+}
 if (typeof window !== "undefined") {
 	axios.default.interceptors.request.use(async (config) => {
-		const state = getAuthRecoveryState();
-		if (state.refreshPromise && !isAuthRecoveryEndpoint(config.url)) {
-			const token = await state.refreshPromise.catch(() => null);
-			if (token) setRequestAuthorizationHeader(config, token);
-			return config;
-		}
-		if (!shouldRefreshBeforeRequest(config.url)) return config;
-		const token = await startAuthRecovery(false).catch(() => null);
+		const token = await refreshBeforeRequest(config.url);
 		if (token) setRequestAuthorizationHeader(config, token);
 		return config;
 	});
@@ -5669,7 +7462,7 @@ if (typeof window !== "undefined") {
 		/** Skip refresh when the Authorization header has been cleared (e.g. during logout),
 		*  but allow the shared link data request to proceed so private shares can still
 		*  recover auth/redirect without unrelated share-page queries forcing login. */
-		if (!axios.default.defaults.headers.common["Authorization"] && !(isSharePage() && isSharedMessagesRequest(originalRequest.url, originalRequest.method))) return Promise.reject(error);
+		if (!axios.default.defaults.headers.common["Authorization"] && !(isSharePage() && (isSharedMessagesRequest(originalRequest.url, originalRequest.method) || isShareForkRequest(originalRequest.url, originalRequest.method)))) return Promise.reject(error);
 		if (isAuthRedirectInProgress()) return Promise.reject(error);
 		if (error.response.status === 401 && !originalRequest._retry) {
 			if (!(getAuthRecoveryState().refreshPromise != null)) console.warn("401 error, refreshing token");
@@ -5682,8 +7475,12 @@ if (typeof window !== "undefined") {
 				}
 				redirectToLoginOnce();
 				return Promise.reject(error);
-			} catch (err) {
-				return Promise.reject(err);
+			} catch {
+				/** A rejected refresh (stale/invalid session → 401/403) must route to
+				*  login just like an empty-token refresh, otherwise the original 401
+				*  surfaces to the caller (e.g. the share fork button) with no redirect. */
+				redirectToLoginOnce();
+				return Promise.reject(error);
 			}
 		}
 		return Promise.reject(error);
@@ -5699,24 +7496,154 @@ var request_default = {
 	delete: _delete,
 	deleteWithOptions: _deleteWithOptions,
 	patch: _patch,
+	authenticatedFetch: _authenticatedFetch,
 	refreshToken,
 	dispatchTokenUpdatedEvent
 };
 //#endregion
+//#region src/upload.ts
+const EVENT_STREAM_MEDIA_TYPE = "text/event-stream";
+const HEARTBEAT_TIMEOUT_MS = 15e3;
+var FileUploadError = class extends Error {
+	constructor(message, fileId, toolResource, displayToUser = false, code = 0) {
+		super(message);
+		this.name = "CustomAppError";
+		this.code = code;
+		this.file_id = fileId;
+		this.tool_resource = toolResource;
+		this.display_to_user = displayToUser;
+		this.response = { data: { message: displayToUser ? message : "" } };
+	}
+};
+var UploadCanceledError = class extends Error {
+	constructor(..._args) {
+		super(..._args);
+		this.code = "ERR_CANCELED";
+	}
+};
+const getFileId = (formData) => String(formData.get("file_id") ?? "");
+const getToolResource = (formData) => formData.get("tool_resource") ?? void 0;
+const parseEvent = (message) => {
+	let type = "message";
+	const data = [];
+	for (const line of message.split(/\r?\n/)) {
+		if (line.startsWith("event:")) {
+			type = line.slice(6).trim();
+			continue;
+		}
+		if (line.startsWith("data:")) data.push(line.slice(5).trimStart());
+	}
+	return {
+		type,
+		data: data.join("\n")
+	};
+};
+const createHttpError = async (response, formData) => {
+	let message = `Server responded with status: ${response.status}`;
+	try {
+		message = (await response.json()).message || message;
+	} catch {}
+	return new FileUploadError(message, getFileId(formData), getToolResource(formData), true, response.status);
+};
+const createStreamError = (data, formData) => {
+	let error;
+	try {
+		error = JSON.parse(data);
+	} catch {
+		error = { message: data };
+	}
+	return new FileUploadError(error.message || "File upload failed.", error.temp_file_id || getFileId(formData), error.tool_resource || getToolResource(formData), error.display_to_user ?? false, error.code ?? 0);
+};
+const readEventStream = async (stream, formData) => {
+	const reader = stream.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	let result = null;
+	let streamEnded = false;
+	let timeoutError = null;
+	let heartbeatTimer;
+	const resetHeartbeatTimer = () => {
+		clearTimeout(heartbeatTimer);
+		heartbeatTimer = setTimeout(() => {
+			timeoutError = /* @__PURE__ */ new Error("Upload connection timed out waiting for a heartbeat.");
+			reader.cancel(timeoutError);
+		}, HEARTBEAT_TIMEOUT_MS);
+	};
+	resetHeartbeatTimer();
+	try {
+		while (true) {
+			const { value, done } = await reader.read();
+			if (done) {
+				streamEnded = true;
+				if (timeoutError) throw timeoutError;
+				if (result) return result;
+				throw new Error("Upload connection closed before completion.");
+			}
+			buffer += decoder.decode(value, { stream: true });
+			const messages = buffer.split(/\r?\n\r?\n/);
+			buffer = messages.pop() ?? "";
+			for (const message of messages) {
+				const event = parseEvent(message);
+				if (event.type === "heartbeat") {
+					resetHeartbeatTimer();
+					continue;
+				}
+				if (event.type === "error") throw createStreamError(event.data, formData);
+				if (event.type === "data") {
+					result = JSON.parse(event.data);
+					continue;
+				}
+				if (event.type === "close") {
+					if (result) return result;
+					throw new Error("Upload stream closed without a result.");
+				}
+			}
+		}
+	} catch (error) {
+		if (error instanceof Error && error.name === "AbortError") throw new UploadCanceledError("Upload canceled.");
+		throw error;
+	} finally {
+		clearTimeout(heartbeatTimer);
+		if (!streamEnded) await reader.cancel().catch(() => void 0);
+		reader.releaseLock();
+	}
+};
+async function uploadEventStream(url, formData, signal) {
+	try {
+		const response = await request_default.authenticatedFetch(url, {
+			method: "POST",
+			body: formData,
+			headers: { Accept: EVENT_STREAM_MEDIA_TYPE },
+			signal: signal ?? void 0
+		});
+		if (!response.ok) throw await createHttpError(response, formData);
+		if (!(response.headers.get("Content-Type")?.toLowerCase() ?? "").includes(EVENT_STREAM_MEDIA_TYPE)) return await response.json();
+		if (!response.body) throw new Error("No upload response body received.");
+		return await readEventStream(response.body, formData);
+	} catch (error) {
+		if (signal?.aborted || error instanceof Error && error.name === "AbortError") throw new UploadCanceledError("Upload canceled.");
+		throw error;
+	}
+}
+//#endregion
 //#region src/data-service.ts
 var data_service_exports = /* @__PURE__ */ __exportAll({
 	acceptTerms: () => acceptTerms,
 	addPromptToGroup: () => addPromptToGroup,
 	addTagToConversation: () => addTagToConversation,
+	addToolFavorite: () => addToolFavorite,
+	archiveAllConversations: () => archiveAllConversations,
 	archiveConversation: () => archiveConversation,
 	assignConversationToProject: () => assignConversationToProject,
 	bindActionOAuth: () => bindActionOAuth,
 	bindMCPOAuth: () => bindMCPOAuth,
 	branchMessage: () => branchMessage,
 	callTool: () => callTool,
+	cancelAgentQueuedTurn: () => cancelAgentQueuedTurn,
 	cancelMCPOAuth: () => cancelMCPOAuth,
 	clearAllConversations: () => clearAllConversations,
 	confirmTwoFactor: () => confirmTwoFactor,
+	controlSubagentTask: () => controlSubagentTask,
 	createAgent: () => createAgent,
 	createAgentApiKey: () => createAgentApiKey,
 	createAssistant: () => createAssistant,
@@ -5726,6 +7653,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	createPreset: () => createPreset,
 	createProject: () => createProject,
 	createPrompt: () => createPrompt,
+	createSchedule: () => createSchedule,
 	createSharedLink: () => createSharedLink,
 	createSkill: () => createSkill,
 	createSkillNode: () => createSkillNode,
@@ -5734,16 +7662,19 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	deleteAgentAction: () => deleteAgentAction,
 	deleteAgentApiKey: () => deleteAgentApiKey,
 	deleteAssistant: () => deleteAssistant,
+	deleteCodeEnvironment: () => deleteCodeEnvironment,
 	deleteConversation: () => deleteConversation,
 	deleteConversationTag: () => deleteConversationTag,
 	deleteFiles: () => deleteFiles,
 	deleteGitHubSkillSyncCredential: () => deleteGitHubSkillSyncCredential,
 	deleteMCPServer: () => deleteMCPServer,
 	deleteMemory: () => deleteMemory,
+	deleteMemoryById: () => deleteMemoryById,
 	deletePreset: () => deletePreset,
 	deleteProject: () => deleteProject,
 	deletePrompt: () => deletePrompt,
 	deletePromptGroup: () => deletePromptGroup,
+	deleteSchedule: () => deleteSchedule,
 	deleteSharedLink: () => deleteSharedLink,
 	deleteSkill: () => deleteSkill,
 	deleteSkillFile: () => deleteSkillFile,
@@ -5754,7 +7685,9 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	duplicateConversation: () => duplicateConversation,
 	editArtifact: () => editArtifact,
 	enableTwoFactor: () => enableTwoFactor,
+	enqueueAgentQueuedTurn: () => enqueueAgentQueuedTurn,
 	forkConversation: () => forkConversation,
+	forkSharedConversation: () => forkSharedConversation,
 	genTitle: () => genTitle,
 	getAIEndpoints: () => getAIEndpoints,
 	getAccessRoles: () => getAccessRoles,
@@ -5764,6 +7697,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getAgentById: () => getAgentById,
 	getAgentCategories: () => getAgentCategories,
 	getAgentFiles: () => getAgentFiles,
+	getAgentVersions: () => getAgentVersions,
 	getAllEffectivePermissions: () => getAllEffectivePermissions,
 	getAllPromptGroups: () => getAllPromptGroups,
 	getAssistantById: () => getAssistantById,
@@ -5773,8 +7707,8 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getAvailableTools: () => getAvailableTools,
 	getBanner: () => getBanner,
 	getCategories: () => getCategories,
+	getCodeEnvironments: () => getCodeEnvironments,
 	getCodeOutputDownload: () => getCodeOutputDownload,
-	getContextProjection: () => getContextProjection,
 	getConversationById: () => getConversationById,
 	getConversationTags: () => getConversationTags,
 	getConversations: () => getConversations,
@@ -5790,17 +7724,24 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getFiles: () => getFiles,
 	getGitHubSkillSyncStatus: () => getGitHubSkillSyncStatus,
 	getGraphApiToken: () => getGraphApiToken,
+	getInsights: () => getInsights,
+	getInsightsAccess: () => getInsightsAccess,
+	getLangfuseConnection: () => getLangfuseConnection,
+	getLangfuseSessionLink: () => getLangfuseSessionLink,
 	getLoginGoogle: () => getLoginGoogle,
 	getMCPAuthValues: () => getMCPAuthValues,
 	getMCPConnectionStatus: () => getMCPConnectionStatus,
+	getMCPOAuthStatus: () => getMCPOAuthStatus,
 	getMCPServer: () => getMCPServer,
 	getMCPServerConnectionStatus: () => getMCPServerConnectionStatus,
 	getMCPServers: () => getMCPServers,
 	getMCPTools: () => getMCPTools,
 	getMarketplaceAgents: () => getMarketplaceAgents,
 	getMemories: () => getMemories,
+	getMessageById: () => getMessageById,
 	getMessagesByConvoId: () => getMessagesByConvoId,
 	getModels: () => getModels,
+	getParentSubagents: () => getParentSubagents,
 	getPresets: () => getPresets,
 	getProjectById: () => getProjectById,
 	getPrompt: () => getPrompt,
@@ -5810,6 +7751,8 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getRandomPrompts: () => getRandomPrompts,
 	getResourcePermissions: () => getResourcePermissions,
 	getRole: () => getRole,
+	getSchedule: () => getSchedule,
+	getSchedules: () => getSchedules,
 	getSearchEnabled: () => getSearchEnabled,
 	getSharedFileDownload: () => getSharedFileDownload,
 	getSharedFilePreview: () => getSharedFilePreview,
@@ -5817,14 +7760,15 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getSharedMessages: () => getSharedMessages,
 	getSharedStartupConfig: () => getSharedStartupConfig,
 	getSkill: () => getSkill,
-	getSkillFavorites: () => getSkillFavorites,
 	getSkillFileContent: () => getSkillFileContent,
 	getSkillNodeContent: () => getSkillNodeContent,
 	getSkillStates: () => getSkillStates,
 	getSkillTree: () => getSkillTree,
 	getStartupConfig: () => getStartupConfig,
+	getSubagentThread: () => getSubagentThread,
 	getTokenConfig: () => getTokenConfig,
 	getToolCalls: () => getToolCalls,
+	getToolFavorites: () => getToolFavorites,
 	getUser: () => getUser,
 	getUserBalance: () => getUserBalance,
 	getUserTerms: () => getUserTerms,
@@ -5833,6 +7777,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	healthCheck: () => healthCheck,
 	importConversationsFile: () => importConversationsFile,
 	importSkill: () => importSkill,
+	listAgentQueuedTurns: () => listAgentQueuedTurns,
 	listAgents: () => listAgents,
 	listAssistants: () => listAssistants,
 	listConversations: () => listConversations,
@@ -5845,12 +7790,15 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	login: () => login,
 	logout: () => logout,
 	makePromptProduction: () => makePromptProduction,
+	markFilesUsage: () => markFilesUsage,
+	pairCodeEnvironment: () => pairCodeEnvironment,
 	pinConversation: () => pinConversation,
 	rebuildConversationTags: () => rebuildConversationTags,
 	recordPromptGroupUsage: () => recordPromptGroupUsage,
 	regenerateBackupCodes: () => regenerateBackupCodes,
 	register: () => register,
 	reinitializeMCPServer: () => reinitializeMCPServer,
+	removeToolFavorite: () => removeToolFavorite,
 	requestPasswordReset: () => requestPasswordReset,
 	resendVerificationEmail: () => resendVerificationEmail,
 	resetPassword: () => resetPassword,
@@ -5858,23 +7806,28 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	revokeAllUserKeys: () => revokeAllUserKeys,
 	revokeUserKey: () => revokeUserKey,
 	runGitHubSkillSync: () => runGitHubSkillSync,
+	runScheduleNow: () => runScheduleNow,
 	searchPrincipals: () => searchPrincipals,
 	setGitHubSkillSyncCredential: () => setGitHubSkillSyncCredential,
 	speechToText: () => speechToText,
+	testLangfuseConnection: () => testLangfuseConnection,
 	textToSpeech: () => textToSpeech,
 	updateAction: () => updateAction,
 	updateAgent: () => updateAgent,
 	updateAgentAction: () => updateAgentAction,
 	updateAgentPermissions: () => updateAgentPermissions,
 	updateAssistant: () => updateAssistant,
+	updateCodeEnvironmentSettings: () => updateCodeEnvironmentSettings,
 	updateConversation: () => updateConversation,
 	updateConversationTag: () => updateConversationTag,
 	updateFavorites: () => updateFavorites,
 	updateFeedback: () => updateFeedback,
+	updateLangfuseConnection: () => updateLangfuseConnection,
 	updateMCPServer: () => updateMCPServer,
 	updateMCPServersPermissions: () => updateMCPServersPermissions,
 	updateMarketplacePermissions: () => updateMarketplacePermissions,
 	updateMemory: () => updateMemory,
+	updateMemoryById: () => updateMemoryById,
 	updateMemoryPermissions: () => updateMemoryPermissions,
 	updateMemoryPreferences: () => updateMemoryPreferences,
 	updateMessage: () => updateMessage,
@@ -5887,9 +7840,9 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	updatePromptPermissions: () => updatePromptPermissions,
 	updateRemoteAgentsPermissions: () => updateRemoteAgentsPermissions,
 	updateResourcePermissions: () => updateResourcePermissions,
+	updateSchedule: () => updateSchedule,
 	updateSharedLink: () => updateSharedLink,
 	updateSkill: () => updateSkill,
-	updateSkillFavorites: () => updateSkillFavorites,
 	updateSkillNode: () => updateSkillNode,
 	updateSkillNodeContent: () => updateSkillNodeContent,
 	updateSkillPermissions: () => updateSkillPermissions,
@@ -5897,6 +7850,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	updateTokenCount: () => updateTokenCount,
 	updateUserKey: () => updateUserKey,
 	updateUserPlugins: () => updateUserPlugins,
+	updateUserPreferences: () => updateUserPreferences,
 	uploadAgentAvatar: () => uploadAgentAvatar,
 	uploadAssistantAvatar: () => uploadAssistantAvatar,
 	uploadAvatar: () => uploadAvatar,
@@ -5908,6 +7862,27 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	verifyTwoFactor: () => verifyTwoFactor,
 	verifyTwoFactorTemp: () => verifyTwoFactorTemp
 });
+function getInsights(params = {}) {
+	const query = new URLSearchParams();
+	for (const [key, value] of Object.entries(params)) if (value !== void 0 && value !== null && value !== "") query.set(key, String(value));
+	const suffix = query.toString() ? `?${query.toString()}` : "";
+	return request_default.get(`${insights()}${suffix}`);
+}
+function getInsightsAccess() {
+	return request_default.get(insightsAccess());
+}
+function getLangfuseConnection() {
+	return request_default.get(adminLangfuseConnection());
+}
+function updateLangfuseConnection(payload) {
+	return request_default.put(adminLangfuseConnection(), payload);
+}
+function testLangfuseConnection(payload) {
+	return request_default.post(adminLangfuseConnectionTest(), payload);
+}
+function getLangfuseSessionLink(conversationId) {
+	return request_default.get(adminLangfuseSessionLink(conversationId));
+}
 function revokeUserKey(name) {
 	return request_default.delete(revokeUserKey$1(name));
 }
@@ -5917,22 +7892,33 @@ function revokeAllUserKeys() {
 function deleteUser(payload) {
 	return request_default.deleteWithOptions(deleteUser$1(), { data: payload });
 }
+function getCodeEnvironments() {
+	return request_default.get(codeEnvironments());
+}
+function pairCodeEnvironment(payload) {
+	return request_default.post(codeEnvironmentPairings(), payload);
+}
+function deleteCodeEnvironment(id) {
+	return request_default.delete(codeEnvironmentById(id));
+}
+function updateCodeEnvironmentSettings({ id, settings }) {
+	return request_default.patch(codeEnvironmentSettings(id), { settings });
+}
 function getFavorites() {
 	return request_default.get(`${apiBaseUrl()}/api/user/settings/favorites`);
 }
 function updateFavorites(favorites) {
 	return request_default.post(`${apiBaseUrl()}/api/user/settings/favorites`, { favorites });
 }
-/**
-* Skill favorites (star-a-skill). The backend route is phase 2 — see the
-* original UI PR for the client surface. Until then, these resolve with
-* an empty list so the UI hooks compile and the Star button is a no-op.
-*/
-function getSkillFavorites() {
-	return Promise.resolve([]);
+/** Tool favorites — starred marketplace items (builtins, tools, MCP servers, skills). */
+function getToolFavorites() {
+	return request_default.get(toolFavorites());
 }
-function updateSkillFavorites(skillFavorites) {
-	return Promise.resolve(skillFavorites);
+function addToolFavorite(favorite) {
+	return request_default.put(toolFavorite(favorite.itemType, favorite.itemId));
+}
+function removeToolFavorite(favorite) {
+	return request_default.delete(toolFavorite(favorite.itemType, favorite.itemId));
 }
 /** Per-user skill active/inactive overrides. */
 function getSkillStates() {
@@ -6001,6 +7987,9 @@ function getSearchEnabled() {
 function getUser() {
 	return request_default.get(user());
 }
+function updateUserPreferences(preferences) {
+	return request_default.patch(userPreferences(), preferences);
+}
 function getUserBalance() {
 	return request_default.get(balance());
 }
@@ -6059,6 +8048,9 @@ const getMCPAuthValues = (serverName) => {
 function cancelMCPOAuth(serverName) {
 	return request_default.post(cancelMCPOAuth$1(serverName), {});
 }
+function getMCPOAuthStatus(flowId) {
+	return request_default.get(mcpOAuthStatus(flowId));
+}
 const getStartupConfig = (options) => {
 	return request_default.get(config(options?.context));
 };
@@ -6068,9 +8060,6 @@ const getAIEndpoints = () => {
 const getTokenConfig = () => {
 	return request_default.get(tokenConfig());
 };
-const getContextProjection = (payload) => {
-	return request_default.post(contextProjection(), payload);
-};
 const getModels = async () => {
 	return request_default.get(models());
 };
@@ -6170,14 +8159,24 @@ const getAgentFiles = (agentId) => {
 const getFileConfig = () => {
 	return request_default.get(`${files()}/config`);
 };
-const uploadImage = (data, signal) => {
+const uploadImage = (data, signal, sseEnabled = false) => {
 	const requestConfig = signal ? { signal } : void 0;
+	if (sseEnabled) return uploadEventStream(images(), data, signal);
 	return request_default.postMultiPart(images(), data, requestConfig);
 };
-const uploadFile = (data, signal) => {
+const uploadFile = (data, signal, sseEnabled = false) => {
 	const requestConfig = signal ? { signal } : void 0;
+	if (sseEnabled) return uploadEventStream(files(), data, signal);
 	return request_default.postMultiPart(files(), data, requestConfig);
 };
+/**
+* Marks uploaded files as used (owner-scoped TTL touch) so the upload-window
+* TTL cannot reap attachments held in a client-side queue during a long run.
+* Best-effort: callers fire-and-forget — send-time marking is the backstop.
+*/
+const markFilesUsage = (body) => {
+	return request_default.post(fileUsage(), body);
+};
 const updateAction = (data) => {
 	const { assistant_id, version, ...body } = data;
 	return request_default.post(assistants({
@@ -6205,6 +8204,9 @@ const getAgentById = ({ agent_id }) => {
 const getExpandedAgentById = ({ agent_id }) => {
 	return request_default.get(agents({ path: `${agent_id}/expanded` }));
 };
+const getAgentVersions = ({ agent_id }) => {
+	return request_default.get(agents({ path: `${agent_id}/versions` }));
+};
 const updateAgent = ({ agent_id, data }) => {
 	return request_default.patch(agents({ path: agent_id }), data);
 };
@@ -6339,6 +8341,12 @@ function duplicateConversation(payload) {
 function forkConversation(payload) {
 	return request_default.post(forkConversation$1(), payload);
 }
+function forkSharedConversation(shareId, targetMessageIndex, shareRevision) {
+	return request_default.post(forkSharedMessages(shareId), {
+		targetMessageIndex,
+		shareRevision
+	});
+}
 function deleteConversation(payload) {
 	return request_default.deleteWithOptions(deleteConversation$1(), { data: { arg: payload } });
 }
@@ -6360,6 +8368,9 @@ function updateConversation(payload) {
 function archiveConversation(payload) {
 	return request_default.post(archiveConversation$1(), { arg: payload });
 }
+function archiveAllConversations() {
+	return request_default.post(archiveAllConversations$1(), {});
+}
 function listProjects(params) {
 	return request_default.get(projects(params ?? {}));
 }
@@ -6418,6 +8429,21 @@ function getMessagesByConvoId(conversationId) {
 	if (conversationId === "new" || conversationId === "PENDING") return Promise.resolve([]);
 	return request_default.get(messages({ conversationId }));
 }
+function getMessageById(conversationId, messageId) {
+	return request_default.get(messages({
+		conversationId,
+		messageId
+	}));
+}
+function getParentSubagents(parentConversationId) {
+	return request_default.get(parentSubagents(parentConversationId));
+}
+function getSubagentThread(parentConversationId, threadId, taskId, cursor) {
+	return request_default.get(subagentThread(parentConversationId, threadId, taskId, cursor));
+}
+function controlSubagentTask(parentConversationId, threadId, body) {
+	return request_default.post(subagentControl(parentConversationId, threadId), body);
+}
 function getPrompt(id) {
 	return request_default.get(getPrompt$1(id));
 }
@@ -6466,6 +8492,33 @@ function getRandomPrompts(variables) {
 function listSkills(params) {
 	return request_default.get(listSkillsWithFilters(params ?? {}));
 }
+function getSchedules() {
+	return request_default.get(schedules());
+}
+function enqueueAgentQueuedTurn(payload) {
+	return request_default.post(agentQueuedTurns(), payload);
+}
+function listAgentQueuedTurns(conversationId, clientRequestIds) {
+	return request_default.get(agentQueuedTurnsByConversation(conversationId, clientRequestIds));
+}
+function cancelAgentQueuedTurn(queuedTurnId) {
+	return request_default.delete(agentQueuedTurn(queuedTurnId));
+}
+function getSchedule(id) {
+	return request_default.get(schedule(id));
+}
+function createSchedule(payload) {
+	return request_default.post(schedules(), payload);
+}
+function updateSchedule(id, payload) {
+	return request_default.patch(schedule(id), payload);
+}
+function deleteSchedule(id) {
+	return request_default.delete(schedule(id));
+}
+function runScheduleNow(id) {
+	return request_default.post(runSchedule(id), {});
+}
 function getSkill(id) {
 	return request_default.get(getSkill$1(id));
 }
@@ -6653,15 +8706,24 @@ function verifyTwoFactorTemp(payload) {
 const getMemories = () => {
 	return request_default.get(memories());
 };
-const deleteMemory = (key) => {
-	return request_default.delete(memory(key));
+const deleteMemory = (key, agentId) => {
+	return request_default.delete(memory(key, agentId));
+};
+const deleteMemoryById = (id, agentId) => {
+	return request_default.delete(memoryById(id, agentId));
 };
-const updateMemory = (key, value, originalKey) => {
-	return request_default.patch(memory(originalKey || key), {
+const updateMemory = (key, value, originalKey, agentId) => {
+	return request_default.patch(memory(originalKey || key, agentId), {
 		key,
 		value
 	});
 };
+const updateMemoryById = (id, value, key, agentId) => {
+	return request_default.patch(memoryById(id, agentId), {
+		value,
+		...key ? { key } : {}
+	});
+};
 const updateMemoryPreferences = (preferences) => {
 	return request_default.patch(memoryPreferences(), preferences);
 };
@@ -6696,6 +8758,24 @@ const getActiveJobs = () => {
 	return request_default.get(activeJobs());
 };
 //#endregion
+Object.defineProperty(exports, "ACTION_METADATA_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return ACTION_METADATA_FILTER_FIELDS;
+	}
+});
+Object.defineProperty(exports, "AGENT_INSTRUCTION_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return AGENT_INSTRUCTION_FILTER_FIELDS;
+	}
+});
+Object.defineProperty(exports, "AUTH_USER_DOC_BY_ID_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return AUTH_USER_DOC_BY_ID_PREFIX;
+	}
+});
 Object.defineProperty(exports, "AccessRoleIds", {
 	enumerable: true,
 	get: function() {
@@ -6756,6 +8836,12 @@ Object.defineProperty(exports, "BASE_ONLY_CONFIG_SECTIONS", {
 		return BASE_ONLY_CONFIG_SECTIONS;
 	}
 });
+Object.defineProperty(exports, "BASE_PRINCIPAL_CONFIG_SECTIONS", {
+	enumerable: true,
+	get: function() {
+		return BASE_PRINCIPAL_CONFIG_SECTIONS;
+	}
+});
 Object.defineProperty(exports, "BedrockProviders", {
 	enumerable: true,
 	get: function() {
@@ -6768,6 +8854,18 @@ Object.defineProperty(exports, "BedrockReasoningConfig", {
 		return BedrockReasoningConfig;
 	}
 });
+Object.defineProperty(exports, "CONVERSATION_STARTER_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return CONVERSATION_STARTER_FILTER_FIELDS;
+	}
+});
+Object.defineProperty(exports, "CONVERSATION_TITLE_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return CONVERSATION_TITLE_FILTER_FIELDS;
+	}
+});
 Object.defineProperty(exports, "CacheKeys", {
 	enumerable: true,
 	get: function() {
@@ -6840,6 +8938,12 @@ Object.defineProperty(exports, "ErrorTypes", {
 		return ErrorTypes;
 	}
 });
+Object.defineProperty(exports, "FEEDBACK_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return FEEDBACK_FILTER_FIELDS;
+	}
+});
 Object.defineProperty(exports, "FEEDBACK_RATINGS", {
 	enumerable: true,
 	get: function() {
@@ -6858,6 +8962,18 @@ Object.defineProperty(exports, "FEEDBACK_TAGS", {
 		return FEEDBACK_TAGS;
 	}
 });
+Object.defineProperty(exports, "FILE_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return FILE_FILTER_FIELDS;
+	}
+});
+Object.defineProperty(exports, "FILTER_PII_STARTER_PATTERNS", {
+	enumerable: true,
+	get: function() {
+		return FILTER_PII_STARTER_PATTERNS;
+	}
+});
 Object.defineProperty(exports, "FetchTokenConfig", {
 	enumerable: true,
 	get: function() {
@@ -6888,6 +9004,12 @@ Object.defineProperty(exports, "ForkOptions", {
 		return ForkOptions;
 	}
 });
+Object.defineProperty(exports, "HITL_MESSAGE_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return HITL_MESSAGE_FILTER_FIELDS;
+	}
+});
 Object.defineProperty(exports, "ImageDetail", {
 	enumerable: true,
 	get: function() {
@@ -6924,94 +9046,202 @@ Object.defineProperty(exports, "LocalStorageKeys", {
 		return LocalStorageKeys;
 	}
 });
-Object.defineProperty(exports, "MAX_SUBAGENTS", {
+Object.defineProperty(exports, "MAX_CHAT_PROJECT_DESCRIPTION_LENGTH", {
 	enumerable: true,
 	get: function() {
-		return MAX_SUBAGENTS;
+		return MAX_CHAT_PROJECT_DESCRIPTION_LENGTH;
 	}
 });
-Object.defineProperty(exports, "MAX_SUBAGENT_DEPTH", {
+Object.defineProperty(exports, "MAX_CHAT_PROJECT_NAME_LENGTH", {
 	enumerable: true,
 	get: function() {
-		return MAX_SUBAGENT_DEPTH;
+		return MAX_CHAT_PROJECT_NAME_LENGTH;
 	}
 });
-Object.defineProperty(exports, "MAX_SUBAGENT_GRAPH_NODES", {
+Object.defineProperty(exports, "MAX_GRAPH_SUBAGENT_MEMBERS", {
 	enumerable: true,
 	get: function() {
-		return MAX_SUBAGENT_GRAPH_NODES;
+		return MAX_GRAPH_SUBAGENT_MEMBERS;
 	}
 });
-Object.defineProperty(exports, "MAX_SUBAGENT_RUN_CONFIGS", {
+Object.defineProperty(exports, "MAX_PII_CUSTOM_PATTERNS_TOTAL", {
 	enumerable: true,
 	get: function() {
-		return MAX_SUBAGENT_RUN_CONFIGS;
+		return MAX_PII_CUSTOM_PATTERNS_TOTAL;
 	}
 });
-Object.defineProperty(exports, "MCPOptionsSchema", {
+Object.defineProperty(exports, "MAX_PII_CUSTOM_REGEX_CHARACTERS", {
 	enumerable: true,
 	get: function() {
-		return MCPOptionsSchema;
+		return MAX_PII_CUSTOM_REGEX_CHARACTERS;
 	}
 });
-Object.defineProperty(exports, "MCPServerUserInputSchema", {
+Object.defineProperty(exports, "MAX_PII_CUSTOM_REGEX_INSTRUCTIONS", {
 	enumerable: true,
 	get: function() {
-		return MCPServerUserInputSchema;
+		return MAX_PII_CUSTOM_REGEX_INSTRUCTIONS;
 	}
 });
-Object.defineProperty(exports, "MCPServersSchema", {
+Object.defineProperty(exports, "MAX_PII_PATTERNS_PER_SOURCE", {
 	enumerable: true,
 	get: function() {
-		return MCPServersSchema;
+		return MAX_PII_PATTERNS_PER_SOURCE;
 	}
 });
-Object.defineProperty(exports, "MCP_USER_INPUT_FIELDS", {
+Object.defineProperty(exports, "MAX_PII_PATTERN_ID_LENGTH", {
 	enumerable: true,
 	get: function() {
-		return MCP_USER_INPUT_FIELDS;
+		return MAX_PII_PATTERN_ID_LENGTH;
 	}
 });
-Object.defineProperty(exports, "MYTHOS_CLASS_FAMILIES", {
+Object.defineProperty(exports, "MAX_PII_PATTERN_LABEL_LENGTH", {
 	enumerable: true,
 	get: function() {
-		return MYTHOS_CLASS_FAMILIES;
+		return MAX_PII_PATTERN_LABEL_LENGTH;
 	}
 });
-Object.defineProperty(exports, "MessageContentTypes", {
+Object.defineProperty(exports, "MAX_PII_PATTERN_LENGTH", {
 	enumerable: true,
 	get: function() {
-		return MessageContentTypes;
+		return MAX_PII_PATTERN_LENGTH;
 	}
 });
-Object.defineProperty(exports, "MutationKeys", {
+Object.defineProperty(exports, "MAX_SUBAGENTS", {
 	enumerable: true,
 	get: function() {
-		return MutationKeys;
+		return MAX_SUBAGENTS;
 	}
 });
-Object.defineProperty(exports, "OCRStrategy", {
+Object.defineProperty(exports, "MAX_SUBAGENTS_CEILING", {
 	enumerable: true,
 	get: function() {
-		return OCRStrategy;
+		return MAX_SUBAGENTS_CEILING;
 	}
 });
-Object.defineProperty(exports, "OptionTypes", {
+Object.defineProperty(exports, "MAX_SUBAGENT_DEPTH", {
 	enumerable: true,
 	get: function() {
-		return OptionTypes;
+		return MAX_SUBAGENT_DEPTH;
 	}
 });
-Object.defineProperty(exports, "PermissionBits", {
+Object.defineProperty(exports, "MAX_SUBAGENT_GRAPH_NODES", {
 	enumerable: true,
 	get: function() {
-		return PermissionBits;
+		return MAX_SUBAGENT_GRAPH_NODES;
 	}
 });
-Object.defineProperty(exports, "PrincipalModel", {
+Object.defineProperty(exports, "MAX_SUBAGENT_RUN_CONFIGS", {
 	enumerable: true,
 	get: function() {
-		return PrincipalModel;
+		return MAX_SUBAGENT_RUN_CONFIGS;
+	}
+});
+Object.defineProperty(exports, "MCPOptionsSchema", {
+	enumerable: true,
+	get: function() {
+		return MCPOptionsSchema;
+	}
+});
+Object.defineProperty(exports, "MCPServerUserInputSchema", {
+	enumerable: true,
+	get: function() {
+		return MCPServerUserInputSchema;
+	}
+});
+Object.defineProperty(exports, "MCPServersSchema", {
+	enumerable: true,
+	get: function() {
+		return MCPServersSchema;
+	}
+});
+Object.defineProperty(exports, "MCP_SERVER_TITLE_ERROR", {
+	enumerable: true,
+	get: function() {
+		return MCP_SERVER_TITLE_ERROR;
+	}
+});
+Object.defineProperty(exports, "MCP_SERVER_TITLE_PATTERN", {
+	enumerable: true,
+	get: function() {
+		return MCP_SERVER_TITLE_PATTERN;
+	}
+});
+Object.defineProperty(exports, "MCP_USER_INPUT_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return MCP_USER_INPUT_FIELDS;
+	}
+});
+Object.defineProperty(exports, "MEMORY_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return MEMORY_FILTER_FIELDS;
+	}
+});
+Object.defineProperty(exports, "MESSAGE_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return MESSAGE_FILTER_FIELDS;
+	}
+});
+Object.defineProperty(exports, "MODEL_PARAMETER_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return MODEL_PARAMETER_FILTER_FIELDS;
+	}
+});
+Object.defineProperty(exports, "MYTHOS_CLASS_FAMILIES", {
+	enumerable: true,
+	get: function() {
+		return MYTHOS_CLASS_FAMILIES;
+	}
+});
+Object.defineProperty(exports, "MemoryScope", {
+	enumerable: true,
+	get: function() {
+		return MemoryScope;
+	}
+});
+Object.defineProperty(exports, "MessageContentTypes", {
+	enumerable: true,
+	get: function() {
+		return MessageContentTypes;
+	}
+});
+Object.defineProperty(exports, "MutationKeys", {
+	enumerable: true,
+	get: function() {
+		return MutationKeys;
+	}
+});
+Object.defineProperty(exports, "OCRStrategy", {
+	enumerable: true,
+	get: function() {
+		return OCRStrategy;
+	}
+});
+Object.defineProperty(exports, "OptionTypes", {
+	enumerable: true,
+	get: function() {
+		return OptionTypes;
+	}
+});
+Object.defineProperty(exports, "PROMPT_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return PROMPT_FILTER_FIELDS;
+	}
+});
+Object.defineProperty(exports, "PermissionBits", {
+	enumerable: true,
+	get: function() {
+		return PermissionBits;
+	}
+});
+Object.defineProperty(exports, "PrincipalModel", {
+	enumerable: true,
+	get: function() {
+		return PrincipalModel;
 	}
 });
 Object.defineProperty(exports, "PrincipalType", {
@@ -7044,12 +9274,24 @@ Object.defineProperty(exports, "RateLimitPrefix", {
 		return RateLimitPrefix;
 	}
 });
+Object.defineProperty(exports, "ReasoningContext", {
+	enumerable: true,
+	get: function() {
+		return ReasoningContext;
+	}
+});
 Object.defineProperty(exports, "ReasoningEffort", {
 	enumerable: true,
 	get: function() {
 		return ReasoningEffort;
 	}
 });
+Object.defineProperty(exports, "ReasoningMode", {
+	enumerable: true,
+	get: function() {
+		return ReasoningMode;
+	}
+});
 Object.defineProperty(exports, "ReasoningParameterFormat", {
 	enumerable: true,
 	get: function() {
@@ -7092,6 +9334,12 @@ Object.defineProperty(exports, "RunStatus", {
 		return RunStatus;
 	}
 });
+Object.defineProperty(exports, "SKILL_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return SKILL_FILTER_FIELDS;
+	}
+});
 Object.defineProperty(exports, "SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH", {
 	enumerable: true,
 	get: function() {
@@ -7122,6 +9370,18 @@ Object.defineProperty(exports, "SSEOptionsSchema", {
 		return SSEOptionsSchema;
 	}
 });
+Object.defineProperty(exports, "STATEFUL_CODE_ENVIRONMENTS", {
+	enumerable: true,
+	get: function() {
+		return STATEFUL_CODE_ENVIRONMENTS;
+	}
+});
+Object.defineProperty(exports, "STORED_MESSAGE_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return STORED_MESSAGE_FILTER_FIELDS;
+	}
+});
 Object.defineProperty(exports, "STTProviders", {
 	enumerable: true,
 	get: function() {
@@ -7170,6 +9430,12 @@ Object.defineProperty(exports, "SettingsViews", {
 		return SettingsViews;
 	}
 });
+Object.defineProperty(exports, "SkillsScope", {
+	enumerable: true,
+	get: function() {
+		return SkillsScope;
+	}
+});
 Object.defineProperty(exports, "StdioOptionsSchema", {
 	enumerable: true,
 	get: function() {
@@ -7194,6 +9460,12 @@ Object.defineProperty(exports, "SystemCategories", {
 		return SystemCategories;
 	}
 });
+Object.defineProperty(exports, "TOOL_ARGUMENT_FILTER_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return TOOL_ARGUMENT_FILTER_FIELDS;
+	}
+});
 Object.defineProperty(exports, "TTSProviders", {
 	enumerable: true,
 	get: function() {
@@ -7284,6 +9556,18 @@ Object.defineProperty(exports, "actionDomainSeparator", {
 		return actionDomainSeparator;
 	}
 });
+Object.defineProperty(exports, "actionMetadataFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return actionMetadataFilterFieldSchema;
+	}
+});
+Object.defineProperty(exports, "agentInstructionFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return agentInstructionFilterFieldSchema;
+	}
+});
 Object.defineProperty(exports, "agentsBaseSchema", {
 	enumerable: true,
 	get: function() {
@@ -7428,6 +9712,12 @@ Object.defineProperty(exports, "bedrockDocumentFormats", {
 		return bedrockDocumentFormats;
 	}
 });
+Object.defineProperty(exports, "bedrockDocumentMimeTypes", {
+	enumerable: true,
+	get: function() {
+		return bedrockDocumentMimeTypes;
+	}
+});
 Object.defineProperty(exports, "bedrockEndpointSchema", {
 	enumerable: true,
 	get: function() {
@@ -7452,6 +9742,12 @@ Object.defineProperty(exports, "buildLoginRedirectUrl", {
 		return buildLoginRedirectUrl;
 	}
 });
+Object.defineProperty(exports, "buildServerNameAliases", {
+	enumerable: true,
+	get: function() {
+		return buildServerNameAliases;
+	}
+});
 Object.defineProperty(exports, "cacheSubsetProviders", {
 	enumerable: true,
 	get: function() {
@@ -7470,6 +9766,24 @@ Object.defineProperty(exports, "checkOpenAIStorage", {
 		return checkOpenAIStorage;
 	}
 });
+Object.defineProperty(exports, "checkpointerSchema", {
+	enumerable: true,
+	get: function() {
+		return checkpointerSchema;
+	}
+});
+Object.defineProperty(exports, "checkpointerTypeSchema", {
+	enumerable: true,
+	get: function() {
+		return checkpointerTypeSchema;
+	}
+});
+Object.defineProperty(exports, "clampSettingRange", {
+	enumerable: true,
+	get: function() {
+		return clampSettingRange;
+	}
+});
 Object.defineProperty(exports, "clearAllConversations", {
 	enumerable: true,
 	get: function() {
@@ -7482,6 +9796,24 @@ Object.defineProperty(exports, "cloudfrontConfigSchema", {
 		return cloudfrontConfigSchema;
 	}
 });
+Object.defineProperty(exports, "codeEnvironmentPermissionDecisionSchema", {
+	enumerable: true,
+	get: function() {
+		return codeEnvironmentPermissionDecisionSchema;
+	}
+});
+Object.defineProperty(exports, "codeEnvironmentUserConfigSchema", {
+	enumerable: true,
+	get: function() {
+		return codeEnvironmentUserConfigSchema;
+	}
+});
+Object.defineProperty(exports, "codeEnvironmentUserSettingsSchema", {
+	enumerable: true,
+	get: function() {
+		return codeEnvironmentUserSettingsSchema;
+	}
+});
 Object.defineProperty(exports, "codeInterpreterMimeTypes", {
 	enumerable: true,
 	get: function() {
@@ -7542,6 +9874,18 @@ Object.defineProperty(exports, "contextPruningSchema", {
 		return contextPruningSchema;
 	}
 });
+Object.defineProperty(exports, "conversationStarterFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return conversationStarterFilterFieldSchema;
+	}
+});
+Object.defineProperty(exports, "conversationTitleFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return conversationTitleFilterFieldSchema;
+	}
+});
 Object.defineProperty(exports, "convertStringsToRegex", {
 	enumerable: true,
 	get: function() {
@@ -7680,12 +10024,24 @@ Object.defineProperty(exports, "eModelEndpointSchema", {
 		return eModelEndpointSchema;
 	}
 });
+Object.defineProperty(exports, "eReasoningContextSchema", {
+	enumerable: true,
+	get: function() {
+		return eReasoningContextSchema;
+	}
+});
 Object.defineProperty(exports, "eReasoningEffortSchema", {
 	enumerable: true,
 	get: function() {
 		return eReasoningEffortSchema;
 	}
 });
+Object.defineProperty(exports, "eReasoningModeSchema", {
+	enumerable: true,
+	get: function() {
+		return eReasoningModeSchema;
+	}
+});
 Object.defineProperty(exports, "eReasoningParameterFormatSchema", {
 	enumerable: true,
 	get: function() {
@@ -7788,6 +10144,12 @@ Object.defineProperty(exports, "extractVariableName", {
 		return extractVariableName;
 	}
 });
+Object.defineProperty(exports, "feedbackFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return feedbackFilterFieldSchema;
+	}
+});
 Object.defineProperty(exports, "feedbackRatingSchema", {
 	enumerable: true,
 	get: function() {
@@ -7818,6 +10180,12 @@ Object.defineProperty(exports, "fileConfigSchema", {
 		return fileConfigSchema;
 	}
 });
+Object.defineProperty(exports, "fileFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return fileFilterFieldSchema;
+	}
+});
 Object.defineProperty(exports, "fileSourceSchema", {
 	enumerable: true,
 	get: function() {
@@ -7836,6 +10204,36 @@ Object.defineProperty(exports, "fileStrategiesSchema", {
 		return fileStrategiesSchema;
 	}
 });
+Object.defineProperty(exports, "filterPiiActionSchema", {
+	enumerable: true,
+	get: function() {
+		return filterPiiActionSchema;
+	}
+});
+Object.defineProperty(exports, "filterPiiCustomPatternSchema", {
+	enumerable: true,
+	get: function() {
+		return filterPiiCustomPatternSchema;
+	}
+});
+Object.defineProperty(exports, "filterPiiRegexSchema", {
+	enumerable: true,
+	get: function() {
+		return filterPiiRegexSchema;
+	}
+});
+Object.defineProperty(exports, "filterPiiStarterPatternSchema", {
+	enumerable: true,
+	get: function() {
+		return filterPiiStarterPatternSchema;
+	}
+});
+Object.defineProperty(exports, "filtersConfigSchema", {
+	enumerable: true,
+	get: function() {
+		return filtersConfigSchema;
+	}
+});
 Object.defineProperty(exports, "fullMimeTypesList", {
 	enumerable: true,
 	get: function() {
@@ -7890,6 +10288,12 @@ Object.defineProperty(exports, "getConfigDefaults", {
 		return getConfigDefaults;
 	}
 });
+Object.defineProperty(exports, "getConfiguredMimeAccept", {
+	enumerable: true,
+	get: function() {
+		return getConfiguredMimeAccept;
+	}
+});
 Object.defineProperty(exports, "getConversationById", {
 	enumerable: true,
 	get: function() {
@@ -7926,12 +10330,30 @@ Object.defineProperty(exports, "getEndpointFileConfig", {
 		return getEndpointFileConfig;
 	}
 });
+Object.defineProperty(exports, "getGoogleThinkingBudgetBounds", {
+	enumerable: true,
+	get: function() {
+		return getGoogleThinkingBudgetBounds;
+	}
+});
+Object.defineProperty(exports, "getGoogleThinkingBudgetMax", {
+	enumerable: true,
+	get: function() {
+		return getGoogleThinkingBudgetMax;
+	}
+});
 Object.defineProperty(exports, "getMCPServerConnectionStatus", {
 	enumerable: true,
 	get: function() {
 		return getMCPServerConnectionStatus;
 	}
 });
+Object.defineProperty(exports, "getMaxSubagents", {
+	enumerable: true,
+	get: function() {
+		return getMaxSubagents;
+	}
+});
 Object.defineProperty(exports, "getModelKey", {
 	enumerable: true,
 	get: function() {
@@ -7944,6 +10366,12 @@ Object.defineProperty(exports, "getModels", {
 		return getModels;
 	}
 });
+Object.defineProperty(exports, "getPiiRegexProgramSize", {
+	enumerable: true,
+	get: function() {
+		return getPiiRegexProgramSize;
+	}
+});
 Object.defineProperty(exports, "getRefillEligibilityDate", {
 	enumerable: true,
 	get: function() {
@@ -8028,12 +10456,36 @@ Object.defineProperty(exports, "googleSettings", {
 		return googleSettings;
 	}
 });
+Object.defineProperty(exports, "hasActiveFiltersConfig", {
+	enumerable: true,
+	get: function() {
+		return hasActiveFiltersConfig;
+	}
+});
+Object.defineProperty(exports, "hasActivePiiFields", {
+	enumerable: true,
+	get: function() {
+		return hasActivePiiFields;
+	}
+});
+Object.defineProperty(exports, "hasActivePiiPatterns", {
+	enumerable: true,
+	get: function() {
+		return hasActivePiiPatterns;
+	}
+});
 Object.defineProperty(exports, "hasPermissions", {
 	enumerable: true,
 	get: function() {
 		return hasPermissions;
 	}
 });
+Object.defineProperty(exports, "hasProcessMCPServerConfig", {
+	enumerable: true,
+	get: function() {
+		return hasProcessMCPServerConfig;
+	}
+});
 Object.defineProperty(exports, "hostImageIdSuffix", {
 	enumerable: true,
 	get: function() {
@@ -8118,6 +10570,18 @@ Object.defineProperty(exports, "isAgentsEndpoint", {
 		return isAgentsEndpoint;
 	}
 });
+Object.defineProperty(exports, "isAnthropicDocumentType", {
+	enumerable: true,
+	get: function() {
+		return isAnthropicDocumentType;
+	}
+});
+Object.defineProperty(exports, "isAnthropicTextDocumentType", {
+	enumerable: true,
+	get: function() {
+		return isAnthropicTextDocumentType;
+	}
+});
 Object.defineProperty(exports, "isAssistantsEndpoint", {
 	enumerable: true,
 	get: function() {
@@ -8166,12 +10630,30 @@ Object.defineProperty(exports, "isPermissiveMimeConfig", {
 		return isPermissiveMimeConfig;
 	}
 });
+Object.defineProperty(exports, "isProcessMCPServerConfig", {
+	enumerable: true,
+	get: function() {
+		return isProcessMCPServerConfig;
+	}
+});
+Object.defineProperty(exports, "isProcessMCPServerField", {
+	enumerable: true,
+	get: function() {
+		return isProcessMCPServerField;
+	}
+});
 Object.defineProperty(exports, "isRemoteOidcUrlAllowed", {
 	enumerable: true,
 	get: function() {
 		return isRemoteOidcUrlAllowed;
 	}
 });
+Object.defineProperty(exports, "isSecureCodeEnvironmentControlURL", {
+	enumerable: true,
+	get: function() {
+		return isSecureCodeEnvironmentControlURL;
+	}
+});
 Object.defineProperty(exports, "isSensitiveEnvVar", {
 	enumerable: true,
 	get: function() {
@@ -8184,12 +10666,24 @@ Object.defineProperty(exports, "isUUID", {
 		return isUUID;
 	}
 });
+Object.defineProperty(exports, "langfuseConfigSchema", {
+	enumerable: true,
+	get: function() {
+		return langfuseConfigSchema;
+	}
+});
 Object.defineProperty(exports, "loginPage", {
 	enumerable: true,
 	get: function() {
 		return loginPage;
 	}
 });
+Object.defineProperty(exports, "materializeModelSpecEndpoints", {
+	enumerable: true,
+	get: function() {
+		return materializeModelSpecEndpoints;
+	}
+});
 Object.defineProperty(exports, "mbToBytes", {
 	enumerable: true,
 	get: function() {
@@ -8202,6 +10696,12 @@ Object.defineProperty(exports, "megabyte", {
 		return megabyte;
 	}
 });
+Object.defineProperty(exports, "memoryFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return memoryFilterFieldSchema;
+	}
+});
 Object.defineProperty(exports, "memorySchema", {
 	enumerable: true,
 	get: function() {
@@ -8214,6 +10714,12 @@ Object.defineProperty(exports, "mergeFileConfig", {
 		return mergeFileConfig;
 	}
 });
+Object.defineProperty(exports, "messageFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return messageFilterFieldSchema;
+	}
+});
 Object.defineProperty(exports, "messageFilterPiiSchema", {
 	enumerable: true,
 	get: function() {
@@ -8238,6 +10744,12 @@ Object.defineProperty(exports, "modelConfigSchema", {
 		return modelConfigSchema;
 	}
 });
+Object.defineProperty(exports, "modelParameterFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return modelParameterFilterFieldSchema;
+	}
+});
 Object.defineProperty(exports, "modelSpecSubagentsSchema", {
 	enumerable: true,
 	get: function() {
@@ -8256,6 +10768,24 @@ Object.defineProperty(exports, "normalizeEndpointName", {
 		return normalizeEndpointName;
 	}
 });
+Object.defineProperty(exports, "normalizeMCPToolKey", {
+	enumerable: true,
+	get: function() {
+		return normalizeMCPToolKey;
+	}
+});
+Object.defineProperty(exports, "normalizeSearxngEngines", {
+	enumerable: true,
+	get: function() {
+		return normalizeSearxngEngines;
+	}
+});
+Object.defineProperty(exports, "normalizeServerName", {
+	enumerable: true,
+	get: function() {
+		return normalizeServerName;
+	}
+});
 Object.defineProperty(exports, "ocrSchema", {
 	enumerable: true,
 	get: function() {
@@ -8316,6 +10846,12 @@ Object.defineProperty(exports, "principalSchema", {
 		return principalSchema;
 	}
 });
+Object.defineProperty(exports, "promptFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return promptFilterFieldSchema;
+	}
+});
 Object.defineProperty(exports, "providerEndpointMap", {
 	enumerable: true,
 	get: function() {
@@ -8370,18 +10906,48 @@ Object.defineProperty(exports, "resetPassword", {
 		return resetPassword;
 	}
 });
+Object.defineProperty(exports, "resolveAgentSkillsScope", {
+	enumerable: true,
+	get: function() {
+		return resolveAgentSkillsScope;
+	}
+});
+Object.defineProperty(exports, "resolveAllowedStatefulCodeEnvironments", {
+	enumerable: true,
+	get: function() {
+		return resolveAllowedStatefulCodeEnvironments;
+	}
+});
 Object.defineProperty(exports, "resolveEndpointType", {
 	enumerable: true,
 	get: function() {
 		return resolveEndpointType;
 	}
 });
+Object.defineProperty(exports, "resolveModelSpecEndpoint", {
+	enumerable: true,
+	get: function() {
+		return resolveModelSpecEndpoint;
+	}
+});
+Object.defineProperty(exports, "resolveStatefulCodeEnvironment", {
+	enumerable: true,
+	get: function() {
+		return resolveStatefulCodeEnvironment;
+	}
+});
 Object.defineProperty(exports, "resourcePermissionsResponseSchema", {
 	enumerable: true,
 	get: function() {
 		return resourcePermissionsResponseSchema;
 	}
 });
+Object.defineProperty(exports, "retainRecentConfigSchema", {
+	enumerable: true,
+	get: function() {
+		return retainRecentConfigSchema;
+	}
+});
 Object.defineProperty(exports, "retrievalMimeTypes", {
 	enumerable: true,
 	get: function() {
@@ -8418,6 +10984,24 @@ Object.defineProperty(exports, "setAcceptLanguageHeader", {
 		return setAcceptLanguageHeader;
 	}
 });
+Object.defineProperty(exports, "setFileConfigRegexCompiler", {
+	enumerable: true,
+	get: function() {
+		return setFileConfigRegexCompiler;
+	}
+});
+Object.defineProperty(exports, "setMaxSubagents", {
+	enumerable: true,
+	get: function() {
+		return setMaxSubagents;
+	}
+});
+Object.defineProperty(exports, "setMessageFilterRegexValidator", {
+	enumerable: true,
+	get: function() {
+		return setMessageFilterRegexValidator;
+	}
+});
 Object.defineProperty(exports, "setTokenHeader", {
 	enumerable: true,
 	get: function() {
@@ -8430,6 +11014,12 @@ Object.defineProperty(exports, "sharedFileDownload", {
 		return sharedFileDownload;
 	}
 });
+Object.defineProperty(exports, "skillFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return skillFilterFieldSchema;
+	}
+});
 Object.defineProperty(exports, "skillSyncConfigSchema", {
 	enumerable: true,
 	get: function() {
@@ -8454,6 +11044,36 @@ Object.defineProperty(exports, "specsConfigSchema", {
 		return specsConfigSchema;
 	}
 });
+Object.defineProperty(exports, "splitMCPToolKey", {
+	enumerable: true,
+	get: function() {
+		return splitMCPToolKey;
+	}
+});
+Object.defineProperty(exports, "splitToolCallName", {
+	enumerable: true,
+	get: function() {
+		return splitToolCallName;
+	}
+});
+Object.defineProperty(exports, "stripServerNamePrefix", {
+	enumerable: true,
+	get: function() {
+		return stripServerNamePrefix;
+	}
+});
+Object.defineProperty(exports, "stripServerNamePrefixes", {
+	enumerable: true,
+	get: function() {
+		return stripServerNamePrefixes;
+	}
+});
+Object.defineProperty(exports, "subagentThreadLineageSchema", {
+	enumerable: true,
+	get: function() {
+		return subagentThreadLineageSchema;
+	}
+});
 Object.defineProperty(exports, "summarizationConfigSchema", {
 	enumerable: true,
 	get: function() {
@@ -8574,6 +11194,30 @@ Object.defineProperty(exports, "toMinimalFeedback", {
 		return toMinimalFeedback;
 	}
 });
+Object.defineProperty(exports, "toolApprovalHookConfigSchema", {
+	enumerable: true,
+	get: function() {
+		return toolApprovalHookConfigSchema;
+	}
+});
+Object.defineProperty(exports, "toolApprovalModeSchema", {
+	enumerable: true,
+	get: function() {
+		return toolApprovalModeSchema;
+	}
+});
+Object.defineProperty(exports, "toolApprovalPolicySchema", {
+	enumerable: true,
+	get: function() {
+		return toolApprovalPolicySchema;
+	}
+});
+Object.defineProperty(exports, "toolArgumentFilterFieldSchema", {
+	enumerable: true,
+	get: function() {
+		return toolArgumentFilterFieldSchema;
+	}
+});
 Object.defineProperty(exports, "transactionsSchema", {
 	enumerable: true,
 	get: function() {
@@ -8592,6 +11236,12 @@ Object.defineProperty(exports, "turnstileSchema", {
 		return turnstileSchema;
 	}
 });
+Object.defineProperty(exports, "unattributedAssistantContentSchema", {
+	enumerable: true,
+	get: function() {
+		return unattributedAssistantContentSchema;
+	}
+});
 Object.defineProperty(exports, "updateFeedback", {
 	enumerable: true,
 	get: function() {
@@ -8652,6 +11302,12 @@ Object.defineProperty(exports, "userKeyQuery", {
 		return userKeyQuery;
 	}
 });
+Object.defineProperty(exports, "userSubmittedMessageFieldPathSchema", {
+	enumerable: true,
+	get: function() {
+		return userSubmittedMessageFieldPathSchema;
+	}
+});
 Object.defineProperty(exports, "validateSettingDefinitions", {
 	enumerable: true,
 	get: function() {
@@ -8695,4 +11351,4 @@ Object.defineProperty(exports, "webSearchSchema", {
 	}
 });
 
-//# sourceMappingURL=data-service-XTxx76uB.js.map
+//# sourceMappingURL=data-service-D5kHzBt-.js.map