librechat-data-provider 0.8.522 → 0.8.524

package/dist/{data-service-CaB7saTP.mjs → data-service-B-WUVvTH.mjs}

@@ -330,6 +330,75 @@ const filtersConfigSchema = z.object({
 	});
 });
 //#endregion
+//#region src/code/workspace.ts
+const CODE_WORKSPACE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+/** Protocol-v1 ceiling enforced by the worker and Code API. */
+const CODE_WORKSPACE_MAX_COUNT = 32;
+/** API/client protocol for immutable conversation-owned environment decisions. */
+const CODE_ENVIRONMENT_DECISION_VERSION = 1;
+/** API/client protocol for an owner's explicit move of a sealed environment decision. */
+const CODE_ENVIRONMENT_MOVE_VERSION = 1;
+const CODE_WORKSPACE_OPERATIONS = [
+	"read_file",
+	"search_text",
+	"list_files",
+	"write_file",
+	"preview_edit",
+	"edit_file",
+	"execute_command"
+];
+const CODE_WORKSPACE_INSTANCE_TYPES = ["git_worktree"];
+const CODE_WORKSPACE_SELECTION_ERROR_REASONS = [
+	"required",
+	"invalid",
+	"worker_unavailable",
+	"unsupported",
+	"missing",
+	"locked"
+];
+const CODE_ENVIRONMENT_MODES = ["attached", "without_attached"];
+function isRepositoryInstructionDescriptor(value) {
+	if (value == null || typeof value !== "object") return false;
+	const descriptor = value;
+	return Object.keys(descriptor).every((key) => [
+		"path",
+		"bytes",
+		"sha256",
+		"truncated"
+	].includes(key)) && (descriptor.path === "AGENTS.md" || descriptor.path === "CLAUDE.md") && Number.isSafeInteger(descriptor.bytes) && Number(descriptor.bytes) >= 0 && Number(descriptor.bytes) <= 32768 && typeof descriptor.sha256 === "string" && /^[a-f0-9]{64}$/.test(descriptor.sha256) && typeof descriptor.truncated === "boolean";
+}
+function isCodeWorkspaceEnvironment(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return false;
+	const environment = value;
+	return Object.keys(environment).every((key) => [
+		"fingerprint",
+		"repo",
+		"ref",
+		"actions"
+	].includes(key)) && typeof environment.fingerprint === "string" && /^[a-f0-9]{64}$/.test(environment.fingerprint) && (environment.repo === void 0 || typeof environment.repo === "string" && environment.repo.length <= 256 && /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(environment.repo)) && (environment.ref === void 0 || typeof environment.ref === "string" && environment.ref.trim().length > 0 && environment.ref.length <= 256 && !/[\0\r\n]/.test(environment.ref)) && Array.isArray(environment.actions) && environment.actions.length <= 32 && environment.actions.every((name) => typeof name === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(name)) && new Set(environment.actions).size === environment.actions.length;
+}
+function isCodeEnvironmentMode(value) {
+	return CODE_ENVIRONMENT_MODES.some((mode) => mode === value);
+}
+function isCodeWorkspaceSelectionErrorReason(value) {
+	return CODE_WORKSPACE_SELECTION_ERROR_REASONS.some((reason) => reason === value);
+}
+function isCodeWorkspaceSelection(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return false;
+	const selection = value;
+	return Object.keys(selection).every((key) => key === "environmentId" || key === "workspaceId") && typeof selection.environmentId === "string" && CODE_WORKSPACE_ID_PATTERN.test(selection.environmentId) && typeof selection.workspaceId === "string" && CODE_WORKSPACE_ID_PATTERN.test(selection.workspaceId);
+}
+/** One exact workspace per attached environment used by a conversation. */
+function isCodeWorkspaceSelections(value) {
+	if (!Array.isArray(value)) return false;
+	const environmentIds = /* @__PURE__ */ new Set();
+	return value.every((selection) => {
+		if (!isCodeWorkspaceSelection(selection) || environmentIds.has(selection.environmentId)) return false;
+		environmentIds.add(selection.environmentId);
+		return true;
+	});
+}
+//#endregion
 //#region src/feedback.ts
 const FEEDBACK_RATINGS = ["thumbsUp", "thumbsDown"];
 const FEEDBACK_REASON_KEYS = [
@@ -439,26 +508,64 @@ function getTagByKey(key) {
 	return FEEDBACK_TAGS.find((tag) => tag.key === key);
 }
 //#endregion
-//#region src/stateful-code.ts
-const STATEFUL_CODE_ENVIRONMENTS = [
-	"user",
-	"agent-user",
-	"conversation"
+//#region src/code/approval.ts
+const CODE_APPROVAL_MODES = [
+	"ask",
+	"acceptEdits",
+	"fullAccess"
 ];
-/** Resolve a deployment allowlist in stable UI order. An omitted value preserves
-* the backward-compatible behavior where every environment is available. */
-function resolveAllowedStatefulCodeEnvironments(configured) {
-	if (configured == null) return [...STATEFUL_CODE_ENVIRONMENTS];
-	const configuredSet = new Set(configured);
-	return STATEFUL_CODE_ENVIRONMENTS.filter((environment) => configuredSet.has(environment));
+const MODE_PERMISSIONS = {
+	ask: {
+		fileWrite: "ask",
+		commandExecution: "ask"
+	},
+	acceptEdits: {
+		fileWrite: "allow",
+		commandExecution: "ask"
+	},
+	fullAccess: {
+		fileWrite: "allow",
+		commandExecution: "allow"
+	}
+};
+/** Omitted deployment configuration never grants unattended execution. */
+function getAllowedCodeApprovalModes({ enabled, allowedModes, configSchema, settings, environment }) {
+	if (enabled === false) return [];
+	const permitted = new Set(allowedModes ?? ["ask"]);
+	return CODE_APPROVAL_MODES.filter((mode) => {
+		if (!permitted.has(mode)) return false;
+		if (environment === "managed") return true;
+		for (const category of ["fileWrite", "commandExecution"]) {
+			if (MODE_PERMISSIONS[mode][category] !== "allow") continue;
+			const field = configSchema?.permissions?.[category];
+			const configured = settings?.permissions?.[category];
+			if ((configured != null && field?.allowed.includes(configured) === true ? configured : field?.default ?? "ask") === "deny" || field?.allowed.includes("allow") !== true) return false;
+		}
+		return true;
+	});
 }
-/** Keep an allowed preference, otherwise select the first deployment-allowed scope. */
-function resolveStatefulCodeEnvironment(preferred, configured) {
-	const allowed = resolveAllowedStatefulCodeEnvironments(configured);
-	return preferred != null && allowed.includes(preferred) ? preferred : allowed[0];
+var CodeApprovalModeError = class extends Error {
+	constructor() {
+		super("The selected code approval mode is not permitted by the current policy.");
+		this.code = "CODE_APPROVAL_MODE_NOT_ALLOWED";
+		this.name = "CodeApprovalModeError";
+	}
+};
+/** Validate untrusted request state again at admission, including after policy changes. */
+function resolveCodeApprovalMode(requested, constraints) {
+	if (requested == null) return void 0;
+	const selected = getAllowedCodeApprovalModes(constraints).find((mode) => mode === requested);
+	if (selected == null) throw new CodeApprovalModeError();
+	return selected;
+}
+/** Apply a turn preference without modifying machine settings or overriding an existing deny. */
+function resolveCodePermissionDecision({ mode, category, decision }) {
+	if (mode == null || decision === "deny") return decision;
+	if (MODE_PERMISSIONS[mode] == null) throw new CodeApprovalModeError();
+	return MODE_PERMISSIONS[mode][category];
 }
 //#endregion
-//#region src/types/assistants.ts
+//#region src/types/tools.ts
 let Tools = /* @__PURE__ */ function(Tools) {
 	Tools["execute_code"] = "execute_code";
 	Tools["code_interpreter"] = "code_interpreter";
@@ -482,35 +589,6 @@ let EToolResources = /* @__PURE__ */ function(EToolResources) {
 	EToolResources["ocr"] = "ocr";
 	return EToolResources;
 }({});
-let AnnotationTypes = /* @__PURE__ */ function(AnnotationTypes) {
-	AnnotationTypes["FILE_CITATION"] = "file_citation";
-	AnnotationTypes["FILE_PATH"] = "file_path";
-	return AnnotationTypes;
-}({});
-let StepStatus = /* @__PURE__ */ function(StepStatus) {
-	StepStatus["IN_PROGRESS"] = "in_progress";
-	StepStatus["CANCELLED"] = "cancelled";
-	StepStatus["FAILED"] = "failed";
-	StepStatus["COMPLETED"] = "completed";
-	StepStatus["EXPIRED"] = "expired";
-	return StepStatus;
-}({});
-let MessageContentTypes = /* @__PURE__ */ function(MessageContentTypes) {
-	MessageContentTypes["TEXT"] = "text";
-	MessageContentTypes["IMAGE_FILE"] = "image_file";
-	return MessageContentTypes;
-}({});
-let RunStatus = /* @__PURE__ */ function(RunStatus) {
-	RunStatus["QUEUED"] = "queued";
-	RunStatus["IN_PROGRESS"] = "in_progress";
-	RunStatus["REQUIRES_ACTION"] = "requires_action";
-	RunStatus["CANCELLING"] = "cancelling";
-	RunStatus["CANCELLED"] = "cancelled";
-	RunStatus["FAILED"] = "failed";
-	RunStatus["COMPLETED"] = "completed";
-	RunStatus["EXPIRED"] = "expired";
-	return RunStatus;
-}({});
 const actionDelimiter = "_action_";
 const actionDomainSeparator = "---";
 /** Mirrors `Constants.mcp_delimiter`; duplicated here to avoid a circular import from `config.ts`. */
@@ -538,46 +616,6 @@ function isActionTool(toolName) {
 	const mcpIdx = toolName.indexOf(mcpDelimiter);
 	return mcpIdx < 0 || mcpIdx < actionIdx;
 }
-const hostImageIdSuffix = "_host_copy";
-const hostImageNamePrefix = "host_copy_";
-let FilePurpose = /* @__PURE__ */ function(FilePurpose) {
-	FilePurpose["Vision"] = "vision";
-	FilePurpose["FineTune"] = "fine-tune";
-	FilePurpose["FineTuneResults"] = "fine-tune-results";
-	FilePurpose["Assistants"] = "assistants";
-	FilePurpose["AssistantsOutput"] = "assistants_output";
-	return FilePurpose;
-}({});
-const defaultOrderQuery = {
-	order: "desc",
-	limit: 100
-};
-let AssistantStreamEvents = /* @__PURE__ */ function(AssistantStreamEvents) {
-	AssistantStreamEvents["ThreadCreated"] = "thread.created";
-	AssistantStreamEvents["ThreadRunCreated"] = "thread.run.created";
-	AssistantStreamEvents["ThreadRunQueued"] = "thread.run.queued";
-	AssistantStreamEvents["ThreadRunInProgress"] = "thread.run.in_progress";
-	AssistantStreamEvents["ThreadRunRequiresAction"] = "thread.run.requires_action";
-	AssistantStreamEvents["ThreadRunCompleted"] = "thread.run.completed";
-	AssistantStreamEvents["ThreadRunFailed"] = "thread.run.failed";
-	AssistantStreamEvents["ThreadRunCancelling"] = "thread.run.cancelling";
-	AssistantStreamEvents["ThreadRunCancelled"] = "thread.run.cancelled";
-	AssistantStreamEvents["ThreadRunExpired"] = "thread.run.expired";
-	AssistantStreamEvents["ThreadRunStepCreated"] = "thread.run.step.created";
-	AssistantStreamEvents["ThreadRunStepInProgress"] = "thread.run.step.in_progress";
-	AssistantStreamEvents["ThreadRunStepCompleted"] = "thread.run.step.completed";
-	AssistantStreamEvents["ThreadRunStepFailed"] = "thread.run.step.failed";
-	AssistantStreamEvents["ThreadRunStepCancelled"] = "thread.run.step.cancelled";
-	AssistantStreamEvents["ThreadRunStepExpired"] = "thread.run.step.expired";
-	AssistantStreamEvents["ThreadRunStepDelta"] = "thread.run.step.delta";
-	AssistantStreamEvents["ThreadMessageCreated"] = "thread.message.created";
-	AssistantStreamEvents["ThreadMessageInProgress"] = "thread.message.in_progress";
-	AssistantStreamEvents["ThreadMessageCompleted"] = "thread.message.completed";
-	AssistantStreamEvents["ThreadMessageIncomplete"] = "thread.message.incomplete";
-	AssistantStreamEvents["ThreadMessageDelta"] = "thread.message.delta";
-	AssistantStreamEvents["ErrorEvent"] = "error";
-	return AssistantStreamEvents;
-}({});
 //#endregion
 //#region src/schemas.ts
 const isUUID = z.string().uuid();
@@ -673,7 +711,35 @@ const inputTokensIncludesCache = (provider) => {
 	return cacheSubsetProviders.has(provider ?? "");
 };
 const isDocumentSupportedProvider = (provider) => {
-	return documentSupportedProviders.has(provider ?? "");
+	const normalized = provider?.toLowerCase() ?? "";
+	return Array.from(documentSupportedProviders).some((candidate) => candidate.toLowerCase() === normalized);
+};
+/**
+* Endpoints whose encoders actually build native audio/video payloads. Narrower than
+* `documentSupportedProviders`: a provider can accept PDFs and still emit nothing for
+* media, in which case the upload has to fall back to text/STT.
+*/
+const mediaSupportedProviders = new Set([
+	"google",
+	"vertexai",
+	"openrouter"
+]);
+const isMediaSupportedProvider = (provider) => {
+	return mediaSupportedProviders.has(provider?.toLowerCase() ?? "");
+};
+/**
+* Built-in endpoint and provider identifiers. A name outside this set is a custom
+* endpoint whose real provider is resolved at request time, so its capabilities
+* cannot be judged from the name alone.
+*/
+const knownProviderIdentifiers = new Set([
+	...Object.values(EModelEndpoint),
+	...Object.values(Providers),
+	...Object.values(EModelEndpoint).map((provider) => provider.toLowerCase()),
+	...Object.values(Providers).map((provider) => provider.toLowerCase())
+]);
+const isKnownProviderIdentifier = (provider) => {
+	return knownProviderIdentifiers.has(provider?.toLowerCase() ?? "");
 };
 const paramEndpoints = new Set([
 	"agents",
@@ -876,6 +942,8 @@ const defaultAgentFormValues = {
 	["memory"]: false,
 	stateful_code_environment: "user",
 	code_environment_id: void 0,
+	code_workspace_id: void 0,
+	repositoryInstructions: void 0,
 	category: "general",
 	support_contact: {
 		name: "",
@@ -1366,6 +1434,12 @@ const tConversationSchema = z.object({
 	pinned: z.boolean().optional(),
 	/** Server-derived: an active shared link exists for this conversation. Not persisted. */
 	isShared: z.boolean().optional(),
+	codeApprovalMode: z.enum(CODE_APPROVAL_MODES).optional(),
+	codeEnvironmentMode: z.enum(CODE_ENVIRONMENT_MODES).optional(),
+	codeWorkspaces: z.array(z.object({
+		environmentId: z.string().regex(CODE_WORKSPACE_ID_PATTERN),
+		workspaceId: z.string().regex(CODE_WORKSPACE_ID_PATTERN)
+	}).strict()).optional(),
 	title: z.string().nullable().or(z.literal("New Chat")).default("New Chat"),
 	user: z.string().optional(),
 	messages: z.array(z.string()).optional(),
@@ -1847,6 +1921,72 @@ const compactAgentsBaseSchema = tConversationSchema.pick({
 });
 const compactAgentsSchema = compactAgentsBaseSchema.transform((obj) => removeNullishValues(obj)).catch(() => ({}));
 //#endregion
+//#region src/balance.ts
+const REFILL_INTERVAL_UNITS = [
+	"seconds",
+	"minutes",
+	"hours",
+	"days",
+	"weeks",
+	"months"
+];
+/** How long an unreleased in-flight balance reservation keeps counting against the balance. */
+const DEFAULT_BALANCE_RESERVATION_TTL_MS = 1800 * 1e3;
+/** Shortest reservation TTL; a live reservation is renewed every half TTL. */
+const MIN_BALANCE_RESERVATION_TTL_MS = 10 * 1e3;
+function getRefillEligibilityDate(lastRefill, value, unit) {
+	const result = new Date(lastRefill);
+	switch (unit) {
+		case "seconds":
+			result.setSeconds(result.getSeconds() + value);
+			return result;
+		case "minutes":
+			result.setMinutes(result.getMinutes() + value);
+			return result;
+		case "hours":
+			result.setHours(result.getHours() + value);
+			return result;
+		case "days":
+			result.setDate(result.getDate() + value);
+			return result;
+		case "weeks":
+			result.setDate(result.getDate() + value * 7);
+			return result;
+		case "months":
+			result.setMonth(result.getMonth() + value);
+			return result;
+		default: return result;
+	}
+}
+//#endregion
+//#region src/limits.ts
+/** Maximum number of explicit subagents per parent agent. UI + Zod schema share this. */
+const MAX_SUBAGENTS = 10;
+/** Hard upper bound for `endpoints.agents.maxSubagents`, keeping the request-validation
+*  cap bounded no matter what the config file says. */
+const MAX_SUBAGENTS_CEILING = 50;
+let maxSubagents = 10;
+/** Effective subagents-per-agent cap; initialized from `endpoints.agents.maxSubagents` at startup. */
+const getMaxSubagents = () => maxSubagents;
+/** Applies a configured cap; any missing or out-of-range value resets to the default. */
+const setMaxSubagents = (value) => {
+	maxSubagents = typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 50 ? value : 10;
+};
+/** Chat project field limits. The dialogs and the persistence layer share these,
+*  so the inputs stop at the same point the server would otherwise truncate. */
+const MAX_CHAT_PROJECT_NAME_LENGTH = 100;
+const MAX_CHAT_PROJECT_DESCRIPTION_LENGTH = 1e3;
+/** Mirrors the bounded graph-child member limit in `@librechat/agents`. */
+const MAX_GRAPH_SUBAGENT_MEMBERS = 32;
+/** Characters of retained tool output one stopped turn may be tokenized for, so the
+*  context gauge can add an exact figure instead of an estimate. The schema default
+*  and the save path share it; tokenizing runs ~60 ms/MB, once per stopped turn. */
+const DEFAULT_MAX_RETAINED_TOOL_COUNT_CHARS = 8 * 1024 * 1024;
+/** Token ceiling for the block of Ask User answers carried verbatim in an agent's
+*  user context (`endpoints.agents.askUserQuestion.retainedAnswers.maxTokens`).
+*  Older answers drop first once the block exceeds it; the newest set is always kept. */
+const DEFAULT_RETAINED_ANSWER_TOKENS = 4096;
+//#endregion
 //#region src/generate.ts
 let ComponentTypes = /* @__PURE__ */ function(ComponentTypes) {
 	ComponentTypes["Input"] = "input";
@@ -2245,30 +2385,30 @@ const generateGoogleSchema = (customGoogle) => {
 	}));
 };
 //#endregion
-//#region src/limits.ts
-/** Maximum number of explicit subagents per parent agent. UI + Zod schema share this. */
-const MAX_SUBAGENTS = 10;
-/** Hard upper bound for `endpoints.agents.maxSubagents`, keeping the request-validation
-*  cap bounded no matter what the config file says. */
-const MAX_SUBAGENTS_CEILING = 50;
-let maxSubagents = 10;
-/** Effective subagents-per-agent cap; initialized from `endpoints.agents.maxSubagents` at startup. */
-const getMaxSubagents = () => maxSubagents;
-/** Applies a configured cap; any missing or out-of-range value resets to the default. */
-const setMaxSubagents = (value) => {
-	maxSubagents = typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 50 ? value : 10;
-};
-/** Chat project field limits. The dialogs and the persistence layer share these,
-*  so the inputs stop at the same point the server would otherwise truncate. */
-const MAX_CHAT_PROJECT_NAME_LENGTH = 100;
-const MAX_CHAT_PROJECT_DESCRIPTION_LENGTH = 1e3;
-/** Mirrors the bounded graph-child member limit in `@librechat/agents`. */
-const MAX_GRAPH_SUBAGENT_MEMBERS = 32;
+//#region src/stateful-code.ts
+const STATEFUL_CODE_ENVIRONMENTS = [
+	"user",
+	"agent-user",
+	"conversation"
+];
+/** Resolve a deployment allowlist in stable UI order. An omitted value preserves
+* the backward-compatible behavior where every environment is available. */
+function resolveAllowedStatefulCodeEnvironments(configured) {
+	if (configured == null) return [...STATEFUL_CODE_ENVIRONMENTS];
+	const configuredSet = new Set(configured);
+	return STATEFUL_CODE_ENVIRONMENTS.filter((environment) => configuredSet.has(environment));
+}
+/** Keep an allowed preference, otherwise select the first deployment-allowed scope. */
+function resolveStatefulCodeEnvironment(preferred, configured) {
+	const allowed = resolveAllowedStatefulCodeEnvironments(configured);
+	return preferred != null && allowed.includes(preferred) ? preferred : allowed[0];
+}
 //#endregion
 //#region src/models.ts
 const modelSpecSubagentsSchema = z.object({
 	enabled: z.boolean().optional(),
 	allowSelf: z.boolean().optional(),
+	shareFiles: z.boolean().optional(),
 	agent_ids: z.array(z.string()).optional()
 }).superRefine((subagents, ctx) => {
 	const maxSubagents = getMaxSubagents();
@@ -2362,41 +2502,9 @@ const specsConfigSchema = z.object({
 	addedEndpoints: z.array(z.union([z.string(), eModelEndpointSchema])).optional()
 });
 //#endregion
-//#region src/balance.ts
-const REFILL_INTERVAL_UNITS = [
-	"seconds",
-	"minutes",
-	"hours",
-	"days",
-	"weeks",
-	"months"
-];
-function getRefillEligibilityDate(lastRefill, value, unit) {
-	const result = new Date(lastRefill);
-	switch (unit) {
-		case "seconds":
-			result.setSeconds(result.getSeconds() + value);
-			return result;
-		case "minutes":
-			result.setMinutes(result.getMinutes() + value);
-			return result;
-		case "hours":
-			result.setHours(result.getHours() + value);
-			return result;
-		case "days":
-			result.setDate(result.getDate() + value);
-			return result;
-		case "weeks":
-			result.setDate(result.getDate() + value * 7);
-			return result;
-		case "months":
-			result.setMonth(result.getMonth() + value);
-			return result;
-		default: return result;
-	}
-}
-//#endregion
 //#region src/file-config.ts
+/** Parallel storage deletions during rollback of a failed skill archive import. */
+const DEFAULT_SKILL_IMPORT_CLEANUP_CONCURRENCY = 8;
 const supportsFiles = {
 	["openAI"]: true,
 	["google"]: true,
@@ -2550,6 +2658,68 @@ const bedrockDocumentFormats = {
 	"text/plain": "txt",
 	"text/markdown": "md"
 };
+/**
+* Whether an upload belongs to the conversation rather than to the agent. The value
+* arrives from multipart form data, so it can be the string "false", which is truthy.
+* Shared so the route, the authorization check and processing cannot disagree about it.
+*/
+const isMessageFileUpload = (value) => value === true || value === "true";
+/**
+* Whether the upload's conversation uses the Responses API, which decides whether Azure
+* can carry a document natively. Multipart form data has no booleans, so it arrives as
+* the string "true".
+*/
+const isResponsesApiUpload = (value) => value === true || value === "true";
+/**
+* The name a file carries inside the code sandbox.
+*
+* Image uploads are converted to the configured output type while the record keeps the
+* original filename, so the extension has to follow the stored bytes or the sandbox
+* decoder is handed a mismatch. Provisioning and priming both resolve the mount path
+* from here: deriving it twice under different rules leaves a later turn advertising a
+* path that does not exist in the sandbox.
+*/
+const resolveSandboxFilename = (filename, mimeType) => {
+	if (!mimeType?.startsWith("image/")) return filename;
+	const subtype = mimeType.slice(6);
+	if (![
+		"webp",
+		"png",
+		"jpeg",
+		"gif"
+	].includes(subtype)) return filename;
+	const accepted = subtype === "jpeg" ? [".jpg", ".jpeg"] : [`.${subtype}`];
+	const lastDot = filename.lastIndexOf(".");
+	const currentExt = lastDot > 0 ? filename.slice(lastDot).toLowerCase() : "";
+	if (accepted.includes(currentExt)) return filename;
+	return `${lastDot > 0 ? filename.slice(0, lastDot) : filename}${accepted[0]}`;
+};
+/**
+* The Responses setting a turn actually runs on. A saved agent's own record wins, since
+* execution reads its model parameters; a conversation only answers for itself. Upload
+* and delivery must agree here, or a document is stored as raw provider content and then
+* re-resolved to text it has no extraction for.
+*/
+const resolveUseResponsesApi = (agentValue, conversationValue) => agentValue ?? conversationValue ?? void 0;
+/** Models whose native OpenAI and Azure execution defaults to Responses. Keep
+* this shared with client upload routing so documents follow the API that the
+* backend will actually invoke. Explicit false remains an opt-out. */
+const prefersResponsesApiByModel = (model) => typeof model === "string" && /^gpt-6-(?:astra|sol|luna)(?:-|$)/i.test(model);
+/** The server has transport and administrator settings the browser cannot see.
+* Missing policy never enables model-based uploads (including during upgrades). */
+const resolveEffectiveUseResponsesApi = ({ value, endpoint, model, routing, webSearch }) => {
+	if (endpoint !== "openAI" && endpoint !== "azureOpenAI") return value ?? void 0;
+	let policy = model ? routing?.[model] : void 0;
+	if (!policy && model && prefersResponsesApiByModel(model)) {
+		const family = /^gpt-6-(?:astra|sol|luna)(?=-|$)/i.exec(model)?.[0].toLowerCase();
+		policy = family ? routing?.[`${family}-*`] : void 0;
+	}
+	policy ??= routing?.["*"];
+	if (!policy) return value ?? void 0;
+	if (webSearch && policy.withWebSearch) policy = policy.withWebSearch;
+	if (value == null) return policy.default;
+	return value ? policy.on : policy.off;
+};
 const isBedrockDocumentType = (mimeType) => mimeType != null && mimeType in bedrockDocumentFormats;
 /** MIME types Bedrock's Converse document path can send to the model (mirrors `bedrockDocumentFormats`). */
 const bedrockDocumentMimeTypes = Object.keys(bedrockDocumentFormats);
@@ -2783,6 +2953,8 @@ const mbToBytes = (mb) => mb * megabyte;
 const defaultSizeLimit = mbToBytes(512);
 const defaultSkillImportSizeLimit = mbToBytes(50);
 const defaultTokenLimit = 1e5;
+const defaultContextSizeLimit = mbToBytes(128);
+const defaultContextCharLimit = 1e6;
 const assistantsFileConfig = {
 	fileLimit: 10,
 	fileSizeLimit: defaultSizeLimit,
@@ -2810,10 +2982,15 @@ const fileConfig = {
 			disabled: false
 		}
 	},
-	skills: { fileSizeLimit: defaultSkillImportSizeLimit },
+	skills: {
+		fileSizeLimit: defaultSkillImportSizeLimit,
+		importCleanupConcurrency: 8
+	},
 	serverFileSizeLimit: defaultSizeLimit,
 	avatarSizeLimit: mbToBytes(2),
 	fileTokenLimit: defaultTokenLimit,
+	fileContextSizeLimit: defaultContextSizeLimit,
+	fileContextCharLimit: defaultContextCharLimit,
 	clientImageResize: {
 		enabled: false,
 		maxWidth: 1900,
@@ -2828,21 +3005,48 @@ const fileConfig = {
 		return supportedTypes.some((regex) => regex.test(fileType));
 	}
 };
-const supportedMimeTypesSchema = z.array(z.string()).optional();
+const supportedMimeTypesSchema = z.array(z.string().superRefine((pattern, context) => {
+	try {
+		compileMimeRegex(pattern);
+	} catch {
+		context.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: "Invalid MIME type regex: not supported by the configured regex engine"
+		});
+	}
+})).optional();
+const DefaultLLMDeliveryPath = z.enum([
+	"provider",
+	"text",
+	"none"
+]);
+const defaultLLMDeliveryPathSchema = z.object({
+	fallback: DefaultLLMDeliveryPath.optional(),
+	overrides: z.record(DefaultLLMDeliveryPath).optional()
+});
 const endpointFileConfigSchema = z.object({
 	disabled: z.boolean().optional(),
 	fileLimit: z.number().min(0).optional(),
 	fileSizeLimit: z.number().min(0).optional(),
 	totalSizeLimit: z.number().min(0).optional(),
-	supportedMimeTypes: supportedMimeTypesSchema.optional()
+	supportedMimeTypes: supportedMimeTypesSchema.optional(),
+	defaultLLMDeliveryPath: defaultLLMDeliveryPathSchema.optional(),
+	legacyFileUploadUX: z.boolean().optional(),
+	textFallbackWithoutTools: z.boolean().optional()
+});
+const skillFileConfigSchema = z.object({
+	fileSizeLimit: z.number().min(0).optional(),
+	importCleanupConcurrency: z.number().int().positive().optional()
 });
-const skillFileConfigSchema = z.object({ fileSizeLimit: z.number().min(0).optional() });
 const fileConfigSchema = z.object({
 	endpoints: z.record(endpointFileConfigSchema).optional(),
 	skills: skillFileConfigSchema.optional(),
 	serverFileSizeLimit: z.number().min(0).optional(),
 	avatarSizeLimit: z.number().min(0).optional(),
 	fileTokenLimit: z.number().min(0).optional(),
+	fileContextSizeLimit: z.number().min(0).optional(),
+	fileContextCharLimit: z.number().min(0).optional(),
+	codeEnvLivenessSafeWindowMs: z.number().min(0).optional(),
 	imageGeneration: z.object({
 		percentage: z.number().min(0).max(100).optional(),
 		px: z.number().min(0).optional()
@@ -2854,7 +3058,10 @@ const fileConfigSchema = z.object({
 		quality: z.number().min(0).max(1).optional()
 	}).optional(),
 	ocr: z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional(),
-	text: z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional()
+	text: z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional(),
+	defaultLLMDeliveryPath: defaultLLMDeliveryPathSchema.optional(),
+	legacyFileUploadUX: z.boolean().optional(),
+	textFallbackWithoutTools: z.boolean().optional()
 });
 /**
 * Compiler for admin-supplied MIME patterns. Defaults to native `RegExp`, which browser
@@ -2891,6 +3098,15 @@ const isPermissiveMimeConfig = (types) => {
 	if (!types || types.length === 0) return false;
 	return types.some((regex) => regex.test("x-librechat/x-probe"));
 };
+/**
+* Detects whether an endpoint's `supportedMimeTypes` were set by the admin rather than inherited
+* from the built-in default list. Inheritance is signaled by referential identity with
+* `supportedMimeTypes`, which `mergeWithDefault` preserves for unconfigured endpoints.
+*/
+const isExplicitMimeConfig = (types) => {
+	if (!types || types.length === 0) return false;
+	return types !== supportedMimeTypes;
+};
 /** Media categories that collapse to a wildcard `accept` token when any member type is allowed. */
 const mimeAcceptCategories = [
 	{
@@ -2990,6 +3206,12 @@ const documentMimeExtensions = [
 	["text/calendar", [".ics"]],
 	["message/rfc822", [".eml"]]
 ];
+/** Preferred extension for a known document MIME type, including its leading dot. */
+function getDocumentFileExtension(mimeType) {
+	const normalized = mimeType?.split(";", 1)[0].trim().toLowerCase();
+	const canonical = normalized === "text/comma-separated-values" ? "text/csv" : normalized;
+	return documentMimeExtensions.find(([type]) => type === canonical)?.[1][0];
+}
 const documentMimeSet = new Set(documentMimeExtensions.map(([mimeType]) => mimeType));
 /** Every MIME type LibreChat may accept, used to detect patterns that reach beyond the representable set. */
 const knownMimeUniverse = Array.from(new Set([
@@ -3083,7 +3305,46 @@ function mergeWithDefault(endpointConfig, defaultConfig, endpoint) {
 		fileLimit: endpointConfig.fileLimit ?? defaultConfig.fileLimit,
 		fileSizeLimit: endpointConfig.fileSizeLimit ?? defaultConfig.fileSizeLimit,
 		totalSizeLimit: endpointConfig.totalSizeLimit ?? defaultConfig.totalSizeLimit,
-		supportedMimeTypes: endpointConfig.supportedMimeTypes ?? defaultMimeTypes
+		supportedMimeTypes: endpointConfig.supportedMimeTypes ?? defaultMimeTypes,
+		defaultLLMDeliveryPath: mergeDeliveryPathConfig(endpointConfig.defaultLLMDeliveryPath, defaultConfig.defaultLLMDeliveryPath),
+		legacyFileUploadUX: endpointConfig.legacyFileUploadUX ?? defaultConfig.legacyFileUploadUX,
+		textFallbackWithoutTools: endpointConfig.textFallbackWithoutTools ?? defaultConfig.textFallbackWithoutTools
+	};
+}
+/**
+* Deep-merges delivery-path config so an endpoint that supplies only one override
+* still inherits the default's fallback and shared overrides. Whole-object
+* replacement would silently drop the inherited routing.
+*/
+function mergeDeliveryPathConfig(endpointValue, defaultValue) {
+	if (!endpointValue) return defaultValue;
+	if (!defaultValue) return endpointValue;
+	if (endpointValue.fallback != null) return endpointValue;
+	const hasOverrides = endpointValue.overrides != null || defaultValue.overrides != null;
+	return {
+		...defaultValue.fallback != null ? { fallback: defaultValue.fallback } : {},
+		...hasOverrides ? { overrides: { ...shadowByWildcard(defaultValue.overrides, endpointValue.overrides) } } : {}
+	};
+}
+/**
+* Flattens two override layers into one map that still resolves like the layered chain.
+* Resolution reads exact keys before wildcards, so a plain spread would let a lower
+* layer's `image/png` outrank the upper layer's `image/*`. Dropping the entries an
+* upper wildcard covers restores precedence without changing how lookups work.
+*/
+function shadowByWildcard(lower, upper) {
+	if (!lower) return { ...upper };
+	const upperWildcards = /* @__PURE__ */ new Set();
+	for (const key in upper) if (key.endsWith("/*")) upperWildcards.add(key.slice(0, -1));
+	if (upperWildcards.size === 0) return {
+		...lower,
+		...upper
+	};
+	const retained = {};
+	for (const key in lower) if (!(!key.endsWith("/*") && upperWildcards.has(key.slice(0, key.indexOf("/") + 1)) && upper?.[key] == null)) retained[key] = lower[key];
+	return {
+		...retained,
+		...upper
 	};
 }
 function getEndpointFileConfig(params) {
@@ -3091,8 +3352,14 @@ function getEndpointFileConfig(params) {
 	if (!mergedFileConfig?.endpoints) return fileConfig.endpoints.default;
 	/** Compute an effective default by merging user-configured default over the base default */
 	const baseDefaultConfig = fileConfig.endpoints.default;
+	const globalDefaultConfig = {
+		...baseDefaultConfig,
+		defaultLLMDeliveryPath: mergeDeliveryPathConfig(mergedFileConfig.defaultLLMDeliveryPath, baseDefaultConfig.defaultLLMDeliveryPath),
+		legacyFileUploadUX: mergedFileConfig.legacyFileUploadUX ?? baseDefaultConfig.legacyFileUploadUX,
+		textFallbackWithoutTools: mergedFileConfig.textFallbackWithoutTools ?? baseDefaultConfig.textFallbackWithoutTools
+	};
 	const userDefaultConfig = mergedFileConfig.endpoints.default;
-	const defaultConfig = userDefaultConfig ? mergeWithDefault(userDefaultConfig, baseDefaultConfig, "default") : baseDefaultConfig;
+	const defaultConfig = userDefaultConfig ? mergeWithDefault(userDefaultConfig, globalDefaultConfig, "default") : globalDefaultConfig;
 	const normalizedEndpoint = normalizeEndpointName(endpoint ?? "");
 	const standardEndpoints = new Set([
 		"default",
@@ -3147,9 +3414,18 @@ function mergeFileConfig(dynamic) {
 		}
 	};
 	if (!dynamic) return mergedConfig;
+	if (dynamic.defaultLLMDeliveryPath !== void 0) mergedConfig.defaultLLMDeliveryPath = dynamic.defaultLLMDeliveryPath;
+	if (dynamic.legacyFileUploadUX !== void 0) mergedConfig.legacyFileUploadUX = dynamic.legacyFileUploadUX;
+	if (dynamic.textFallbackWithoutTools !== void 0) mergedConfig.textFallbackWithoutTools = dynamic.textFallbackWithoutTools;
 	if (dynamic.serverFileSizeLimit !== void 0) mergedConfig.serverFileSizeLimit = mbToBytes(dynamic.serverFileSizeLimit);
 	if (dynamic.avatarSizeLimit !== void 0) mergedConfig.avatarSizeLimit = mbToBytes(dynamic.avatarSizeLimit);
 	if (dynamic.fileTokenLimit !== void 0) mergedConfig.fileTokenLimit = dynamic.fileTokenLimit;
+	if (dynamic.fileContextSizeLimit !== void 0) mergedConfig.fileContextSizeLimit = mbToBytes(dynamic.fileContextSizeLimit);
+	if (dynamic.fileContextCharLimit !== void 0) mergedConfig.fileContextCharLimit = dynamic.fileContextCharLimit;
+	if (dynamic.skills?.importCleanupConcurrency !== void 0) mergedConfig.skills = {
+		...mergedConfig.skills,
+		importCleanupConcurrency: dynamic.skills.importCleanupConcurrency
+	};
 	if (dynamic.skills?.fileSizeLimit !== void 0) mergedConfig.skills = {
 		...mergedConfig.skills,
 		fileSizeLimit: mbToBytes(dynamic.skills.fileSizeLimit)
@@ -3197,6 +3473,9 @@ function mergeFileConfig(dynamic) {
 		});
 		if (dynamicEndpoint.disabled !== void 0) mergedEndpoint.disabled = dynamicEndpoint.disabled;
 		if (dynamicEndpoint.supportedMimeTypes) mergedEndpoint.supportedMimeTypes = convertStringsToRegex(dynamicEndpoint.supportedMimeTypes);
+		if (dynamicEndpoint.defaultLLMDeliveryPath !== void 0) mergedEndpoint.defaultLLMDeliveryPath = dynamicEndpoint.defaultLLMDeliveryPath;
+		if (dynamicEndpoint.legacyFileUploadUX !== void 0) mergedEndpoint.legacyFileUploadUX = dynamicEndpoint.legacyFileUploadUX;
+		if (dynamicEndpoint.textFallbackWithoutTools !== void 0) mergedEndpoint.textFallbackWithoutTools = dynamicEndpoint.textFallbackWithoutTools;
 	}
 	return mergedConfig;
 }
@@ -3226,6 +3505,8 @@ const codeEnvironments = () => `${BASE_URL}/api/code-environments`;
 const codeEnvironmentPairings = () => `${codeEnvironments()}/pairings`;
 const codeEnvironmentById = (id) => `${codeEnvironments()}/${encodeURIComponent(id)}`;
 const codeEnvironmentSettings = (id) => `${codeEnvironmentById(id)}/settings`;
+const codeEnvironmentStatus = (id) => `${codeEnvironmentById(id)}/status`;
+const codeEnvironmentConversationDecision = (conversationId) => `${codeEnvironments()}/conversations/${encodeURIComponent(conversationId)}/decision`;
 const messagesRoot = `${BASE_URL}/api/messages`;
 const messages = (params) => {
 	const { conversationId, messageId, ...rest } = params;
@@ -3438,8 +3719,15 @@ const listSkillsWithFilters = (filter) => {
 };
 const skillFiles = (id) => `${getSkill$1(id)}/files`;
 const skillFile = (id, relativePath) => `${skillFiles(id)}/${encodeURIComponent(relativePath)}`;
-const insights = () => `${BASE_URL}/api/admin/insights`;
+const insights = () => `${BASE_URL}/api/insights`;
 const insightsAccess = () => `${insights()}/access`;
+const conversationTrace = (conversationId) => `${BASE_URL}/api/traces/${encodeURIComponent(conversationId)}`;
+const conversationTraceAvailability = (conversationId) => `${conversationTrace(conversationId)}/availability`;
+const conversationTraceRecords = (conversationId, cursor) => `${conversationTrace(conversationId)}/records${cursor ? `?${new URLSearchParams({ cursor }).toString()}` : ""}`;
+const conversationTraceRecord = (conversationId, recordId, messageId, sourceId) => `${conversationTrace(conversationId)}/records/${encodeURIComponent(recordId)}?${new URLSearchParams({
+	message: messageId,
+	...sourceId ? { source: sourceId } : {}
+}).toString()}`;
 const adminSkillsSync = () => `${BASE_URL}/api/admin/skills/sync`;
 const adminSkillsSyncStatus = () => `${adminSkillsSync()}/status`;
 const adminSkillsSyncRun = () => `${adminSkillsSync()}/run`;
@@ -3448,6 +3736,7 @@ const skillStates = () => `${BASE_URL}/api/user/settings/skills/active`;
 const adminLangfuseConnection = () => `${BASE_URL}/api/admin/langfuse/connection`;
 const adminLangfuseConnectionTest = () => `${adminLangfuseConnection()}/test`;
 const adminLangfuseSessionLink = (conversationId) => `${adminLangfuseConnection()}/session/${encodeURIComponent(conversationId)}`;
+const pinnedOrder = () => `${BASE_URL}/api/user/settings/pinned-order`;
 const toolFavorites = () => `${BASE_URL}/api/user/settings/favorites/tools`;
 const toolFavorite = (itemType, itemId) => `${toolFavorites()}/${itemType}/${encodeURIComponent(itemId)}`;
 const roles = () => `${BASE_URL}/api/roles`;
@@ -3519,6 +3808,7 @@ let FileContext = /* @__PURE__ */ function(FileContext) {
 	FileContext["image_generation"] = "image_generation";
 	FileContext["assistants_output"] = "assistants_output";
 	FileContext["message_attachment"] = "message_attachment";
+	FileContext["run_artifact"] = "run_artifact";
 	FileContext["skill_file"] = "skill_file";
 	FileContext["filename"] = "filename";
 	FileContext["updatedAt"] = "updatedAt";
@@ -3547,8 +3837,20 @@ let TokenExchangeMethodEnum = /* @__PURE__ */ function(TokenExchangeMethodEnum)
 	TokenExchangeMethodEnum["BasicAuthHeader"] = "basic_auth_header";
 	return TokenExchangeMethodEnum;
 }({});
+const agentGitIdentitySchema = z.object({
+	name: z.string().trim().min(1).max(128).refine((value) => !/[\0\r\n]/.test(value)),
+	email: z.string().trim().email().max(254).refine((value) => !/[\0\r\n]/.test(value))
+}).optional();
 //#endregion
 //#region src/mcp.ts
+/**
+* Upper bound on a stored MCP `iconPath` (URL or data URI). Enforced by
+* `sanitizeMcpIconPath`, not a schema `.max()`, so re-submitting a server whose
+* stored icon predates the cap clears the icon instead of rejecting the update.
+*/
+const MAX_MCP_ICON_PATH_LENGTH = 256 * 1024;
+/** Keep persistence admission waits below the shared lease's 15-minute lifetime. */
+const MAX_MCP_OAUTH_PERSISTENCE_WAIT_MS = 14 * 6e4;
 const validateOAuthClientCredentials = (oauth, ctx) => {
 	if (oauth.client_secret && !oauth.client_id) ctx.addIssue({
 		code: z.ZodIssueCode.custom,
@@ -3623,6 +3925,27 @@ const OAuthOptionsBaseSchema = z.object({
 	* Ignored when `audience` itself is not configured.
 	*/
 	forward_audience_on_refresh: z.boolean().optional(),
+	/**
+	* Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+	* `authorization_code` exchange and the `refresh_token` grant. The value is the
+	* canonical resource identifier from the MCP server's Protected Resource Metadata
+	* (RFC 9728), never an operator-supplied string.
+	*
+	* Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+	* that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+	* fails an `/authorize` request carrying both `resource` and `scope` with
+	* `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+	* `audience` above) to obtain an API-scoped token.
+	*
+	* Opting out suppresses the parameter only. Protected Resource Metadata is still
+	* discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+	* still recorded on the stored client binding, so scope discovery, authorization
+	* server discovery and re-authentication checks are unaffected.
+	*
+	* This field is only accepted from trusted/admin MCP configuration and is rejected
+	* from user-managed servers.
+	*/
+	send_resource_parameter: z.boolean().optional(),
 	/** OAuth revocation endpoint (optional - can be auto-discovered) */
 	revocation_endpoint: z.string().transform((val) => extractEnvVariable(val)).pipe(z.string().url()).optional(),
 	/** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -3641,14 +3964,16 @@ const userOAuthEndpointUrlSchema = z.string().refine((val) => !envVarPattern.tes
 }, { message: "OAuth endpoint URLs cannot include audience or resource query parameters" });
 const UserOAuthOptionsSchema = OAuthOptionsBaseSchema.omit({
 	audience: true,
-	forward_audience_on_refresh: true
+	forward_audience_on_refresh: true,
+	send_resource_parameter: true
 }).extend({
 	authorization_url: userOAuthEndpointUrlSchema.optional(),
 	token_url: userOAuthEndpointUrlSchema.optional(),
 	redirect_uri: userOAuthEndpointUrlSchema.optional(),
 	revocation_endpoint: userOAuthEndpointUrlSchema.optional(),
 	audience: z.never().optional(),
-	forward_audience_on_refresh: z.never().optional()
+	forward_audience_on_refresh: z.never().optional(),
+	send_resource_parameter: z.never().optional()
 }).superRefine(validateOAuthClientCredentials);
 const OboOptionsSchema = z.object({ 
 /** Scopes to request for the downstream MCP server (e.g., "api://<client-id>/Mcp.Tools.ReadWrite") */
@@ -3673,6 +3998,21 @@ const BaseOptionsSchema = z.object({
 	sseReadTimeout: z.number().int().positive().optional(),
 	initTimeout: z.number().int().nonnegative().optional(),
 	/**
+	* How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+	* before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+	* faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+	* redemption aborts itself, because this wait runs inside the redemption that window governs.
+	*
+	* Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+	* contended refresh instead of adopting the rotation a peer is about to store, and that is the
+	* common case this wait exists to serve. Omit the field to take the default.
+	*/
+	oauthRefreshWaitTimeout: z.number().int().positive().optional(),
+	/** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+	oauthRefreshCoordination: z.boolean().optional(),
+	/** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+	oauthPersistenceWaitTimeout: z.number().int().positive().max(MAX_MCP_OAUTH_PERSISTENCE_WAIT_MS).optional(),
+	/**
 	* Whether the server is offered in chat.
 	*
 	* `false` hides it from the chat dropdown (MCPSelect) AND bars it from the
@@ -3806,6 +4146,13 @@ const SSEOptionsSchema = BaseOptionsSchema.extend({
 	type: z.literal("sse").default("sse"),
 	headers: z.record(z.string(), z.string()).optional(),
 	/**
+	* Headers resolved from the live chat request and merged over `headers`.
+	* Omitted during catalog discovery, which has no request context, so a
+	* `{{LIBRECHAT_BODY_*}}` placeholder here does not block tool listing.
+	* On a duplicate header name the resolved `requestHeaders` value wins.
+	*/
+	requestHeaders: z.record(z.string(), z.string()).optional(),
+	/**
 	* On-Behalf-Of (OBO) token exchange configuration.
 	* When configured, LibreChat exchanges the logged-in user's federated access token
 	* for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
@@ -3824,6 +4171,13 @@ const StreamableHTTPOptionsSchema = BaseOptionsSchema.extend({
 	type: z.union([z.literal("streamable-http"), z.literal("http")]),
 	headers: z.record(z.string(), z.string()).optional(),
 	/**
+	* Headers resolved from the live chat request and merged over `headers`.
+	* Omitted during catalog discovery, which has no request context, so a
+	* `{{LIBRECHAT_BODY_*}}` placeholder here does not block tool listing.
+	* On a duplicate header name the resolved `requestHeaders` value wins.
+	*/
+	requestHeaders: z.record(z.string(), z.string()).optional(),
+	/**
 	* On-Behalf-Of (OBO) token exchange configuration.
 	* When configured, LibreChat exchanges the logged-in user's federated access token
 	* for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
@@ -3853,6 +4207,9 @@ const omitServerManagedFields = (schema) => schema.omit({
 	timeout: true,
 	sseReadTimeout: true,
 	initTimeout: true,
+	oauthRefreshWaitTimeout: true,
+	oauthRefreshCoordination: true,
+	oauthPersistenceWaitTimeout: true,
 	chatMenu: true,
 	serverInstructions: true,
 	requiresOAuth: true,
@@ -3919,6 +4276,8 @@ const MCP_USER_INPUT_FIELDS = (() => {
 })();
 //#endregion
 //#region src/config.ts
+const AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_DEFAULT = 24 * 1024;
+const AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_HARD_MAX = 64 * 1024;
 const defaultSocialLogins = [
 	"google",
 	"facebook",
@@ -3927,6 +4286,8 @@ const defaultSocialLogins = [
 	"discord",
 	"saml"
 ];
+/** How long a started social login may take to return to its callback before its `state` expires. */
+const DEFAULT_OAUTH_STATE_TTL_MS = 600 * 1e3;
 const BASE_ONLY_CONFIG_SECTIONS = ["filters"];
 /** Sections that may be stored in the tenant's base config document but must
 * not be overridden or tombstoned by role, group, or user config documents. */
@@ -3957,6 +4318,8 @@ const excludedKeys = new Set([
 	"conversationId",
 	"agentEventBinding",
 	"agentEventActor",
+	"agentEventActorCleanup",
+	"agentEventActorSuspension",
 	"agentEventActorReconciliations",
 	"agentEventActorEpoch",
 	"agentEventActorLegacyTurn",
@@ -4465,13 +4828,13 @@ function isRemoteOidcUrlAllowed(value) {
 }
 const remoteApiOidcUrlSchema = z.string().url().refine(isRemoteOidcUrlAllowed, { message: "must use https:// unless targeting localhost" });
 const remoteApiOidcScopeSchema = z.string().refine((scope) => !scope.includes(","), { message: "scopes must be space-separated" });
-const remoteApiOidcSchema = z.object({
+const oidcAccessTokenSchema = z.object({
 	enabled: z.boolean().default(false),
 	issuer: remoteApiOidcUrlSchema.optional(),
 	audience: z.string().min(1).optional(),
-	jwksUri: remoteApiOidcUrlSchema.optional(),
-	scope: remoteApiOidcScopeSchema.optional()
-}).superRefine((oidc, ctx) => {
+	jwksUri: remoteApiOidcUrlSchema.optional()
+});
+function validateEnabledOidc(oidc, ctx) {
 	if (oidc.enabled === true && !oidc.issuer) ctx.addIssue({
 		code: z.ZodIssueCode.custom,
 		path: ["issuer"],
@@ -4482,12 +4845,60 @@ const remoteApiOidcSchema = z.object({
 		path: ["audience"],
 		message: "audience is required when OIDC auth is enabled"
 	});
-});
+}
+const remoteApiOidcSchema = oidcAccessTokenSchema.extend({ scope: remoteApiOidcScopeSchema.optional() }).superRefine(validateEnabledOidc);
 const remoteApiAuthSchema = z.object({
 	apiKey: z.object({ enabled: z.boolean().default(true) }).optional(),
 	oidc: remoteApiOidcSchema.optional()
 });
 const remoteApiSchema = z.object({ auth: remoteApiAuthSchema.optional() });
+const managementClientBindingSchema = z.object({
+	clientId: z.string().trim().min(1).max(128),
+	subject: z.string().trim().min(1).max(512).optional(),
+	userId: z.string().trim().regex(/^[a-f\d]{24}$/i, "must be a MongoDB ObjectId").transform((userId) => userId.toLowerCase()),
+	tenantId: z.string().trim().min(1).max(128).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/, "must be a valid tenant id").refine((tenantId) => tenantId !== "__SYSTEM__", "system tenant is not allowed"),
+	enabled: z.boolean().default(true)
+}).strict();
+const managementApiOidcSchema = oidcAccessTokenSchema.extend({
+	tokenUse: z.literal("access").optional(),
+	requiredScopes: z.array(z.string().trim().min(1).max(256).regex(/^\S+$/, "must be a single scope token")).min(1).max(20).optional()
+}).strict().superRefine((oidc, ctx) => {
+	if (oidc.enabled === true && !oidc.issuer) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["issuer"],
+		message: "issuer is required when OIDC auth is enabled"
+	});
+	if (oidc.enabled === true && !oidc.audience && (oidc.tokenUse !== "access" || !oidc.requiredScopes?.length)) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["requiredScopes"],
+		message: "audience or access-token validation with required scopes is required when OIDC auth is enabled"
+	});
+});
+const managementApiAuthSchema = z.object({
+	oidc: managementApiOidcSchema,
+	clients: z.array(managementClientBindingSchema).max(100).default([])
+}).strict().superRefine((auth, ctx) => {
+	if (auth.oidc.enabled === true && auth.clients.length === 0) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		path: ["clients"],
+		message: "at least one client binding is required when management auth is enabled"
+	});
+	const clientIds = /* @__PURE__ */ new Set();
+	for (let index = 0; index < auth.clients.length; index++) {
+		const client = auth.clients[index];
+		if (clientIds.has(client.clientId)) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: [
+				"clients",
+				index,
+				"clientId"
+			],
+			message: "client IDs must be unique"
+		});
+		clientIds.add(client.clientId);
+	}
+});
+const managementApiSchema = z.object({ auth: managementApiAuthSchema.optional() }).strict();
 /**
 * Permission mode applied to a tool call. Mirrors `@librechat/agents`'s
 * `ToolPolicyMode` 1:1.
@@ -4561,6 +4972,24 @@ const toolApprovalPolicySchema = z.object({
 	*/
 	hooks: z.array(toolApprovalHookConfigSchema).optional()
 }).optional();
+const askUserQuestionRetainedAnswersSchema = z.object({
+	/** `false` stops carrying answers forward; they then live only in the messages. */
+	enabled: z.boolean().optional(),
+	/** Token ceiling for the carried block. Older answers drop first once it is
+	*  exceeded; the newest set is always kept. Defaults to
+	*  `DEFAULT_RETAINED_ANSWER_TOKENS` (4096). */
+	maxTokens: z.number().int().positive().optional()
+});
+/**
+* Behavior of the `ask_user_question` tool beyond the admin kill switch
+* (`filteredTools` / `includedTools`).
+*
+* `retainedAnswers`: every answer the user gave to an agent's question is
+* quoted verbatim in the run's user context, so it survives after the
+* messages that carried it were summarized, pruned or dropped from the context
+* window. On by default.
+*/
+const askUserQuestionConfigSchema = z.object({ retainedAnswers: askUserQuestionRetainedAnswersSchema.optional() }).optional();
 /**
 * Durable checkpointer backing human-in-the-loop resume.
 *
@@ -4626,22 +5055,55 @@ const codeEnvironmentPermissionFieldSchema = z.object({
 		message: "Permission default must be included in allowed values"
 	});
 });
+/** Existing attached commands used a fixed 30-second execution budget. */
+const CODE_ENVIRONMENT_COMMAND_TIMEOUT_DEFAULT_MS = 3e4;
+/** Protocol-level ceiling; deployments may only lower this value. */
+const CODE_ENVIRONMENT_COMMAND_TIMEOUT_HARD_MAX_MS = 5 * 6e4;
+/**
+* Client retry horizon across Code API admission windows. Also the hard cap:
+* deployments may only lower it. `0` disables client retries, not the server's
+* initial admission wait or an already-admitted operation's execution budget.
+*/
+const CODE_ENVIRONMENT_QUEUE_WAIT_DEFAULT_MS = 5 * 6e4;
 /**
 * Typed user-tunable surface for one attached code environment. Omitted fields
 * remain fixed at LibreChat's safe baseline. Isolation, networking, mounts,
 * privileged execution, and secrets are deliberately not representable here.
 */
-const codeEnvironmentUserConfigSchema = z.object({ permissions: z.object({
-	fileWrite: codeEnvironmentPermissionFieldSchema.optional(),
-	commandExecution: codeEnvironmentPermissionFieldSchema.optional()
-}).strict().optional() }).strict();
+const codeEnvironmentUserConfigSchema = z.object({
+	permissions: z.object({
+		fileWrite: codeEnvironmentPermissionFieldSchema.optional(),
+		commandExecution: codeEnvironmentPermissionFieldSchema.optional()
+	}).strict().optional(),
+	limits: z.object({
+		/** Maximum timeout a Bash invocation may request. Omission preserves
+		* the historical 30-second command budget. */
+		maxCommandTimeoutMs: z.number().int().min(1).max(CODE_ENVIRONMENT_COMMAND_TIMEOUT_HARD_MAX_MS).optional(),
+		/** Client retry horizon for capacity expirations, shared by preview/edit.
+		* Omission keeps five minutes; `0` makes each required operation try once.
+		* An in-flight request retains Code API's admission/execution budgets and
+		* can finish after this horizon. This is not a server admission timeout. */
+		maxQueueWaitMs: z.number().int().min(0).max(CODE_ENVIRONMENT_QUEUE_WAIT_DEFAULT_MS).optional()
+	}).strict().optional()
+}).strict();
 const codeEnvironmentUserSettingsSchema = z.object({ permissions: z.object({
 	fileWrite: codeEnvironmentPermissionDecisionSchema.optional(),
 	commandExecution: codeEnvironmentPermissionDecisionSchema.optional()
 }).strict().optional() }).strict();
+const DEFAULT_MAX_PROVIDER_ERROR_CHARS = 2e3;
+const DEFAULT_AGENT_MODEL_RESPONSE_BODY_TIMEOUT_MS = 9e5;
+const DEFAULT_AGENT_MODEL_RESPONSE_HEADERS_TIMEOUT_MS = 3e5;
 const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(z.object({
+	/** Maximum provider error characters retained in unprotected terminal failures. */
+	maxProviderErrorChars: z.number().int().min(0).max(1e6).default(DEFAULT_MAX_PROVIDER_ERROR_CHARS),
+	/** Maximum inactivity between provider response body chunks; 0 disables the idle timeout. */
+	modelResponseBodyTimeoutMs: z.number().int().min(0).max(864e5).default(DEFAULT_AGENT_MODEL_RESPONSE_BODY_TIMEOUT_MS),
+	/** Maximum wait for provider response headers; 0 disables the header timeout. */
+	modelResponseHeadersTimeoutMs: z.number().int().min(0).max(864e5).default(DEFAULT_AGENT_MODEL_RESPONSE_HEADERS_TIMEOUT_MS),
 	recursionLimit: z.number().optional(),
 	disableBuilder: z.boolean().optional().default(false),
+	/** Optional workspace guidance acquisition budget, separate from command execution. */
+	repositoryInstructions: z.object({ timeoutMs: z.number().int().min(100).max(3e4).optional().default(2e3) }).optional(),
 	maxRecursionLimit: z.number().optional(),
 	/** Max cumulative bytes a single streamed tool call's arguments may reach before the run
 	* aborts. Defaults to 64 KiB in the agents SDK; `0` disables the guard. */
@@ -4652,6 +5114,13 @@ const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(z.
 	* disables the guard for that tool only. Merged over LibreChat's shipped default of
 	* `{ create_file: 131072 }`. */
 	maxToolCallArgBytesByTool: z.record(z.number()).optional(),
+	/** Characters of retained tool output the save path may tokenize exactly for the
+	* context gauge when a turn stops at the tool-call limit (see
+	* `retainedToolTokens`). Tokenizing costs ~60 ms/MB and runs once per stopped
+	* turn; past this ceiling the figure is withdrawn rather than estimated, so the
+	* gauge under-reports that turn instead of blocking the save. Raise it for
+	* deployments whose tools legitimately return more, lower it on slow hardware. */
+	maxRetainedToolCountChars: z.number().int().min(0).optional().default(DEFAULT_MAX_RETAINED_TOOL_COUNT_CHARS),
 	maxCitations: z.number().min(1).max(50).optional().default(30),
 	maxCitationsPerFile: z.number().min(1).max(10).optional().default(7),
 	minRelevanceScore: z.number().min(0).max(1).optional().default(.45),
@@ -4659,12 +5128,35 @@ const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(z.
 	* the shipped default of 10 for orchestration-heavy deployments, bounded by
 	* `MAX_SUBAGENTS_CEILING`. */
 	maxSubagents: z.number().int().min(1).max(50).optional().default(10),
+	/** Run-scoped file access for explicitly opted-in subagent delegations. */
+	fileSharing: z.object({
+		enabled: z.boolean().optional().default(false),
+		allowSiblingSharing: z.boolean().optional().default(false),
+		maxFiles: z.number().int().min(1).max(1e3).optional().default(100),
+		/** Aggregate disk budget for private output versions retained during a run. */
+		maxPrivateBytes: z.number().int().min(1).max(10737418240).optional().default(268435456),
+		ttlMs: z.number().int().min(1).max(864e5).optional().default(36e5)
+	}).optional(),
+	/** Maximum concurrent Code API uploads per route and authenticated principal. */
+	codeApiUploadConcurrency: z.number().int().min(1).max(100).optional().default(3),
+	/** Maximum wall-clock time spent waiting on Code API rate limits per operation. */
+	codeApiMaxRetryWaitMs: z.number().int().min(0).max(3e5).optional().default(2e4),
 	allowedProviders: z.array(z.union([z.string(), eModelEndpointSchema])).optional(),
 	capabilities: z.array(z.nativeEnum(AgentCapabilities)).optional().default(defaultAgentCapabilities),
 	/** Controls which workspace-sharing scopes users may select for stateful code sessions.
 	*  Omit this block to preserve the legacy behavior of allowing every scope. */
 	statefulCodeSessions: z.object({
 		allowedEnvironments: z.array(z.enum(STATEFUL_CODE_ENVIRONMENTS)).min(1),
+		/** Server-only personal worker enrollment policy. Effective principal
+		* policy may tighten, but never raise, the deployment ceiling. */
+		principalWorkers: z.object({
+			enabled: z.boolean().optional(),
+			/** Defaults to five. Zero disables enrollment; existing machines remain usable. */
+			maxPerUser: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional()
+		}).optional(),
+		/** Server-only policy letting a conversation's owner move its sealed attached decision
+		* onto the environments its agents now use. Omit to keep sealed decisions immovable. */
+		conversationMoves: z.object({ enabled: z.boolean().optional() }).optional(),
 		/** Operator-managed execution environments. Attached entries route to a
 		* Code API deployment backed by an outbound librechat-code worker. */
 		environments: z.array(z.object({
@@ -4771,11 +5263,25 @@ const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(z.
 	eventDriven: z.object({ selfUrl: z.string().url().optional() }).optional(),
 	/** Conversational background-task delivery policy. Automatic completion wakeups are
 	* enabled unless an administrator explicitly restores poll-only behavior. */
-	backgroundTasks: z.object({ completionWakeups: z.boolean().optional().default(true) }).optional(),
+	backgroundTasks: z.object({
+		completionWakeups: z.boolean().optional().default(true),
+		/** Maximum terminal output copied into the private completion receipt.
+		* Generated files remain governed by their separate attachment policy. */
+		completionResultMaxChars: z.number().int().min(1).max(AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_HARD_MAX).optional().default(AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_DEFAULT),
+		/** Maximum message-backed sibling results in one continuation.
+		* Independent receipts retain task-local delivery ownership. */
+		completionResultBatchSize: z.number().int().min(1).max(16).optional().default(8),
+		/** Cooperative cancellation for process-local ordinary tools. Off
+		* by default so existing deployments opt into the new control. */
+		ordinaryToolCancellation: z.boolean().optional().default(false)
+	}).optional(),
 	skills: z.object({ maxCatalogSkills: z.number().int().min(1).max(100).optional() }).optional(),
+	managementApi: managementApiSchema.optional(),
 	remoteApi: remoteApiSchema.optional(),
 	/** Human-in-the-loop tool approval policy. Off by default. */
 	toolApproval: toolApprovalPolicySchema,
+	/** Ask User question behavior; see {@link askUserQuestionConfigSchema}. */
+	askUserQuestion: askUserQuestionConfigSchema,
 	/** Durable checkpointer backing tool-approval and Ask User resume.
 	*  Defaults to the app's MongoDB when either flow needs it. */
 	checkpointer: checkpointerSchema
@@ -5030,6 +5536,21 @@ const sttSchema = z.object({
 	openai: sttOpenaiSchema.optional(),
 	azureOpenAI: sttAzureOpenAISchema.optional()
 });
+/**
+* The speech providers a schema actually configures. `allowedAddresses` is transport
+* policy rather than a provider, and a provider key present but empty configures
+* nothing. The speech services accept a schema only when exactly one survives here, so
+* the upload router reads availability from the same list and never routes audio to a
+* transcription that cannot run.
+*/
+function listConfiguredSpeechProviders(schema) {
+	if (schema == null) return [];
+	return Object.entries(schema).filter(([key, value]) => key !== "allowedAddresses" && value != null && typeof value === "object" && Object.keys(value).length > 0);
+}
+/** Whether a speech schema names exactly one usable provider. */
+function isSpeechProviderConfigured(schema) {
+	return listConfiguredSpeechProviders(schema).length === 1;
+}
 const speechTab = z.object({
 	conversationMode: z.boolean().optional(),
 	advancedMode: z.boolean().optional(),
@@ -5114,7 +5635,14 @@ const termsOfServiceSchema = z.object({
 	modalContent: z.string().or(z.array(z.string())).optional()
 });
 const localizedStringSchema = z.union([z.string(), z.record(z.string())]);
+const mcpRefreshDefaults = {
+	toolsRefreshInterval: 300 * 1e3,
+	statusRefreshInterval: 30 * 1e3
+};
 const mcpServersSchema = z.object({
+	/** Foreground polling intervals in milliseconds; 0 disables polling. */
+	toolsRefreshInterval: z.number().int().nonnegative().max(2147483647).optional(),
+	statusRefreshInterval: z.number().int().nonnegative().max(2147483647).optional(),
 	placeholder: z.string().optional(),
 	use: z.boolean().optional(),
 	create: z.boolean().optional(),
@@ -5126,6 +5654,76 @@ const mcpServersSchema = z.object({
 		subLabel: localizedStringSchema.optional()
 	}).optional()
 }).optional();
+/** Values the trace viewer uses for any `interface.traceViewer` field left unset. */
+const traceViewerDefaults = {
+	enabled: false,
+	showInputOutput: false,
+	showToolNames: false,
+	maxRecords: 1e3,
+	maxContentLength: 5e4,
+	requestsPerMinute: 30,
+	requestTimeoutMs: 1e4
+};
+/** Inclusive bounds for the numeric `interface.traceViewer` fields. */
+const traceViewerLimits = {
+	maxRecords: {
+		min: 1,
+		max: 1e4
+	},
+	maxContentLength: {
+		min: 1,
+		max: 1e6
+	},
+	requestsPerMinute: {
+		min: 1,
+		max: 1e3
+	},
+	requestTimeoutMs: {
+		min: 1e3,
+		max: 3e5
+	}
+};
+const boundedIntegerSchema = (field) => z.number().int().min(traceViewerLimits[field].min).max(traceViewerLimits[field].max).optional();
+const traceViewerSchema = z.object({
+	/** Shows the conversation trace control for traces this deployment exported. */
+	enabled: z.boolean().optional(),
+	/** Returns observation input, output and metadata in the record inspector. */
+	showInputOutput: z.boolean().optional(),
+	/**
+	* Names the tools of each tool round from the tracing backend's own record of the round, at the
+	* cost of further backend reads per listed page, which carry each round's input and output.
+	* Off, a round is named only when the chat's messages can be matched to the trace.
+	*/
+	showToolNames: z.boolean().optional(),
+	/** Observations read from the tracing backend per request. */
+	maxRecords: boundedIntegerSchema("maxRecords"),
+	/** Characters kept from each input, output and metadata value before truncation. */
+	maxContentLength: boundedIntegerSchema("maxContentLength"),
+	/** Trace reads one user may start per minute. */
+	requestsPerMinute: boundedIntegerSchema("requestsPerMinute"),
+	/** Budget for each round trip to the tracing backend, in milliseconds. */
+	requestTimeoutMs: boundedIntegerSchema("requestTimeoutMs")
+});
+function boundedInteger(value, field) {
+	const { min, max } = traceViewerLimits[field];
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= min ? Math.min(value, max) : traceViewerDefaults[field];
+}
+/**
+* Fills unset or invalid `interface.traceViewer` fields from
+* {@link traceViewerDefaults}. Admin config overrides reach runtime without
+* schema validation, so every consumer reads the section through this.
+*/
+function resolveTraceViewerConfig(config) {
+	return {
+		enabled: config?.enabled === true,
+		showInputOutput: config?.showInputOutput === true,
+		showToolNames: config?.showToolNames === true,
+		maxRecords: boundedInteger(config?.maxRecords, "maxRecords"),
+		maxContentLength: boundedInteger(config?.maxContentLength, "maxContentLength"),
+		requestsPerMinute: boundedInteger(config?.requestsPerMinute, "requestsPerMinute"),
+		requestTimeoutMs: boundedInteger(config?.requestTimeoutMs, "requestTimeoutMs")
+	};
+}
 let RetentionMode = /* @__PURE__ */ function(RetentionMode) {
 	RetentionMode["ALL"] = "all";
 	RetentionMode["TEMPORARY"] = "temporary";
@@ -5140,6 +5738,8 @@ const interfaceSchema = z.object({
 	customWelcome: z.string().optional(),
 	mcpServers: mcpServersSchema.optional(),
 	modelSelect: z.boolean().optional(),
+	/** Milliseconds between syntax highlights while a code block streams. */
+	codeHighlightThrottleMs: z.number().int().min(0).max(6e4).default(300),
 	parameters: z.boolean().optional(),
 	multiConvo: z.boolean().optional(),
 	bookmarks: z.boolean().optional(),
@@ -5159,6 +5759,7 @@ const interfaceSchema = z.object({
 	})]).optional(),
 	temporaryChat: z.boolean().optional(),
 	temporaryChatRetention: z.number().min(1).max(8760).optional(),
+	generalChatRetention: z.number().min(1).max(8760).optional(),
 	autoSubmitFromUrl: z.boolean().optional(),
 	retentionMode: z.nativeEnum(RetentionMode).default("temporary"),
 	retainAgentFiles: z.boolean().optional(),
@@ -5179,6 +5780,7 @@ const interfaceSchema = z.object({
 	marketplace: z.object({ use: z.boolean().optional() }).optional(),
 	fileSearch: z.boolean().optional(),
 	fileCitations: z.boolean().optional(),
+	traceViewer: traceViewerSchema.optional(),
 	/** Tool keys (and `'mcp'` or an MCP server name) pinned to the prompt bar by default */
 	defaultPinnedTools: z.array(z.string()).optional(),
 	buildInfo: z.boolean().optional(),
@@ -5207,7 +5809,10 @@ const interfaceSchema = z.object({
 		maxPerUser: z.number().int().min(0).optional(),
 		minIntervalMinutes: z.number().int().min(1).optional(),
 		autoDisableAfterFailures: z.number().int().min(1).optional(),
+		admissionConcurrency: z.number().int().min(1).max(100).optional(),
 		fireConcurrency: z.number().int().min(1).optional(),
+		mcpPreflightConcurrency: z.number().int().min(1).max(10).optional(),
+		mcpPreflightTimeoutMs: z.number().int().min(1e3).max(6e5).optional(),
 		/** Refuse schedules that are not filed under a chat project. Enforced on
 		*  create/update AND at every fire, so raising it later stops schedules
 		*  that predate the policy instead of grandfathering them. */
@@ -5220,6 +5825,7 @@ const interfaceSchema = z.object({
 	})]).optional()
 }).default({
 	modelSelect: true,
+	codeHighlightThrottleMs: 300,
 	parameters: true,
 	presets: true,
 	multiConvo: true,
@@ -5476,7 +6082,8 @@ const balanceSchema = z.object({
 	autoRefillEnabled: z.boolean().optional().default(false),
 	refillIntervalValue: z.number().optional().default(30),
 	refillIntervalUnit: z.enum(REFILL_INTERVAL_UNITS).optional().default("days"),
-	refillAmount: z.number().optional().default(1e4)
+	refillAmount: z.number().optional().default(1e4),
+	reservationTtlMs: z.number().int().min(MIN_BALANCE_RESERVATION_TTL_MS).optional().default(DEFAULT_BALANCE_RESERVATION_TTL_MS)
 });
 const transactionsSchema = z.object({ enabled: z.boolean().optional().default(true) });
 const DEFAULT_MEMORY_MAX_INPUT_TOKENS = 12e3;
@@ -5600,6 +6207,57 @@ const messageFilterPiiSchema = z.object({
 	});
 });
 const messageFilterSchema = z.object({ pii: messageFilterPiiSchema.optional() });
+/** User fields a deployment may select as the Langfuse trace `userId`. */
+const LANGFUSE_TRACE_USER_ID_FIELDS = [
+	"id",
+	"email",
+	"username",
+	"name",
+	"openidId",
+	"samlId",
+	"ldapId",
+	"googleId",
+	"githubId",
+	"discordId",
+	"appleId",
+	"facebookId"
+];
+/** User fields a deployment may copy into Langfuse trace metadata. */
+const LANGFUSE_TRACE_USER_METADATA_FIELDS = [
+	...LANGFUSE_TRACE_USER_ID_FIELDS,
+	"role",
+	"provider"
+];
+/** Request fields a deployment may copy into Langfuse trace metadata. */
+const LANGFUSE_TRACE_CONVERSATION_METADATA_FIELDS = [
+	"conversationId",
+	"endpoint",
+	"endpointType",
+	"provider",
+	"model",
+	"modelLabel",
+	"spec"
+];
+/**
+* What a deployment attaches to every Langfuse trace beyond the defaults.
+* Nothing here is exported unless explicitly listed, so the default trace
+* carries only the internal user id and no user or request metadata.
+*/
+const langfuseTraceConfigSchema = z.object({
+	/**
+	* Which user field becomes the trace `userId`. Defaults to the internal user
+	* id; a user with no value for the chosen field keeps the internal id.
+	*/
+	userIdField: z.enum(LANGFUSE_TRACE_USER_ID_FIELDS).optional(),
+	/** User fields exported as `librechat.user.<field>` trace metadata. */
+	userMetadataFields: z.array(z.enum(LANGFUSE_TRACE_USER_METADATA_FIELDS)).optional(),
+	/**
+	* Request fields exported as trace metadata: `librechat.conversation.id`,
+	* `librechat.endpoint`, `librechat.endpoint.type`, `librechat.provider`,
+	* `librechat.model`, `librechat.model.label`, and `librechat.spec`.
+	*/
+	conversationMetadataFields: z.array(z.enum(LANGFUSE_TRACE_CONVERSATION_METADATA_FIELDS)).optional()
+});
 const langfuseConfigSchema = z.object({
 	enabled: z.boolean().optional(),
 	publicKey: z.string().optional(),
@@ -5631,10 +6289,21 @@ const langfuseConfigSchema = z.object({
 	* schema does not yet express — and note the fanout collector forwards only
 	* `Authorization` upstream regardless.
 	*/
-	headers: z.record(z.string()).optional()
+	headers: z.record(z.string()).optional(),
+	/** Trace user identity and allowlisted user/request metadata. */
+	trace: langfuseTraceConfigSchema.optional()
+});
+const openIdDiscoverySchema = z.object({
+	/** Discovery attempts made before startup continues; `0` retries only in the background. */
+	startupAttempts: z.number().int().min(0).max(100).default(1),
+	/** Milliseconds between startup and background discovery attempts. */
+	retryDelayMs: z.number().int().min(100).max(36e5).default(5e3)
 });
+/** Maximum CAS attempts per ACL document, including the initial attempt. */
+const permissionWriteAttemptsSchema = z.number().int().min(1).max(100).default(3);
 const configSchema = z.object({
 	version: z.string(),
+	permissions: z.object({ maxWriteAttempts: permissionWriteAttemptsSchema }).optional(),
 	cache: z.boolean().default(true),
 	ocr: ocrSchema.optional(),
 	webSearch: webSearchSchema.optional(),
@@ -5649,7 +6318,35 @@ const configSchema = z.object({
 	mcpServers: MCPServersSchema.optional(),
 	mcpSettings: z.object({
 		allowedDomains: z.array(z.string()).optional(),
-		allowedAddresses: allowedAddressesSchema
+		allowedAddresses: allowedAddressesSchema,
+		catalogRecovery: z.object({
+			discoveryBackoffMs: z.array(z.number().int().positive().max(1440 * 6e4)).min(1).max(8).default([
+				5 * 6e4,
+				10 * 6e4,
+				20 * 6e4,
+				30 * 6e4
+			]),
+			discoveryTimeoutMs: z.number().int().positive().max(5 * 6e4).default(3e3),
+			/** How long past `discoveryTimeoutMs` a stalled discovery may hold its catalog slot and
+			* coalesced requests. It is never cancelled, so OAuth tokens it redeemed still persist,
+			* and no other discovery for the same server state starts until it settles. */
+			discoverySettleGraceMs: z.number().int().nonnegative().max(5 * 6e4).default(1e4),
+			reauthRetryMs: z.number().int().positive().max(1440 * 6e4).default(30 * 6e4),
+			maxStateEntries: z.number().int().positive().max(1e6).default(1e4),
+			/** Process-wide: how many discoveries released past `discoverySettleGraceMs` may still be
+			* running before recovery starts no new discovery until one settles. The default matches
+			* the three catalog slots a stalled dependency could hold before discoveries were released. */
+			maxDetachedDiscoveries: z.number().int().positive().max(1e3).default(3),
+			generationReadTimeoutMs: z.number().int().positive().max(1e4).default(500),
+			authorizationFenceRetryMs: z.array(z.number().int().nonnegative().max(6e4)).min(1).max(8).default([
+				0,
+				50,
+				200
+			]),
+			authorizationFenceTimeoutMs: z.number().int().positive().max(3e4).default(1e3),
+			authorizationFenceRetryIntervalMs: z.number().int().positive().max(60 * 6e4).default(3e4),
+			authorizationFenceRetryBatchSize: z.number().int().positive().max(1e4).default(100)
+		}).default({})
 	}).optional(),
 	interface: interfaceSchema,
 	turnstile: turnstileSchema.optional(),
@@ -5662,7 +6359,11 @@ const configSchema = z.object({
 	}).optional(),
 	registration: z.object({
 		socialLogins: z.array(z.string()).optional(),
-		allowedDomains: z.array(z.string()).optional()
+		allowedDomains: z.array(z.string()).optional(),
+		/** Milliseconds a started social login may take to reach its callback; defaults to `DEFAULT_OAUTH_STATE_TTL_MS`. */
+		oauthStateTtlMs: z.number().int().min(6e4).max(36e5).optional(),
+		/** OpenID discovery retries; an unset field falls back to its `OPENID_DISCOVERY_RETRY_*` env var, then the schema default. */
+		openidDiscovery: openIdDiscoverySchema.partial().optional()
 	}).default({ socialLogins: defaultSocialLogins }),
 	balance: balanceSchema.optional(),
 	transactions: transactionsSchema.optional(),
@@ -5695,7 +6396,9 @@ const configSchema = z.object({
 		["agents"]: agentsEndpointSchema.optional(),
 		["custom"]: customEndpointsSchema.optional(),
 		["bedrock"]: bedrockEndpointSchema.optional()
-	}).strict().refine((data) => Object.keys(data).length > 0, { message: "At least one `endpoints` field must be provided." }).optional()
+	}).strict().refine((data) => Object.keys(data).length > 0, { message: "At least one `endpoints` field must be provided." }).optional(),
+	/** Serve the OpenAPI spec and docs for the public Agents API. Off by default. */
+	openapi: z.object({ enabled: z.boolean().optional() }).optional()
 });
 const getConfigDefaults = () => getSchemaDefaults(configSchema);
 let KnownEndpoints = /* @__PURE__ */ function(KnownEndpoints) {
@@ -5708,6 +6411,7 @@ let KnownEndpoints = /* @__PURE__ */ function(KnownEndpoints) {
 	KnownEndpoints["groq"] = "groq";
 	KnownEndpoints["helicone"] = "helicone";
 	KnownEndpoints["huggingface"] = "huggingface";
+	KnownEndpoints["lemonade"] = "lemonade";
 	KnownEndpoints["mistral"] = "mistral";
 	KnownEndpoints["mlx"] = "mlx";
 	KnownEndpoints["ollama"] = "ollama";
@@ -5746,6 +6450,7 @@ const alternateName = {
 	["anthropic"]: "Anthropic",
 	["custom"]: "Custom",
 	["bedrock"]: "AWS Bedrock",
+	["lemonade"]: "AMD Lemonade",
 	["ollama"]: "Ollama",
 	["deepseek"]: "DeepSeek",
 	["moonshot"]: "Moonshot",
@@ -5753,6 +6458,17 @@ const alternateName = {
 	["vercel"]: "Vercel",
 	["helicone"]: "Helicone"
 };
+/**
+* Models the Assistants endpoints cannot run. GPT-6 Astra serves tool calls only
+* from the Responses API, and the Assistants surface does not route through
+* `getOpenAILLMConfig`, so listing it there would offer a configuration the
+* provider rejects. Kept out of `sharedOpenAIModels`, which both Assistants
+* catalogs consume.
+*/
+const responsesOnlyOpenAIModels = ["gpt-6-astra"];
+/** Tool calls with Sol/Luna's default reasoning require Responses. Do not offer
+* these on Assistants, which cannot use the native request-routing path. */
+const responsesReasoningOpenAIModels = ["gpt-6-sol", "gpt-6-luna"];
 const sharedOpenAIModels = [
 	"gpt-5.6",
 	"gpt-5.6-terra",
@@ -5782,6 +6498,7 @@ const sharedOpenAIModels = [
 const sharedAnthropicModels = [
 	"claude-fable-5-1",
 	"claude-fable-5",
+	"claude-opus-5-5",
 	"claude-opus-5",
 	"claude-opus-4-8",
 	"claude-opus-4-7",
@@ -5817,6 +6534,7 @@ const sharedAnthropicModels = [
 const bedrockModels = [
 	"global.anthropic.claude-fable-5-1",
 	"global.anthropic.claude-fable-5",
+	"global.anthropic.claude-opus-5-5",
 	"global.anthropic.claude-opus-5",
 	"global.anthropic.claude-opus-4-8",
 	"global.anthropic.claude-opus-4-7",
@@ -5848,7 +6566,11 @@ const bedrockModels = [
 const defaultModels = {
 	["azureAssistants"]: sharedOpenAIModels,
 	["assistants"]: [...sharedOpenAIModels, "chatgpt-4o-latest"],
-	["agents"]: sharedOpenAIModels,
+	["agents"]: [
+		...responsesOnlyOpenAIModels,
+		...responsesReasoningOpenAIModels,
+		...sharedOpenAIModels
+	],
 	["google"]: [
 		"gemini-3.8-flash",
 		"gemini-3.7-flash",
@@ -5866,6 +6588,8 @@ const defaultModels = {
 	],
 	["anthropic"]: sharedAnthropicModels,
 	["openAI"]: [
+		...responsesOnlyOpenAIModels,
+		...responsesReasoningOpenAIModels,
 		...sharedOpenAIModels,
 		"chatgpt-4o-latest",
 		"gpt-4-vision-preview",
@@ -5878,12 +6602,18 @@ const fitlerAssistantModels = (str) => {
 	return /gpt-4|gpt-3\\.5/i.test(str) && !/vision|instruct/i.test(str);
 };
 const openAIModels = defaultModels["openAI"];
+/**
+* Preserve Azure's fallback default selection when the OpenAI catalog gains
+* Responses-preferred models. Configured Azure deployments supply their own
+* model list, including Astra when deployed.
+*/
+const nonResponsesOnlyOpenAIModels = openAIModels.filter((model) => !responsesOnlyOpenAIModels.includes(model) && !responsesReasoningOpenAIModels.includes(model));
 const initialModelsConfig = {
 	initial: [],
 	["openAI"]: openAIModels,
 	["assistants"]: openAIModels.filter(fitlerAssistantModels),
 	["agents"]: openAIModels,
-	["azureOpenAI"]: openAIModels,
+	["azureOpenAI"]: nonResponsesOnlyOpenAIModels,
 	["google"]: defaultModels["google"],
 	["anthropic"]: defaultModels["anthropic"],
 	["bedrock"]: defaultModels["bedrock"]
@@ -5918,6 +6648,8 @@ const visionModels = [
 	"grok-vision",
 	"grok-2-vision",
 	"grok-3",
+	"grok-4.7",
+	"grok-4-7",
 	"gpt-4o-mini",
 	"gpt-4o",
 	"gpt-4-turbo",
@@ -6181,6 +6913,10 @@ let ViolationTypes = /* @__PURE__ */ function(ViolationTypes) {
 	* Registration violations.
 	*/
 	ViolationTypes["REGISTRATIONS"] = "registrations";
+	/**
+	* Shared link retrieval limit violations.
+	*/
+	ViolationTypes["SHARE_LIMIT"] = "share_limit";
 	return ViolationTypes;
 }({});
 /**
@@ -6248,6 +6984,10 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	*/
 	ErrorTypes["STATEFUL_CODE_ENVIRONMENT_NOT_ALLOWED"] = "stateful_code_environment_not_allowed";
 	/**
+	* A conversation's selected attached workspace cannot be used as requested.
+	*/
+	ErrorTypes["CODE_WORKSPACE_UNAVAILABLE"] = "code_workspace_unavailable";
+	/**
 	* Invalid Agent Provider (excluded by Admin)
 	*/
 	ErrorTypes["INVALID_AGENT_PROVIDER"] = "invalid_agent_provider";
@@ -6276,6 +7016,10 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	*/
 	ErrorTypes["AUTH_BANNED"] = "auth_banned";
 	/**
+	* Authentication request was not sent from this application's origin
+	*/
+	ErrorTypes["AUTH_CROSS_ORIGIN"] = "auth_cross_origin";
+	/**
 	* Model refused to respond (content policy violation)
 	*/
 	ErrorTypes["REFUSAL"] = "refusal";
@@ -6291,6 +7035,26 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	* Provider throttled or refused the request for exceeding a rate/spend allowance
 	*/
 	ErrorTypes["MODEL_RATE_LIMIT"] = "model_rate_limit";
+	/**
+	* An agent model provider failed and the run could not recover.
+	*/
+	ErrorTypes["UPSTREAM_MODEL_ERROR"] = "upstream_model_error";
+	/**
+	* Context pruning removed every message; nothing fits the configured context window
+	*/
+	ErrorTypes["EMPTY_MESSAGES"] = "empty_messages";
+	/**
+	* Formatted provider payload exceeded the context budget before invocation
+	*/
+	ErrorTypes["FINAL_CONTEXT_OVERFLOW"] = "final_context_overflow";
+	/**
+	* A manual compaction the graph could not attempt; `reason` says why
+	*/
+	ErrorTypes["COMPACTION_SKIPPED"] = "compaction_skipped";
+	/**
+	* A manual compaction whose summarizer produced nothing; history is untouched
+	*/
+	ErrorTypes["COMPACTION_FAILED"] = "compaction_failed";
 	return ErrorTypes;
 }({});
 /**
@@ -6422,7 +7186,7 @@ let TTSProviders = /* @__PURE__ */ function(TTSProviders) {
 /** Enum for app-wide constants */
 let Constants = /* @__PURE__ */ function(Constants) {
 	/**
-	* Key for the app's version. The placeholder `v0.8.8-rc2` is
+	* Key for the app's version. The placeholder `v0.8.8-rc4` is
 	* swapped in by `@rollup/plugin-replace` during `npm run build:data-provider`
 	* using the value of the root `package.json`'s `version` field. Consumers
 	* always import this via the built dist bundle (see `main` field in
@@ -6430,9 +7194,9 @@ let Constants = /* @__PURE__ */ function(Constants) {
 	* substituted value. Only tests that import the TypeScript source directly
 	* would observe the raw placeholder.
 	*/
-	Constants["VERSION"] = "v0.8.8-rc2";
+	Constants["VERSION"] = "v0.8.8-rc4";
 	/** Key for the Custom Config's version (librechat.yaml). */
-	Constants["CONFIG_VERSION"] = "1.3.15";
+	Constants["CONFIG_VERSION"] = "1.3.17";
 	/** Standard value for the first message's `parentMessageId` value, to indicate no parent exists. */
 	Constants["NO_PARENT"] = "00000000-0000-0000-0000-000000000000";
 	/** Standard value to use whatever the submission prelim. `responseMessageId` is */
@@ -6765,6 +7529,8 @@ let LocalStorageKeys = /* @__PURE__ */ function(LocalStorageKeys) {
 	LocalStorageKeys["PIN_WEB_SEARCH_"] = "PIN_WEB_SEARCH_";
 	/** Pin state for Code Interpreter per conversation ID */
 	LocalStorageKeys["PIN_CODE_INTERPRETER_"] = "PIN_CODE_INTERPRETER_";
+	/** Key for the last selected code approval mode */
+	LocalStorageKeys["LAST_CODE_APPROVAL_MODE"] = "lastCodeApprovalMode";
 	return LocalStorageKeys;
 }({});
 let ForkOptions = /* @__PURE__ */ function(ForkOptions) {
@@ -6857,6 +7623,57 @@ function getDefaultParamsEndpoint(endpointsConfig, endpoint) {
 	return endpointsConfig[endpoint]?.customParams?.defaultParamsEndpoint;
 }
 //#endregion
+//#region src/types/assistants.ts
+let RunStatus = /* @__PURE__ */ function(RunStatus) {
+	RunStatus["QUEUED"] = "queued";
+	RunStatus["IN_PROGRESS"] = "in_progress";
+	RunStatus["REQUIRES_ACTION"] = "requires_action";
+	RunStatus["CANCELLING"] = "cancelling";
+	RunStatus["CANCELLED"] = "cancelled";
+	RunStatus["FAILED"] = "failed";
+	RunStatus["COMPLETED"] = "completed";
+	RunStatus["EXPIRED"] = "expired";
+	return RunStatus;
+}({});
+let FilePurpose = /* @__PURE__ */ function(FilePurpose) {
+	FilePurpose["Vision"] = "vision";
+	FilePurpose["FineTune"] = "fine-tune";
+	FilePurpose["FineTuneResults"] = "fine-tune-results";
+	FilePurpose["Assistants"] = "assistants";
+	FilePurpose["AssistantsOutput"] = "assistants_output";
+	return FilePurpose;
+}({});
+const defaultOrderQuery = {
+	order: "desc",
+	limit: 100
+};
+let AssistantStreamEvents = /* @__PURE__ */ function(AssistantStreamEvents) {
+	AssistantStreamEvents["ThreadCreated"] = "thread.created";
+	AssistantStreamEvents["ThreadRunCreated"] = "thread.run.created";
+	AssistantStreamEvents["ThreadRunQueued"] = "thread.run.queued";
+	AssistantStreamEvents["ThreadRunInProgress"] = "thread.run.in_progress";
+	AssistantStreamEvents["ThreadRunRequiresAction"] = "thread.run.requires_action";
+	AssistantStreamEvents["ThreadRunCompleted"] = "thread.run.completed";
+	AssistantStreamEvents["ThreadRunFailed"] = "thread.run.failed";
+	AssistantStreamEvents["ThreadRunCancelling"] = "thread.run.cancelling";
+	AssistantStreamEvents["ThreadRunCancelled"] = "thread.run.cancelled";
+	AssistantStreamEvents["ThreadRunExpired"] = "thread.run.expired";
+	AssistantStreamEvents["ThreadRunStepCreated"] = "thread.run.step.created";
+	AssistantStreamEvents["ThreadRunStepInProgress"] = "thread.run.step.in_progress";
+	AssistantStreamEvents["ThreadRunStepCompleted"] = "thread.run.step.completed";
+	AssistantStreamEvents["ThreadRunStepFailed"] = "thread.run.step.failed";
+	AssistantStreamEvents["ThreadRunStepCancelled"] = "thread.run.step.cancelled";
+	AssistantStreamEvents["ThreadRunStepExpired"] = "thread.run.step.expired";
+	AssistantStreamEvents["ThreadRunStepDelta"] = "thread.run.step.delta";
+	AssistantStreamEvents["ThreadMessageCreated"] = "thread.message.created";
+	AssistantStreamEvents["ThreadMessageInProgress"] = "thread.message.in_progress";
+	AssistantStreamEvents["ThreadMessageCompleted"] = "thread.message.completed";
+	AssistantStreamEvents["ThreadMessageIncomplete"] = "thread.message.incomplete";
+	AssistantStreamEvents["ThreadMessageDelta"] = "thread.message.delta";
+	AssistantStreamEvents["ErrorEvent"] = "error";
+	return AssistantStreamEvents;
+}({});
+//#endregion
 //#region src/accessPermissions.ts
 /**
 * Granular Permission System Types for Agent Sharing
@@ -6909,6 +7726,8 @@ let PermissionBits = /* @__PURE__ */ function(PermissionBits) {
 	PermissionBits[PermissionBits["DELETE"] = 4] = "DELETE";
 	/**  1000 - Can share agent with others (future) */
 	PermissionBits[PermissionBits["SHARE"] = 8] = "SHARE";
+	/** 10000 - Can view Insights data for an agent when VIEW is also present */
+	PermissionBits[PermissionBits["VIEW_INSIGHTS"] = 16] = "VIEW_INSIGHTS";
 	return PermissionBits;
 }({});
 /**
@@ -6950,6 +7769,8 @@ const principalSchema = z.object({
 	description: z.string().optional(),
 	idOnTheSource: z.string().optional(),
 	accessRoleId: z.nativeEnum(AccessRoleIds).optional(),
+	viewInsights: z.boolean().optional(),
+	isAdmin: z.boolean().optional(),
 	memberCount: z.number().optional()
 });
 /**
@@ -7083,6 +7904,9 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["searchEnabled"] = "searchEnabled";
 	QueryKeys["langfuseConnection"] = "langfuseConnection";
 	QueryKeys["langfuseSessionLink"] = "langfuseSessionLink";
+	QueryKeys["conversationTraceAvailability"] = "conversationTraceAvailability";
+	QueryKeys["conversationTraceRecords"] = "conversationTraceRecords";
+	QueryKeys["conversationTraceRecord"] = "conversationTraceRecord";
 	QueryKeys["user"] = "user";
 	QueryKeys["name"] = "name";
 	QueryKeys["models"] = "models";
@@ -7159,13 +7983,26 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["subagentThread"] = "subagentThread";
 	QueryKeys["codeEnvironments"] = "codeEnvironments";
 	QueryKeys["agentQueuedTurns"] = "agentQueuedTurns";
+	QueryKeys["pinnedOrder"] = "pinnedOrder";
 	return QueryKeys;
 }({});
-const DynamicQueryKeys = { agentFiles: (agentId) => ["agentFiles", agentId] };
+const DynamicQueryKeys = {
+	agentFiles: (agentId) => ["agentFiles", agentId],
+	codeEnvironmentStatus: (id) => [
+		"codeEnvironments",
+		id,
+		"status"
+	]
+};
 let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
 	MutationKeys["subagentControl"] = "subagentControl";
 	MutationKeys["enqueueAgentQueuedTurn"] = "enqueueAgentQueuedTurn";
 	MutationKeys["cancelAgentQueuedTurn"] = "cancelAgentQueuedTurn";
+	/** Whole-array favorites write, keyed so every hook instance's write is
+	*  visible to the others through the query client. */
+	MutationKeys["updateFavorites"] = "updateFavorites";
+	/** Pinned-section display order write, keyed for the same reason. */
+	MutationKeys["updatePinnedOrder"] = "updatePinnedOrder";
 	MutationKeys["updateLangfuseConnection"] = "updateLangfuseConnection";
 	MutationKeys["testLangfuseConnection"] = "testLangfuseConnection";
 	MutationKeys["createAgentApiKey"] = "createAgentApiKey";
@@ -7211,6 +8048,7 @@ let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
 	MutationKeys["pairCodeEnvironment"] = "pairCodeEnvironment";
 	MutationKeys["updateCodeEnvironmentSettings"] = "updateCodeEnvironmentSettings";
 	MutationKeys["deleteCodeEnvironment"] = "deleteCodeEnvironment";
+	MutationKeys["moveConversationCodeEnvironment"] = "moveConversationCodeEnvironment";
 	return MutationKeys;
 }({});
 //#endregion
@@ -7687,10 +8525,14 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getAvailableTools: () => getAvailableTools,
 	getBanner: () => getBanner,
 	getCategories: () => getCategories,
+	getCodeEnvironmentStatus: () => getCodeEnvironmentStatus,
 	getCodeEnvironments: () => getCodeEnvironments,
 	getCodeOutputDownload: () => getCodeOutputDownload,
 	getConversationById: () => getConversationById,
 	getConversationTags: () => getConversationTags,
+	getConversationTraceAvailability: () => getConversationTraceAvailability,
+	getConversationTraceRecord: () => getConversationTraceRecord,
+	getConversationTraceRecords: () => getConversationTraceRecords,
 	getConversations: () => getConversations,
 	getCustomConfigSpeech: () => getCustomConfigSpeech,
 	getDomainServerBaseUrl: () => getDomainServerBaseUrl,
@@ -7722,6 +8564,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getMessagesByConvoId: () => getMessagesByConvoId,
 	getModels: () => getModels,
 	getParentSubagents: () => getParentSubagents,
+	getPinnedOrder: () => getPinnedOrder,
 	getPresets: () => getPresets,
 	getProjectById: () => getProjectById,
 	getPrompt: () => getPrompt,
@@ -7771,6 +8614,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	logout: () => logout,
 	makePromptProduction: () => makePromptProduction,
 	markFilesUsage: () => markFilesUsage,
+	moveConversationCodeEnvironment: () => moveConversationCodeEnvironment,
 	pairCodeEnvironment: () => pairCodeEnvironment,
 	pinConversation: () => pinConversation,
 	rebuildConversationTags: () => rebuildConversationTags,
@@ -7813,6 +8657,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	updateMessage: () => updateMessage,
 	updateMessageContent: () => updateMessageContent,
 	updatePeoplePickerPermissions: () => updatePeoplePickerPermissions,
+	updatePinnedOrder: () => updatePinnedOrder,
 	updatePreset: () => updatePreset,
 	updateProject: () => updateProject,
 	updatePromptGroup: () => updatePromptGroup,
@@ -7844,13 +8689,23 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 });
 function getInsights(params = {}) {
 	const query = new URLSearchParams();
-	for (const [key, value] of Object.entries(params)) if (value !== void 0 && value !== null && value !== "") query.set(key, String(value));
+	for (const [key, value] of Object.entries(params)) if (Array.isArray(value)) value.forEach((item) => query.append(key, String(item)));
+	else if (value !== void 0 && value !== null && value !== "") query.set(key, String(value));
 	const suffix = query.toString() ? `?${query.toString()}` : "";
 	return request_default.get(`${insights()}${suffix}`);
 }
 function getInsightsAccess() {
 	return request_default.get(insightsAccess());
 }
+function getConversationTraceAvailability(conversationId) {
+	return request_default.get(conversationTraceAvailability(conversationId));
+}
+function getConversationTraceRecords({ conversationId, cursor }, signal) {
+	return request_default.get(conversationTraceRecords(conversationId, cursor), signal ? { signal } : void 0);
+}
+function getConversationTraceRecord({ conversationId, recordId, messageId, sourceId }, signal) {
+	return request_default.get(conversationTraceRecord(conversationId, recordId, messageId, sourceId), signal ? { signal } : void 0);
+}
 function getLangfuseConnection() {
 	return request_default.get(adminLangfuseConnection());
 }
@@ -7875,6 +8730,15 @@ function deleteUser(payload) {
 function getCodeEnvironments() {
 	return request_default.get(codeEnvironments());
 }
+function getCodeEnvironmentStatus(id) {
+	return request_default.get(codeEnvironmentStatus(id));
+}
+function moveConversationCodeEnvironment({ conversationId, from, to }) {
+	return request_default.patch(codeEnvironmentConversationDecision(conversationId), {
+		from,
+		to
+	});
+}
 function pairCodeEnvironment(payload) {
 	return request_default.post(codeEnvironmentPairings(), payload);
 }
@@ -7890,6 +8754,13 @@ function getFavorites() {
 function updateFavorites(favorites) {
 	return request_default.post(`${apiBaseUrl()}/api/user/settings/favorites`, { favorites });
 }
+/** Combined Pinned-section display order: favorite and pinned-chat entry keys interleaved. */
+function getPinnedOrder() {
+	return request_default.get(pinnedOrder());
+}
+function updatePinnedOrder(pinnedOrder$1) {
+	return request_default.post(pinnedOrder(), { pinnedOrder: pinnedOrder$1 });
+}
 /** Tool favorites — starred marketplace items (builtins, tools, MCP servers, skills). */
 function getToolFavorites() {
 	return request_default.get(toolFavorites());
@@ -8738,6 +9609,6 @@ const getActiveJobs = () => {
 	return request_default.get(activeJobs());
 };
 //#endregion
-export { permissionEntrySchema as $, googleSchema as $a, BedrockReasoningConfig as $i, specialVariables as $n, feedbackSchema as $o, defaultTextMimeTypes as $r, normalizeEndpointName as $s, azureGroupConfigsSchema as $t, updateResourcePermissions as A, defaultAgentFormValues as Aa, materializeModelSpecEndpoints as Ai, imageGenTools as An, tQueryParamsSchema as Ao, isProcessMCPServerField as Ar, feedbackFilterFieldSchema as As, SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH as At, MutationKeys as B, eReasoningResponseKeySchema as Ba, getMaxSubagents as Bi, modularEndpoints as Bn, actionDelimiter as Bo, registerPage as Br, hasActivePiiPatterns as Bs, SettingsViews as Bt, resetPassword as C, authTypeSchema as Ca, setFileConfigRegexCompiler as Ci, fileSourceSchema as Cn, tConvoUpdateSchema as Co, MCP_USER_INPUT_FIELDS as Cr, SKILL_FILTER_FIELDS as Cs, MAX_SUBAGENT_DEPTH as Ct, updateFeedback as D, compactAgentsSchema as Da, videoMimeTypes as Di, getDefaultParamsEndpoint as Dn, tPluginAuthConfigSchema as Do, WebSocketOptionsSchema as Dr, agentInstructionFilterFieldSchema as Ds, RateLimitPrefix as Dt, searchPrincipals as E, compactAgentsBaseSchema as Ea, textMimeTypes as Ei, getConfigDefaults as En, tModelSpecPresetSchema as Eo, StreamableHTTPOptionsSchema as Er, actionMetadataFilterFieldSchema as Es, OCRStrategy as Et, request_default as F, eModelEndpointSchema as Fa, MAX_CHAT_PROJECT_DESCRIPTION_LENGTH as Fi, langfuseConfigSchema as Fn, FilePurpose as Fo, FileSources as Fr, filterPiiStarterPatternSchema as Fs, SafeSearchTypes as Ft, PrincipalType as G, endpointSettings as Ga, clampSettingRange as Gi, paramDefinitionSchema as Gn, isActionTool as Go, bedrockDocumentFormats as Gr, skillFilterFieldSchema as Gs, VisionModes as Gt, AccessRoleIds as H, eThinkingDisplaySchema as Ha, ComponentTypes as Hi, normalizeSearxngEngines as Hn, defaultOrderQuery as Ho, applicationMimeTypes as Hr, messageFilterFieldSchema as Hs, TTSProviders as Ht, getTokenHeader as I, eReasoningContextSchema as Ia, MAX_CHAT_PROJECT_NAME_LENGTH as Ii, memorySchema as In, MessageContentTypes as Io, checkOpenAIStorage as Ir, filtersConfigSchema as Is, ScraperProviders as It, accessRoleToPermBits as J, getGoogleThinkingBudgetMax as Ja, generateOpenAISchema as Ji, resolveEndpointType as Jn, resolveStatefulCodeEnvironment as Jo, codeInterpreterMimeTypesList as Jr, userSubmittedMessageFieldPathSchema as Js, alternateName as Jt, ResourceType as K, extendedModelEndpointSchema as Ka, generateDynamicSchema as Ki, providerEndpointMap as Kn, STATEFUL_CODE_ENVIRONMENTS as Ko, bedrockDocumentMimeTypes as Kr, toolArgumentFilterFieldSchema as Ks, agentsEndpointSchema as Kt, setAcceptLanguageHeader as L, eReasoningEffortSchema as La, MAX_GRAPH_SUBAGENT_MEMBERS as Li, messageFilterPiiSchema as Ln, RunStatus as Lo, apiBaseUrl as Lr, getPiiRegexProgramSize as Ls, SearchCategories as Lt, updateUserKey as M, documentSupportedProviders as Ma, resolveModelSpecEndpoint as Mi, interfaceSchema as Mn, AnnotationTypes as Mo, AuthorizationTypeEnum as Mr, filterPiiActionSchema as Ms, SKILL_SYNC_MAX_INTERVAL_MINUTES as Mt, updateUserPlugins as N, eAnthropicEffortSchema as Na, specsConfigSchema as Ni, isRemoteOidcUrlAllowed as Nn, AssistantStreamEvents as No, TokenExchangeMethodEnum as Nr, filterPiiCustomPatternSchema as Ns, SKILL_SYNC_MIN_INTERVAL_MINUTES as Nt, updateMessage as O, compactAssistantSchema as Oa, REFILL_INTERVAL_UNITS as Oi, getEndpointField as On, tPluginSchema as Oo, hasProcessMCPServerConfig as Or, conversationStarterFilterFieldSchema as Os, RerankerTypes as Ot, userKeyQuery as P, eImageDetailSchema as Pa, tModelSpecSchema as Pi, isSecureCodeEnvironmentControlURL as Pn, EToolResources as Po, FileContext as Pr, filterPiiRegexSchema as Ps, STTProviders as Pt, permBitsToAccessLevel as Q, googleGenConfigSchema as Qa, BedrockProviders as Qi, skillSyncGitHubSourceSchema as Qn, feedbackRatingSchema as Qo, defaultSTTMimeTypes as Qr, isSensitiveEnvVar as Qs, azureEndpointSchema as Qt, setTokenHeader as R, eReasoningModeSchema as Ra, MAX_SUBAGENTS as Ri, messageFilterSchema as Rn, StepStatus as Ro, buildLoginRedirectUrl as Rr, hasActiveFiltersConfig as Rs, SearchProviders as Rt, requestPasswordReset as S, assistantSchema as Sa, retrievalMimeTypesList as Si, excludedKeys as Sn, tConversationTagSchema as So, MCP_SERVER_TITLE_PATTERN as Sr, PROMPT_FILTER_FIELDS as Ss, LocalStorageKeys as St, revokeUserKey as T, coerceNumber as Ta, supportsFiles as Ti, fileStrategiesSchema as Tn, tMessageSchema as To, StdioOptionsSchema as Tr, TOOL_ARGUMENT_FILTER_FIELDS as Ts, MAX_SUBAGENT_RUN_CONFIGS as Tt, PermissionBits as U, eThinkingLevelSchema as Ua, OptionTypes as Ui, normalizeServerName as Un, hostImageIdSuffix as Uo, audioMimeTypes as Ur, modelParameterFilterFieldSchema as Us, Time as Ut, QueryKeys as V, eReasoningSummarySchema as Va, setMaxSubagents as Vi, normalizeMCPToolKey as Vn, actionDomainSeparator as Vo, sharedFileDownload as Vr, memoryFilterFieldSchema as Vs, SystemCategories as Vt, PrincipalModel as W, eVerbositySchema as Wa, SettingTypes as Wi, ocrSchema as Wn, hostImageNamePrefix as Wo, bedrockDocumentExtensions as Wr, promptFilterFieldSchema as Ws, ViolationTypes as Wt, getResourcePermissionsResponseSchema as X, getSettingsKeys as Xa, AnthropicEffort as Xi, setMessageFilterRegexValidator as Xn, FEEDBACK_REASON_KEYS as Xo, convertStringsToRegex as Xr, extractEnvVariable as Xs, assistantEndpointSchema as Xt, effectivePermissionsResponseSchema as Y, getModelKey as Ya, validateSettingDefinitions as Yi, retainRecentConfigSchema as Yn, FEEDBACK_RATINGS as Yo, codeTypeMapping as Yr, envVarRegex as Ys, anthropicEndpointSchema as Yt, hasPermissions as Z, googleBaseSchema as Za, AuthType as Zi, skillSyncConfigSchema as Zn, FEEDBACK_TAGS as Zo, defaultOCRMimeTypes as Zr, extractVariableName as Zs, azureBaseSchema as Zt, getResourcePermissions as _, agentsSchema as _a, mbToBytes as _i, defaultEndpoints as _n, removeNullishValues as _o, webSearchSchema as _r, MAX_PII_PATTERN_LABEL_LENGTH as _s, FetchTokenConfig as _t, data_service_exports as a, Providers as aa, fileConfigSchema as ai, bedrockModels as an, isAssistantsEndpoint as ao, summarizationTriggerSchema as ar, AGENT_INSTRUCTION_FILTER_FIELDS as as, AgentCapabilities as at, register as b, anthropicSchema as ba, mimeTypeAliases as bi, defaultSocialLogins as bn, tBannerSchema as bo, MCPServersSchema as br, MESSAGE_FILTER_FIELDS as bs, InfiniteCollections as bt, getAccessRoles as c, ReasoningMode as ca, getEndpointFileConfig as ci, checkpointerTypeSchema as cn, isMythosClassModel as co, toolApprovalModeSchema as cr, FEEDBACK_FILTER_FIELDS as cs, BASE_PRINCIPAL_CONFIG_SECTIONS as ct, getAvailablePlugins as d, ReasoningSummary as da, imageTypeMapping as di, codeEnvironmentUserConfigSchema as dn, isUUID as do, turnstileOptionsSchema as dr, HITL_MESSAGE_FILTER_FIELDS as ds, CohereConstants as dt, EModelEndpoint as ea, documentParserMimeTypes as ei, azureGroupSchema as en, googleSettings as eo, splitMCPToolKey as er, feedbackTagKeySchema as es, principalSchema as et, getConversationById as f, SkillsScope as fa, inferMimeType as fi, codeEnvironmentUserSettingsSchema as fn, openAIBaseSchema as fo, turnstileSchema as fr, MAX_PII_CUSTOM_PATTERNS_TOTAL as fs, Constants as ft, getModels as g, agentsBaseSchema as ga, isPermissiveMimeConfig as gi, defaultAssistantsVersion as gn, paramEndpoints as go, visionModels as gr, MAX_PII_PATTERN_ID_LENGTH as gs, ErrorTypes as gt, getMCPServerConnectionStatus as h, Verbosity as ha, isBedrockDocumentType as hi, defaultAgentCapabilities as hn, openRouterSchema as ho, vertexModelConfigSchema as hr, MAX_PII_PATTERNS_PER_SOURCE as hs, EndpointURLs as ht, createPreset as i, MemoryScope as ia, fileConfig as ii, bedrockGuardrailConfigSchema as in, isAgentsEndpoint as io, summarizationConfigSchema as ir, ACTION_METADATA_FILTER_FIELDS as is, AUTH_USER_DOC_BY_ID_PREFIX as it, updateTokenCount as j, defaultAssistantFormValues as ja, modelSpecSubagentsSchema as ji, initialModelsConfig as jn, tSharedLinkSchema as jo, AuthTypeEnum as jr, fileFilterFieldSchema as js, SKILL_SYNC_MAX_DISCOVERY_DEPTH as jt, updateMessageContent as k, compactGoogleSchema as ka, getRefillEligibilityDate as ki, getSchemaDefaults as kn, tPresetSchema as ko, isProcessMCPServerConfig as kr, conversationTitleFilterFieldSchema as ks, RetentionMode as kt, getAgentApiKeys as l, ReasoningParameterFormat as la, imageExtRegex as li, cloudfrontConfigSchema as ln, isOpenAILikeProvider as lo, toolApprovalPolicySchema as lr, FILE_FILTER_FIELDS as ls, CacheKeys as lt, getEffectivePermissions as m, ThinkingLevel as ma, isAnthropicTextDocumentType as mi, contextPruningSchema as mn, openAISettings as mo, vertexAISchema as mr, MAX_PII_CUSTOM_REGEX_INSTRUCTIONS as ms, EImageOutputType as mt, clearAllConversations as n, ImageVisionTool as na, excelFileTypes as ni, baseEndpointSchema as nn, imageDetailValue as no, stripServerNamePrefix as nr, getTagsForRating as ns, updateResourcePermissionsRequestSchema as nt, deleteAgentApiKey as o, ReasoningContext as oa, fullMimeTypesList as oi, buildServerNameAliases as on, isDocumentSupportedProvider as oo, supportsBalanceCheck as or, CONVERSATION_STARTER_FILTER_FIELDS as os, AuthKeys as ot, getCustomConfigSpeech as p, ThinkingDisplay as pa, isAnthropicDocumentType as pi, configSchema as pn, openAISchema as po, validateVisionModel as pr, MAX_PII_CUSTOM_REGEX_CHARACTERS as ps, DEFAULT_MEMORY_MAX_INPUT_TOKENS as pt, accessRoleSchema as q, getGoogleThinkingBudgetBounds as qa, generateGoogleSchema as qi, rateLimitSchema as qn, resolveAllowedStatefulCodeEnvironments as qo, codeInterpreterMimeTypes as qr, unattributedAssistantContentSchema as qs, allowedAddressesSchema as qt, createAgentApiKey as r, MYTHOS_CLASS_FAMILIES as ra, excelMimeTypes as ri, bedrockEndpointSchema as rn, inputTokensIncludesCache as ro, stripServerNamePrefixes as rr, toMinimalFeedback as rs, updateResourcePermissionsResponseSchema as rt, deletePreset as s, ReasoningEffort as sa, getConfiguredMimeAccept as si, checkpointerSchema as sn, isImageVisionTool as so, toolApprovalHookConfigSchema as sr, CONVERSATION_TITLE_FILTER_FIELDS as ss, BASE_ONLY_CONFIG_SECTIONS as st, cancelMCPOAuth as t, ImageDetail as ta, endpointFileConfigSchema as ti, balanceSchema as tn, imageDetailNumeric as to, splitToolCallName as tr, getTagByKey as ts, resourcePermissionsResponseSchema as tt, getAllEffectivePermissions as u, ReasoningResponseKey as ua, imageMimeTypes as ui, codeEnvironmentPermissionDecisionSchema as un, isParamEndpoint as uo, transactionsSchema as ur, FILTER_PII_STARTER_PATTERNS as us, Capabilities as ut, getSharedLink as v, agentsSettings as va, megabyte as vi, defaultModels as vn, resolveAgentSkillsScope as vo, MCPOptionsSchema as vr, MAX_PII_PATTERN_LENGTH as vs, ForkOptions as vt, revokeAllUserKeys as w, cacheSubsetProviders as wa, supportedMimeTypes as wi, fileStorageSchema as wn, tExampleSchema as wo, SSEOptionsSchema as wr, STORED_MESSAGE_FILTER_FIELDS as ws, MAX_SUBAGENT_GRAPH_NODES as wt, reinitializeMCPServer as x, anthropicSettings as xa, retrievalMimeTypes as xi, endpointSchema as xn, tConversationSchema as xo, MCP_SERVER_TITLE_ERROR as xr, MODEL_PARAMETER_FILTER_FIELDS as xs, KnownEndpoints as xt, getSharedMessages as y, anthropicBaseSchema as ya, mergeFileConfig as yi, defaultRetrievalModels as yn, subagentThreadLineageSchema as yo, MCPServerUserInputSchema as yr, MEMORY_FILTER_FIELDS as ys, ImageDetailCost as yt, DynamicQueryKeys as z, eReasoningParameterFormatSchema as za, MAX_SUBAGENTS_CEILING as zi, modelConfigSchema as zn, Tools as zo, loginPage as zr, hasActivePiiFields as zs, SettingsTabValues as zt };
+export { permissionEntrySchema as $, Providers as $a, envVarRegex as $c, isResponsesApiUpload as $i, isSpeechProviderConfigured as $n, isAssistantsEndpoint as $o, SSEOptionsSchema as $r, CODE_WORKSPACE_MAX_COUNT as $s, SearchCategories as $t, updateResourcePermissions as A, validateSettingDefinitions as Aa, actionMetadataFilterFieldSchema as Ac, defaultOCRMimeTypes as Ai, codeEnvironmentUserSettingsSchema as An, eReasoningContextSchema as Ao, summarizationTriggerSchema as Ar, Tools as As, FetchTokenConfig as At, MutationKeys as B, DEFAULT_BALANCE_RESERVATION_TTL_MS as Ba, filtersConfigSchema as Bc, getConfiguredMimeAccept as Bi, excludedKeys as Bn, extendedModelEndpointSchema as Bo, validateVisionModel as Br, FEEDBACK_REASON_KEYS as Bs, MAX_SUBAGENT_GRAPH_NODES as Bt, resetPassword as C, ComponentTypes as Ca, MEMORY_FILTER_FIELDS as Cc, bedrockDocumentFormats as Ci, bedrockModels as Cn, compactGoogleSchema as Co, skillSyncGitHubSourceSchema as Cr, tModelSpecPresetSchema as Cs, DEFAULT_AGENT_MODEL_RESPONSE_HEADERS_TIMEOUT_MS as Ct, updateFeedback as D, generateDynamicSchema as Da, SKILL_FILTER_FIELDS as Dc, codeTypeMapping as Di, cloudfrontConfigSchema as Dn, eAnthropicEffortSchema as Do, stripServerNamePrefix as Dr, tQueryParamsSchema as Ds, EImageOutputType as Dt, searchPrincipals as E, clampSettingRange as Ea, PROMPT_FILTER_FIELDS as Ec, codeInterpreterMimeTypesList as Ei, checkpointerTypeSchema as En, documentSupportedProviders as Eo, splitToolCallName as Er, tPresetSchema as Es, DEFAULT_OAUTH_STATE_TTL_MS as Et, request_default as F, MAX_GRAPH_SUBAGENT_MEMBERS as Fa, fileFilterFieldSchema as Fc, excelFileTypes as Fi, defaultEndpoints as Fn, eReasoningSummarySchema as Fo, traceViewerDefaults as Fr, CodeApprovalModeError as Fs, LANGFUSE_TRACE_CONVERSATION_METADATA_FIELDS as Ft, PrincipalType as G, AuthType as Ga, memoryFilterFieldSchema as Gc, imageTypeMapping as Gi, getDefaultParamsEndpoint as Gn, googleBaseSchema as Go, MAX_MCP_ICON_PATH_LENGTH as Gr, getTagByKey as Gs, RetentionMode as Gt, AccessRoleIds as H, REFILL_INTERVAL_UNITS as Ha, hasActiveFiltersConfig as Hc, getEndpointFileConfig as Hi, fileStorageSchema as Hn, getGoogleThinkingBudgetMax as Ho, vertexModelConfigSchema as Hr, feedbackRatingSchema as Hs, OCRStrategy as Ht, getTokenHeader as I, MAX_SUBAGENTS as Ia, filterPiiActionSchema as Ic, excelMimeTypes as Ii, defaultModels as In, eThinkingDisplaySchema as Io, traceViewerLimits as Ir, getAllowedCodeApprovalModes as Is, LANGFUSE_TRACE_USER_ID_FIELDS as It, accessRoleToPermBits as J, EModelEndpoint as Ja, promptFilterFieldSchema as Jc, isAnthropicTextDocumentType as Ji, imageGenTools as Jn, googleSettings as Jo, MCPServerUserInputSchema as Jr, CODE_ENVIRONMENT_DECISION_VERSION as Js, SKILL_SYNC_MAX_INTERVAL_MINUTES as Jt, ResourceType as K, BedrockProviders as Ka, messageFilterFieldSchema as Kc, inferMimeType as Ki, getEndpointField as Kn, googleGenConfigSchema as Ko, MAX_MCP_OAUTH_PERSISTENCE_WAIT_MS as Kr, getTagsForRating as Ks, SKILL_SYNC_DEFAULT_DISCOVERY_DEPTH as Kt, setAcceptLanguageHeader as L, MAX_SUBAGENTS_CEILING as La, filterPiiCustomPatternSchema as Lc, fileConfig as Li, defaultRetrievalModels as Ln, eThinkingLevelSchema as Lo, transactionsSchema as Lr, resolveCodeApprovalMode as Ls, LANGFUSE_TRACE_USER_METADATA_FIELDS as Lt, updateUserKey as M, DEFAULT_RETAINED_ANSWER_TOKENS as Ma, conversationStarterFilterFieldSchema as Mc, defaultTextMimeTypes as Mi, contextPruningSchema as Mn, eReasoningModeSchema as Mo, toolApprovalHookConfigSchema as Mr, actionDomainSeparator as Ms, ImageDetailCost as Mt, updateUserPlugins as N, MAX_CHAT_PROJECT_DESCRIPTION_LENGTH as Na, conversationTitleFilterFieldSchema as Nc, documentParserMimeTypes as Ni, defaultAgentCapabilities as Nn, eReasoningParameterFormatSchema as No, toolApprovalModeSchema as Nr, isActionTool as Ns, InfiniteCollections as Nt, updateMessage as O, generateGoogleSchema as Oa, STORED_MESSAGE_FILTER_FIELDS as Oc, convertStringsToRegex as Oi, codeEnvironmentPermissionDecisionSchema as On, eImageDetailSchema as Oo, stripServerNamePrefixes as Or, tSharedLinkSchema as Os, EndpointURLs as Ot, userKeyQuery as P, MAX_CHAT_PROJECT_NAME_LENGTH as Pa, feedbackFilterFieldSchema as Pc, endpointFileConfigSchema as Pi, defaultAssistantsVersion as Pn, eReasoningResponseKeySchema as Po, toolApprovalPolicySchema as Pr, CODE_APPROVAL_MODES as Ps, KnownEndpoints as Pt, permBitsToAccessLevel as Q, MemoryScope as Qa, userSubmittedMessageFieldPathSchema as Qc, isPermissiveMimeConfig as Qi, isSecureCodeEnvironmentControlURL as Qn, isAgentsEndpoint as Qo, MCP_USER_INPUT_FIELDS as Qr, CODE_WORKSPACE_INSTANCE_TYPES as Qs, ScraperProviders as Qt, setTokenHeader as R, getMaxSubagents as Ra, filterPiiRegexSchema as Rc, fileConfigSchema as Ri, defaultSocialLogins as Rn, eVerbositySchema as Ro, turnstileOptionsSchema as Rr, resolveCodePermissionDecision as Rs, LocalStorageKeys as Rt, requestPasswordReset as S, resolveStatefulCodeEnvironment as Sa, MAX_PII_PATTERN_LENGTH as Sc, bedrockDocumentExtensions as Si, bedrockGuardrailConfigSchema as Sn, compactAssistantSchema as So, skillSyncConfigSchema as Sr, tMessageSchema as Ss, DEFAULT_AGENT_MODEL_RESPONSE_BODY_TIMEOUT_MS as St, revokeUserKey as T, SettingTypes as Ta, MODEL_PARAMETER_FILTER_FIELDS as Tc, codeInterpreterMimeTypes as Ti, checkpointerSchema as Tn, defaultAssistantFormValues as To, splitMCPToolKey as Tr, tPluginSchema as Ts, DEFAULT_MEMORY_MAX_INPUT_TOKENS as Tt, PermissionBits as U, getRefillEligibilityDate as Ua, hasActivePiiFields as Uc, imageExtRegex as Ui, fileStrategiesSchema as Un, getModelKey as Uo, visionModels as Ur, feedbackSchema as Us, RateLimitPrefix as Ut, QueryKeys as V, MIN_BALANCE_RESERVATION_TTL_MS as Va, getPiiRegexProgramSize as Vc, getDocumentFileExtension as Vi, fileSourceSchema as Vn, getGoogleThinkingBudgetBounds as Vo, vertexAISchema as Vr, FEEDBACK_TAGS as Vs, MAX_SUBAGENT_RUN_CONFIGS as Vt, PrincipalModel as W, AnthropicEffort as Wa, hasActivePiiPatterns as Wc, imageMimeTypes as Wi, getConfigDefaults as Wn, getSettingsKeys as Wo, webSearchSchema as Wr, feedbackTagKeySchema as Ws, RerankerTypes as Wt, getResourcePermissionsResponseSchema as X, ImageVisionTool as Xa, toolArgumentFilterFieldSchema as Xc, isExplicitMimeConfig as Xi, interfaceSchema as Xn, imageDetailValue as Xo, MCP_SERVER_TITLE_ERROR as Xr, CODE_ENVIRONMENT_MOVE_VERSION as Xs, STTProviders as Xt, effectivePermissionsResponseSchema as Y, ImageDetail as Ya, skillFilterFieldSchema as Yc, isBedrockDocumentType as Yi, initialModelsConfig as Yn, imageDetailNumeric as Yo, MCPServersSchema as Yr, CODE_ENVIRONMENT_MODES as Ys, SKILL_SYNC_MIN_INTERVAL_MINUTES as Yt, hasPermissions as Z, MYTHOS_CLASS_FAMILIES as Za, unattributedAssistantContentSchema as Zc, isMessageFileUpload as Zi, isRemoteOidcUrlAllowed as Zn, inputTokensIncludesCache as Zo, MCP_SERVER_TITLE_PATTERN as Zr, CODE_WORKSPACE_ID_PATTERN as Zs, SafeSearchTypes as Zt, getResourcePermissions as _, resolveModelSpecEndpoint as _a, MAX_PII_CUSTOM_REGEX_CHARACTERS as _c, sharedFileDownload as _i, azureGroupConfigsSchema as _n, authTypeSchema as _o, rateLimitSchema as _r, tBannerSchema as _s, CODE_ENVIRONMENT_QUEUE_WAIT_DEFAULT_MS as _t, data_service_exports as a, resolveEffectiveUseResponsesApi as aa, isCodeWorkspaceSelectionErrorReason as ac, isProcessMCPServerField as ai, Time as an, ReasoningSummary as ao, messageFilterPiiSchema as ar, isOpenAILikeProvider as as, FilePurpose as at, register as b, STATEFUL_CODE_ENVIRONMENTS as ba, MAX_PII_PATTERN_ID_LENGTH as bc, applicationMimeTypes as bi, baseEndpointSchema as bn, compactAgentsBaseSchema as bo, retainRecentConfigSchema as br, tConvoUpdateSchema as bs, CohereConstants as bt, getAccessRoles as c, retrievalMimeTypes as ca, ACTION_METADATA_FILTER_FIELDS as cc, TokenExchangeMethodEnum as ci, agentsEndpointSchema as cn, ThinkingLevel as co, modularEndpoints as cr, mediaSupportedProviders as cs, AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_DEFAULT as ct, getAvailablePlugins as d, supportedMimeTypes as da, CONVERSATION_TITLE_FILTER_FIELDS as dc, FileSources as di, anthropicEndpointSchema as dn, agentsSchema as do, normalizeServerName as dr, openAISettings as ds, AgentCapabilities as dt, mbToBytes as ea, CODE_WORKSPACE_OPERATIONS as ec, StdioOptionsSchema as ei, extractEnvVariable as el, SearchProviders as en, ReasoningContext as eo, langfuseConfigSchema as er, isDocumentSupportedProvider as es, principalSchema as et, getConversationById as f, supportsFiles as fa, FEEDBACK_FILTER_FIELDS as fc, checkOpenAIStorage as fi, askUserQuestionConfigSchema as fn, agentsSettings as fo, ocrSchema as fr, openRouterSchema as fs, AuthKeys as ft, getModels as g, modelSpecSubagentsSchema as ga, MAX_PII_CUSTOM_PATTERNS_TOTAL as gc, registerPage as gi, azureEndpointSchema as gn, assistantSchema as go, providerEndpointMap as gr, subagentThreadLineageSchema as gs, CODE_ENVIRONMENT_COMMAND_TIMEOUT_HARD_MAX_MS as gt, getMCPServerConnectionStatus as h, materializeModelSpecEndpoints as ha, HITL_MESSAGE_FILTER_FIELDS as hc, loginPage as hi, azureBaseSchema as hn, anthropicSettings as ho, permissionWriteAttemptsSchema as hr, resolveAgentSkillsScope as hs, CODE_ENVIRONMENT_COMMAND_TIMEOUT_DEFAULT_MS as ht, createPreset as i, prefersResponsesApiByModel as ia, isCodeWorkspaceSelection as ic, isProcessMCPServerConfig as ii, TTSProviders as in, ReasoningResponseKey as io, memorySchema as ir, isMythosClassModel as is, AssistantStreamEvents as it, updateTokenCount as j, DEFAULT_MAX_RETAINED_TOOL_COUNT_CHARS as ja, agentInstructionFilterFieldSchema as jc, defaultSTTMimeTypes as ji, configSchema as jn, eReasoningEffortSchema as jo, supportsBalanceCheck as jr, actionDelimiter as js, ForkOptions as jt, updateMessageContent as k, generateOpenAISchema as ka, TOOL_ARGUMENT_FILTER_FIELDS as kc, defaultLLMDeliveryPathSchema as ki, codeEnvironmentUserConfigSchema as kn, eModelEndpointSchema as ko, summarizationConfigSchema as kr, EToolResources as ks, ErrorTypes as kt, getAgentApiKeys as l, retrievalMimeTypesList as la, AGENT_INSTRUCTION_FILTER_FIELDS as lc, agentGitIdentitySchema as li, allowedAddressesSchema as ln, Verbosity as lo, normalizeMCPToolKey as lr, openAIBaseSchema as ls, AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_HARD_MAX as lt, getEffectivePermissions as m, videoMimeTypes as ma, FILTER_PII_STARTER_PATTERNS as mc, buildLoginRedirectUrl as mi, assistantEndpointSchema as mn, anthropicSchema as mo, paramDefinitionSchema as mr, removeNullishValues as ms, BASE_PRINCIPAL_CONFIG_SECTIONS as mt, clearAllConversations as n, mergeFileConfig as na, isCodeEnvironmentMode as nc, WebSocketOptionsSchema as ni, isSensitiveEnvVar as nl, SettingsViews as nn, ReasoningMode as no, listConfiguredSpeechProviders as nr, isKnownProviderIdentifier as ns, updateResourcePermissionsRequestSchema as nt, deleteAgentApiKey as o, resolveSandboxFilename as oa, isCodeWorkspaceSelections as oc, AuthTypeEnum as oi, ViolationTypes as on, SkillsScope as oo, messageFilterSchema as or, isParamEndpoint as os, RunStatus as ot, getCustomConfigSpeech as p, textMimeTypes as pa, FILE_FILTER_FIELDS as pc, apiBaseUrl as pi, askUserQuestionRetainedAnswersSchema as pn, anthropicBaseSchema as po, openIdDiscoverySchema as pr, paramEndpoints as ps, BASE_ONLY_CONFIG_SECTIONS as pt, accessRoleSchema as q, BedrockReasoningConfig as qa, modelParameterFilterFieldSchema as qc, isAnthropicDocumentType as qi, getSchemaDefaults as qn, googleSchema as qo, MCPOptionsSchema as qr, toMinimalFeedback as qs, SKILL_SYNC_MAX_DISCOVERY_DEPTH as qt, createAgentApiKey as r, mimeTypeAliases as ra, isCodeWorkspaceEnvironment as rc, hasProcessMCPServerConfig as ri, normalizeEndpointName as rl, SystemCategories as rn, ReasoningParameterFormat as ro, mcpRefreshDefaults as rr, isMediaSupportedProvider as rs, updateResourcePermissionsResponseSchema as rt, deletePreset as s, resolveUseResponsesApi as sa, isRepositoryInstructionDescriptor as sc, AuthorizationTypeEnum as si, VisionModes as sn, ThinkingDisplay as so, modelConfigSchema as sr, isUUID as ss, defaultOrderQuery as st, cancelMCPOAuth as t, megabyte as ta, CODE_WORKSPACE_SELECTION_ERROR_REASONS as tc, StreamableHTTPOptionsSchema as ti, extractVariableName as tl, SettingsTabValues as tn, ReasoningEffort as to, langfuseTraceConfigSchema as tr, isImageVisionTool as ts, resourcePermissionsResponseSchema as tt, getAllEffectivePermissions as u, setFileConfigRegexCompiler as ua, CONVERSATION_STARTER_FILTER_FIELDS as uc, FileContext as ui, alternateName as un, agentsBaseSchema as uo, normalizeSearxngEngines as ur, openAISchema as us, AUTH_USER_DOC_BY_ID_PREFIX as ut, getSharedLink as v, specsConfigSchema as va, MAX_PII_CUSTOM_REGEX_INSTRUCTIONS as vc, DEFAULT_SKILL_IMPORT_CLEANUP_CONCURRENCY as vi, azureGroupSchema as vn, cacheSubsetProviders as vo, resolveEndpointType as vr, tConversationSchema as vs, CacheKeys as vt, revokeAllUserKeys as w, OptionTypes as wa, MESSAGE_FILTER_FIELDS as wc, bedrockDocumentMimeTypes as wi, buildServerNameAliases as wn, defaultAgentFormValues as wo, specialVariables as wr, tPluginAuthConfigSchema as ws, DEFAULT_MAX_PROVIDER_ERROR_CHARS as wt, reinitializeMCPServer as x, resolveAllowedStatefulCodeEnvironments as xa, MAX_PII_PATTERN_LABEL_LENGTH as xc, audioMimeTypes as xi, bedrockEndpointSchema as xn, compactAgentsSchema as xo, setMessageFilterRegexValidator as xr, tExampleSchema as xs, Constants as xt, getSharedMessages as y, tModelSpecSchema as ya, MAX_PII_PATTERNS_PER_SOURCE as yc, DefaultLLMDeliveryPath as yi, balanceSchema as yn, coerceNumber as yo, resolveTraceViewerConfig as yr, tConversationTagSchema as ys, Capabilities as yt, DynamicQueryKeys as z, setMaxSubagents as za, filterPiiStarterPatternSchema as zc, fullMimeTypesList as zi, endpointSchema as zn, endpointSettings as zo, turnstileSchema as zr, FEEDBACK_RATINGS as zs, MAX_SUBAGENT_DEPTH as zt };
 
-//# sourceMappingURL=data-service-CaB7saTP.mjs.map
+//# sourceMappingURL=data-service-B-WUVvTH.mjs.map