librechat-data-provider 0.8.522 → 0.8.524

package/dist/{data-service-D5kHzBt-.js → data-service-CUG1qdeC.js}

@@ -350,6 +350,75 @@ const filtersConfigSchema = zod.z.object({
 	});
 });
 //#endregion
+//#region src/code/workspace.ts
+const CODE_WORKSPACE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+/** Protocol-v1 ceiling enforced by the worker and Code API. */
+const CODE_WORKSPACE_MAX_COUNT = 32;
+/** API/client protocol for immutable conversation-owned environment decisions. */
+const CODE_ENVIRONMENT_DECISION_VERSION = 1;
+/** API/client protocol for an owner's explicit move of a sealed environment decision. */
+const CODE_ENVIRONMENT_MOVE_VERSION = 1;
+const CODE_WORKSPACE_OPERATIONS = [
+	"read_file",
+	"search_text",
+	"list_files",
+	"write_file",
+	"preview_edit",
+	"edit_file",
+	"execute_command"
+];
+const CODE_WORKSPACE_INSTANCE_TYPES = ["git_worktree"];
+const CODE_WORKSPACE_SELECTION_ERROR_REASONS = [
+	"required",
+	"invalid",
+	"worker_unavailable",
+	"unsupported",
+	"missing",
+	"locked"
+];
+const CODE_ENVIRONMENT_MODES = ["attached", "without_attached"];
+function isRepositoryInstructionDescriptor(value) {
+	if (value == null || typeof value !== "object") return false;
+	const descriptor = value;
+	return Object.keys(descriptor).every((key) => [
+		"path",
+		"bytes",
+		"sha256",
+		"truncated"
+	].includes(key)) && (descriptor.path === "AGENTS.md" || descriptor.path === "CLAUDE.md") && Number.isSafeInteger(descriptor.bytes) && Number(descriptor.bytes) >= 0 && Number(descriptor.bytes) <= 32768 && typeof descriptor.sha256 === "string" && /^[a-f0-9]{64}$/.test(descriptor.sha256) && typeof descriptor.truncated === "boolean";
+}
+function isCodeWorkspaceEnvironment(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return false;
+	const environment = value;
+	return Object.keys(environment).every((key) => [
+		"fingerprint",
+		"repo",
+		"ref",
+		"actions"
+	].includes(key)) && typeof environment.fingerprint === "string" && /^[a-f0-9]{64}$/.test(environment.fingerprint) && (environment.repo === void 0 || typeof environment.repo === "string" && environment.repo.length <= 256 && /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(environment.repo)) && (environment.ref === void 0 || typeof environment.ref === "string" && environment.ref.trim().length > 0 && environment.ref.length <= 256 && !/[\0\r\n]/.test(environment.ref)) && Array.isArray(environment.actions) && environment.actions.length <= 32 && environment.actions.every((name) => typeof name === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(name)) && new Set(environment.actions).size === environment.actions.length;
+}
+function isCodeEnvironmentMode(value) {
+	return CODE_ENVIRONMENT_MODES.some((mode) => mode === value);
+}
+function isCodeWorkspaceSelectionErrorReason(value) {
+	return CODE_WORKSPACE_SELECTION_ERROR_REASONS.some((reason) => reason === value);
+}
+function isCodeWorkspaceSelection(value) {
+	if (value == null || typeof value !== "object" || Array.isArray(value)) return false;
+	const selection = value;
+	return Object.keys(selection).every((key) => key === "environmentId" || key === "workspaceId") && typeof selection.environmentId === "string" && CODE_WORKSPACE_ID_PATTERN.test(selection.environmentId) && typeof selection.workspaceId === "string" && CODE_WORKSPACE_ID_PATTERN.test(selection.workspaceId);
+}
+/** One exact workspace per attached environment used by a conversation. */
+function isCodeWorkspaceSelections(value) {
+	if (!Array.isArray(value)) return false;
+	const environmentIds = /* @__PURE__ */ new Set();
+	return value.every((selection) => {
+		if (!isCodeWorkspaceSelection(selection) || environmentIds.has(selection.environmentId)) return false;
+		environmentIds.add(selection.environmentId);
+		return true;
+	});
+}
+//#endregion
 //#region src/feedback.ts
 const FEEDBACK_RATINGS = ["thumbsUp", "thumbsDown"];
 const FEEDBACK_REASON_KEYS = [
@@ -459,26 +528,64 @@ function getTagByKey(key) {
 	return FEEDBACK_TAGS.find((tag) => tag.key === key);
 }
 //#endregion
-//#region src/stateful-code.ts
-const STATEFUL_CODE_ENVIRONMENTS = [
-	"user",
-	"agent-user",
-	"conversation"
+//#region src/code/approval.ts
+const CODE_APPROVAL_MODES = [
+	"ask",
+	"acceptEdits",
+	"fullAccess"
 ];
-/** Resolve a deployment allowlist in stable UI order. An omitted value preserves
-* the backward-compatible behavior where every environment is available. */
-function resolveAllowedStatefulCodeEnvironments(configured) {
-	if (configured == null) return [...STATEFUL_CODE_ENVIRONMENTS];
-	const configuredSet = new Set(configured);
-	return STATEFUL_CODE_ENVIRONMENTS.filter((environment) => configuredSet.has(environment));
+const MODE_PERMISSIONS = {
+	ask: {
+		fileWrite: "ask",
+		commandExecution: "ask"
+	},
+	acceptEdits: {
+		fileWrite: "allow",
+		commandExecution: "ask"
+	},
+	fullAccess: {
+		fileWrite: "allow",
+		commandExecution: "allow"
+	}
+};
+/** Omitted deployment configuration never grants unattended execution. */
+function getAllowedCodeApprovalModes({ enabled, allowedModes, configSchema, settings, environment }) {
+	if (enabled === false) return [];
+	const permitted = new Set(allowedModes ?? ["ask"]);
+	return CODE_APPROVAL_MODES.filter((mode) => {
+		if (!permitted.has(mode)) return false;
+		if (environment === "managed") return true;
+		for (const category of ["fileWrite", "commandExecution"]) {
+			if (MODE_PERMISSIONS[mode][category] !== "allow") continue;
+			const field = configSchema?.permissions?.[category];
+			const configured = settings?.permissions?.[category];
+			if ((configured != null && field?.allowed.includes(configured) === true ? configured : field?.default ?? "ask") === "deny" || field?.allowed.includes("allow") !== true) return false;
+		}
+		return true;
+	});
 }
-/** Keep an allowed preference, otherwise select the first deployment-allowed scope. */
-function resolveStatefulCodeEnvironment(preferred, configured) {
-	const allowed = resolveAllowedStatefulCodeEnvironments(configured);
-	return preferred != null && allowed.includes(preferred) ? preferred : allowed[0];
+var CodeApprovalModeError = class extends Error {
+	constructor() {
+		super("The selected code approval mode is not permitted by the current policy.");
+		this.code = "CODE_APPROVAL_MODE_NOT_ALLOWED";
+		this.name = "CodeApprovalModeError";
+	}
+};
+/** Validate untrusted request state again at admission, including after policy changes. */
+function resolveCodeApprovalMode(requested, constraints) {
+	if (requested == null) return void 0;
+	const selected = getAllowedCodeApprovalModes(constraints).find((mode) => mode === requested);
+	if (selected == null) throw new CodeApprovalModeError();
+	return selected;
+}
+/** Apply a turn preference without modifying machine settings or overriding an existing deny. */
+function resolveCodePermissionDecision({ mode, category, decision }) {
+	if (mode == null || decision === "deny") return decision;
+	if (MODE_PERMISSIONS[mode] == null) throw new CodeApprovalModeError();
+	return MODE_PERMISSIONS[mode][category];
 }
 //#endregion
-//#region src/types/assistants.ts
+//#region src/types/tools.ts
 let Tools = /* @__PURE__ */ function(Tools) {
 	Tools["execute_code"] = "execute_code";
 	Tools["code_interpreter"] = "code_interpreter";
@@ -502,35 +609,6 @@ let EToolResources = /* @__PURE__ */ function(EToolResources) {
 	EToolResources["ocr"] = "ocr";
 	return EToolResources;
 }({});
-let AnnotationTypes = /* @__PURE__ */ function(AnnotationTypes) {
-	AnnotationTypes["FILE_CITATION"] = "file_citation";
-	AnnotationTypes["FILE_PATH"] = "file_path";
-	return AnnotationTypes;
-}({});
-let StepStatus = /* @__PURE__ */ function(StepStatus) {
-	StepStatus["IN_PROGRESS"] = "in_progress";
-	StepStatus["CANCELLED"] = "cancelled";
-	StepStatus["FAILED"] = "failed";
-	StepStatus["COMPLETED"] = "completed";
-	StepStatus["EXPIRED"] = "expired";
-	return StepStatus;
-}({});
-let MessageContentTypes = /* @__PURE__ */ function(MessageContentTypes) {
-	MessageContentTypes["TEXT"] = "text";
-	MessageContentTypes["IMAGE_FILE"] = "image_file";
-	return MessageContentTypes;
-}({});
-let RunStatus = /* @__PURE__ */ function(RunStatus) {
-	RunStatus["QUEUED"] = "queued";
-	RunStatus["IN_PROGRESS"] = "in_progress";
-	RunStatus["REQUIRES_ACTION"] = "requires_action";
-	RunStatus["CANCELLING"] = "cancelling";
-	RunStatus["CANCELLED"] = "cancelled";
-	RunStatus["FAILED"] = "failed";
-	RunStatus["COMPLETED"] = "completed";
-	RunStatus["EXPIRED"] = "expired";
-	return RunStatus;
-}({});
 const actionDelimiter = "_action_";
 const actionDomainSeparator = "---";
 /** Mirrors `Constants.mcp_delimiter`; duplicated here to avoid a circular import from `config.ts`. */
@@ -558,46 +636,6 @@ function isActionTool(toolName) {
 	const mcpIdx = toolName.indexOf(mcpDelimiter);
 	return mcpIdx < 0 || mcpIdx < actionIdx;
 }
-const hostImageIdSuffix = "_host_copy";
-const hostImageNamePrefix = "host_copy_";
-let FilePurpose = /* @__PURE__ */ function(FilePurpose) {
-	FilePurpose["Vision"] = "vision";
-	FilePurpose["FineTune"] = "fine-tune";
-	FilePurpose["FineTuneResults"] = "fine-tune-results";
-	FilePurpose["Assistants"] = "assistants";
-	FilePurpose["AssistantsOutput"] = "assistants_output";
-	return FilePurpose;
-}({});
-const defaultOrderQuery = {
-	order: "desc",
-	limit: 100
-};
-let AssistantStreamEvents = /* @__PURE__ */ function(AssistantStreamEvents) {
-	AssistantStreamEvents["ThreadCreated"] = "thread.created";
-	AssistantStreamEvents["ThreadRunCreated"] = "thread.run.created";
-	AssistantStreamEvents["ThreadRunQueued"] = "thread.run.queued";
-	AssistantStreamEvents["ThreadRunInProgress"] = "thread.run.in_progress";
-	AssistantStreamEvents["ThreadRunRequiresAction"] = "thread.run.requires_action";
-	AssistantStreamEvents["ThreadRunCompleted"] = "thread.run.completed";
-	AssistantStreamEvents["ThreadRunFailed"] = "thread.run.failed";
-	AssistantStreamEvents["ThreadRunCancelling"] = "thread.run.cancelling";
-	AssistantStreamEvents["ThreadRunCancelled"] = "thread.run.cancelled";
-	AssistantStreamEvents["ThreadRunExpired"] = "thread.run.expired";
-	AssistantStreamEvents["ThreadRunStepCreated"] = "thread.run.step.created";
-	AssistantStreamEvents["ThreadRunStepInProgress"] = "thread.run.step.in_progress";
-	AssistantStreamEvents["ThreadRunStepCompleted"] = "thread.run.step.completed";
-	AssistantStreamEvents["ThreadRunStepFailed"] = "thread.run.step.failed";
-	AssistantStreamEvents["ThreadRunStepCancelled"] = "thread.run.step.cancelled";
-	AssistantStreamEvents["ThreadRunStepExpired"] = "thread.run.step.expired";
-	AssistantStreamEvents["ThreadRunStepDelta"] = "thread.run.step.delta";
-	AssistantStreamEvents["ThreadMessageCreated"] = "thread.message.created";
-	AssistantStreamEvents["ThreadMessageInProgress"] = "thread.message.in_progress";
-	AssistantStreamEvents["ThreadMessageCompleted"] = "thread.message.completed";
-	AssistantStreamEvents["ThreadMessageIncomplete"] = "thread.message.incomplete";
-	AssistantStreamEvents["ThreadMessageDelta"] = "thread.message.delta";
-	AssistantStreamEvents["ErrorEvent"] = "error";
-	return AssistantStreamEvents;
-}({});
 //#endregion
 //#region src/schemas.ts
 const isUUID = zod.z.string().uuid();
@@ -693,7 +731,35 @@ const inputTokensIncludesCache = (provider) => {
 	return cacheSubsetProviders.has(provider ?? "");
 };
 const isDocumentSupportedProvider = (provider) => {
-	return documentSupportedProviders.has(provider ?? "");
+	const normalized = provider?.toLowerCase() ?? "";
+	return Array.from(documentSupportedProviders).some((candidate) => candidate.toLowerCase() === normalized);
+};
+/**
+* Endpoints whose encoders actually build native audio/video payloads. Narrower than
+* `documentSupportedProviders`: a provider can accept PDFs and still emit nothing for
+* media, in which case the upload has to fall back to text/STT.
+*/
+const mediaSupportedProviders = new Set([
+	"google",
+	"vertexai",
+	"openrouter"
+]);
+const isMediaSupportedProvider = (provider) => {
+	return mediaSupportedProviders.has(provider?.toLowerCase() ?? "");
+};
+/**
+* Built-in endpoint and provider identifiers. A name outside this set is a custom
+* endpoint whose real provider is resolved at request time, so its capabilities
+* cannot be judged from the name alone.
+*/
+const knownProviderIdentifiers = new Set([
+	...Object.values(EModelEndpoint),
+	...Object.values(Providers),
+	...Object.values(EModelEndpoint).map((provider) => provider.toLowerCase()),
+	...Object.values(Providers).map((provider) => provider.toLowerCase())
+]);
+const isKnownProviderIdentifier = (provider) => {
+	return knownProviderIdentifiers.has(provider?.toLowerCase() ?? "");
 };
 const paramEndpoints = new Set([
 	"agents",
@@ -896,6 +962,8 @@ const defaultAgentFormValues = {
 	["memory"]: false,
 	stateful_code_environment: "user",
 	code_environment_id: void 0,
+	code_workspace_id: void 0,
+	repositoryInstructions: void 0,
 	category: "general",
 	support_contact: {
 		name: "",
@@ -1386,6 +1454,12 @@ const tConversationSchema = zod.z.object({
 	pinned: zod.z.boolean().optional(),
 	/** Server-derived: an active shared link exists for this conversation. Not persisted. */
 	isShared: zod.z.boolean().optional(),
+	codeApprovalMode: zod.z.enum(CODE_APPROVAL_MODES).optional(),
+	codeEnvironmentMode: zod.z.enum(CODE_ENVIRONMENT_MODES).optional(),
+	codeWorkspaces: zod.z.array(zod.z.object({
+		environmentId: zod.z.string().regex(CODE_WORKSPACE_ID_PATTERN),
+		workspaceId: zod.z.string().regex(CODE_WORKSPACE_ID_PATTERN)
+	}).strict()).optional(),
 	title: zod.z.string().nullable().or(zod.z.literal("New Chat")).default("New Chat"),
 	user: zod.z.string().optional(),
 	messages: zod.z.array(zod.z.string()).optional(),
@@ -1867,6 +1941,72 @@ const compactAgentsBaseSchema = tConversationSchema.pick({
 });
 const compactAgentsSchema = compactAgentsBaseSchema.transform((obj) => removeNullishValues(obj)).catch(() => ({}));
 //#endregion
+//#region src/balance.ts
+const REFILL_INTERVAL_UNITS = [
+	"seconds",
+	"minutes",
+	"hours",
+	"days",
+	"weeks",
+	"months"
+];
+/** How long an unreleased in-flight balance reservation keeps counting against the balance. */
+const DEFAULT_BALANCE_RESERVATION_TTL_MS = 1800 * 1e3;
+/** Shortest reservation TTL; a live reservation is renewed every half TTL. */
+const MIN_BALANCE_RESERVATION_TTL_MS = 10 * 1e3;
+function getRefillEligibilityDate(lastRefill, value, unit) {
+	const result = new Date(lastRefill);
+	switch (unit) {
+		case "seconds":
+			result.setSeconds(result.getSeconds() + value);
+			return result;
+		case "minutes":
+			result.setMinutes(result.getMinutes() + value);
+			return result;
+		case "hours":
+			result.setHours(result.getHours() + value);
+			return result;
+		case "days":
+			result.setDate(result.getDate() + value);
+			return result;
+		case "weeks":
+			result.setDate(result.getDate() + value * 7);
+			return result;
+		case "months":
+			result.setMonth(result.getMonth() + value);
+			return result;
+		default: return result;
+	}
+}
+//#endregion
+//#region src/limits.ts
+/** Maximum number of explicit subagents per parent agent. UI + Zod schema share this. */
+const MAX_SUBAGENTS = 10;
+/** Hard upper bound for `endpoints.agents.maxSubagents`, keeping the request-validation
+*  cap bounded no matter what the config file says. */
+const MAX_SUBAGENTS_CEILING = 50;
+let maxSubagents = 10;
+/** Effective subagents-per-agent cap; initialized from `endpoints.agents.maxSubagents` at startup. */
+const getMaxSubagents = () => maxSubagents;
+/** Applies a configured cap; any missing or out-of-range value resets to the default. */
+const setMaxSubagents = (value) => {
+	maxSubagents = typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 50 ? value : 10;
+};
+/** Chat project field limits. The dialogs and the persistence layer share these,
+*  so the inputs stop at the same point the server would otherwise truncate. */
+const MAX_CHAT_PROJECT_NAME_LENGTH = 100;
+const MAX_CHAT_PROJECT_DESCRIPTION_LENGTH = 1e3;
+/** Mirrors the bounded graph-child member limit in `@librechat/agents`. */
+const MAX_GRAPH_SUBAGENT_MEMBERS = 32;
+/** Characters of retained tool output one stopped turn may be tokenized for, so the
+*  context gauge can add an exact figure instead of an estimate. The schema default
+*  and the save path share it; tokenizing runs ~60 ms/MB, once per stopped turn. */
+const DEFAULT_MAX_RETAINED_TOOL_COUNT_CHARS = 8 * 1024 * 1024;
+/** Token ceiling for the block of Ask User answers carried verbatim in an agent's
+*  user context (`endpoints.agents.askUserQuestion.retainedAnswers.maxTokens`).
+*  Older answers drop first once the block exceeds it; the newest set is always kept. */
+const DEFAULT_RETAINED_ANSWER_TOKENS = 4096;
+//#endregion
 //#region src/generate.ts
 let ComponentTypes = /* @__PURE__ */ function(ComponentTypes) {
 	ComponentTypes["Input"] = "input";
@@ -2265,30 +2405,30 @@ const generateGoogleSchema = (customGoogle) => {
 	}));
 };
 //#endregion
-//#region src/limits.ts
-/** Maximum number of explicit subagents per parent agent. UI + Zod schema share this. */
-const MAX_SUBAGENTS = 10;
-/** Hard upper bound for `endpoints.agents.maxSubagents`, keeping the request-validation
-*  cap bounded no matter what the config file says. */
-const MAX_SUBAGENTS_CEILING = 50;
-let maxSubagents = 10;
-/** Effective subagents-per-agent cap; initialized from `endpoints.agents.maxSubagents` at startup. */
-const getMaxSubagents = () => maxSubagents;
-/** Applies a configured cap; any missing or out-of-range value resets to the default. */
-const setMaxSubagents = (value) => {
-	maxSubagents = typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 50 ? value : 10;
-};
-/** Chat project field limits. The dialogs and the persistence layer share these,
-*  so the inputs stop at the same point the server would otherwise truncate. */
-const MAX_CHAT_PROJECT_NAME_LENGTH = 100;
-const MAX_CHAT_PROJECT_DESCRIPTION_LENGTH = 1e3;
-/** Mirrors the bounded graph-child member limit in `@librechat/agents`. */
-const MAX_GRAPH_SUBAGENT_MEMBERS = 32;
+//#region src/stateful-code.ts
+const STATEFUL_CODE_ENVIRONMENTS = [
+	"user",
+	"agent-user",
+	"conversation"
+];
+/** Resolve a deployment allowlist in stable UI order. An omitted value preserves
+* the backward-compatible behavior where every environment is available. */
+function resolveAllowedStatefulCodeEnvironments(configured) {
+	if (configured == null) return [...STATEFUL_CODE_ENVIRONMENTS];
+	const configuredSet = new Set(configured);
+	return STATEFUL_CODE_ENVIRONMENTS.filter((environment) => configuredSet.has(environment));
+}
+/** Keep an allowed preference, otherwise select the first deployment-allowed scope. */
+function resolveStatefulCodeEnvironment(preferred, configured) {
+	const allowed = resolveAllowedStatefulCodeEnvironments(configured);
+	return preferred != null && allowed.includes(preferred) ? preferred : allowed[0];
+}
 //#endregion
 //#region src/models.ts
 const modelSpecSubagentsSchema = zod.z.object({
 	enabled: zod.z.boolean().optional(),
 	allowSelf: zod.z.boolean().optional(),
+	shareFiles: zod.z.boolean().optional(),
 	agent_ids: zod.z.array(zod.z.string()).optional()
 }).superRefine((subagents, ctx) => {
 	const maxSubagents = getMaxSubagents();
@@ -2382,41 +2522,9 @@ const specsConfigSchema = zod.z.object({
 	addedEndpoints: zod.z.array(zod.z.union([zod.z.string(), eModelEndpointSchema])).optional()
 });
 //#endregion
-//#region src/balance.ts
-const REFILL_INTERVAL_UNITS = [
-	"seconds",
-	"minutes",
-	"hours",
-	"days",
-	"weeks",
-	"months"
-];
-function getRefillEligibilityDate(lastRefill, value, unit) {
-	const result = new Date(lastRefill);
-	switch (unit) {
-		case "seconds":
-			result.setSeconds(result.getSeconds() + value);
-			return result;
-		case "minutes":
-			result.setMinutes(result.getMinutes() + value);
-			return result;
-		case "hours":
-			result.setHours(result.getHours() + value);
-			return result;
-		case "days":
-			result.setDate(result.getDate() + value);
-			return result;
-		case "weeks":
-			result.setDate(result.getDate() + value * 7);
-			return result;
-		case "months":
-			result.setMonth(result.getMonth() + value);
-			return result;
-		default: return result;
-	}
-}
-//#endregion
 //#region src/file-config.ts
+/** Parallel storage deletions during rollback of a failed skill archive import. */
+const DEFAULT_SKILL_IMPORT_CLEANUP_CONCURRENCY = 8;
 const supportsFiles = {
 	["openAI"]: true,
 	["google"]: true,
@@ -2570,6 +2678,68 @@ const bedrockDocumentFormats = {
 	"text/plain": "txt",
 	"text/markdown": "md"
 };
+/**
+* Whether an upload belongs to the conversation rather than to the agent. The value
+* arrives from multipart form data, so it can be the string "false", which is truthy.
+* Shared so the route, the authorization check and processing cannot disagree about it.
+*/
+const isMessageFileUpload = (value) => value === true || value === "true";
+/**
+* Whether the upload's conversation uses the Responses API, which decides whether Azure
+* can carry a document natively. Multipart form data has no booleans, so it arrives as
+* the string "true".
+*/
+const isResponsesApiUpload = (value) => value === true || value === "true";
+/**
+* The name a file carries inside the code sandbox.
+*
+* Image uploads are converted to the configured output type while the record keeps the
+* original filename, so the extension has to follow the stored bytes or the sandbox
+* decoder is handed a mismatch. Provisioning and priming both resolve the mount path
+* from here: deriving it twice under different rules leaves a later turn advertising a
+* path that does not exist in the sandbox.
+*/
+const resolveSandboxFilename = (filename, mimeType) => {
+	if (!mimeType?.startsWith("image/")) return filename;
+	const subtype = mimeType.slice(6);
+	if (![
+		"webp",
+		"png",
+		"jpeg",
+		"gif"
+	].includes(subtype)) return filename;
+	const accepted = subtype === "jpeg" ? [".jpg", ".jpeg"] : [`.${subtype}`];
+	const lastDot = filename.lastIndexOf(".");
+	const currentExt = lastDot > 0 ? filename.slice(lastDot).toLowerCase() : "";
+	if (accepted.includes(currentExt)) return filename;
+	return `${lastDot > 0 ? filename.slice(0, lastDot) : filename}${accepted[0]}`;
+};
+/**
+* The Responses setting a turn actually runs on. A saved agent's own record wins, since
+* execution reads its model parameters; a conversation only answers for itself. Upload
+* and delivery must agree here, or a document is stored as raw provider content and then
+* re-resolved to text it has no extraction for.
+*/
+const resolveUseResponsesApi = (agentValue, conversationValue) => agentValue ?? conversationValue ?? void 0;
+/** Models whose native OpenAI and Azure execution defaults to Responses. Keep
+* this shared with client upload routing so documents follow the API that the
+* backend will actually invoke. Explicit false remains an opt-out. */
+const prefersResponsesApiByModel = (model) => typeof model === "string" && /^gpt-6-(?:astra|sol|luna)(?:-|$)/i.test(model);
+/** The server has transport and administrator settings the browser cannot see.
+* Missing policy never enables model-based uploads (including during upgrades). */
+const resolveEffectiveUseResponsesApi = ({ value, endpoint, model, routing, webSearch }) => {
+	if (endpoint !== "openAI" && endpoint !== "azureOpenAI") return value ?? void 0;
+	let policy = model ? routing?.[model] : void 0;
+	if (!policy && model && prefersResponsesApiByModel(model)) {
+		const family = /^gpt-6-(?:astra|sol|luna)(?=-|$)/i.exec(model)?.[0].toLowerCase();
+		policy = family ? routing?.[`${family}-*`] : void 0;
+	}
+	policy ??= routing?.["*"];
+	if (!policy) return value ?? void 0;
+	if (webSearch && policy.withWebSearch) policy = policy.withWebSearch;
+	if (value == null) return policy.default;
+	return value ? policy.on : policy.off;
+};
 const isBedrockDocumentType = (mimeType) => mimeType != null && mimeType in bedrockDocumentFormats;
 /** MIME types Bedrock's Converse document path can send to the model (mirrors `bedrockDocumentFormats`). */
 const bedrockDocumentMimeTypes = Object.keys(bedrockDocumentFormats);
@@ -2803,6 +2973,8 @@ const mbToBytes = (mb) => mb * megabyte;
 const defaultSizeLimit = mbToBytes(512);
 const defaultSkillImportSizeLimit = mbToBytes(50);
 const defaultTokenLimit = 1e5;
+const defaultContextSizeLimit = mbToBytes(128);
+const defaultContextCharLimit = 1e6;
 const assistantsFileConfig = {
 	fileLimit: 10,
 	fileSizeLimit: defaultSizeLimit,
@@ -2830,10 +3002,15 @@ const fileConfig = {
 			disabled: false
 		}
 	},
-	skills: { fileSizeLimit: defaultSkillImportSizeLimit },
+	skills: {
+		fileSizeLimit: defaultSkillImportSizeLimit,
+		importCleanupConcurrency: 8
+	},
 	serverFileSizeLimit: defaultSizeLimit,
 	avatarSizeLimit: mbToBytes(2),
 	fileTokenLimit: defaultTokenLimit,
+	fileContextSizeLimit: defaultContextSizeLimit,
+	fileContextCharLimit: defaultContextCharLimit,
 	clientImageResize: {
 		enabled: false,
 		maxWidth: 1900,
@@ -2848,21 +3025,48 @@ const fileConfig = {
 		return supportedTypes.some((regex) => regex.test(fileType));
 	}
 };
-const supportedMimeTypesSchema = zod.z.array(zod.z.string()).optional();
+const supportedMimeTypesSchema = zod.z.array(zod.z.string().superRefine((pattern, context) => {
+	try {
+		compileMimeRegex(pattern);
+	} catch {
+		context.addIssue({
+			code: zod.z.ZodIssueCode.custom,
+			message: "Invalid MIME type regex: not supported by the configured regex engine"
+		});
+	}
+})).optional();
+const DefaultLLMDeliveryPath = zod.z.enum([
+	"provider",
+	"text",
+	"none"
+]);
+const defaultLLMDeliveryPathSchema = zod.z.object({
+	fallback: DefaultLLMDeliveryPath.optional(),
+	overrides: zod.z.record(DefaultLLMDeliveryPath).optional()
+});
 const endpointFileConfigSchema = zod.z.object({
 	disabled: zod.z.boolean().optional(),
 	fileLimit: zod.z.number().min(0).optional(),
 	fileSizeLimit: zod.z.number().min(0).optional(),
 	totalSizeLimit: zod.z.number().min(0).optional(),
-	supportedMimeTypes: supportedMimeTypesSchema.optional()
+	supportedMimeTypes: supportedMimeTypesSchema.optional(),
+	defaultLLMDeliveryPath: defaultLLMDeliveryPathSchema.optional(),
+	legacyFileUploadUX: zod.z.boolean().optional(),
+	textFallbackWithoutTools: zod.z.boolean().optional()
+});
+const skillFileConfigSchema = zod.z.object({
+	fileSizeLimit: zod.z.number().min(0).optional(),
+	importCleanupConcurrency: zod.z.number().int().positive().optional()
 });
-const skillFileConfigSchema = zod.z.object({ fileSizeLimit: zod.z.number().min(0).optional() });
 const fileConfigSchema = zod.z.object({
 	endpoints: zod.z.record(endpointFileConfigSchema).optional(),
 	skills: skillFileConfigSchema.optional(),
 	serverFileSizeLimit: zod.z.number().min(0).optional(),
 	avatarSizeLimit: zod.z.number().min(0).optional(),
 	fileTokenLimit: zod.z.number().min(0).optional(),
+	fileContextSizeLimit: zod.z.number().min(0).optional(),
+	fileContextCharLimit: zod.z.number().min(0).optional(),
+	codeEnvLivenessSafeWindowMs: zod.z.number().min(0).optional(),
 	imageGeneration: zod.z.object({
 		percentage: zod.z.number().min(0).max(100).optional(),
 		px: zod.z.number().min(0).optional()
@@ -2874,7 +3078,10 @@ const fileConfigSchema = zod.z.object({
 		quality: zod.z.number().min(0).max(1).optional()
 	}).optional(),
 	ocr: zod.z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional(),
-	text: zod.z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional()
+	text: zod.z.object({ supportedMimeTypes: supportedMimeTypesSchema.optional() }).optional(),
+	defaultLLMDeliveryPath: defaultLLMDeliveryPathSchema.optional(),
+	legacyFileUploadUX: zod.z.boolean().optional(),
+	textFallbackWithoutTools: zod.z.boolean().optional()
 });
 /**
 * Compiler for admin-supplied MIME patterns. Defaults to native `RegExp`, which browser
@@ -2911,6 +3118,15 @@ const isPermissiveMimeConfig = (types) => {
 	if (!types || types.length === 0) return false;
 	return types.some((regex) => regex.test("x-librechat/x-probe"));
 };
+/**
+* Detects whether an endpoint's `supportedMimeTypes` were set by the admin rather than inherited
+* from the built-in default list. Inheritance is signaled by referential identity with
+* `supportedMimeTypes`, which `mergeWithDefault` preserves for unconfigured endpoints.
+*/
+const isExplicitMimeConfig = (types) => {
+	if (!types || types.length === 0) return false;
+	return types !== supportedMimeTypes;
+};
 /** Media categories that collapse to a wildcard `accept` token when any member type is allowed. */
 const mimeAcceptCategories = [
 	{
@@ -3010,6 +3226,12 @@ const documentMimeExtensions = [
 	["text/calendar", [".ics"]],
 	["message/rfc822", [".eml"]]
 ];
+/** Preferred extension for a known document MIME type, including its leading dot. */
+function getDocumentFileExtension(mimeType) {
+	const normalized = mimeType?.split(";", 1)[0].trim().toLowerCase();
+	const canonical = normalized === "text/comma-separated-values" ? "text/csv" : normalized;
+	return documentMimeExtensions.find(([type]) => type === canonical)?.[1][0];
+}
 const documentMimeSet = new Set(documentMimeExtensions.map(([mimeType]) => mimeType));
 /** Every MIME type LibreChat may accept, used to detect patterns that reach beyond the representable set. */
 const knownMimeUniverse = Array.from(new Set([
@@ -3103,16 +3325,61 @@ function mergeWithDefault(endpointConfig, defaultConfig, endpoint) {
 		fileLimit: endpointConfig.fileLimit ?? defaultConfig.fileLimit,
 		fileSizeLimit: endpointConfig.fileSizeLimit ?? defaultConfig.fileSizeLimit,
 		totalSizeLimit: endpointConfig.totalSizeLimit ?? defaultConfig.totalSizeLimit,
-		supportedMimeTypes: endpointConfig.supportedMimeTypes ?? defaultMimeTypes
+		supportedMimeTypes: endpointConfig.supportedMimeTypes ?? defaultMimeTypes,
+		defaultLLMDeliveryPath: mergeDeliveryPathConfig(endpointConfig.defaultLLMDeliveryPath, defaultConfig.defaultLLMDeliveryPath),
+		legacyFileUploadUX: endpointConfig.legacyFileUploadUX ?? defaultConfig.legacyFileUploadUX,
+		textFallbackWithoutTools: endpointConfig.textFallbackWithoutTools ?? defaultConfig.textFallbackWithoutTools
 	};
 }
-function getEndpointFileConfig(params) {
-	const { fileConfig: mergedFileConfig, endpoint, endpointType } = params;
-	if (!mergedFileConfig?.endpoints) return fileConfig.endpoints.default;
-	/** Compute an effective default by merging user-configured default over the base default */
-	const baseDefaultConfig = fileConfig.endpoints.default;
+/**
+* Deep-merges delivery-path config so an endpoint that supplies only one override
+* still inherits the default's fallback and shared overrides. Whole-object
+* replacement would silently drop the inherited routing.
+*/
+function mergeDeliveryPathConfig(endpointValue, defaultValue) {
+	if (!endpointValue) return defaultValue;
+	if (!defaultValue) return endpointValue;
+	if (endpointValue.fallback != null) return endpointValue;
+	const hasOverrides = endpointValue.overrides != null || defaultValue.overrides != null;
+	return {
+		...defaultValue.fallback != null ? { fallback: defaultValue.fallback } : {},
+		...hasOverrides ? { overrides: { ...shadowByWildcard(defaultValue.overrides, endpointValue.overrides) } } : {}
+	};
+}
+/**
+* Flattens two override layers into one map that still resolves like the layered chain.
+* Resolution reads exact keys before wildcards, so a plain spread would let a lower
+* layer's `image/png` outrank the upper layer's `image/*`. Dropping the entries an
+* upper wildcard covers restores precedence without changing how lookups work.
+*/
+function shadowByWildcard(lower, upper) {
+	if (!lower) return { ...upper };
+	const upperWildcards = /* @__PURE__ */ new Set();
+	for (const key in upper) if (key.endsWith("/*")) upperWildcards.add(key.slice(0, -1));
+	if (upperWildcards.size === 0) return {
+		...lower,
+		...upper
+	};
+	const retained = {};
+	for (const key in lower) if (!(!key.endsWith("/*") && upperWildcards.has(key.slice(0, key.indexOf("/") + 1)) && upper?.[key] == null)) retained[key] = lower[key];
+	return {
+		...retained,
+		...upper
+	};
+}
+function getEndpointFileConfig(params) {
+	const { fileConfig: mergedFileConfig, endpoint, endpointType } = params;
+	if (!mergedFileConfig?.endpoints) return fileConfig.endpoints.default;
+	/** Compute an effective default by merging user-configured default over the base default */
+	const baseDefaultConfig = fileConfig.endpoints.default;
+	const globalDefaultConfig = {
+		...baseDefaultConfig,
+		defaultLLMDeliveryPath: mergeDeliveryPathConfig(mergedFileConfig.defaultLLMDeliveryPath, baseDefaultConfig.defaultLLMDeliveryPath),
+		legacyFileUploadUX: mergedFileConfig.legacyFileUploadUX ?? baseDefaultConfig.legacyFileUploadUX,
+		textFallbackWithoutTools: mergedFileConfig.textFallbackWithoutTools ?? baseDefaultConfig.textFallbackWithoutTools
+	};
 	const userDefaultConfig = mergedFileConfig.endpoints.default;
-	const defaultConfig = userDefaultConfig ? mergeWithDefault(userDefaultConfig, baseDefaultConfig, "default") : baseDefaultConfig;
+	const defaultConfig = userDefaultConfig ? mergeWithDefault(userDefaultConfig, globalDefaultConfig, "default") : globalDefaultConfig;
 	const normalizedEndpoint = normalizeEndpointName(endpoint ?? "");
 	const standardEndpoints = new Set([
 		"default",
@@ -3167,9 +3434,18 @@ function mergeFileConfig(dynamic) {
 		}
 	};
 	if (!dynamic) return mergedConfig;
+	if (dynamic.defaultLLMDeliveryPath !== void 0) mergedConfig.defaultLLMDeliveryPath = dynamic.defaultLLMDeliveryPath;
+	if (dynamic.legacyFileUploadUX !== void 0) mergedConfig.legacyFileUploadUX = dynamic.legacyFileUploadUX;
+	if (dynamic.textFallbackWithoutTools !== void 0) mergedConfig.textFallbackWithoutTools = dynamic.textFallbackWithoutTools;
 	if (dynamic.serverFileSizeLimit !== void 0) mergedConfig.serverFileSizeLimit = mbToBytes(dynamic.serverFileSizeLimit);
 	if (dynamic.avatarSizeLimit !== void 0) mergedConfig.avatarSizeLimit = mbToBytes(dynamic.avatarSizeLimit);
 	if (dynamic.fileTokenLimit !== void 0) mergedConfig.fileTokenLimit = dynamic.fileTokenLimit;
+	if (dynamic.fileContextSizeLimit !== void 0) mergedConfig.fileContextSizeLimit = mbToBytes(dynamic.fileContextSizeLimit);
+	if (dynamic.fileContextCharLimit !== void 0) mergedConfig.fileContextCharLimit = dynamic.fileContextCharLimit;
+	if (dynamic.skills?.importCleanupConcurrency !== void 0) mergedConfig.skills = {
+		...mergedConfig.skills,
+		importCleanupConcurrency: dynamic.skills.importCleanupConcurrency
+	};
 	if (dynamic.skills?.fileSizeLimit !== void 0) mergedConfig.skills = {
 		...mergedConfig.skills,
 		fileSizeLimit: mbToBytes(dynamic.skills.fileSizeLimit)
@@ -3217,6 +3493,9 @@ function mergeFileConfig(dynamic) {
 		});
 		if (dynamicEndpoint.disabled !== void 0) mergedEndpoint.disabled = dynamicEndpoint.disabled;
 		if (dynamicEndpoint.supportedMimeTypes) mergedEndpoint.supportedMimeTypes = convertStringsToRegex(dynamicEndpoint.supportedMimeTypes);
+		if (dynamicEndpoint.defaultLLMDeliveryPath !== void 0) mergedEndpoint.defaultLLMDeliveryPath = dynamicEndpoint.defaultLLMDeliveryPath;
+		if (dynamicEndpoint.legacyFileUploadUX !== void 0) mergedEndpoint.legacyFileUploadUX = dynamicEndpoint.legacyFileUploadUX;
+		if (dynamicEndpoint.textFallbackWithoutTools !== void 0) mergedEndpoint.textFallbackWithoutTools = dynamicEndpoint.textFallbackWithoutTools;
 	}
 	return mergedConfig;
 }
@@ -3246,6 +3525,8 @@ const codeEnvironments = () => `${BASE_URL}/api/code-environments`;
 const codeEnvironmentPairings = () => `${codeEnvironments()}/pairings`;
 const codeEnvironmentById = (id) => `${codeEnvironments()}/${encodeURIComponent(id)}`;
 const codeEnvironmentSettings = (id) => `${codeEnvironmentById(id)}/settings`;
+const codeEnvironmentStatus = (id) => `${codeEnvironmentById(id)}/status`;
+const codeEnvironmentConversationDecision = (conversationId) => `${codeEnvironments()}/conversations/${encodeURIComponent(conversationId)}/decision`;
 const messagesRoot = `${BASE_URL}/api/messages`;
 const messages = (params) => {
 	const { conversationId, messageId, ...rest } = params;
@@ -3458,8 +3739,15 @@ const listSkillsWithFilters = (filter) => {
 };
 const skillFiles = (id) => `${getSkill$1(id)}/files`;
 const skillFile = (id, relativePath) => `${skillFiles(id)}/${encodeURIComponent(relativePath)}`;
-const insights = () => `${BASE_URL}/api/admin/insights`;
+const insights = () => `${BASE_URL}/api/insights`;
 const insightsAccess = () => `${insights()}/access`;
+const conversationTrace = (conversationId) => `${BASE_URL}/api/traces/${encodeURIComponent(conversationId)}`;
+const conversationTraceAvailability = (conversationId) => `${conversationTrace(conversationId)}/availability`;
+const conversationTraceRecords = (conversationId, cursor) => `${conversationTrace(conversationId)}/records${cursor ? `?${new URLSearchParams({ cursor }).toString()}` : ""}`;
+const conversationTraceRecord = (conversationId, recordId, messageId, sourceId) => `${conversationTrace(conversationId)}/records/${encodeURIComponent(recordId)}?${new URLSearchParams({
+	message: messageId,
+	...sourceId ? { source: sourceId } : {}
+}).toString()}`;
 const adminSkillsSync = () => `${BASE_URL}/api/admin/skills/sync`;
 const adminSkillsSyncStatus = () => `${adminSkillsSync()}/status`;
 const adminSkillsSyncRun = () => `${adminSkillsSync()}/run`;
@@ -3468,6 +3756,7 @@ const skillStates = () => `${BASE_URL}/api/user/settings/skills/active`;
 const adminLangfuseConnection = () => `${BASE_URL}/api/admin/langfuse/connection`;
 const adminLangfuseConnectionTest = () => `${adminLangfuseConnection()}/test`;
 const adminLangfuseSessionLink = (conversationId) => `${adminLangfuseConnection()}/session/${encodeURIComponent(conversationId)}`;
+const pinnedOrder = () => `${BASE_URL}/api/user/settings/pinned-order`;
 const toolFavorites = () => `${BASE_URL}/api/user/settings/favorites/tools`;
 const toolFavorite = (itemType, itemId) => `${toolFavorites()}/${itemType}/${encodeURIComponent(itemId)}`;
 const roles = () => `${BASE_URL}/api/roles`;
@@ -3539,6 +3828,7 @@ let FileContext = /* @__PURE__ */ function(FileContext) {
 	FileContext["image_generation"] = "image_generation";
 	FileContext["assistants_output"] = "assistants_output";
 	FileContext["message_attachment"] = "message_attachment";
+	FileContext["run_artifact"] = "run_artifact";
 	FileContext["skill_file"] = "skill_file";
 	FileContext["filename"] = "filename";
 	FileContext["updatedAt"] = "updatedAt";
@@ -3567,8 +3857,20 @@ let TokenExchangeMethodEnum = /* @__PURE__ */ function(TokenExchangeMethodEnum)
 	TokenExchangeMethodEnum["BasicAuthHeader"] = "basic_auth_header";
 	return TokenExchangeMethodEnum;
 }({});
+const agentGitIdentitySchema = zod.z.object({
+	name: zod.z.string().trim().min(1).max(128).refine((value) => !/[\0\r\n]/.test(value)),
+	email: zod.z.string().trim().email().max(254).refine((value) => !/[\0\r\n]/.test(value))
+}).optional();
 //#endregion
 //#region src/mcp.ts
+/**
+* Upper bound on a stored MCP `iconPath` (URL or data URI). Enforced by
+* `sanitizeMcpIconPath`, not a schema `.max()`, so re-submitting a server whose
+* stored icon predates the cap clears the icon instead of rejecting the update.
+*/
+const MAX_MCP_ICON_PATH_LENGTH = 256 * 1024;
+/** Keep persistence admission waits below the shared lease's 15-minute lifetime. */
+const MAX_MCP_OAUTH_PERSISTENCE_WAIT_MS = 14 * 6e4;
 const validateOAuthClientCredentials = (oauth, ctx) => {
 	if (oauth.client_secret && !oauth.client_id) ctx.addIssue({
 		code: zod.z.ZodIssueCode.custom,
@@ -3643,6 +3945,27 @@ const OAuthOptionsBaseSchema = zod.z.object({
 	* Ignored when `audience` itself is not configured.
 	*/
 	forward_audience_on_refresh: zod.z.boolean().optional(),
+	/**
+	* Whether to send the RFC 8707 `resource` parameter on `/authorize`, the
+	* `authorization_code` exchange and the `refresh_token` grant. The value is the
+	* canonical resource identifier from the MCP server's Protected Resource Metadata
+	* (RFC 9728), never an operator-supplied string.
+	*
+	* Default: `true`. RFC 8707 makes `resource` OPTIONAL, and authorization servers
+	* that reject it cannot complete a flow that sends it: Microsoft Entra ID v2.0
+	* fails an `/authorize` request carrying both `resource` and `scope` with
+	* `AADSTS9010010`. Set to `false` for those providers, and rely on `scope` (or
+	* `audience` above) to obtain an API-scoped token.
+	*
+	* Opting out suppresses the parameter only. Protected Resource Metadata is still
+	* discovered, still validated against the MCP server URL (RFC 9728 §3.3), and
+	* still recorded on the stored client binding, so scope discovery, authorization
+	* server discovery and re-authentication checks are unaffected.
+	*
+	* This field is only accepted from trusted/admin MCP configuration and is rejected
+	* from user-managed servers.
+	*/
+	send_resource_parameter: zod.z.boolean().optional(),
 	/** OAuth revocation endpoint (optional - can be auto-discovered) */
 	revocation_endpoint: zod.z.string().transform((val) => extractEnvVariable(val)).pipe(zod.z.string().url()).optional(),
 	/** OAuth revocation endpoint authentication methods supported (optional - can be auto-discovered) */
@@ -3661,14 +3984,16 @@ const userOAuthEndpointUrlSchema = zod.z.string().refine((val) => !envVarPattern
 }, { message: "OAuth endpoint URLs cannot include audience or resource query parameters" });
 const UserOAuthOptionsSchema = OAuthOptionsBaseSchema.omit({
 	audience: true,
-	forward_audience_on_refresh: true
+	forward_audience_on_refresh: true,
+	send_resource_parameter: true
 }).extend({
 	authorization_url: userOAuthEndpointUrlSchema.optional(),
 	token_url: userOAuthEndpointUrlSchema.optional(),
 	redirect_uri: userOAuthEndpointUrlSchema.optional(),
 	revocation_endpoint: userOAuthEndpointUrlSchema.optional(),
 	audience: zod.z.never().optional(),
-	forward_audience_on_refresh: zod.z.never().optional()
+	forward_audience_on_refresh: zod.z.never().optional(),
+	send_resource_parameter: zod.z.never().optional()
 }).superRefine(validateOAuthClientCredentials);
 const OboOptionsSchema = zod.z.object({ 
 /** Scopes to request for the downstream MCP server (e.g., "api://<client-id>/Mcp.Tools.ReadWrite") */
@@ -3693,6 +4018,21 @@ const BaseOptionsSchema = zod.z.object({
 	sseReadTimeout: zod.z.number().int().positive().optional(),
 	initTimeout: zod.z.number().int().nonnegative().optional(),
 	/**
+	* How long (ms) a replica waits for another replica's in-flight OAuth refresh-token redemption
+	* before failing the attempt as retryable. Raise it for a slow token endpoint; lower it to fail
+	* faster. Default when unset: 15_000. Clamped to 30_000, half the window after which a
+	* redemption aborts itself, because this wait runs inside the redemption that window governs.
+	*
+	* Positive rather than non-negative: zero would mean "never wait for a peer", which fails every
+	* contended refresh instead of adopting the rotation a peer is about to store, and that is the
+	* common case this wait exists to serve. Omit the field to take the default.
+	*/
+	oauthRefreshWaitTimeout: zod.z.number().int().positive().optional(),
+	/** Enable only after every replica has upgraded to the coordinated OAuth writer protocol. Default: false. */
+	oauthRefreshCoordination: zod.z.boolean().optional(),
+	/** Wait (ms) for callback/adoption persistence and publication. Default: 15_000; maximum: 840_000. */
+	oauthPersistenceWaitTimeout: zod.z.number().int().positive().max(MAX_MCP_OAUTH_PERSISTENCE_WAIT_MS).optional(),
+	/**
 	* Whether the server is offered in chat.
 	*
 	* `false` hides it from the chat dropdown (MCPSelect) AND bars it from the
@@ -3826,6 +4166,13 @@ const SSEOptionsSchema = BaseOptionsSchema.extend({
 	type: zod.z.literal("sse").default("sse"),
 	headers: zod.z.record(zod.z.string(), zod.z.string()).optional(),
 	/**
+	* Headers resolved from the live chat request and merged over `headers`.
+	* Omitted during catalog discovery, which has no request context, so a
+	* `{{LIBRECHAT_BODY_*}}` placeholder here does not block tool listing.
+	* On a duplicate header name the resolved `requestHeaders` value wins.
+	*/
+	requestHeaders: zod.z.record(zod.z.string(), zod.z.string()).optional(),
+	/**
 	* On-Behalf-Of (OBO) token exchange configuration.
 	* When configured, LibreChat exchanges the logged-in user's federated access token
 	* for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
@@ -3844,6 +4191,13 @@ const StreamableHTTPOptionsSchema = BaseOptionsSchema.extend({
 	type: zod.z.union([zod.z.literal("streamable-http"), zod.z.literal("http")]),
 	headers: zod.z.record(zod.z.string(), zod.z.string()).optional(),
 	/**
+	* Headers resolved from the live chat request and merged over `headers`.
+	* Omitted during catalog discovery, which has no request context, so a
+	* `{{LIBRECHAT_BODY_*}}` placeholder here does not block tool listing.
+	* On a duplicate header name the resolved `requestHeaders` value wins.
+	*/
+	requestHeaders: zod.z.record(zod.z.string(), zod.z.string()).optional(),
+	/**
 	* On-Behalf-Of (OBO) token exchange configuration.
 	* When configured, LibreChat exchanges the logged-in user's federated access token
 	* for a token scoped to this MCP server via the OAuth 2.0 OBO flow (jwt-bearer grant).
@@ -3873,6 +4227,9 @@ const omitServerManagedFields = (schema) => schema.omit({
 	timeout: true,
 	sseReadTimeout: true,
 	initTimeout: true,
+	oauthRefreshWaitTimeout: true,
+	oauthRefreshCoordination: true,
+	oauthPersistenceWaitTimeout: true,
 	chatMenu: true,
 	serverInstructions: true,
 	requiresOAuth: true,
@@ -3939,6 +4296,8 @@ const MCP_USER_INPUT_FIELDS = (() => {
 })();
 //#endregion
 //#region src/config.ts
+const AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_DEFAULT = 24 * 1024;
+const AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_HARD_MAX = 64 * 1024;
 const defaultSocialLogins = [
 	"google",
 	"facebook",
@@ -3947,6 +4306,8 @@ const defaultSocialLogins = [
 	"discord",
 	"saml"
 ];
+/** How long a started social login may take to return to its callback before its `state` expires. */
+const DEFAULT_OAUTH_STATE_TTL_MS = 600 * 1e3;
 const BASE_ONLY_CONFIG_SECTIONS = ["filters"];
 /** Sections that may be stored in the tenant's base config document but must
 * not be overridden or tombstoned by role, group, or user config documents. */
@@ -3977,6 +4338,8 @@ const excludedKeys = new Set([
 	"conversationId",
 	"agentEventBinding",
 	"agentEventActor",
+	"agentEventActorCleanup",
+	"agentEventActorSuspension",
 	"agentEventActorReconciliations",
 	"agentEventActorEpoch",
 	"agentEventActorLegacyTurn",
@@ -4485,13 +4848,13 @@ function isRemoteOidcUrlAllowed(value) {
 }
 const remoteApiOidcUrlSchema = zod.z.string().url().refine(isRemoteOidcUrlAllowed, { message: "must use https:// unless targeting localhost" });
 const remoteApiOidcScopeSchema = zod.z.string().refine((scope) => !scope.includes(","), { message: "scopes must be space-separated" });
-const remoteApiOidcSchema = zod.z.object({
+const oidcAccessTokenSchema = zod.z.object({
 	enabled: zod.z.boolean().default(false),
 	issuer: remoteApiOidcUrlSchema.optional(),
 	audience: zod.z.string().min(1).optional(),
-	jwksUri: remoteApiOidcUrlSchema.optional(),
-	scope: remoteApiOidcScopeSchema.optional()
-}).superRefine((oidc, ctx) => {
+	jwksUri: remoteApiOidcUrlSchema.optional()
+});
+function validateEnabledOidc(oidc, ctx) {
 	if (oidc.enabled === true && !oidc.issuer) ctx.addIssue({
 		code: zod.z.ZodIssueCode.custom,
 		path: ["issuer"],
@@ -4502,12 +4865,60 @@ const remoteApiOidcSchema = zod.z.object({
 		path: ["audience"],
 		message: "audience is required when OIDC auth is enabled"
 	});
-});
+}
+const remoteApiOidcSchema = oidcAccessTokenSchema.extend({ scope: remoteApiOidcScopeSchema.optional() }).superRefine(validateEnabledOidc);
 const remoteApiAuthSchema = zod.z.object({
 	apiKey: zod.z.object({ enabled: zod.z.boolean().default(true) }).optional(),
 	oidc: remoteApiOidcSchema.optional()
 });
 const remoteApiSchema = zod.z.object({ auth: remoteApiAuthSchema.optional() });
+const managementClientBindingSchema = zod.z.object({
+	clientId: zod.z.string().trim().min(1).max(128),
+	subject: zod.z.string().trim().min(1).max(512).optional(),
+	userId: zod.z.string().trim().regex(/^[a-f\d]{24}$/i, "must be a MongoDB ObjectId").transform((userId) => userId.toLowerCase()),
+	tenantId: zod.z.string().trim().min(1).max(128).regex(/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/, "must be a valid tenant id").refine((tenantId) => tenantId !== "__SYSTEM__", "system tenant is not allowed"),
+	enabled: zod.z.boolean().default(true)
+}).strict();
+const managementApiOidcSchema = oidcAccessTokenSchema.extend({
+	tokenUse: zod.z.literal("access").optional(),
+	requiredScopes: zod.z.array(zod.z.string().trim().min(1).max(256).regex(/^\S+$/, "must be a single scope token")).min(1).max(20).optional()
+}).strict().superRefine((oidc, ctx) => {
+	if (oidc.enabled === true && !oidc.issuer) ctx.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		path: ["issuer"],
+		message: "issuer is required when OIDC auth is enabled"
+	});
+	if (oidc.enabled === true && !oidc.audience && (oidc.tokenUse !== "access" || !oidc.requiredScopes?.length)) ctx.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		path: ["requiredScopes"],
+		message: "audience or access-token validation with required scopes is required when OIDC auth is enabled"
+	});
+});
+const managementApiAuthSchema = zod.z.object({
+	oidc: managementApiOidcSchema,
+	clients: zod.z.array(managementClientBindingSchema).max(100).default([])
+}).strict().superRefine((auth, ctx) => {
+	if (auth.oidc.enabled === true && auth.clients.length === 0) ctx.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		path: ["clients"],
+		message: "at least one client binding is required when management auth is enabled"
+	});
+	const clientIds = /* @__PURE__ */ new Set();
+	for (let index = 0; index < auth.clients.length; index++) {
+		const client = auth.clients[index];
+		if (clientIds.has(client.clientId)) ctx.addIssue({
+			code: zod.z.ZodIssueCode.custom,
+			path: [
+				"clients",
+				index,
+				"clientId"
+			],
+			message: "client IDs must be unique"
+		});
+		clientIds.add(client.clientId);
+	}
+});
+const managementApiSchema = zod.z.object({ auth: managementApiAuthSchema.optional() }).strict();
 /**
 * Permission mode applied to a tool call. Mirrors `@librechat/agents`'s
 * `ToolPolicyMode` 1:1.
@@ -4581,6 +4992,24 @@ const toolApprovalPolicySchema = zod.z.object({
 	*/
 	hooks: zod.z.array(toolApprovalHookConfigSchema).optional()
 }).optional();
+const askUserQuestionRetainedAnswersSchema = zod.z.object({
+	/** `false` stops carrying answers forward; they then live only in the messages. */
+	enabled: zod.z.boolean().optional(),
+	/** Token ceiling for the carried block. Older answers drop first once it is
+	*  exceeded; the newest set is always kept. Defaults to
+	*  `DEFAULT_RETAINED_ANSWER_TOKENS` (4096). */
+	maxTokens: zod.z.number().int().positive().optional()
+});
+/**
+* Behavior of the `ask_user_question` tool beyond the admin kill switch
+* (`filteredTools` / `includedTools`).
+*
+* `retainedAnswers`: every answer the user gave to an agent's question is
+* quoted verbatim in the run's user context, so it survives after the
+* messages that carried it were summarized, pruned or dropped from the context
+* window. On by default.
+*/
+const askUserQuestionConfigSchema = zod.z.object({ retainedAnswers: askUserQuestionRetainedAnswersSchema.optional() }).optional();
 /**
 * Durable checkpointer backing human-in-the-loop resume.
 *
@@ -4646,22 +5075,55 @@ const codeEnvironmentPermissionFieldSchema = zod.z.object({
 		message: "Permission default must be included in allowed values"
 	});
 });
+/** Existing attached commands used a fixed 30-second execution budget. */
+const CODE_ENVIRONMENT_COMMAND_TIMEOUT_DEFAULT_MS = 3e4;
+/** Protocol-level ceiling; deployments may only lower this value. */
+const CODE_ENVIRONMENT_COMMAND_TIMEOUT_HARD_MAX_MS = 5 * 6e4;
+/**
+* Client retry horizon across Code API admission windows. Also the hard cap:
+* deployments may only lower it. `0` disables client retries, not the server's
+* initial admission wait or an already-admitted operation's execution budget.
+*/
+const CODE_ENVIRONMENT_QUEUE_WAIT_DEFAULT_MS = 5 * 6e4;
 /**
 * Typed user-tunable surface for one attached code environment. Omitted fields
 * remain fixed at LibreChat's safe baseline. Isolation, networking, mounts,
 * privileged execution, and secrets are deliberately not representable here.
 */
-const codeEnvironmentUserConfigSchema = zod.z.object({ permissions: zod.z.object({
-	fileWrite: codeEnvironmentPermissionFieldSchema.optional(),
-	commandExecution: codeEnvironmentPermissionFieldSchema.optional()
-}).strict().optional() }).strict();
+const codeEnvironmentUserConfigSchema = zod.z.object({
+	permissions: zod.z.object({
+		fileWrite: codeEnvironmentPermissionFieldSchema.optional(),
+		commandExecution: codeEnvironmentPermissionFieldSchema.optional()
+	}).strict().optional(),
+	limits: zod.z.object({
+		/** Maximum timeout a Bash invocation may request. Omission preserves
+		* the historical 30-second command budget. */
+		maxCommandTimeoutMs: zod.z.number().int().min(1).max(CODE_ENVIRONMENT_COMMAND_TIMEOUT_HARD_MAX_MS).optional(),
+		/** Client retry horizon for capacity expirations, shared by preview/edit.
+		* Omission keeps five minutes; `0` makes each required operation try once.
+		* An in-flight request retains Code API's admission/execution budgets and
+		* can finish after this horizon. This is not a server admission timeout. */
+		maxQueueWaitMs: zod.z.number().int().min(0).max(CODE_ENVIRONMENT_QUEUE_WAIT_DEFAULT_MS).optional()
+	}).strict().optional()
+}).strict();
 const codeEnvironmentUserSettingsSchema = zod.z.object({ permissions: zod.z.object({
 	fileWrite: codeEnvironmentPermissionDecisionSchema.optional(),
 	commandExecution: codeEnvironmentPermissionDecisionSchema.optional()
 }).strict().optional() }).strict();
+const DEFAULT_MAX_PROVIDER_ERROR_CHARS = 2e3;
+const DEFAULT_AGENT_MODEL_RESPONSE_BODY_TIMEOUT_MS = 9e5;
+const DEFAULT_AGENT_MODEL_RESPONSE_HEADERS_TIMEOUT_MS = 3e5;
 const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(zod.z.object({
+	/** Maximum provider error characters retained in unprotected terminal failures. */
+	maxProviderErrorChars: zod.z.number().int().min(0).max(1e6).default(DEFAULT_MAX_PROVIDER_ERROR_CHARS),
+	/** Maximum inactivity between provider response body chunks; 0 disables the idle timeout. */
+	modelResponseBodyTimeoutMs: zod.z.number().int().min(0).max(864e5).default(DEFAULT_AGENT_MODEL_RESPONSE_BODY_TIMEOUT_MS),
+	/** Maximum wait for provider response headers; 0 disables the header timeout. */
+	modelResponseHeadersTimeoutMs: zod.z.number().int().min(0).max(864e5).default(DEFAULT_AGENT_MODEL_RESPONSE_HEADERS_TIMEOUT_MS),
 	recursionLimit: zod.z.number().optional(),
 	disableBuilder: zod.z.boolean().optional().default(false),
+	/** Optional workspace guidance acquisition budget, separate from command execution. */
+	repositoryInstructions: zod.z.object({ timeoutMs: zod.z.number().int().min(100).max(3e4).optional().default(2e3) }).optional(),
 	maxRecursionLimit: zod.z.number().optional(),
 	/** Max cumulative bytes a single streamed tool call's arguments may reach before the run
 	* aborts. Defaults to 64 KiB in the agents SDK; `0` disables the guard. */
@@ -4672,6 +5134,13 @@ const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(zo
 	* disables the guard for that tool only. Merged over LibreChat's shipped default of
 	* `{ create_file: 131072 }`. */
 	maxToolCallArgBytesByTool: zod.z.record(zod.z.number()).optional(),
+	/** Characters of retained tool output the save path may tokenize exactly for the
+	* context gauge when a turn stops at the tool-call limit (see
+	* `retainedToolTokens`). Tokenizing costs ~60 ms/MB and runs once per stopped
+	* turn; past this ceiling the figure is withdrawn rather than estimated, so the
+	* gauge under-reports that turn instead of blocking the save. Raise it for
+	* deployments whose tools legitimately return more, lower it on slow hardware. */
+	maxRetainedToolCountChars: zod.z.number().int().min(0).optional().default(DEFAULT_MAX_RETAINED_TOOL_COUNT_CHARS),
 	maxCitations: zod.z.number().min(1).max(50).optional().default(30),
 	maxCitationsPerFile: zod.z.number().min(1).max(10).optional().default(7),
 	minRelevanceScore: zod.z.number().min(0).max(1).optional().default(.45),
@@ -4679,12 +5148,35 @@ const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(zo
 	* the shipped default of 10 for orchestration-heavy deployments, bounded by
 	* `MAX_SUBAGENTS_CEILING`. */
 	maxSubagents: zod.z.number().int().min(1).max(50).optional().default(10),
+	/** Run-scoped file access for explicitly opted-in subagent delegations. */
+	fileSharing: zod.z.object({
+		enabled: zod.z.boolean().optional().default(false),
+		allowSiblingSharing: zod.z.boolean().optional().default(false),
+		maxFiles: zod.z.number().int().min(1).max(1e3).optional().default(100),
+		/** Aggregate disk budget for private output versions retained during a run. */
+		maxPrivateBytes: zod.z.number().int().min(1).max(10737418240).optional().default(268435456),
+		ttlMs: zod.z.number().int().min(1).max(864e5).optional().default(36e5)
+	}).optional(),
+	/** Maximum concurrent Code API uploads per route and authenticated principal. */
+	codeApiUploadConcurrency: zod.z.number().int().min(1).max(100).optional().default(3),
+	/** Maximum wall-clock time spent waiting on Code API rate limits per operation. */
+	codeApiMaxRetryWaitMs: zod.z.number().int().min(0).max(3e5).optional().default(2e4),
 	allowedProviders: zod.z.array(zod.z.union([zod.z.string(), eModelEndpointSchema])).optional(),
 	capabilities: zod.z.array(zod.z.nativeEnum(AgentCapabilities)).optional().default(defaultAgentCapabilities),
 	/** Controls which workspace-sharing scopes users may select for stateful code sessions.
 	*  Omit this block to preserve the legacy behavior of allowing every scope. */
 	statefulCodeSessions: zod.z.object({
 		allowedEnvironments: zod.z.array(zod.z.enum(STATEFUL_CODE_ENVIRONMENTS)).min(1),
+		/** Server-only personal worker enrollment policy. Effective principal
+		* policy may tighten, but never raise, the deployment ceiling. */
+		principalWorkers: zod.z.object({
+			enabled: zod.z.boolean().optional(),
+			/** Defaults to five. Zero disables enrollment; existing machines remain usable. */
+			maxPerUser: zod.z.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional()
+		}).optional(),
+		/** Server-only policy letting a conversation's owner move its sealed attached decision
+		* onto the environments its agents now use. Omit to keep sealed decisions immovable. */
+		conversationMoves: zod.z.object({ enabled: zod.z.boolean().optional() }).optional(),
 		/** Operator-managed execution environments. Attached entries route to a
 		* Code API deployment backed by an outbound librechat-code worker. */
 		environments: zod.z.array(zod.z.object({
@@ -4791,11 +5283,25 @@ const agentsEndpointSchema = baseEndpointSchema.omit({ baseURL: true }).merge(zo
 	eventDriven: zod.z.object({ selfUrl: zod.z.string().url().optional() }).optional(),
 	/** Conversational background-task delivery policy. Automatic completion wakeups are
 	* enabled unless an administrator explicitly restores poll-only behavior. */
-	backgroundTasks: zod.z.object({ completionWakeups: zod.z.boolean().optional().default(true) }).optional(),
+	backgroundTasks: zod.z.object({
+		completionWakeups: zod.z.boolean().optional().default(true),
+		/** Maximum terminal output copied into the private completion receipt.
+		* Generated files remain governed by their separate attachment policy. */
+		completionResultMaxChars: zod.z.number().int().min(1).max(AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_HARD_MAX).optional().default(AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_DEFAULT),
+		/** Maximum message-backed sibling results in one continuation.
+		* Independent receipts retain task-local delivery ownership. */
+		completionResultBatchSize: zod.z.number().int().min(1).max(16).optional().default(8),
+		/** Cooperative cancellation for process-local ordinary tools. Off
+		* by default so existing deployments opt into the new control. */
+		ordinaryToolCancellation: zod.z.boolean().optional().default(false)
+	}).optional(),
 	skills: zod.z.object({ maxCatalogSkills: zod.z.number().int().min(1).max(100).optional() }).optional(),
+	managementApi: managementApiSchema.optional(),
 	remoteApi: remoteApiSchema.optional(),
 	/** Human-in-the-loop tool approval policy. Off by default. */
 	toolApproval: toolApprovalPolicySchema,
+	/** Ask User question behavior; see {@link askUserQuestionConfigSchema}. */
+	askUserQuestion: askUserQuestionConfigSchema,
 	/** Durable checkpointer backing tool-approval and Ask User resume.
 	*  Defaults to the app's MongoDB when either flow needs it. */
 	checkpointer: checkpointerSchema
@@ -5050,6 +5556,21 @@ const sttSchema = zod.z.object({
 	openai: sttOpenaiSchema.optional(),
 	azureOpenAI: sttAzureOpenAISchema.optional()
 });
+/**
+* The speech providers a schema actually configures. `allowedAddresses` is transport
+* policy rather than a provider, and a provider key present but empty configures
+* nothing. The speech services accept a schema only when exactly one survives here, so
+* the upload router reads availability from the same list and never routes audio to a
+* transcription that cannot run.
+*/
+function listConfiguredSpeechProviders(schema) {
+	if (schema == null) return [];
+	return Object.entries(schema).filter(([key, value]) => key !== "allowedAddresses" && value != null && typeof value === "object" && Object.keys(value).length > 0);
+}
+/** Whether a speech schema names exactly one usable provider. */
+function isSpeechProviderConfigured(schema) {
+	return listConfiguredSpeechProviders(schema).length === 1;
+}
 const speechTab = zod.z.object({
 	conversationMode: zod.z.boolean().optional(),
 	advancedMode: zod.z.boolean().optional(),
@@ -5134,7 +5655,14 @@ const termsOfServiceSchema = zod.z.object({
 	modalContent: zod.z.string().or(zod.z.array(zod.z.string())).optional()
 });
 const localizedStringSchema = zod.z.union([zod.z.string(), zod.z.record(zod.z.string())]);
+const mcpRefreshDefaults = {
+	toolsRefreshInterval: 300 * 1e3,
+	statusRefreshInterval: 30 * 1e3
+};
 const mcpServersSchema = zod.z.object({
+	/** Foreground polling intervals in milliseconds; 0 disables polling. */
+	toolsRefreshInterval: zod.z.number().int().nonnegative().max(2147483647).optional(),
+	statusRefreshInterval: zod.z.number().int().nonnegative().max(2147483647).optional(),
 	placeholder: zod.z.string().optional(),
 	use: zod.z.boolean().optional(),
 	create: zod.z.boolean().optional(),
@@ -5146,6 +5674,76 @@ const mcpServersSchema = zod.z.object({
 		subLabel: localizedStringSchema.optional()
 	}).optional()
 }).optional();
+/** Values the trace viewer uses for any `interface.traceViewer` field left unset. */
+const traceViewerDefaults = {
+	enabled: false,
+	showInputOutput: false,
+	showToolNames: false,
+	maxRecords: 1e3,
+	maxContentLength: 5e4,
+	requestsPerMinute: 30,
+	requestTimeoutMs: 1e4
+};
+/** Inclusive bounds for the numeric `interface.traceViewer` fields. */
+const traceViewerLimits = {
+	maxRecords: {
+		min: 1,
+		max: 1e4
+	},
+	maxContentLength: {
+		min: 1,
+		max: 1e6
+	},
+	requestsPerMinute: {
+		min: 1,
+		max: 1e3
+	},
+	requestTimeoutMs: {
+		min: 1e3,
+		max: 3e5
+	}
+};
+const boundedIntegerSchema = (field) => zod.z.number().int().min(traceViewerLimits[field].min).max(traceViewerLimits[field].max).optional();
+const traceViewerSchema = zod.z.object({
+	/** Shows the conversation trace control for traces this deployment exported. */
+	enabled: zod.z.boolean().optional(),
+	/** Returns observation input, output and metadata in the record inspector. */
+	showInputOutput: zod.z.boolean().optional(),
+	/**
+	* Names the tools of each tool round from the tracing backend's own record of the round, at the
+	* cost of further backend reads per listed page, which carry each round's input and output.
+	* Off, a round is named only when the chat's messages can be matched to the trace.
+	*/
+	showToolNames: zod.z.boolean().optional(),
+	/** Observations read from the tracing backend per request. */
+	maxRecords: boundedIntegerSchema("maxRecords"),
+	/** Characters kept from each input, output and metadata value before truncation. */
+	maxContentLength: boundedIntegerSchema("maxContentLength"),
+	/** Trace reads one user may start per minute. */
+	requestsPerMinute: boundedIntegerSchema("requestsPerMinute"),
+	/** Budget for each round trip to the tracing backend, in milliseconds. */
+	requestTimeoutMs: boundedIntegerSchema("requestTimeoutMs")
+});
+function boundedInteger(value, field) {
+	const { min, max } = traceViewerLimits[field];
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= min ? Math.min(value, max) : traceViewerDefaults[field];
+}
+/**
+* Fills unset or invalid `interface.traceViewer` fields from
+* {@link traceViewerDefaults}. Admin config overrides reach runtime without
+* schema validation, so every consumer reads the section through this.
+*/
+function resolveTraceViewerConfig(config) {
+	return {
+		enabled: config?.enabled === true,
+		showInputOutput: config?.showInputOutput === true,
+		showToolNames: config?.showToolNames === true,
+		maxRecords: boundedInteger(config?.maxRecords, "maxRecords"),
+		maxContentLength: boundedInteger(config?.maxContentLength, "maxContentLength"),
+		requestsPerMinute: boundedInteger(config?.requestsPerMinute, "requestsPerMinute"),
+		requestTimeoutMs: boundedInteger(config?.requestTimeoutMs, "requestTimeoutMs")
+	};
+}
 let RetentionMode = /* @__PURE__ */ function(RetentionMode) {
 	RetentionMode["ALL"] = "all";
 	RetentionMode["TEMPORARY"] = "temporary";
@@ -5160,6 +5758,8 @@ const interfaceSchema = zod.z.object({
 	customWelcome: zod.z.string().optional(),
 	mcpServers: mcpServersSchema.optional(),
 	modelSelect: zod.z.boolean().optional(),
+	/** Milliseconds between syntax highlights while a code block streams. */
+	codeHighlightThrottleMs: zod.z.number().int().min(0).max(6e4).default(300),
 	parameters: zod.z.boolean().optional(),
 	multiConvo: zod.z.boolean().optional(),
 	bookmarks: zod.z.boolean().optional(),
@@ -5179,6 +5779,7 @@ const interfaceSchema = zod.z.object({
 	})]).optional(),
 	temporaryChat: zod.z.boolean().optional(),
 	temporaryChatRetention: zod.z.number().min(1).max(8760).optional(),
+	generalChatRetention: zod.z.number().min(1).max(8760).optional(),
 	autoSubmitFromUrl: zod.z.boolean().optional(),
 	retentionMode: zod.z.nativeEnum(RetentionMode).default("temporary"),
 	retainAgentFiles: zod.z.boolean().optional(),
@@ -5199,6 +5800,7 @@ const interfaceSchema = zod.z.object({
 	marketplace: zod.z.object({ use: zod.z.boolean().optional() }).optional(),
 	fileSearch: zod.z.boolean().optional(),
 	fileCitations: zod.z.boolean().optional(),
+	traceViewer: traceViewerSchema.optional(),
 	/** Tool keys (and `'mcp'` or an MCP server name) pinned to the prompt bar by default */
 	defaultPinnedTools: zod.z.array(zod.z.string()).optional(),
 	buildInfo: zod.z.boolean().optional(),
@@ -5227,7 +5829,10 @@ const interfaceSchema = zod.z.object({
 		maxPerUser: zod.z.number().int().min(0).optional(),
 		minIntervalMinutes: zod.z.number().int().min(1).optional(),
 		autoDisableAfterFailures: zod.z.number().int().min(1).optional(),
+		admissionConcurrency: zod.z.number().int().min(1).max(100).optional(),
 		fireConcurrency: zod.z.number().int().min(1).optional(),
+		mcpPreflightConcurrency: zod.z.number().int().min(1).max(10).optional(),
+		mcpPreflightTimeoutMs: zod.z.number().int().min(1e3).max(6e5).optional(),
 		/** Refuse schedules that are not filed under a chat project. Enforced on
 		*  create/update AND at every fire, so raising it later stops schedules
 		*  that predate the policy instead of grandfathering them. */
@@ -5240,6 +5845,7 @@ const interfaceSchema = zod.z.object({
 	})]).optional()
 }).default({
 	modelSelect: true,
+	codeHighlightThrottleMs: 300,
 	parameters: true,
 	presets: true,
 	multiConvo: true,
@@ -5496,7 +6102,8 @@ const balanceSchema = zod.z.object({
 	autoRefillEnabled: zod.z.boolean().optional().default(false),
 	refillIntervalValue: zod.z.number().optional().default(30),
 	refillIntervalUnit: zod.z.enum(REFILL_INTERVAL_UNITS).optional().default("days"),
-	refillAmount: zod.z.number().optional().default(1e4)
+	refillAmount: zod.z.number().optional().default(1e4),
+	reservationTtlMs: zod.z.number().int().min(MIN_BALANCE_RESERVATION_TTL_MS).optional().default(DEFAULT_BALANCE_RESERVATION_TTL_MS)
 });
 const transactionsSchema = zod.z.object({ enabled: zod.z.boolean().optional().default(true) });
 const DEFAULT_MEMORY_MAX_INPUT_TOKENS = 12e3;
@@ -5620,6 +6227,57 @@ const messageFilterPiiSchema = zod.z.object({
 	});
 });
 const messageFilterSchema = zod.z.object({ pii: messageFilterPiiSchema.optional() });
+/** User fields a deployment may select as the Langfuse trace `userId`. */
+const LANGFUSE_TRACE_USER_ID_FIELDS = [
+	"id",
+	"email",
+	"username",
+	"name",
+	"openidId",
+	"samlId",
+	"ldapId",
+	"googleId",
+	"githubId",
+	"discordId",
+	"appleId",
+	"facebookId"
+];
+/** User fields a deployment may copy into Langfuse trace metadata. */
+const LANGFUSE_TRACE_USER_METADATA_FIELDS = [
+	...LANGFUSE_TRACE_USER_ID_FIELDS,
+	"role",
+	"provider"
+];
+/** Request fields a deployment may copy into Langfuse trace metadata. */
+const LANGFUSE_TRACE_CONVERSATION_METADATA_FIELDS = [
+	"conversationId",
+	"endpoint",
+	"endpointType",
+	"provider",
+	"model",
+	"modelLabel",
+	"spec"
+];
+/**
+* What a deployment attaches to every Langfuse trace beyond the defaults.
+* Nothing here is exported unless explicitly listed, so the default trace
+* carries only the internal user id and no user or request metadata.
+*/
+const langfuseTraceConfigSchema = zod.z.object({
+	/**
+	* Which user field becomes the trace `userId`. Defaults to the internal user
+	* id; a user with no value for the chosen field keeps the internal id.
+	*/
+	userIdField: zod.z.enum(LANGFUSE_TRACE_USER_ID_FIELDS).optional(),
+	/** User fields exported as `librechat.user.<field>` trace metadata. */
+	userMetadataFields: zod.z.array(zod.z.enum(LANGFUSE_TRACE_USER_METADATA_FIELDS)).optional(),
+	/**
+	* Request fields exported as trace metadata: `librechat.conversation.id`,
+	* `librechat.endpoint`, `librechat.endpoint.type`, `librechat.provider`,
+	* `librechat.model`, `librechat.model.label`, and `librechat.spec`.
+	*/
+	conversationMetadataFields: zod.z.array(zod.z.enum(LANGFUSE_TRACE_CONVERSATION_METADATA_FIELDS)).optional()
+});
 const langfuseConfigSchema = zod.z.object({
 	enabled: zod.z.boolean().optional(),
 	publicKey: zod.z.string().optional(),
@@ -5651,10 +6309,21 @@ const langfuseConfigSchema = zod.z.object({
 	* schema does not yet express — and note the fanout collector forwards only
 	* `Authorization` upstream regardless.
 	*/
-	headers: zod.z.record(zod.z.string()).optional()
+	headers: zod.z.record(zod.z.string()).optional(),
+	/** Trace user identity and allowlisted user/request metadata. */
+	trace: langfuseTraceConfigSchema.optional()
+});
+const openIdDiscoverySchema = zod.z.object({
+	/** Discovery attempts made before startup continues; `0` retries only in the background. */
+	startupAttempts: zod.z.number().int().min(0).max(100).default(1),
+	/** Milliseconds between startup and background discovery attempts. */
+	retryDelayMs: zod.z.number().int().min(100).max(36e5).default(5e3)
 });
+/** Maximum CAS attempts per ACL document, including the initial attempt. */
+const permissionWriteAttemptsSchema = zod.z.number().int().min(1).max(100).default(3);
 const configSchema = zod.z.object({
 	version: zod.z.string(),
+	permissions: zod.z.object({ maxWriteAttempts: permissionWriteAttemptsSchema }).optional(),
 	cache: zod.z.boolean().default(true),
 	ocr: ocrSchema.optional(),
 	webSearch: webSearchSchema.optional(),
@@ -5669,7 +6338,35 @@ const configSchema = zod.z.object({
 	mcpServers: MCPServersSchema.optional(),
 	mcpSettings: zod.z.object({
 		allowedDomains: zod.z.array(zod.z.string()).optional(),
-		allowedAddresses: allowedAddressesSchema
+		allowedAddresses: allowedAddressesSchema,
+		catalogRecovery: zod.z.object({
+			discoveryBackoffMs: zod.z.array(zod.z.number().int().positive().max(1440 * 6e4)).min(1).max(8).default([
+				5 * 6e4,
+				10 * 6e4,
+				20 * 6e4,
+				30 * 6e4
+			]),
+			discoveryTimeoutMs: zod.z.number().int().positive().max(5 * 6e4).default(3e3),
+			/** How long past `discoveryTimeoutMs` a stalled discovery may hold its catalog slot and
+			* coalesced requests. It is never cancelled, so OAuth tokens it redeemed still persist,
+			* and no other discovery for the same server state starts until it settles. */
+			discoverySettleGraceMs: zod.z.number().int().nonnegative().max(5 * 6e4).default(1e4),
+			reauthRetryMs: zod.z.number().int().positive().max(1440 * 6e4).default(30 * 6e4),
+			maxStateEntries: zod.z.number().int().positive().max(1e6).default(1e4),
+			/** Process-wide: how many discoveries released past `discoverySettleGraceMs` may still be
+			* running before recovery starts no new discovery until one settles. The default matches
+			* the three catalog slots a stalled dependency could hold before discoveries were released. */
+			maxDetachedDiscoveries: zod.z.number().int().positive().max(1e3).default(3),
+			generationReadTimeoutMs: zod.z.number().int().positive().max(1e4).default(500),
+			authorizationFenceRetryMs: zod.z.array(zod.z.number().int().nonnegative().max(6e4)).min(1).max(8).default([
+				0,
+				50,
+				200
+			]),
+			authorizationFenceTimeoutMs: zod.z.number().int().positive().max(3e4).default(1e3),
+			authorizationFenceRetryIntervalMs: zod.z.number().int().positive().max(60 * 6e4).default(3e4),
+			authorizationFenceRetryBatchSize: zod.z.number().int().positive().max(1e4).default(100)
+		}).default({})
 	}).optional(),
 	interface: interfaceSchema,
 	turnstile: turnstileSchema.optional(),
@@ -5682,7 +6379,11 @@ const configSchema = zod.z.object({
 	}).optional(),
 	registration: zod.z.object({
 		socialLogins: zod.z.array(zod.z.string()).optional(),
-		allowedDomains: zod.z.array(zod.z.string()).optional()
+		allowedDomains: zod.z.array(zod.z.string()).optional(),
+		/** Milliseconds a started social login may take to reach its callback; defaults to `DEFAULT_OAUTH_STATE_TTL_MS`. */
+		oauthStateTtlMs: zod.z.number().int().min(6e4).max(36e5).optional(),
+		/** OpenID discovery retries; an unset field falls back to its `OPENID_DISCOVERY_RETRY_*` env var, then the schema default. */
+		openidDiscovery: openIdDiscoverySchema.partial().optional()
 	}).default({ socialLogins: defaultSocialLogins }),
 	balance: balanceSchema.optional(),
 	transactions: transactionsSchema.optional(),
@@ -5715,7 +6416,9 @@ const configSchema = zod.z.object({
 		["agents"]: agentsEndpointSchema.optional(),
 		["custom"]: customEndpointsSchema.optional(),
 		["bedrock"]: bedrockEndpointSchema.optional()
-	}).strict().refine((data) => Object.keys(data).length > 0, { message: "At least one `endpoints` field must be provided." }).optional()
+	}).strict().refine((data) => Object.keys(data).length > 0, { message: "At least one `endpoints` field must be provided." }).optional(),
+	/** Serve the OpenAPI spec and docs for the public Agents API. Off by default. */
+	openapi: zod.z.object({ enabled: zod.z.boolean().optional() }).optional()
 });
 const getConfigDefaults = () => getSchemaDefaults(configSchema);
 let KnownEndpoints = /* @__PURE__ */ function(KnownEndpoints) {
@@ -5728,6 +6431,7 @@ let KnownEndpoints = /* @__PURE__ */ function(KnownEndpoints) {
 	KnownEndpoints["groq"] = "groq";
 	KnownEndpoints["helicone"] = "helicone";
 	KnownEndpoints["huggingface"] = "huggingface";
+	KnownEndpoints["lemonade"] = "lemonade";
 	KnownEndpoints["mistral"] = "mistral";
 	KnownEndpoints["mlx"] = "mlx";
 	KnownEndpoints["ollama"] = "ollama";
@@ -5766,6 +6470,7 @@ const alternateName = {
 	["anthropic"]: "Anthropic",
 	["custom"]: "Custom",
 	["bedrock"]: "AWS Bedrock",
+	["lemonade"]: "AMD Lemonade",
 	["ollama"]: "Ollama",
 	["deepseek"]: "DeepSeek",
 	["moonshot"]: "Moonshot",
@@ -5773,6 +6478,17 @@ const alternateName = {
 	["vercel"]: "Vercel",
 	["helicone"]: "Helicone"
 };
+/**
+* Models the Assistants endpoints cannot run. GPT-6 Astra serves tool calls only
+* from the Responses API, and the Assistants surface does not route through
+* `getOpenAILLMConfig`, so listing it there would offer a configuration the
+* provider rejects. Kept out of `sharedOpenAIModels`, which both Assistants
+* catalogs consume.
+*/
+const responsesOnlyOpenAIModels = ["gpt-6-astra"];
+/** Tool calls with Sol/Luna's default reasoning require Responses. Do not offer
+* these on Assistants, which cannot use the native request-routing path. */
+const responsesReasoningOpenAIModels = ["gpt-6-sol", "gpt-6-luna"];
 const sharedOpenAIModels = [
 	"gpt-5.6",
 	"gpt-5.6-terra",
@@ -5802,6 +6518,7 @@ const sharedOpenAIModels = [
 const sharedAnthropicModels = [
 	"claude-fable-5-1",
 	"claude-fable-5",
+	"claude-opus-5-5",
 	"claude-opus-5",
 	"claude-opus-4-8",
 	"claude-opus-4-7",
@@ -5837,6 +6554,7 @@ const sharedAnthropicModels = [
 const bedrockModels = [
 	"global.anthropic.claude-fable-5-1",
 	"global.anthropic.claude-fable-5",
+	"global.anthropic.claude-opus-5-5",
 	"global.anthropic.claude-opus-5",
 	"global.anthropic.claude-opus-4-8",
 	"global.anthropic.claude-opus-4-7",
@@ -5868,7 +6586,11 @@ const bedrockModels = [
 const defaultModels = {
 	["azureAssistants"]: sharedOpenAIModels,
 	["assistants"]: [...sharedOpenAIModels, "chatgpt-4o-latest"],
-	["agents"]: sharedOpenAIModels,
+	["agents"]: [
+		...responsesOnlyOpenAIModels,
+		...responsesReasoningOpenAIModels,
+		...sharedOpenAIModels
+	],
 	["google"]: [
 		"gemini-3.8-flash",
 		"gemini-3.7-flash",
@@ -5886,6 +6608,8 @@ const defaultModels = {
 	],
 	["anthropic"]: sharedAnthropicModels,
 	["openAI"]: [
+		...responsesOnlyOpenAIModels,
+		...responsesReasoningOpenAIModels,
 		...sharedOpenAIModels,
 		"chatgpt-4o-latest",
 		"gpt-4-vision-preview",
@@ -5898,12 +6622,18 @@ const fitlerAssistantModels = (str) => {
 	return /gpt-4|gpt-3\\.5/i.test(str) && !/vision|instruct/i.test(str);
 };
 const openAIModels = defaultModels["openAI"];
+/**
+* Preserve Azure's fallback default selection when the OpenAI catalog gains
+* Responses-preferred models. Configured Azure deployments supply their own
+* model list, including Astra when deployed.
+*/
+const nonResponsesOnlyOpenAIModels = openAIModels.filter((model) => !responsesOnlyOpenAIModels.includes(model) && !responsesReasoningOpenAIModels.includes(model));
 const initialModelsConfig = {
 	initial: [],
 	["openAI"]: openAIModels,
 	["assistants"]: openAIModels.filter(fitlerAssistantModels),
 	["agents"]: openAIModels,
-	["azureOpenAI"]: openAIModels,
+	["azureOpenAI"]: nonResponsesOnlyOpenAIModels,
 	["google"]: defaultModels["google"],
 	["anthropic"]: defaultModels["anthropic"],
 	["bedrock"]: defaultModels["bedrock"]
@@ -5938,6 +6668,8 @@ const visionModels = [
 	"grok-vision",
 	"grok-2-vision",
 	"grok-3",
+	"grok-4.7",
+	"grok-4-7",
 	"gpt-4o-mini",
 	"gpt-4o",
 	"gpt-4-turbo",
@@ -6201,6 +6933,10 @@ let ViolationTypes = /* @__PURE__ */ function(ViolationTypes) {
 	* Registration violations.
 	*/
 	ViolationTypes["REGISTRATIONS"] = "registrations";
+	/**
+	* Shared link retrieval limit violations.
+	*/
+	ViolationTypes["SHARE_LIMIT"] = "share_limit";
 	return ViolationTypes;
 }({});
 /**
@@ -6268,6 +7004,10 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	*/
 	ErrorTypes["STATEFUL_CODE_ENVIRONMENT_NOT_ALLOWED"] = "stateful_code_environment_not_allowed";
 	/**
+	* A conversation's selected attached workspace cannot be used as requested.
+	*/
+	ErrorTypes["CODE_WORKSPACE_UNAVAILABLE"] = "code_workspace_unavailable";
+	/**
 	* Invalid Agent Provider (excluded by Admin)
 	*/
 	ErrorTypes["INVALID_AGENT_PROVIDER"] = "invalid_agent_provider";
@@ -6296,6 +7036,10 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	*/
 	ErrorTypes["AUTH_BANNED"] = "auth_banned";
 	/**
+	* Authentication request was not sent from this application's origin
+	*/
+	ErrorTypes["AUTH_CROSS_ORIGIN"] = "auth_cross_origin";
+	/**
 	* Model refused to respond (content policy violation)
 	*/
 	ErrorTypes["REFUSAL"] = "refusal";
@@ -6311,6 +7055,26 @@ let ErrorTypes = /* @__PURE__ */ function(ErrorTypes) {
 	* Provider throttled or refused the request for exceeding a rate/spend allowance
 	*/
 	ErrorTypes["MODEL_RATE_LIMIT"] = "model_rate_limit";
+	/**
+	* An agent model provider failed and the run could not recover.
+	*/
+	ErrorTypes["UPSTREAM_MODEL_ERROR"] = "upstream_model_error";
+	/**
+	* Context pruning removed every message; nothing fits the configured context window
+	*/
+	ErrorTypes["EMPTY_MESSAGES"] = "empty_messages";
+	/**
+	* Formatted provider payload exceeded the context budget before invocation
+	*/
+	ErrorTypes["FINAL_CONTEXT_OVERFLOW"] = "final_context_overflow";
+	/**
+	* A manual compaction the graph could not attempt; `reason` says why
+	*/
+	ErrorTypes["COMPACTION_SKIPPED"] = "compaction_skipped";
+	/**
+	* A manual compaction whose summarizer produced nothing; history is untouched
+	*/
+	ErrorTypes["COMPACTION_FAILED"] = "compaction_failed";
 	return ErrorTypes;
 }({});
 /**
@@ -6442,7 +7206,7 @@ let TTSProviders = /* @__PURE__ */ function(TTSProviders) {
 /** Enum for app-wide constants */
 let Constants = /* @__PURE__ */ function(Constants) {
 	/**
-	* Key for the app's version. The placeholder `v0.8.8-rc2` is
+	* Key for the app's version. The placeholder `v0.8.8-rc4` is
 	* swapped in by `@rollup/plugin-replace` during `npm run build:data-provider`
 	* using the value of the root `package.json`'s `version` field. Consumers
 	* always import this via the built dist bundle (see `main` field in
@@ -6450,9 +7214,9 @@ let Constants = /* @__PURE__ */ function(Constants) {
 	* substituted value. Only tests that import the TypeScript source directly
 	* would observe the raw placeholder.
 	*/
-	Constants["VERSION"] = "v0.8.8-rc2";
+	Constants["VERSION"] = "v0.8.8-rc4";
 	/** Key for the Custom Config's version (librechat.yaml). */
-	Constants["CONFIG_VERSION"] = "1.3.15";
+	Constants["CONFIG_VERSION"] = "1.3.17";
 	/** Standard value for the first message's `parentMessageId` value, to indicate no parent exists. */
 	Constants["NO_PARENT"] = "00000000-0000-0000-0000-000000000000";
 	/** Standard value to use whatever the submission prelim. `responseMessageId` is */
@@ -6785,6 +7549,8 @@ let LocalStorageKeys = /* @__PURE__ */ function(LocalStorageKeys) {
 	LocalStorageKeys["PIN_WEB_SEARCH_"] = "PIN_WEB_SEARCH_";
 	/** Pin state for Code Interpreter per conversation ID */
 	LocalStorageKeys["PIN_CODE_INTERPRETER_"] = "PIN_CODE_INTERPRETER_";
+	/** Key for the last selected code approval mode */
+	LocalStorageKeys["LAST_CODE_APPROVAL_MODE"] = "lastCodeApprovalMode";
 	return LocalStorageKeys;
 }({});
 let ForkOptions = /* @__PURE__ */ function(ForkOptions) {
@@ -6877,6 +7643,57 @@ function getDefaultParamsEndpoint(endpointsConfig, endpoint) {
 	return endpointsConfig[endpoint]?.customParams?.defaultParamsEndpoint;
 }
 //#endregion
+//#region src/types/assistants.ts
+let RunStatus = /* @__PURE__ */ function(RunStatus) {
+	RunStatus["QUEUED"] = "queued";
+	RunStatus["IN_PROGRESS"] = "in_progress";
+	RunStatus["REQUIRES_ACTION"] = "requires_action";
+	RunStatus["CANCELLING"] = "cancelling";
+	RunStatus["CANCELLED"] = "cancelled";
+	RunStatus["FAILED"] = "failed";
+	RunStatus["COMPLETED"] = "completed";
+	RunStatus["EXPIRED"] = "expired";
+	return RunStatus;
+}({});
+let FilePurpose = /* @__PURE__ */ function(FilePurpose) {
+	FilePurpose["Vision"] = "vision";
+	FilePurpose["FineTune"] = "fine-tune";
+	FilePurpose["FineTuneResults"] = "fine-tune-results";
+	FilePurpose["Assistants"] = "assistants";
+	FilePurpose["AssistantsOutput"] = "assistants_output";
+	return FilePurpose;
+}({});
+const defaultOrderQuery = {
+	order: "desc",
+	limit: 100
+};
+let AssistantStreamEvents = /* @__PURE__ */ function(AssistantStreamEvents) {
+	AssistantStreamEvents["ThreadCreated"] = "thread.created";
+	AssistantStreamEvents["ThreadRunCreated"] = "thread.run.created";
+	AssistantStreamEvents["ThreadRunQueued"] = "thread.run.queued";
+	AssistantStreamEvents["ThreadRunInProgress"] = "thread.run.in_progress";
+	AssistantStreamEvents["ThreadRunRequiresAction"] = "thread.run.requires_action";
+	AssistantStreamEvents["ThreadRunCompleted"] = "thread.run.completed";
+	AssistantStreamEvents["ThreadRunFailed"] = "thread.run.failed";
+	AssistantStreamEvents["ThreadRunCancelling"] = "thread.run.cancelling";
+	AssistantStreamEvents["ThreadRunCancelled"] = "thread.run.cancelled";
+	AssistantStreamEvents["ThreadRunExpired"] = "thread.run.expired";
+	AssistantStreamEvents["ThreadRunStepCreated"] = "thread.run.step.created";
+	AssistantStreamEvents["ThreadRunStepInProgress"] = "thread.run.step.in_progress";
+	AssistantStreamEvents["ThreadRunStepCompleted"] = "thread.run.step.completed";
+	AssistantStreamEvents["ThreadRunStepFailed"] = "thread.run.step.failed";
+	AssistantStreamEvents["ThreadRunStepCancelled"] = "thread.run.step.cancelled";
+	AssistantStreamEvents["ThreadRunStepExpired"] = "thread.run.step.expired";
+	AssistantStreamEvents["ThreadRunStepDelta"] = "thread.run.step.delta";
+	AssistantStreamEvents["ThreadMessageCreated"] = "thread.message.created";
+	AssistantStreamEvents["ThreadMessageInProgress"] = "thread.message.in_progress";
+	AssistantStreamEvents["ThreadMessageCompleted"] = "thread.message.completed";
+	AssistantStreamEvents["ThreadMessageIncomplete"] = "thread.message.incomplete";
+	AssistantStreamEvents["ThreadMessageDelta"] = "thread.message.delta";
+	AssistantStreamEvents["ErrorEvent"] = "error";
+	return AssistantStreamEvents;
+}({});
+//#endregion
 //#region src/accessPermissions.ts
 /**
 * Granular Permission System Types for Agent Sharing
@@ -6929,6 +7746,8 @@ let PermissionBits = /* @__PURE__ */ function(PermissionBits) {
 	PermissionBits[PermissionBits["DELETE"] = 4] = "DELETE";
 	/**  1000 - Can share agent with others (future) */
 	PermissionBits[PermissionBits["SHARE"] = 8] = "SHARE";
+	/** 10000 - Can view Insights data for an agent when VIEW is also present */
+	PermissionBits[PermissionBits["VIEW_INSIGHTS"] = 16] = "VIEW_INSIGHTS";
 	return PermissionBits;
 }({});
 /**
@@ -6970,6 +7789,8 @@ const principalSchema = zod.z.object({
 	description: zod.z.string().optional(),
 	idOnTheSource: zod.z.string().optional(),
 	accessRoleId: zod.z.nativeEnum(AccessRoleIds).optional(),
+	viewInsights: zod.z.boolean().optional(),
+	isAdmin: zod.z.boolean().optional(),
 	memberCount: zod.z.number().optional()
 });
 /**
@@ -7103,6 +7924,9 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["searchEnabled"] = "searchEnabled";
 	QueryKeys["langfuseConnection"] = "langfuseConnection";
 	QueryKeys["langfuseSessionLink"] = "langfuseSessionLink";
+	QueryKeys["conversationTraceAvailability"] = "conversationTraceAvailability";
+	QueryKeys["conversationTraceRecords"] = "conversationTraceRecords";
+	QueryKeys["conversationTraceRecord"] = "conversationTraceRecord";
 	QueryKeys["user"] = "user";
 	QueryKeys["name"] = "name";
 	QueryKeys["models"] = "models";
@@ -7179,13 +8003,26 @@ let QueryKeys = /* @__PURE__ */ function(QueryKeys) {
 	QueryKeys["subagentThread"] = "subagentThread";
 	QueryKeys["codeEnvironments"] = "codeEnvironments";
 	QueryKeys["agentQueuedTurns"] = "agentQueuedTurns";
+	QueryKeys["pinnedOrder"] = "pinnedOrder";
 	return QueryKeys;
 }({});
-const DynamicQueryKeys = { agentFiles: (agentId) => ["agentFiles", agentId] };
+const DynamicQueryKeys = {
+	agentFiles: (agentId) => ["agentFiles", agentId],
+	codeEnvironmentStatus: (id) => [
+		"codeEnvironments",
+		id,
+		"status"
+	]
+};
 let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
 	MutationKeys["subagentControl"] = "subagentControl";
 	MutationKeys["enqueueAgentQueuedTurn"] = "enqueueAgentQueuedTurn";
 	MutationKeys["cancelAgentQueuedTurn"] = "cancelAgentQueuedTurn";
+	/** Whole-array favorites write, keyed so every hook instance's write is
+	*  visible to the others through the query client. */
+	MutationKeys["updateFavorites"] = "updateFavorites";
+	/** Pinned-section display order write, keyed for the same reason. */
+	MutationKeys["updatePinnedOrder"] = "updatePinnedOrder";
 	MutationKeys["updateLangfuseConnection"] = "updateLangfuseConnection";
 	MutationKeys["testLangfuseConnection"] = "testLangfuseConnection";
 	MutationKeys["createAgentApiKey"] = "createAgentApiKey";
@@ -7231,6 +8068,7 @@ let MutationKeys = /* @__PURE__ */ function(MutationKeys) {
 	MutationKeys["pairCodeEnvironment"] = "pairCodeEnvironment";
 	MutationKeys["updateCodeEnvironmentSettings"] = "updateCodeEnvironmentSettings";
 	MutationKeys["deleteCodeEnvironment"] = "deleteCodeEnvironment";
+	MutationKeys["moveConversationCodeEnvironment"] = "moveConversationCodeEnvironment";
 	return MutationKeys;
 }({});
 //#endregion
@@ -7707,10 +8545,14 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getAvailableTools: () => getAvailableTools,
 	getBanner: () => getBanner,
 	getCategories: () => getCategories,
+	getCodeEnvironmentStatus: () => getCodeEnvironmentStatus,
 	getCodeEnvironments: () => getCodeEnvironments,
 	getCodeOutputDownload: () => getCodeOutputDownload,
 	getConversationById: () => getConversationById,
 	getConversationTags: () => getConversationTags,
+	getConversationTraceAvailability: () => getConversationTraceAvailability,
+	getConversationTraceRecord: () => getConversationTraceRecord,
+	getConversationTraceRecords: () => getConversationTraceRecords,
 	getConversations: () => getConversations,
 	getCustomConfigSpeech: () => getCustomConfigSpeech,
 	getDomainServerBaseUrl: () => getDomainServerBaseUrl,
@@ -7742,6 +8584,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	getMessagesByConvoId: () => getMessagesByConvoId,
 	getModels: () => getModels,
 	getParentSubagents: () => getParentSubagents,
+	getPinnedOrder: () => getPinnedOrder,
 	getPresets: () => getPresets,
 	getProjectById: () => getProjectById,
 	getPrompt: () => getPrompt,
@@ -7791,6 +8634,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	logout: () => logout,
 	makePromptProduction: () => makePromptProduction,
 	markFilesUsage: () => markFilesUsage,
+	moveConversationCodeEnvironment: () => moveConversationCodeEnvironment,
 	pairCodeEnvironment: () => pairCodeEnvironment,
 	pinConversation: () => pinConversation,
 	rebuildConversationTags: () => rebuildConversationTags,
@@ -7833,6 +8677,7 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 	updateMessage: () => updateMessage,
 	updateMessageContent: () => updateMessageContent,
 	updatePeoplePickerPermissions: () => updatePeoplePickerPermissions,
+	updatePinnedOrder: () => updatePinnedOrder,
 	updatePreset: () => updatePreset,
 	updateProject: () => updateProject,
 	updatePromptGroup: () => updatePromptGroup,
@@ -7864,13 +8709,23 @@ var data_service_exports = /* @__PURE__ */ __exportAll({
 });
 function getInsights(params = {}) {
 	const query = new URLSearchParams();
-	for (const [key, value] of Object.entries(params)) if (value !== void 0 && value !== null && value !== "") query.set(key, String(value));
+	for (const [key, value] of Object.entries(params)) if (Array.isArray(value)) value.forEach((item) => query.append(key, String(item)));
+	else if (value !== void 0 && value !== null && value !== "") query.set(key, String(value));
 	const suffix = query.toString() ? `?${query.toString()}` : "";
 	return request_default.get(`${insights()}${suffix}`);
 }
 function getInsightsAccess() {
 	return request_default.get(insightsAccess());
 }
+function getConversationTraceAvailability(conversationId) {
+	return request_default.get(conversationTraceAvailability(conversationId));
+}
+function getConversationTraceRecords({ conversationId, cursor }, signal) {
+	return request_default.get(conversationTraceRecords(conversationId, cursor), signal ? { signal } : void 0);
+}
+function getConversationTraceRecord({ conversationId, recordId, messageId, sourceId }, signal) {
+	return request_default.get(conversationTraceRecord(conversationId, recordId, messageId, sourceId), signal ? { signal } : void 0);
+}
 function getLangfuseConnection() {
 	return request_default.get(adminLangfuseConnection());
 }
@@ -7895,6 +8750,15 @@ function deleteUser(payload) {
 function getCodeEnvironments() {
 	return request_default.get(codeEnvironments());
 }
+function getCodeEnvironmentStatus(id) {
+	return request_default.get(codeEnvironmentStatus(id));
+}
+function moveConversationCodeEnvironment({ conversationId, from, to }) {
+	return request_default.patch(codeEnvironmentConversationDecision(conversationId), {
+		from,
+		to
+	});
+}
 function pairCodeEnvironment(payload) {
 	return request_default.post(codeEnvironmentPairings(), payload);
 }
@@ -7910,6 +8774,13 @@ function getFavorites() {
 function updateFavorites(favorites) {
 	return request_default.post(`${apiBaseUrl()}/api/user/settings/favorites`, { favorites });
 }
+/** Combined Pinned-section display order: favorite and pinned-chat entry keys interleaved. */
+function getPinnedOrder() {
+	return request_default.get(pinnedOrder());
+}
+function updatePinnedOrder(pinnedOrder$1) {
+	return request_default.post(pinnedOrder(), { pinnedOrder: pinnedOrder$1 });
+}
 /** Tool favorites — starred marketplace items (builtins, tools, MCP servers, skills). */
 function getToolFavorites() {
 	return request_default.get(toolFavorites());
@@ -8764,6 +9635,18 @@ Object.defineProperty(exports, "ACTION_METADATA_FILTER_FIELDS", {
 		return ACTION_METADATA_FILTER_FIELDS;
 	}
 });
+Object.defineProperty(exports, "AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_DEFAULT", {
+	enumerable: true,
+	get: function() {
+		return AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_DEFAULT;
+	}
+});
+Object.defineProperty(exports, "AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_HARD_MAX", {
+	enumerable: true,
+	get: function() {
+		return AGENT_BACKGROUND_COMPLETION_RESULT_MAX_CHARS_HARD_MAX;
+	}
+});
 Object.defineProperty(exports, "AGENT_INSTRUCTION_FILTER_FIELDS", {
 	enumerable: true,
 	get: function() {
@@ -8788,12 +9671,6 @@ Object.defineProperty(exports, "AgentCapabilities", {
 		return AgentCapabilities;
 	}
 });
-Object.defineProperty(exports, "AnnotationTypes", {
-	enumerable: true,
-	get: function() {
-		return AnnotationTypes;
-	}
-});
 Object.defineProperty(exports, "AnthropicEffort", {
 	enumerable: true,
 	get: function() {
@@ -8854,6 +9731,78 @@ Object.defineProperty(exports, "BedrockReasoningConfig", {
 		return BedrockReasoningConfig;
 	}
 });
+Object.defineProperty(exports, "CODE_APPROVAL_MODES", {
+	enumerable: true,
+	get: function() {
+		return CODE_APPROVAL_MODES;
+	}
+});
+Object.defineProperty(exports, "CODE_ENVIRONMENT_COMMAND_TIMEOUT_DEFAULT_MS", {
+	enumerable: true,
+	get: function() {
+		return CODE_ENVIRONMENT_COMMAND_TIMEOUT_DEFAULT_MS;
+	}
+});
+Object.defineProperty(exports, "CODE_ENVIRONMENT_COMMAND_TIMEOUT_HARD_MAX_MS", {
+	enumerable: true,
+	get: function() {
+		return CODE_ENVIRONMENT_COMMAND_TIMEOUT_HARD_MAX_MS;
+	}
+});
+Object.defineProperty(exports, "CODE_ENVIRONMENT_DECISION_VERSION", {
+	enumerable: true,
+	get: function() {
+		return CODE_ENVIRONMENT_DECISION_VERSION;
+	}
+});
+Object.defineProperty(exports, "CODE_ENVIRONMENT_MODES", {
+	enumerable: true,
+	get: function() {
+		return CODE_ENVIRONMENT_MODES;
+	}
+});
+Object.defineProperty(exports, "CODE_ENVIRONMENT_MOVE_VERSION", {
+	enumerable: true,
+	get: function() {
+		return CODE_ENVIRONMENT_MOVE_VERSION;
+	}
+});
+Object.defineProperty(exports, "CODE_ENVIRONMENT_QUEUE_WAIT_DEFAULT_MS", {
+	enumerable: true,
+	get: function() {
+		return CODE_ENVIRONMENT_QUEUE_WAIT_DEFAULT_MS;
+	}
+});
+Object.defineProperty(exports, "CODE_WORKSPACE_ID_PATTERN", {
+	enumerable: true,
+	get: function() {
+		return CODE_WORKSPACE_ID_PATTERN;
+	}
+});
+Object.defineProperty(exports, "CODE_WORKSPACE_INSTANCE_TYPES", {
+	enumerable: true,
+	get: function() {
+		return CODE_WORKSPACE_INSTANCE_TYPES;
+	}
+});
+Object.defineProperty(exports, "CODE_WORKSPACE_MAX_COUNT", {
+	enumerable: true,
+	get: function() {
+		return CODE_WORKSPACE_MAX_COUNT;
+	}
+});
+Object.defineProperty(exports, "CODE_WORKSPACE_OPERATIONS", {
+	enumerable: true,
+	get: function() {
+		return CODE_WORKSPACE_OPERATIONS;
+	}
+});
+Object.defineProperty(exports, "CODE_WORKSPACE_SELECTION_ERROR_REASONS", {
+	enumerable: true,
+	get: function() {
+		return CODE_WORKSPACE_SELECTION_ERROR_REASONS;
+	}
+});
 Object.defineProperty(exports, "CONVERSATION_STARTER_FILTER_FIELDS", {
 	enumerable: true,
 	get: function() {
@@ -8878,6 +9827,12 @@ Object.defineProperty(exports, "Capabilities", {
 		return Capabilities;
 	}
 });
+Object.defineProperty(exports, "CodeApprovalModeError", {
+	enumerable: true,
+	get: function() {
+		return CodeApprovalModeError;
+	}
+});
 Object.defineProperty(exports, "CohereConstants", {
 	enumerable: true,
 	get: function() {
@@ -8896,12 +9851,66 @@ Object.defineProperty(exports, "Constants", {
 		return Constants;
 	}
 });
+Object.defineProperty(exports, "DEFAULT_AGENT_MODEL_RESPONSE_BODY_TIMEOUT_MS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_AGENT_MODEL_RESPONSE_BODY_TIMEOUT_MS;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_AGENT_MODEL_RESPONSE_HEADERS_TIMEOUT_MS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_AGENT_MODEL_RESPONSE_HEADERS_TIMEOUT_MS;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_BALANCE_RESERVATION_TTL_MS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_BALANCE_RESERVATION_TTL_MS;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_MAX_PROVIDER_ERROR_CHARS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_MAX_PROVIDER_ERROR_CHARS;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_MAX_RETAINED_TOOL_COUNT_CHARS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_MAX_RETAINED_TOOL_COUNT_CHARS;
+	}
+});
 Object.defineProperty(exports, "DEFAULT_MEMORY_MAX_INPUT_TOKENS", {
 	enumerable: true,
 	get: function() {
 		return DEFAULT_MEMORY_MAX_INPUT_TOKENS;
 	}
 });
+Object.defineProperty(exports, "DEFAULT_OAUTH_STATE_TTL_MS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_OAUTH_STATE_TTL_MS;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_RETAINED_ANSWER_TOKENS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_RETAINED_ANSWER_TOKENS;
+	}
+});
+Object.defineProperty(exports, "DEFAULT_SKILL_IMPORT_CLEANUP_CONCURRENCY", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_SKILL_IMPORT_CLEANUP_CONCURRENCY;
+	}
+});
+Object.defineProperty(exports, "DefaultLLMDeliveryPath", {
+	enumerable: true,
+	get: function() {
+		return DefaultLLMDeliveryPath;
+	}
+});
 Object.defineProperty(exports, "DynamicQueryKeys", {
 	enumerable: true,
 	get: function() {
@@ -9040,6 +10049,24 @@ Object.defineProperty(exports, "KnownEndpoints", {
 		return KnownEndpoints;
 	}
 });
+Object.defineProperty(exports, "LANGFUSE_TRACE_CONVERSATION_METADATA_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return LANGFUSE_TRACE_CONVERSATION_METADATA_FIELDS;
+	}
+});
+Object.defineProperty(exports, "LANGFUSE_TRACE_USER_ID_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return LANGFUSE_TRACE_USER_ID_FIELDS;
+	}
+});
+Object.defineProperty(exports, "LANGFUSE_TRACE_USER_METADATA_FIELDS", {
+	enumerable: true,
+	get: function() {
+		return LANGFUSE_TRACE_USER_METADATA_FIELDS;
+	}
+});
 Object.defineProperty(exports, "LocalStorageKeys", {
 	enumerable: true,
 	get: function() {
@@ -9064,6 +10091,18 @@ Object.defineProperty(exports, "MAX_GRAPH_SUBAGENT_MEMBERS", {
 		return MAX_GRAPH_SUBAGENT_MEMBERS;
 	}
 });
+Object.defineProperty(exports, "MAX_MCP_ICON_PATH_LENGTH", {
+	enumerable: true,
+	get: function() {
+		return MAX_MCP_ICON_PATH_LENGTH;
+	}
+});
+Object.defineProperty(exports, "MAX_MCP_OAUTH_PERSISTENCE_WAIT_MS", {
+	enumerable: true,
+	get: function() {
+		return MAX_MCP_OAUTH_PERSISTENCE_WAIT_MS;
+	}
+});
 Object.defineProperty(exports, "MAX_PII_CUSTOM_PATTERNS_TOTAL", {
 	enumerable: true,
 	get: function() {
@@ -9184,6 +10223,12 @@ Object.defineProperty(exports, "MESSAGE_FILTER_FIELDS", {
 		return MESSAGE_FILTER_FIELDS;
 	}
 });
+Object.defineProperty(exports, "MIN_BALANCE_RESERVATION_TTL_MS", {
+	enumerable: true,
+	get: function() {
+		return MIN_BALANCE_RESERVATION_TTL_MS;
+	}
+});
 Object.defineProperty(exports, "MODEL_PARAMETER_FILTER_FIELDS", {
 	enumerable: true,
 	get: function() {
@@ -9202,12 +10247,6 @@ Object.defineProperty(exports, "MemoryScope", {
 		return MemoryScope;
 	}
 });
-Object.defineProperty(exports, "MessageContentTypes", {
-	enumerable: true,
-	get: function() {
-		return MessageContentTypes;
-	}
-});
 Object.defineProperty(exports, "MutationKeys", {
 	enumerable: true,
 	get: function() {
@@ -9442,12 +10481,6 @@ Object.defineProperty(exports, "StdioOptionsSchema", {
 		return StdioOptionsSchema;
 	}
 });
-Object.defineProperty(exports, "StepStatus", {
-	enumerable: true,
-	get: function() {
-		return StepStatus;
-	}
-});
 Object.defineProperty(exports, "StreamableHTTPOptionsSchema", {
 	enumerable: true,
 	get: function() {
@@ -9562,6 +10595,12 @@ Object.defineProperty(exports, "actionMetadataFilterFieldSchema", {
 		return actionMetadataFilterFieldSchema;
 	}
 });
+Object.defineProperty(exports, "agentGitIdentitySchema", {
+	enumerable: true,
+	get: function() {
+		return agentGitIdentitySchema;
+	}
+});
 Object.defineProperty(exports, "agentInstructionFilterFieldSchema", {
 	enumerable: true,
 	get: function() {
@@ -9640,6 +10679,18 @@ Object.defineProperty(exports, "applicationMimeTypes", {
 		return applicationMimeTypes;
 	}
 });
+Object.defineProperty(exports, "askUserQuestionConfigSchema", {
+	enumerable: true,
+	get: function() {
+		return askUserQuestionConfigSchema;
+	}
+});
+Object.defineProperty(exports, "askUserQuestionRetainedAnswersSchema", {
+	enumerable: true,
+	get: function() {
+		return askUserQuestionRetainedAnswersSchema;
+	}
+});
 Object.defineProperty(exports, "assistantEndpointSchema", {
 	enumerable: true,
 	get: function() {
@@ -9940,6 +10991,12 @@ Object.defineProperty(exports, "defaultEndpoints", {
 		return defaultEndpoints;
 	}
 });
+Object.defineProperty(exports, "defaultLLMDeliveryPathSchema", {
+	enumerable: true,
+	get: function() {
+		return defaultLLMDeliveryPathSchema;
+	}
+});
 Object.defineProperty(exports, "defaultModels", {
 	enumerable: true,
 	get: function() {
@@ -10276,6 +11333,12 @@ Object.defineProperty(exports, "getAllEffectivePermissions", {
 		return getAllEffectivePermissions;
 	}
 });
+Object.defineProperty(exports, "getAllowedCodeApprovalModes", {
+	enumerable: true,
+	get: function() {
+		return getAllowedCodeApprovalModes;
+	}
+});
 Object.defineProperty(exports, "getAvailablePlugins", {
 	enumerable: true,
 	get: function() {
@@ -10312,6 +11375,12 @@ Object.defineProperty(exports, "getDefaultParamsEndpoint", {
 		return getDefaultParamsEndpoint;
 	}
 });
+Object.defineProperty(exports, "getDocumentFileExtension", {
+	enumerable: true,
+	get: function() {
+		return getDocumentFileExtension;
+	}
+});
 Object.defineProperty(exports, "getEffectivePermissions", {
 	enumerable: true,
 	get: function() {
@@ -10486,18 +11555,6 @@ Object.defineProperty(exports, "hasProcessMCPServerConfig", {
 		return hasProcessMCPServerConfig;
 	}
 });
-Object.defineProperty(exports, "hostImageIdSuffix", {
-	enumerable: true,
-	get: function() {
-		return hostImageIdSuffix;
-	}
-});
-Object.defineProperty(exports, "hostImageNamePrefix", {
-	enumerable: true,
-	get: function() {
-		return hostImageNamePrefix;
-	}
-});
 Object.defineProperty(exports, "imageDetailNumeric", {
 	enumerable: true,
 	get: function() {
@@ -10594,18 +11651,72 @@ Object.defineProperty(exports, "isBedrockDocumentType", {
 		return isBedrockDocumentType;
 	}
 });
+Object.defineProperty(exports, "isCodeEnvironmentMode", {
+	enumerable: true,
+	get: function() {
+		return isCodeEnvironmentMode;
+	}
+});
+Object.defineProperty(exports, "isCodeWorkspaceEnvironment", {
+	enumerable: true,
+	get: function() {
+		return isCodeWorkspaceEnvironment;
+	}
+});
+Object.defineProperty(exports, "isCodeWorkspaceSelection", {
+	enumerable: true,
+	get: function() {
+		return isCodeWorkspaceSelection;
+	}
+});
+Object.defineProperty(exports, "isCodeWorkspaceSelectionErrorReason", {
+	enumerable: true,
+	get: function() {
+		return isCodeWorkspaceSelectionErrorReason;
+	}
+});
+Object.defineProperty(exports, "isCodeWorkspaceSelections", {
+	enumerable: true,
+	get: function() {
+		return isCodeWorkspaceSelections;
+	}
+});
 Object.defineProperty(exports, "isDocumentSupportedProvider", {
 	enumerable: true,
 	get: function() {
 		return isDocumentSupportedProvider;
 	}
 });
+Object.defineProperty(exports, "isExplicitMimeConfig", {
+	enumerable: true,
+	get: function() {
+		return isExplicitMimeConfig;
+	}
+});
 Object.defineProperty(exports, "isImageVisionTool", {
 	enumerable: true,
 	get: function() {
 		return isImageVisionTool;
 	}
 });
+Object.defineProperty(exports, "isKnownProviderIdentifier", {
+	enumerable: true,
+	get: function() {
+		return isKnownProviderIdentifier;
+	}
+});
+Object.defineProperty(exports, "isMediaSupportedProvider", {
+	enumerable: true,
+	get: function() {
+		return isMediaSupportedProvider;
+	}
+});
+Object.defineProperty(exports, "isMessageFileUpload", {
+	enumerable: true,
+	get: function() {
+		return isMessageFileUpload;
+	}
+});
 Object.defineProperty(exports, "isMythosClassModel", {
 	enumerable: true,
 	get: function() {
@@ -10648,6 +11759,18 @@ Object.defineProperty(exports, "isRemoteOidcUrlAllowed", {
 		return isRemoteOidcUrlAllowed;
 	}
 });
+Object.defineProperty(exports, "isRepositoryInstructionDescriptor", {
+	enumerable: true,
+	get: function() {
+		return isRepositoryInstructionDescriptor;
+	}
+});
+Object.defineProperty(exports, "isResponsesApiUpload", {
+	enumerable: true,
+	get: function() {
+		return isResponsesApiUpload;
+	}
+});
 Object.defineProperty(exports, "isSecureCodeEnvironmentControlURL", {
 	enumerable: true,
 	get: function() {
@@ -10660,6 +11783,12 @@ Object.defineProperty(exports, "isSensitiveEnvVar", {
 		return isSensitiveEnvVar;
 	}
 });
+Object.defineProperty(exports, "isSpeechProviderConfigured", {
+	enumerable: true,
+	get: function() {
+		return isSpeechProviderConfigured;
+	}
+});
 Object.defineProperty(exports, "isUUID", {
 	enumerable: true,
 	get: function() {
@@ -10672,6 +11801,18 @@ Object.defineProperty(exports, "langfuseConfigSchema", {
 		return langfuseConfigSchema;
 	}
 });
+Object.defineProperty(exports, "langfuseTraceConfigSchema", {
+	enumerable: true,
+	get: function() {
+		return langfuseTraceConfigSchema;
+	}
+});
+Object.defineProperty(exports, "listConfiguredSpeechProviders", {
+	enumerable: true,
+	get: function() {
+		return listConfiguredSpeechProviders;
+	}
+});
 Object.defineProperty(exports, "loginPage", {
 	enumerable: true,
 	get: function() {
@@ -10690,6 +11831,18 @@ Object.defineProperty(exports, "mbToBytes", {
 		return mbToBytes;
 	}
 });
+Object.defineProperty(exports, "mcpRefreshDefaults", {
+	enumerable: true,
+	get: function() {
+		return mcpRefreshDefaults;
+	}
+});
+Object.defineProperty(exports, "mediaSupportedProviders", {
+	enumerable: true,
+	get: function() {
+		return mediaSupportedProviders;
+	}
+});
 Object.defineProperty(exports, "megabyte", {
 	enumerable: true,
 	get: function() {
@@ -10810,6 +11963,12 @@ Object.defineProperty(exports, "openAISettings", {
 		return openAISettings;
 	}
 });
+Object.defineProperty(exports, "openIdDiscoverySchema", {
+	enumerable: true,
+	get: function() {
+		return openIdDiscoverySchema;
+	}
+});
 Object.defineProperty(exports, "openRouterSchema", {
 	enumerable: true,
 	get: function() {
@@ -10840,6 +11999,18 @@ Object.defineProperty(exports, "permissionEntrySchema", {
 		return permissionEntrySchema;
 	}
 });
+Object.defineProperty(exports, "permissionWriteAttemptsSchema", {
+	enumerable: true,
+	get: function() {
+		return permissionWriteAttemptsSchema;
+	}
+});
+Object.defineProperty(exports, "prefersResponsesApiByModel", {
+	enumerable: true,
+	get: function() {
+		return prefersResponsesApiByModel;
+	}
+});
 Object.defineProperty(exports, "principalSchema", {
 	enumerable: true,
 	get: function() {
@@ -10918,6 +12089,24 @@ Object.defineProperty(exports, "resolveAllowedStatefulCodeEnvironments", {
 		return resolveAllowedStatefulCodeEnvironments;
 	}
 });
+Object.defineProperty(exports, "resolveCodeApprovalMode", {
+	enumerable: true,
+	get: function() {
+		return resolveCodeApprovalMode;
+	}
+});
+Object.defineProperty(exports, "resolveCodePermissionDecision", {
+	enumerable: true,
+	get: function() {
+		return resolveCodePermissionDecision;
+	}
+});
+Object.defineProperty(exports, "resolveEffectiveUseResponsesApi", {
+	enumerable: true,
+	get: function() {
+		return resolveEffectiveUseResponsesApi;
+	}
+});
 Object.defineProperty(exports, "resolveEndpointType", {
 	enumerable: true,
 	get: function() {
@@ -10930,12 +12119,30 @@ Object.defineProperty(exports, "resolveModelSpecEndpoint", {
 		return resolveModelSpecEndpoint;
 	}
 });
+Object.defineProperty(exports, "resolveSandboxFilename", {
+	enumerable: true,
+	get: function() {
+		return resolveSandboxFilename;
+	}
+});
 Object.defineProperty(exports, "resolveStatefulCodeEnvironment", {
 	enumerable: true,
 	get: function() {
 		return resolveStatefulCodeEnvironment;
 	}
 });
+Object.defineProperty(exports, "resolveTraceViewerConfig", {
+	enumerable: true,
+	get: function() {
+		return resolveTraceViewerConfig;
+	}
+});
+Object.defineProperty(exports, "resolveUseResponsesApi", {
+	enumerable: true,
+	get: function() {
+		return resolveUseResponsesApi;
+	}
+});
 Object.defineProperty(exports, "resourcePermissionsResponseSchema", {
 	enumerable: true,
 	get: function() {
@@ -11218,6 +12425,18 @@ Object.defineProperty(exports, "toolArgumentFilterFieldSchema", {
 		return toolArgumentFilterFieldSchema;
 	}
 });
+Object.defineProperty(exports, "traceViewerDefaults", {
+	enumerable: true,
+	get: function() {
+		return traceViewerDefaults;
+	}
+});
+Object.defineProperty(exports, "traceViewerLimits", {
+	enumerable: true,
+	get: function() {
+		return traceViewerLimits;
+	}
+});
 Object.defineProperty(exports, "transactionsSchema", {
 	enumerable: true,
 	get: function() {
@@ -11351,4 +12570,4 @@ Object.defineProperty(exports, "webSearchSchema", {
 	}
 });
 
-//# sourceMappingURL=data-service-D5kHzBt-.js.map
+//# sourceMappingURL=data-service-CUG1qdeC.js.map