diff --git a/.env.example b/.env.example
index 943fbdb8..5cdbec2f 100644
--- a/.env.example
+++ b/.env.example
@@ -25,6 +25,11 @@
 # Example: VEKTRA_LLM_API_BASE=http://localhost:8000/v1
 # VEKTRA_LLM_API_BASE=
 
+# Extra JSON body forwarded to litellm. Useful for vLLM thinking models
+# (Qwen3.5, DeepSeek-R1) to disable thinking mode.
+# Example: VEKTRA_LLM_EXTRA_BODY={"chat_template_kwargs": {"enable_thinking": false}}
+# VEKTRA_LLM_EXTRA_BODY=
+
 # Or set provider-specific keys directly:
 # OPENAI_API_KEY=sk-...
 # ANTHROPIC_API_KEY=sk-ant-...
@@ -83,6 +88,12 @@
 # VEKTRA_CONTEXT_CHUNK_RATIO=0.6
 # VEKTRA_PROMPT_TEMPLATES_DIR=
 
+# Default RAG grounding policy. Per-namespace override via
+# PATCH /api/v1/admin/namespaces/{id}/config.
+#   strict  - answer from retrieved context + history only
+#   hybrid  - fall back to model knowledge when confident
+# VEKTRA_PROMPT_GROUNDING_MODE=strict
+
 # Query rewriting (AdvancedQueryPipeline)
 # VEKTRA_QUERY_REWRITE_ENABLED=true
 # VEKTRA_QUERY_REWRITE_MODEL=
@@ -141,6 +152,14 @@
 # VEKTRA_AUDIT_RETENTION_DAYS=90
 # VEKTRA_EVAL_MODE=false
 
+# Persist QueryTrace rows for every query (DEBT-011). When unset, defaults
+# to true if vektra-analytics is configured, false otherwise.
+# VEKTRA_ANALYTICS_STORE_TRACES=
+
+# Log original and rewritten query text at debug level. Development only;
+# query text is otherwise redacted from logs.
+# VEKTRA_DEBUG_LOG_QUERIES=false
+
 # --------------------------------------------------------------------------
 # Security
 # --------------------------------------------------------------------------
@@ -174,3 +193,10 @@
 # Set to false when an external LMS (e.g. Moodle) manages enrollment.
 # When false, namespace is derived from JWT (namespace claim or course_id fallback).
 # VEKTRA_LEARN_REQUIRE_ENROLLMENT=true
+
+# Default visibility of the source-citations section in the chatbot widget
+# (FEAT-014). Resolution chain: data-show-sources attr (client) >
+# namespaces.config.show_sources (per-course) > this env var > hardcoded true.
+# The API always returns the full sources list; this flag only instructs the
+# widget whether to render them.
+# VEKTRA_LEARN_SHOW_SOURCES=true
diff --git a/.gemini/styleguide.md b/.gemini/styleguide.md
index 76d5c073..69bb2a7c 100644
--- a/.gemini/styleguide.md
+++ b/.gemini/styleguide.md
@@ -1,4 +1,4 @@
-# Vektra coding conventions for Gemini Code Assist
+# Vektra RAG coding conventions for Gemini Code Assist
 
 ## General
 
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index e49c2a6c..3e5699b4 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -1,5 +1,5 @@
 name: Bug report
-description: Report a bug in Vektra
+description: Report a bug in Vektra RAG
 labels: ["bug"]
 body:
   - type: markdown
diff --git a/.s2s/BACKLOG.md b/.s2s/BACKLOG.md
index fa32efba..38e57aea 100644
--- a/.s2s/BACKLOG.md
+++ b/.s2s/BACKLOG.md
@@ -664,6 +664,172 @@ As a result, `conversation.j2` and `TemplateRenderer.render_conversation()` are
 
 ---
 
+### DEBT-017: Consolidate namespace-resolution logic in vektra-learn
+
+**Status**: planned | **Priority**: low | **Created**: 2026-04-21
+**Origin**: CodeRabbit review on PR #66 (v0.5.0), `vektra-learn/src/vektra_learn/api.py:498-512`
+
+**Context**: `_resolve_namespace_from_token()` (added for WI-1 in v0.5.0) re-implements the same fallback chain that `course_query` does inline around lines 663-673 and 694-695: read `course_id` from the JWT, fall back to `namespace` claim, default to `course_id`. The learn-query path additionally performs an enrollment lookup when `VEKTRA_LEARN_REQUIRE_ENROLLMENT=true` which is interleaved with the plain resolution, so a naive extraction would miss that branch.
+
+**Proposed approach**: extend `_resolve_namespace_from_token` to return a `(course_id, namespace, namespace_source)` tuple, then refactor `course_query` to call it for the non-enrollment branch while keeping the enrollment path inline. Both endpoints stay in lockstep if the JWT schema evolves (e.g., a new claim is added).
+
+**Acceptance criteria**:
+- [ ] Single helper used by both `get_conversation_turns` and `course_query` (non-enrollment branch)
+- [ ] Enrollment-required branch unchanged
+- [ ] Tests cover both call sites against a shared fixture set
+- [ ] No behaviour change to error codes (ERR-LEARN-003 on missing course_id)
+
+---
+
+### DEBT-018: Scope widget `--vektra-primary` override and dedupe style node
+
+**Status**: completed | **Priority**: low | **Created**: 2026-04-21 | **Completed**: 2026-04-27 (v0.5.0)
+**Origin**: CodeRabbit review on PR #66 (v0.5.0), `vektra-learn/widget/src/chat-ui.js:138-144`
+
+**Resolution**: `_injectStyles()` now writes the `--vektra-primary` override scoped to `.vektra-chat-btn, .vektra-chat-panel` (no longer to `:root`) and reuses a single `<style id="vektra-primary-override">` element across instantiations.
+
+**Context**: `ChatUI._injectStyles()` appends a new `<style>` element setting `:root { --vektra-primary: <color> }` on every instantiation. Two consequences:
+
+1. Repeated construction (hot reload, multi-instance embedding, host-page re-init) accumulates style nodes.
+2. The override lives on `:root`, so if the host page already defines `--vektra-primary` for an unrelated purpose, the widget now wins document-wide.
+
+In today's deploy there is one widget per page and init fires once, so the impact is theoretical. Filing as debt so it's tracked when we eventually support embedding multiple instances or host pages that reuse the custom property.
+
+**Proposed approach**:
+1. Scope the override to the widget roots: `.vektra-chat-btn, .vektra-chat-panel { --vektra-primary: <color> }`.
+2. Cache/replace a single `<style id="vektra-primary-override">` node rather than appending on every construction.
+
+**Acceptance criteria**:
+- [ ] Custom property no longer leaks to `:root` when a widget is initialised
+- [ ] Re-initialising a widget replaces the style node instead of appending a new one
+- [ ] Default-color deploys render identically (no visual regression)
+
+---
+
+### DEBT-019: Unit assertion for `document_name` on streaming sources
+
+**Status**: planned | **Priority**: low | **Created**: 2026-04-21
+**Origin**: CodeRabbit review on PR #66 (v0.5.0), `vektra-core/tests/test_pipeline.py:423-497`
+
+**Context**: the streaming path (`execute_stream` in both `SimpleQueryPipeline` and `AdvancedQueryPipeline`) was the regression vector fixed by commit `45437c8` (missing `document_name` in `sources_data` dict of `AdvancedQueryPipeline.execute_stream`). Current unit coverage exercises `execute()` via `test_execute_populates_document_name` and is cross-checked end-to-end by the Kalypso smoke test. Adding a dedicated unit assertion on the streamed `sources` payload would catch the same regression at fastest feedback.
+
+**Proposed approach**: mirror `test_execute_populates_document_name` using the existing `_collect_stream()` helper: monkeypatch `pipeline_mod._fetch_document_names` to the same hit/miss fakes and assert each streamed `QueryChunk(type="sources", ...).data[*]["document_name"]` matches expectations. Add the same test for `AdvancedQueryPipeline`.
+
+**Acceptance criteria**:
+- [ ] Unit test covers `SimpleQueryPipeline.execute_stream` sources payload
+- [ ] Unit test covers `AdvancedQueryPipeline.execute_stream` sources payload
+- [ ] Both tests use the same mapping / empty-dict monkeypatches as the non-stream test for parity
+
+---
+
+### DEBT-020: Audit log fallback when `request_id` is missing on sensitive endpoints
+
+**Status**: completed | **Priority**: medium | **Created**: 2026-04-26 | **Completed**: 2026-04-27 (v0.5.0)
+**Origin**: Gemini review on PR #71 (v0.5.0 release), `vektra-admin/src/vektra_admin/api.py:768-783`. Same pattern applies to sensitive reads, e.g. `get_conversation_turns` in `vektra-admin/src/vektra_admin/api.py:491-539`.
+
+**Resolution**: each of `vektra-admin/api.py`, `vektra-learn/api.py`, and `vektra-ingest/api.py` declares a private `_resolve_request_id(request) -> UUID` helper that synthesizes `uuid4()` when `request.state.request_id` is missing and emits a `request_id_middleware_missing_fallback` structlog warning. All known sensitive endpoints (admin api-keys CRUD, namespace config PATCH, admin/learn conversation turns reads, ingest async + direct audit writers) now audit unconditionally. Helper duplication across three modules is intentional for v0.5.0 — extraction to `vektra_shared` is tracked separately if a fourth caller appears.
+
+**Context**: `patch_namespace_config` writes the audit log only when `request.state.request_id` is truthy:
+
+```python
+request_id = getattr(request.state, "request_id", None)
+if request_id:
+    background_tasks.add_task(_audit.log_event, ...)
+```
+
+If the request-id middleware fails to set the attribute (or runs out of order), audit events are silently skipped. This weakens NFR-007 ("audit every sensitive content access"). The same `if request_id:` guard appears on sensitive **read** endpoints too (e.g. `GET /admin/conversations/{id}/turns`), which means both write and read paths leak audit coverage when the middleware misbehaves. The fix should sweep both classes of endpoint, not only writes.
+
+**Proposed approach**:
+1. Synthesize a fallback `uuid4()` request_id when `request.state.request_id` is missing, so the audit log always fires.
+2. Emit a structlog warning in that path so middleware misconfiguration is observable.
+3. Sweep `vektra-admin/api.py` and `vektra-learn/api.py` for the `if request_id:` pattern across **both read and write** sensitive endpoints; apply the fix consistently.
+
+**Acceptance criteria**:
+- [ ] `patch_namespace_config` always writes an audit row, with a synthetic request_id when missing
+- [ ] Structlog warning emitted when the fallback path triggers
+- [ ] Same pattern applied to sensitive endpoints across vektra-admin and vektra-learn, covering reads (e.g. `GET /admin/conversations/{id}/turns`) **and** writes (`POST /api-keys`, `DELETE /api-keys/{id}`, `PATCH /admin/namespaces/{id}/config`, etc.)
+- [ ] Unit test covers the fallback path on at least one read and one write endpoint
+
+---
+
+### DEBT-021: Replace `_fetch_document_names` round-trip with provider-aligned filename resolution
+
+**Status**: planned | **Priority**: low | **Created**: 2026-04-26
+**Origin**: Gemini review on PR #71 (v0.5.0 release), `vektra-core/src/vektra_core/pipeline.py:100-126`. Multi-provider scoping refined per Gemini review on PR #72.
+
+**Context**: WI-2 (FEAT-012) added `document_name` to source citations by introducing `_fetch_document_names()`, which performs a separate `SELECT id, filename, deleted_at FROM source_documents WHERE id = ANY(...)` after the main chunk fetch. This adds one Postgres round-trip per query.
+
+The original WI-2 plan suggested integrating filename lookup into the existing chunk-fetch query. The v0.5.0 implementation chose the separate-call shape for clarity during milestone scope; consolidation is tracked here for future hardening.
+
+In current low-QPS deployments the extra round-trip is not measurable in user-facing latency. It becomes relevant under high concurrency.
+
+**Multi-provider note**: chunk metadata (text, source_document_id) lives in the Postgres `document_chunks` table regardless of vector store provider. Two valid optimization paths exist:
+
+- **Path A — Postgres-side JOIN** (works for both `pgvector` and `qdrant`): collapse the chunk fetch and filename lookup into a single SQL with `LEFT JOIN source_documents ON document_chunks.source_document_id = source_documents.id`. Saves one round-trip; provider-agnostic because chunks always live in Postgres.
+- **Path B — Provider-native payload denormalization** (Qdrant only): store `document_name` and a soft-delete flag inside the vector payload at ingest time. Search results carry the filename directly, eliminating the need for any Postgres lookup beyond the chunk text. Lower latency than path A for Qdrant deployments, at the cost of payload migration on document rename or soft-delete.
+
+Path A is sufficient for the immediate goal (one fewer round-trip). Path B is a follow-up for Qdrant-heavy deployments and requires a separate ingest-side change.
+
+**Proposed approach**:
+1. Implement path A first: move filename + `deleted_at` resolution into the chunk-fetch query (in `vektra-index` or wherever `document_chunks` is queried). Delete `_fetch_document_names`.
+2. Preserve the `(archived)` suffix at the citation-rendering layer (API serialization), independent of the storage path.
+3. Optionally: under the Qdrant provider, follow up with path B (denormalize at ingest, sync on document rename / soft-delete) as a separate item.
+
+**Acceptance criteria**:
+- [ ] Chunk-fetch query covers text + filename + soft-delete flag in a single round-trip (path A)
+- [ ] `_fetch_document_names()` removed from `vektra-core/pipeline.py`
+- [ ] Streaming and non-streaming pipelines both reflect the new shape
+- [ ] No regression in `(archived)` rendering for soft-deleted documents
+- [ ] Latency benchmark confirms one fewer Postgres round-trip per `/query` regardless of vector store provider
+- [ ] Qdrant payload denormalization (path B) tracked as a follow-up if needed
+
+---
+
+### DEBT-022: Widget multi-instance primary-color and base-style support
+
+**Status**: planned | **Priority**: low | **Created**: 2026-04-27
+**Origin**: Gemini review on PR #73 (v0.5.0 hardening), `vektra-learn/widget/src/chat-ui.js:152`
+
+**Context**: DEBT-018 closed the host-page leak (`:root` → widget-roots scoped) and deduped the `--vektra-primary` override style node. It does **not** support multiple widgets on the same page with different primary colors: the override is keyed by a global `id="vektra-primary-override"` and writes class selectors shared by every instance, so the last constructor to fire wins for all instances. Separately, the main `<style>` block (the theme stylesheet) still appends a fresh element on every `ChatUI` construction — fine for the current 1-widget-per-page assumption, but accumulates under hot-reload or future multi-instance embedding.
+
+Today's deploy is single-instance, so the gap is theoretical. Filing for the moment we ship multi-instance embedding (e.g. an instructor-side admin widget alongside a student widget on the same LMS page).
+
+**Proposed approach**:
+1. Apply per-instance primary color via `style.setProperty("--vektra-primary", color)` on the widget's root elements (`._btn` and `._panel`) inside `_createElements`, instead of writing a global stylesheet override. Drop the `vektra-primary-override` style node.
+2. Dedupe the main style block too: look up `document.getElementById("vektra-chat-ui-styles")` and reuse if present; otherwise create. Note: instances must agree on theme — or theme should also become per-instance.
+3. Decide whether `--vektra-primary` lookups inside descendants (`.vektra-chat-msg.user`, etc.) still resolve correctly via cascade after the per-instance set.
+
+**Acceptance criteria**:
+- [ ] Two widgets on the same page with different `data-primary-color` render with their own respective colors
+- [ ] Re-initialising a widget (hot reload / SPA navigation) does not accumulate `<style>` elements in `document.head`
+- [ ] No regression on single-instance deploys (dominant case today)
+- [ ] Visual smoke test in Moodle host page
+
+---
+
+### DEBT-023: Hoist `_resolve_request_id` audit-fallback helper into `vektra_shared`
+
+**Status**: planned | **Priority**: low | **Created**: 2026-04-27
+**Origin**: CodeRabbit review on PR #73 (v0.5.0 hardening), nitpick on `vektra-learn/src/vektra_learn/api.py:60-76`
+
+**Context**: DEBT-020 introduced a `_resolve_request_id(request) -> UUID` helper that synthesizes `uuid4()` when `request.state.request_id` is missing and emits a structlog warning. The helper is duplicated almost verbatim across `vektra-admin/src/vektra_admin/api.py`, `vektra-learn/src/vektra_learn/api.py`, and `vektra-ingest/src/vektra_ingest/api.py`. Logger usage is also subtly inconsistent: admin/ingest call `log.warning(...)` against a module-level `log`, while learn calls `structlog.get_logger(__name__).warning(...)` inline.
+
+Three near-duplicates is the threshold where extraction starts to pay off (a fourth caller is plausible if the platform grows new audited endpoints; behavioural drift between modules is the real risk).
+
+**Proposed approach**:
+1. Add `vektra_shared.audit.resolve_request_id(request: Request) -> UUID` (or a new `vektra_shared.request_id` module if `audit.py` should stay narrow).
+2. Standardize the logger call shape so all three modules emit the same `request_id_middleware_missing_fallback` event with identical keys.
+3. Replace the three local helpers with imports.
+4. Verify import-linter contracts still pass (`vektra_shared` is the only module the components are allowed to import from, so this is well within the existing contract).
+
+**Acceptance criteria**:
+- [ ] `_resolve_request_id` removed from `vektra-admin/api.py`, `vektra-learn/api.py`, `vektra-ingest/api.py`
+- [ ] Single shared helper in `vektra_shared` with the same signature and behaviour
+- [ ] Same structlog event name and keys regardless of caller
+- [ ] All existing audit-fallback tests still pass; helper unit-tested in `vektra-shared/tests`
+
+---
+
 ### INFRA-005: Docker log persistence across container restarts
 
 **Status**: planned | **Priority**: medium | **Created**: 2026-03-23
@@ -1147,6 +1313,8 @@ Plan generation follows a three-phase approach (lesson learned from Phase 1):
 **Status**: draft | **Priority**: medium | **Created**: 2026-03-17
 **Origin**: Moodle integration testing — greetings like "ciao", "buongiorno" trigger `no_relevant_context` and produce empty/unhelpful responses
 
+**Note (2026-04-18)**: FEAT-020 (`grounding_mode=hybrid`) partially overlaps: in hybrid mode the pipeline no longer short-circuits on `no_relevant_context` and calls the LLM. However, the system prompt is generic (training-data fallback), not tailored to greetings/meta-questions/off-topic with an explicit "redirect to course" behavior. FEAT-005 remains open for the dedicated no-context system prompt variant described in the acceptance criteria.
+
 **Context**: Both `SimpleQueryPipeline` and `AdvancedQueryPipeline` short-circuit when no chunks pass the relevance threshold (`min_relevance_score`): they return `answer: null` + `no_relevant_context: true` without ever calling the LLM. This is correct for retrieval quality (ARCH-056, REQ-066) — the system should not hallucinate answers from non-relevant chunks.
 
 However, for the learn chatbot widget (and any conversational interface), this creates a poor UX for:
@@ -1179,7 +1347,7 @@ The existing **SafeguardHook** (`pre_query`, `post_retrieval`, `pre_response`) c
 
 ### FEAT-007: Markdown rendering in widget chat messages
 
-**Status**: in_progress | **Priority**: medium | **Created**: 2026-03-20
+**Status**: completed | **Priority**: medium | **Created**: 2026-03-20 | **Completed**: 2026-03-23 | **PR**: #50
 **Origin**: Moodle integration testing (2026-03-20)
 
 **Context**: The learn chatbot widget (`vektra-chat.js`) renders all messages as plain text via `textContent`. LLM responses typically contain Markdown formatting (bold, italic, lists, code blocks, headings) which is displayed as raw syntax. This makes responses harder to read, especially for structured answers with bullet points or code examples.
@@ -1280,7 +1448,7 @@ If no custom template exists, the global system.j2 still has access to the same
 
 ### FEAT-006: Widget error feedback when Vektra API is unreachable
 
-**Status**: draft | **Priority**: medium | **Created**: 2026-03-20
+**Status**: completed | **Priority**: medium | **Created**: 2026-03-20 | **Completed**: 2026-03-23 | **PR**: #50
 **Origin**: Moodle integration testing on remote machine (2026-03-20)
 
 **Context**: When the chatbot widget JS (`vektra-chat.js`) cannot reach the Vektra API (missing SSH tunnel, CORS misconfiguration, Vektra container down), the floating chat button silently fails to appear. No error is shown to the user or the admin. The Moodle block still displays "AI Assistant is active" because the server-side token generation succeeded (PHP runs inside Docker, reaches Vektra on the internal network), but the browser-side widget cannot load or connect.
@@ -1303,7 +1471,7 @@ This makes troubleshooting difficult: the admin sees "active" but students see n
 
 ### FEAT-012: Include document name in query source citations
 
-**Status**: draft | **Priority**: medium | **Created**: 2026-03-20
+**Status**: completed | **Priority**: medium | **Created**: 2026-03-20 | **Completed**: 2026-04-21 | **Plan**: 20260418-v050-widget-and-prof-config
 **Origin**: Moodle integration testing - sources show chunk_id (UUID) instead of document name
 
 **Context**: The learn query response includes source citations with `doc_id`, `chunk_id`, `score`, and `snippet`. The widget renders these as `[1] chunk_id (score)` with a snippet preview. The `chunk_id` is a UUID which is meaningless to the user. The original document filename (e.g., "Escapologia Fiscale - 59 segreti.pdf") is not included in the source data.
@@ -1347,9 +1515,11 @@ Approach 1 (keyword proximity) is the best cost/benefit trade-off for a first im
 
 ### FEAT-016: White-label widget customization (name, colors, branding)
 
-**Status**: draft | **Priority**: medium | **Created**: 2026-03-20
+**Status**: partial (data-attrs) | **Priority**: medium | **Created**: 2026-03-20 | **Updated**: 2026-04-21 | **Plan**: 20260418-v050-widget-and-prof-config
 **Origin**: vertical deployment requirements - universities and organizations need chatbot with their own branding
 
+**v0.5.0 progress**: data-* attributes implemented (`data-title`, `data-primary-color`, `data-icon`, `data-welcome-message`, `data-powered-by`). Namespace-backed branding (category B) and JWT-claim precedence remain open — see FEAT-008.
+
 **Context**: The widget currently supports only `theme` (light/dark) and `language` (en/it) as visual customization. Everything else is hardcoded: title ("Course Assistant"), primary color (#2563eb blue), icon (speech bubble emoji), and no welcome message. ADR-0025 defines the `data-*` attribute contract as the configuration API, and the "configuration over fork" principle requires that customization happens via config, not code changes.
 
 For vertical deployments (e.g., a university running Vektra for their students), the chatbot should be brandable to match the institution's identity. The same applies to any organization deploying Vektra as infrastructure behind their own product.
@@ -1386,7 +1556,7 @@ For vertical deployments (e.g., a university running Vektra for their students),
 
 ### FEAT-014: Configurable source citation visibility
 
-**Status**: draft | **Priority**: medium | **Created**: 2026-03-20
+**Status**: completed | **Priority**: medium | **Created**: 2026-03-20 | **Completed**: 2026-04-22 | **PR**: pending
 **Origin**: Moodle integration testing - source citations may not be appropriate for all courses
 
 **Context**: The widget always displays source citations (document/chunk reference, relevance score, snippet) below each assistant response. Some instructors may prefer to hide them:
@@ -1407,12 +1577,12 @@ The API still returns sources in the response regardless of the flag (useful for
 
 **Traceability**: ADR-0025, ARCH-063, FEAT-008
 
-**Acceptance Criteria** (tentative):
-- [ ] Global `show_sources` setting with default `true`
-- [ ] Per-namespace override (metadata or JWT claim)
-- [ ] Widget hides sources section when flag is `false`
-- [ ] API response still includes sources regardless (no data loss)
-- [ ] Moodle plugin exposes the setting in per-course block configuration
+**Acceptance Criteria**:
+- [x] Global `show_sources` setting with default `true` (`VEKTRA_LEARN_SHOW_SOURCES`)
+- [x] Per-namespace override via `namespaces.config.show_sources` (writable through the existing `PATCH /api/v1/admin/namespaces/{id}/config` whitelist)
+- [x] Widget hides sources section when flag is `false` (resolution chain: `data-show-sources` client override > server-resolved value > default `true`)
+- [x] API response still includes sources regardless (no data loss)
+- [ ] Moodle plugin exposes the setting in per-course block configuration — **deferred to the vektra-moodle sibling plan**
 
 ---
 
@@ -1469,7 +1639,7 @@ Phase 2 (skip_retrieval flag):
 
 ### FEAT-009: Widget token auto-refresh on expiry
 
-**Status**: draft | **Priority**: high | **Created**: 2026-03-20
+**Status**: completed | **Priority**: high | **Created**: 2026-03-20 | **Completed**: 2026-03-23 | **PR**: #50
 **Origin**: Moodle integration testing - "invalid or expired dashboard token" after ~1h session
 
 **Context**: The JWT dashboard token has a 1h TTL (default). The token is generated server-side by the Moodle plugin (or any LMS) at page load and embedded in the widget via `data-token` attribute. Once expired, all subsequent queries fail with "signature has expired". The user must manually reload the page to get a fresh token.
@@ -1498,7 +1668,7 @@ For Moodle specifically, the plugin would expose a lightweight AJAX endpoint (`/
 
 ### FEAT-010: Enable SSE streaming in widget
 
-**Status**: draft | **Priority**: medium | **Created**: 2026-03-20
+**Status**: completed | **Priority**: medium | **Created**: 2026-03-20 | **Completed**: 2026-03-23 | **PR**: #50
 **Origin**: Moodle integration testing - responses arrive as a single block, no progressive rendering
 
 **Context**: The widget's api-client.js already has a complete SSE streaming parser (lines 65-107) with `onToken`, `onSources`, `onDone` callbacks. The chat-ui.js has `createStreamMessage()` and `appendToken()` methods that progressively append text to the DOM. However, the query is sent with `stream: false` (hardcoded, line 33), so all responses arrive as a single JSON blob.
@@ -1548,6 +1718,54 @@ This does not violate REQ-051 if data is aggregated (no individual conversations
 
 ---
 
+### FEAT-022: Suggested questions as quick-start chips in widget
+
+**Status**: draft | **Priority**: low | **Created**: 2026-04-18
+**Origin**: v0.5.0 scoping discussion - instructor wants to guide students toward typical questions without crafting a new conversation each time
+
+**Context**: students opening the chatbot often do not know how to start. A short list of instructor-curated prompts, rendered as clickable chips above the input box on first open, lowers the barrier and steers usage toward pedagogically useful questions (e.g., "Riassumi la lezione 3", "Quali sono i punti chiave del capitolo?", "Fammi un quiz su questo argomento").
+
+**Proposed approach**: purely client-side, category (A) config (visual, no backend involvement). Passed via `data-suggested-questions` attribute on the script tag as a JSON array. The Moodle block config form exposes a textarea (one question per line) that the plugin serializes into the attribute. The widget renders chips on first open; clicking one fills the input and submits as if typed.
+
+**Traceability**: ADR-0025, FEAT-016
+
+**Acceptance Criteria** (tentative):
+- [ ] `data-suggested-questions` attribute parsed as JSON array of strings
+- [ ] Chips rendered above the input on first open only (hidden after first message)
+- [ ] Click fills input and submits
+- [ ] Chips respect theme (light/dark) and primary color from FEAT-016
+- [ ] Missing/malformed attribute falls back to no chips (no error)
+- [ ] Moodle block config exposes a textarea for instructor to edit the list
+
+---
+
+### FEAT-023: Socratic interaction mode for guided learning
+
+**Status**: draft | **Priority**: medium | **Created**: 2026-04-18
+**Origin**: v0.5.0 scoping discussion - pedagogical need to differentiate "answer giver" from "learning guide" per course
+
+**Context**: in some courses the instructor wants the chatbot to act as a Socratic tutor — asking the student guiding questions instead of delivering the answer directly. This supports active learning and prevents the chatbot from becoming a shortcut that bypasses the learning process. Other courses (reference-style, FAQ-style) want the chatbot to give direct answers. The choice is per-course and must be configurable by the instructor.
+
+Implementation approach is deliberately deferred. Questions to resolve when designing this feature:
+- Is Socratic mode a third `grounding_mode` value (alongside `strict` and `hybrid`), or an orthogonal `interaction_mode` dimension?
+- How do the two interact when combined (strict + socratic, hybrid + socratic)?
+- Does the Socratic prompt need worked examples or is a system-prompt instruction enough?
+- How does it behave across multi-turn conversations (when does it "reveal" the answer)?
+- Should the instructor configure the depth of Socratic questioning (light nudging vs full inquiry)?
+
+Storage aligns with the same model as grounding mode: persisted in `namespaces.config` JSONB (category B config, backend-enforced), configurable via the Moodle block config form → `PATCH /api/v1/namespaces/{id}/config`. The widget does not need to know — the difference is entirely in the system prompt selected server-side.
+
+**Traceability**: FEAT-020 (grounding mode), ADR-0020 (prompt template architecture)
+
+**Acceptance Criteria** (tentative, pending design):
+- [ ] Per-namespace Socratic mode flag in `namespaces.config`
+- [ ] System prompt variant that implements Socratic dialogue
+- [ ] Works alongside strict/hybrid grounding modes
+- [ ] Validated with representative course scenarios
+- [ ] Instructor can enable/disable from Moodle block config
+
+---
+
 ## In Progress
 
 ### BUG-011: ~~Ingest pipeline does not generate sparse embeddings for hybrid search~~
@@ -1590,10 +1808,12 @@ The core API (`POST /api/v1/query`) has the same design — it's documented as "
 
 ### FEAT-004: Widget conversation lifecycle improvements
 
-**Status**: draft | **Priority**: medium | **Created**: 2026-03-16
+**Status**: partial (persistence + new chat) | **Priority**: medium | **Created**: 2026-03-16 | **Updated**: 2026-04-21 | **Plan**: 20260418-v050-widget-and-prof-config
 **Origin**: Moodle integration testing (2026-03-16)
 **Depends on**: BUG-010
 
+**v0.5.0 progress**: sessionStorage persistence with 24h stale cutoff (tab-scoped, keyed by course_id), history replay via new `GET /conversations/{id}/turns`, explicit "New chat" button. Remaining open: idle timeout, cross-device continuity, token-refresh interaction policy. Sources are returned empty for v0.5.0 — extending turns response with citations requires joining query_traces and is deferred.
+
 **Context**: After BUG-010 is fixed, the widget will support multi-turn conversations within a single page load. However, the `conversation_id` lives only in JS memory (`ApiClient._conversationId`) and is lost on page refresh, navigation, or tab close. Additionally, there is no explicit way for the user to start a fresh conversation. These are UX improvements to evaluate for the learn chatbot widget.
 
 **Areas to evaluate**:
diff --git a/.s2s/CONTEXT.md b/.s2s/CONTEXT.md
index 16df3387..2f46d50e 100644
--- a/.s2s/CONTEXT.md
+++ b/.s2s/CONTEXT.md
@@ -140,7 +140,7 @@ See [architecture.md](architecture.md) for complete architecture documentation.
 - ChunkingStrategy: pluggable chunking. FixedSizeChunking (Phase 1), DualStrategyChunking with semantic splitting (Phase 2)
 - QueryPipeline: RAG pipeline abstraction returning QueryResponse + QueryTrace. Phase 2: AdvancedQueryPipeline with query rewriting (ARCH-061), reranking, hybrid search (implemented)
 - SafeguardHook: pre/post query safeguards (3 trust boundary points) with content modification support (ARCH-049)
-- EventEmitter: internal event hooks. NoOpEventEmitter (Phase 1), LogEventEmitter (Phase 2)
+- EventEmitter: internal event hooks. NoOpEventEmitter (Phase 1), WebhookEventEmitter (Phase 2: HMAC-SHA256 signed HTTP POST)
 
 **Key decisions** (64 total, 25 ADRs):
 - [ADR-0003](decisions/ADR-0003-modular-monolith-phase1.md): Modular monolith for Phase 1
diff --git a/.s2s/architecture.md b/.s2s/architecture.md
index 18712808..148ac79a 100644
--- a/.s2s/architecture.md
+++ b/.s2s/architecture.md
@@ -429,7 +429,7 @@ See [section 8.4](#84-deployment) for Docker Compose specification and resource
 - **ARCH-035 - EmbeddingProvider Protocol**: Dedicated Protocol for embedding generation. Separates embed_documents() from embed_query() for asymmetric models. Single shared instance between ingest and core. Configurable provider and model via env vars.
 - **ARCH-036 - QueryPipeline Protocol**: Abstraction of RAG query pipeline. execute() returns (QueryResponse, QueryTrace). Phase 1: SimpleQueryPipeline (embed -> search -> relevance_filter -> build_prompt -> LLM, with graceful degradation). relevance_filter applies minimum score threshold and overlap deduplication (ARCH-056). build_prompt calculates token budget from model context window (ARCH-055), renders composable Jinja2 templates (ARCH-054). Phase 2: AdvancedQueryPipeline adds query_rewrite (ARCH-061), query_classify, rerank, confidence scoring steps. Selectable via VEKTRA_QUERY_PIPELINE.
 - **ARCH-037 - ChunkingStrategy Protocol**: Abstraction of text chunking. Receives DocumentChunk stream, returns chunked stream. Phase 1: FixedSizeChunking. Selectable via VEKTRA_CHUNKING_STRATEGY.
-- **ARCH-038 - EventEmitter interface**: Internal event hooks with NoOp default. Emission points at document lifecycle, query completion, safeguard triggers, API key operations. Phase 2 (implemented): LogEventEmitter. WebhookEventEmitter with HMAC-SHA256 deferred to Phase 3.
+- **ARCH-038 - EventEmitter interface**: Internal event hooks with NoOp default. Emission points at document lifecycle, query completion, safeguard triggers, API key operations. Phase 2 (implemented): WebhookEventEmitter (HMAC-SHA256 signed HTTP POST, activated via `VEKTRA_WEBHOOK_URL`). LogEventEmitter (structlog-based) was scoped during planning but never implemented; the webhook path subsumed the use case.
 - **ARCH-039 - ProviderRegistry pattern**: Unified registry for all Protocol implementations. Dict-based in Phase 1, extensible to entry_points plugin discovery in Phase 2. Consistent VEKTRA_* env var configuration pattern.
 - **ARCH-040 - Forward-compatible data model**: Phase 1 schema includes fields for Phase 2 features: response_id and citation_id for feedback loops, document version and supersedes_id for versioning, deleted_at and deletion_reason for soft delete, index_version for zero-downtime reindex. All fields nullable/defaulted, no behavioral change in Phase 1.
 - **ARCH-041 - Audit/analytics separation**: QueryTrace (per-step timing, chunk refs, model info) emitted separately from audit log. QueryTrace does not contain query text or response content (REQ-051 compliance). Phase 1: structlog emission. Phase 2 (implemented): dedicated query_traces table with reporting API (vektra-analytics).
@@ -704,7 +704,7 @@ class EventEmitter(Protocol):
     async def emit(event_type: str, payload: dict) -> None
 ```
 
-Phase 1: NoOpEventEmitter. Emission points: document.indexed, document.failed, query.completed, safeguard.triggered, apikey.created, apikey.revoked. Phase 2 (implemented): LogEventEmitter (structlog-based event logging). WebhookEventEmitter with HMAC-SHA256 deferred to Phase 3.
+Phase 1: NoOpEventEmitter. Emission points: document.indexed, document.failed, query.completed, safeguard.triggered, apikey.created, apikey.revoked. Phase 2 (implemented): WebhookEventEmitter — HMAC-SHA256 signed HTTP POST with configurable URL, secret, and timeout (`VEKTRA_WEBHOOK_URL`, `VEKTRA_WEBHOOK_SECRET`, `VEKTRA_WEBHOOK_TIMEOUT`). LogEventEmitter was originally scoped for Phase 2 but never built; structlog already emits the same events at module boundaries, so the webhook path was prioritized instead.
 
 ### 8.3.1 Extended types
 
@@ -1989,7 +1989,7 @@ Quality scenarios (QS-xx) define measurable targets. Validation scenarios ([vali
 | TD-05 | No OAuth/OIDC | API keys sufficient for Phase 1 | Add for vektra-learn in Phase 2 |
 | TD-06 | Confidence scoring undefined | Algorithm needs research spike, confidence_tier field exists in QueryResponse | OQ-014, Phase 2 spike, field ready (ARCH-040) |
 | TD-07 | Dense-only vector search | Hybrid search Protocol ready (SearchMode enum), implementation deferred | REQ-050, swap PgvectorProvider or add QdrantVectorStoreProvider in Phase 2 (ARCH-051) |
-| TD-08 | NoOp event emission | EventEmitter hooks in place, no handler | REQ-061, swap to WebhookEventEmitter in Phase 2 |
+| TD-08 | NoOp event emission | EventEmitter hooks in place, no handler | REQ-061, WebhookEventEmitter implemented in Phase 2 |
 | TD-09 | Passthrough safeguards | SafeguardHook hooks in place, no enforcement | REQ-044, swap to Presidio-based in Phase 2 |
 | TD-10 | No sparse embeddings | SparseEmbeddingProvider Protocol defined, not registered | ARCH-053, register FastEmbedBM25Provider or SPLADEProvider in Phase 2 |
 
@@ -2133,7 +2133,7 @@ Quality scenarios (QS-xx) define measurable targets. Validation scenarios ([vali
 | REQ-058 Content type detection | ARCH-042 Magic bytes | Reliable dispatch, mismatch warnings |
 | REQ-059 LLM graceful degradation | ARCH-043 Graceful degradation, ARCH-056 Retrieval quality | Fallback model, context-only response, no-relevant-context path |
 | REQ-060 QueryTrace | ARCH-041 Audit/analytics separation | Per-step RAG tracing, GDPR-safe |
-| REQ-061 EventEmitter | ARCH-038 EventEmitter interface | NoOp Phase 1, LogEventEmitter Phase 2 |
+| REQ-061 EventEmitter | ARCH-038 EventEmitter interface | NoOp Phase 1, WebhookEventEmitter Phase 2 |
 | REQ-062 ProviderRegistry | ARCH-039 ProviderRegistry pattern | Unified provider configuration |
 | REQ-063 Metadata filtering | ARCH-044 Chunk metadata filtering | JSONB + GIN index, SearchFilters in search() |
 | REQ-064 Zero-downtime reindex | ARCH-045 Index version | Atomic version switch, no downtime |
@@ -2218,4 +2218,4 @@ Quality scenarios (QS-xx) define measurable targets. Validation scenarios ([vali
 *Version 1.9 - Quality scenarios: Section 10 expanded from 12 to 18 QS entries, quality tree restructured, 6 architecture-derived scenarios added (ARCH-043 degradation, ARCH-057 startup, ARCH-039 extensibility, ARCH-040 evolvability, NFR-008 retention, NFR-010 progress), validation scenario cross-reference (10.4)*
 *Version 1.9.1 - Conversational query rewriting: ARCH-061 (pre-retrieval query rewriting in AdvancedQueryPipeline), ADR-0023, rewrite.j2 template added to ARCH-054, ARCH-036 Phase 2 updated. Multilingual embedding note added to ADR-0013.*
 *Version 1.10 - OQ-018/OQ-019 resolution: ARCH-062 (admin UI server-side rendering, ADR-0024), ARCH-063 (learn chatbot widget, ADR-0025), ARCH-064 (Phase 2 hardware target 8GB/4CPU). Glossary: HTMX added. Deferred table: 3 entries added.*
-*Version 2.0 - Phase 2 delivery annotations: all Phase 2 features marked as implemented (v0.2.0). Component table expanded with vektra-analytics and vektra-learn. Protocol implementations updated: QdrantVectorStoreProvider, UnstructuredExtractor, DualStrategyChunking, AdvancedQueryPipeline, FastEmbedBM25Provider, LogEventEmitter. WebhookEventEmitter deferred to Phase 3.*
+*Version 2.0 - Phase 2 delivery annotations: all Phase 2 features marked as implemented (v0.2.0). Component table expanded with vektra-analytics and vektra-learn. Protocol implementations updated: QdrantVectorStoreProvider, UnstructuredExtractor, DualStrategyChunking, AdvancedQueryPipeline, FastEmbedBM25Provider, WebhookEventEmitter. LogEventEmitter was originally scoped for Phase 2 but never built; the webhook path subsumed the use case.*
diff --git a/.s2s/plans/20260418-v050-widget-and-prof-config.md b/.s2s/plans/20260418-v050-widget-and-prof-config.md
new file mode 100644
index 00000000..78ed8bdd
--- /dev/null
+++ b/.s2s/plans/20260418-v050-widget-and-prof-config.md
@@ -0,0 +1,306 @@
+# Plan: v0.5.0 - Widget production-ready + instructor configuration
+
+**Status**: active
+**Plan ID**: 20260418-v050-widget-and-prof-config
+**Branch**: feat/v050-widget-and-prof-config
+**Created**: 2026-04-18T12:40:00Z
+**Updated**: 2026-04-18T12:40:00Z
+**Source**: v0.5.0 milestone scoping discussion (2026-04-18)
+**Source type**: milestone
+
+## Traceability
+
+- **Requirements**: REQ-049 (multi-turn conversations), REQ-053 (QueryPipeline Protocol), REQ-066 (no relevant context)
+- **Architecture**: ARCH-047 (namespace metadata as JSONB), ARCH-063 (widget architecture), ARCH-054 (composable prompt templates)
+- **Decisions**: ADR-0025 (learn chatbot widget as backend-served JS bundle), ADR-0020 (prompt template architecture), ADR-0010 (authentication gateway)
+- **Backlog items**: FEAT-016, FEAT-012, FEAT-004
+- **Related (deferred)**: FEAT-008 (per-namespace prompt templates), FEAT-014 (source visibility), FEAT-022 (suggested questions), FEAT-023 (socratic mode)
+- **Builds on**: FEAT-020 (grounding mode already reads from `namespaces.config`)
+- **Dependencies**: none (all infrastructure in place)
+
+## Overview
+
+v0.5.0 closes the gap between "widget works" (v0.4.0) and "widget is production-ready for real courses". Three user-visible gaps remain:
+
+1. **White-label** (FEAT-016): every course looks identical. Universities need their own title, color, welcome message.
+2. **Citation clarity** (FEAT-012): sources show `chunk_id` UUIDs — meaningless to students. Document filename must be shown.
+3. **Conversation persistence** (FEAT-004): refresh or accidental tab close loses the conversation. Unacceptable for courses where students ask follow-up questions.
+
+Plus one foundational backend addition: **instructor configuration API** — professors need to toggle grounding mode (strict/hybrid) per course from inside Moodle without admin intervention. The `namespaces.config` JSONB column and pipeline resolution already exist (FEAT-020); only the write API and the Moodle integration are missing.
+
+**Repositories touched**: vektra-stack (this plan), vektra-moodle (separate plan in the plugin repo).
+
+**Not in scope**: FEAT-022 (suggested questions), FEAT-023 (socratic mode), FEAT-014 (source visibility toggle), FEAT-008 (per-namespace prompt templates), full admin UI for namespace config. These are deliberately deferred.
+
+## Architecture decisions for this plan
+
+### Two-category configuration model
+
+All course customization splits cleanly into two categories, persisted in different places:
+
+| Category | Examples | Storage | Read by | Write path |
+|---|---|---|---|---|
+| **(A) Visual** | title, color, welcome message, icon | Moodle block config | Widget via `data-*` attrs | Moodle block edit form → stays in Moodle |
+| **(B) Behavioral** | `grounding_mode`, future `show_sources`, `top_k` override | `namespaces.config` JSONB | Vektra pipeline server-side | Moodle block edit form → AJAX → `PATCH /api/v1/namespaces/{id}/config` |
+
+Rationale: behavioral config must be server-enforced to prevent clients from bypassing (e.g., a browser can't be trusted to enforce strict mode). Visual config has no security implications and can stay in the host plugin.
+
+### Authentication model for namespace PATCH
+
+Same trust model already used for token generation (FEAT-003):
+
+1. Moodle plugin holds `VEKTRA_API_KEY` (admin scope) in its server-side PHP config.
+2. Moodle's native auth verifies "user X is a teacher of course Y" before showing/accepting the block edit form.
+3. When a teacher saves the form, Moodle PHP calls `PATCH /api/v1/namespaces/{course_id}/config` authenticated with the admin API key.
+4. Vektra does not know individual professors. It trusts the upstream auth (same philosophy as `VEKTRA_LEARN_REQUIRE_ENROLLMENT=false`).
+
+No new Vektra-side auth primitive needed. No "teacher scope" API key type to invent.
+
+### Conversation persistence: tab-scoped, no cross-device
+
+- Storage: `sessionStorage` keyed by `course_id` (tab-scoped per browser tab, wiped on tab close).
+- Not `localStorage`: shared computers in university labs must not leak conversations across students.
+- Not server-side "last conversation for this student": avoids privacy debate and keeps the widget stateless from Vektra's perspective (conversation turns are already persisted encrypted server-side per ADR-0011, this is just a UI convenience).
+- On load: if `sessionStorage[course_id]` has a `conversation_id`, widget fetches turns from `GET /api/v1/conversations/{id}/turns` and renders them before the user types.
+- "New chat" button: explicit reset (clears sessionStorage + DOM).
+
+## Work items
+
+### WI-1 - Backend: GET /api/v1/conversations/{id}/turns (JWT-scoped)
+
+FEAT-004 prerequisite. Admin equivalent already exists at `vektra-admin/src/vektra_admin/api.py:463`; this is the student-scoped mirror in `vektra-learn`.
+
+**Endpoint**:
+- Method: `GET`
+- Path: `/api/v1/conversations/{conversation_id}/turns`
+- Auth: JWT (learn dashboard token)
+- Path param: `conversation_id: UUID`
+- Response: `200 OK` with `{"turns": [{"turn_id": UUID, "question": str, "answer": str, "created_at": ISO8601, "sources": [...] }], "conversation_id": UUID, "namespace": str}`
+- Errors: `404` if conversation does not exist, `403` if JWT namespace does not match conversation namespace, `401` if JWT invalid/expired
+
+**Authorization rule**: the JWT contains `namespace` (or `course_id` fallback per FEAT-003). The endpoint MUST verify `conversation.namespace_id == jwt.namespace` before returning turns. This is the only authorization gate — we do not also check `student_id` because a student may legitimately reload a conversation started in a previous session with the same course.
+
+**Files**:
+- `vektra-learn/src/vektra_learn/api.py` - add endpoint
+- `vektra-learn/src/vektra_learn/models.py` - add `ConversationTurnsResponse` Pydantic model if not present
+- `vektra-core/src/vektra_core/conversations.py` (or wherever `conversation_turns` table is queried) - add `get_turns_by_conversation_id(conversation_id, namespace) -> list[Turn]` helper that decrypts `question` and `answer` via `pgp_sym_decrypt` (see CLAUDE.md DB investigation notes)
+- Tests: `vektra-learn/tests/test_conversations.py`
+
+**Decryption note**: `conversation_turns.question` and `conversation_turns.answer` are encrypted with `pgp_sym_encrypt()` using `VEKTRA_CONVERSATION_KEY`. The helper must decrypt before serializing. See `.claude/CLAUDE.md` → "Conversation turns are encrypted".
+
+**Test gates** (acceptance):
+- [ ] Valid JWT + matching namespace returns decrypted turns ordered by `created_at` ASC
+- [ ] Valid JWT + different namespace returns `403` (no data leak across courses)
+- [ ] Expired JWT returns `401`
+- [ ] Non-existent `conversation_id` returns `404`
+- [ ] Response includes `sources` field (even if empty array) so widget does not need a conditional render
+- [ ] Integration test uses a real Postgres (per `feedback_no_mock_database` memory)
+
+### WI-2 - Backend: document name in source citations (FEAT-012)
+
+Currently `SourceRef` returns `chunk_id` (UUID). Students see `[1] 4a2f3b... (0.82)`. They need to see the document name.
+
+**Data source**: `document_chunks.document_id` → `documents.source_file` (or `documents.title` if we want a human-friendlier field). The Qdrant payload also carries `source_file` per audit earlier.
+
+**Changes**:
+- Extend `SourceRef` schema to include `document_name: str` (derived from `documents.source_file`, fallback to `documents.id[:8]` if null)
+- Update the pipeline source assembly to fetch `source_file` from the document referenced by each chunk. Prefer a JOIN in the existing query over a second round-trip per chunk.
+- Widget change: render `[1] document_name (score)` instead of `[1] chunk_id (score)`. Tooltip on hover can keep the chunk UUID for debugging.
+
+**Files**:
+- `vektra-core/src/vektra_core/api.py` or `pipeline.py` - `SourceRef` schema + assembly
+- `vektra-learn/src/vektra_learn/query.py` - ensure the field passes through to the learn response
+- `vektra-learn/widget/src/chat-ui.js` (or wherever sources render) - use `document_name`
+- Tests: both backend (pipeline returns document_name) and widget (renders correctly)
+
+**Edge cases**:
+- Document soft-deleted (REQ-057): still render the name, append " (archived)" marker. Do NOT hide the citation — it must match what was retrieved.
+- Document name with special chars (e.g., emoji, Italian accents): must survive JSON round-trip. Widget uses `textContent`, not `innerHTML`, for the citation label.
+
+**Test gates**:
+- [ ] `/api/v1/query` response includes `document_name` for each source
+- [ ] `/api/v1/learn/query` response propagates the field
+- [ ] Widget displays `[1] <name> (<score>)` — no UUID visible in normal UI
+- [ ] Falls back gracefully if `source_file` is null
+
+### WI-3 - Backend: PATCH /api/v1/namespaces/{id}/config (instructor config)
+
+Foundation for category (B) config. Writes into the existing `namespaces.config` JSONB column. Read path already exists (`resolve_grounding_mode` at `vektra-shared/src/vektra_shared/namespace.py:19`).
+
+**Endpoint**:
+- Method: `PATCH`
+- Path: `/api/v1/namespaces/{namespace_id}/config`
+- Auth: admin API key (via `require_admin` dependency pattern already used elsewhere)
+- Body: `{"grounding_mode": "strict" | "hybrid" | null}` (null = unset, falls back to env var). Explicitly allow partial updates — only keys present in the body are updated, others are preserved. Unknown keys rejected with `400`.
+- Response: `200 OK` with the current full `config` object after merge
+- Errors: `404` if namespace does not exist, `400` if value invalid (not in enum), `401`/`403` for auth
+
+**Design choice — allowed keys**:
+Keep the whitelist tight. For v0.5.0, only `grounding_mode` is a valid key. Adding more keys is a later patch-release change. The endpoint must reject unknown keys (not silently ignore) so that typos from the Moodle plugin surface immediately during development.
+
+```python
+ALLOWED_CONFIG_KEYS = {"grounding_mode"}  # extend cautiously; each key is a public contract
+ALLOWED_GROUNDING_MODES = {"strict", "hybrid"}
+```
+
+**Files**:
+- `vektra-admin/src/vektra_admin/api.py` (namespace routes already live here) - add PATCH
+- `vektra-admin/src/vektra_admin/service.py` (or similar) - `update_namespace_config(namespace_id, partial_config) -> dict`
+- Tests: `vektra-admin/tests/test_namespaces.py`
+
+**Why admin API (not a new "teacher" scope)**: Moodle acts as the trusted upstream (see "Authentication model" above). Inventing a new scope here adds complexity without benefit — Moodle's admin key is already stored server-side and never reaches the browser.
+
+**Test gates**:
+- [ ] PATCH with `{"grounding_mode": "hybrid"}` updates the value in `namespaces.config`
+- [ ] Subsequent query to that namespace uses hybrid mode (end-to-end: write → resolve → pipeline)
+- [ ] PATCH with unknown key returns `400` with the rejected key name
+- [ ] PATCH with invalid value (e.g., `"grounding_mode": "banana"`) returns `400`
+- [ ] PATCH with `null` value for a key removes it from config (fallback to env var)
+- [ ] PATCH is partial: existing keys not in the body are preserved
+- [ ] Non-admin API key returns `403`
+
+### WI-4 - Widget: white-label data-attrs (FEAT-016)
+
+Client-side only. Read additional `data-*` attributes from the script tag, expose them as CSS custom properties + template values.
+
+**New data-* attributes**:
+
+| Attribute | Default | Applied to |
+|---|---|---|
+| `data-title` | "Course Assistant" / i18n | Chat panel header |
+| `data-primary-color` | `#2563eb` | Button, links, accents (as `--vektra-primary` CSS var) |
+| `data-icon` | speech bubble emoji | Floating button icon (URL or emoji) |
+| `data-welcome-message` | (none) | First assistant message on open |
+| `data-powered-by` | "true" | If "false", hide "Powered by Vektra" footer |
+
+**Files**:
+- `vektra-learn/widget/src/index.js` - parse new attributes in the constructor
+- `vektra-learn/widget/src/styles.js` - replace hardcoded `#2563eb` with `var(--vektra-primary, #2563eb)`
+- `vektra-learn/widget/src/chat-ui.js` - render title from config, inject welcome message on first open
+- Tests: `vektra-learn/widget/tests/` - verify each attribute changes the rendered output, missing attributes fall back to defaults
+
+**Fallback chain** (consistent with FEAT-016 backlog spec): `data-* attribute > hardcoded default`. Namespace metadata override is deferred to a later release (would require category-B endpoint extension, not worth it for visual fields).
+
+**Test gates**:
+- [ ] Each `data-*` attribute individually changes the widget output
+- [ ] Missing attributes fall back to current v0.4.0 defaults (no breaking change for existing Moodle installs)
+- [ ] Light/dark theme still works when `data-primary-color` is set
+- [ ] `data-icon` accepts both emoji and URL; URL shows image, emoji shows text
+- [ ] XSS: `data-title` with `<script>` injected is rendered as text (verify via `textContent`, not `innerHTML`)
+
+### WI-5 - Widget: conversation persistence (FEAT-004)
+
+Consumes WI-1 endpoint. Client-side logic for `sessionStorage` + history reload + "New chat" button.
+
+**Storage schema**:
+```js
+sessionStorage[`vektra-conv-${courseId}`] = JSON.stringify({
+  conversation_id: "...",
+  created_at: "2026-04-18T..."  // for optional stale-after-N-hours cleanup
+});
+```
+
+**Lifecycle**:
+- On widget init: read sessionStorage for this `course_id`. If present and not stale (configurable TTL, default 24h), call `GET /conversations/{id}/turns` and render them before enabling input.
+- On each successful query response: persist `conversation_id` (comes back in the response / SSE `done` event).
+- On "New chat" button: clear sessionStorage entry, clear DOM, reset `_conversationId`.
+- On `404` from turns endpoint (conversation deleted server-side): clear sessionStorage, start fresh, do not show error to user.
+- On `403`: log and start fresh (likely namespace mismatch after course change).
+
+**Token expiry and conversation continuity**: the existing `onTokenExpired` callback (FEAT-009) already handles transparent token refresh. Conversation ID is independent of JWT — it survives a refresh. This is the correct behavior.
+
+**Idle timeout**: deferred. Do not auto-reset conversations after N minutes. Sessions in university contexts may include long reading breaks; forcing a new conversation frustrates follow-up questions.
+
+**Files**:
+- `vektra-learn/widget/src/index.js` - init-time history restore, persistence hook
+- `vektra-learn/widget/src/chat-ui.js` - "New chat" button in header, message replay renderer
+- `vektra-learn/widget/src/api-client.js` - `getConversationTurns(id)` method
+
+**Test gates**:
+- [ ] After sending a message and refreshing the page, the message history reappears
+- [ ] Closing the tab and reopening loses the history (sessionStorage is tab-scoped — expected)
+- [ ] "New chat" button resets conversation_id and DOM
+- [ ] Different `course_id` on the same tab does NOT share history (keyed by course)
+- [ ] `403` response triggers silent reset, not error UI
+- [ ] History replay renders assistant messages with Markdown (FEAT-007 already in place) and sources (FEAT-012)
+
+## Implementation order
+
+Strict ordering to minimize rework:
+
+1. **WI-3** first (PATCH /namespaces/config). Foundation. Also the easiest to test standalone.
+2. **WI-2** (document name). Independent of WI-3. Small backend change, small widget change.
+3. **WI-1** (GET turns endpoint). Prerequisite for WI-5.
+4. **WI-4** (data-attrs). Independent of backend work. Can be done in parallel with WI-1/2/3 if convenient but not required.
+5. **WI-5** (conversation persistence widget). Last, depends on WI-1. Also benefits from WI-2 being done (so replayed history shows document names, not UUIDs).
+
+Each WI gets its own commit (Conventional Commits) on the `feat/v050-widget-and-prof-config` branch. Do not squash during development; squash-or-merge is a PR-time decision.
+
+## Handoff to vektra-moodle
+
+A sibling plan lives in `vektra-moodle` covering:
+
+- Block edit form with two sections (visual / behavioral) that separate category (A) data-attrs from category (B) namespace config
+- AJAX endpoint `/blocks/vektra/save_config.php` that receives the form, validates teacher auth, and fans out:
+  - Visual fields → persisted as block instance config (Moodle native)
+  - Behavioral fields → POST to `PATCH /api/v1/namespaces/{course_id}/config` with stored admin API key
+- AJAX endpoint `/blocks/vektra/refresh_token.php` for FEAT-009 (if not yet implemented)
+- Page render: read block config, emit `<script data-title="..." data-primary-color="..." ...>` on each course page
+
+Vektra-stack plan (this file) is independent and can be completed and merged before the Moodle work starts. The widget's data-attr contract is stable (ADR-0025); Moodle consumes it.
+
+## Test strategy
+
+Three layers:
+
+1. **Unit tests**: each WI has its own. Backend uses pytest + real Postgres (per the `feedback_no_mock_database` memory — do NOT mock the DB). Widget uses the existing Jest-like setup.
+2. **Integration tests**: extend `tests/integration/` with a flow that:
+   - Creates a namespace
+   - PATCHes `grounding_mode=hybrid`
+   - Runs a query against a namespace with no ingested content
+   - Asserts the response is non-null (hybrid fallback engaged) — proves end-to-end persistence → read path works
+3. **Manual smoke test before PR** (documented in PR description):
+   - Kalypso Docker stack up, Moodle + Vektra reachable
+   - Open a course page with the widget
+   - Set a custom title + color via data-attrs (hardcoded in test Moodle block for now)
+   - Send a message, refresh, verify history returns
+   - Click "New chat", verify reset
+   - Manually PATCH namespace to hybrid, ask an off-topic question, verify hybrid behavior kicks in
+
+Lint/test gate per `feedback_lint_before_push`: `make lint && make test` must pass before any push.
+
+## Risks and mitigations
+
+| Risk | Mitigation |
+|---|---|
+| GET /conversations/turns decryption key unavailable in vektra-learn container | Keys loaded from same env var (`VEKTRA_CONVERSATION_KEY`) already used by core — single source of truth. Verify in startup check. |
+| `namespaces.config` overwrite: concurrent PATCH from two professor edits races | Out of scope for v0.5.0 — last-write-wins is acceptable for instructor config. Add row-level locking if seen in practice. |
+| Widget `sessionStorage` quota exhaustion on public computers | Quota is ~5MB per origin; storing only conversation_id + timestamp is a few hundred bytes. Not a realistic concern. |
+| XSS via `data-title` or `data-welcome-message` | All data-attrs rendered via `textContent`, never `innerHTML`. Add explicit test case. |
+| Decrypted conversation history exposed to wrong student via bad JWT scoping | Enforce `conversation.namespace_id == jwt.namespace` check + integration test that asserts 403 on mismatch. |
+
+## Acceptance criteria (aggregate)
+
+Plan is complete when:
+- [ ] All 5 WIs merged to `feat/v050-widget-and-prof-config` (one commit per WI)
+- [ ] `make lint && make test` pass
+- [ ] Integration test for PATCH → hybrid query flow passes
+- [ ] Manual smoke test checklist executed and documented
+- [ ] Backlog statuses updated: FEAT-016, FEAT-012, FEAT-004 → completed; add new FEAT for "instructor namespace config API" if we want explicit tracking separate from FEAT-008
+- [ ] vektra-moodle sibling plan referenced
+- [ ] CHANGELOG.md updated with v0.5.0 section
+- [ ] Version bumped to `0.5.0` in `pyproject.toml` and wherever else
+
+## Integration and deployment notes
+
+- No DB migration needed: `namespaces.config` column already exists.
+- No new environment variables: all config flows through the existing admin API key.
+- No new dependencies in `pyproject.toml`.
+- Widget bundle size may grow ~1-2KB for data-attr parsing + history replay; acceptable (ADR-0025 sets no hard limit).
+- Moodle plugin release is independent — v0.5.0 of vektra-stack works unchanged for a Moodle plugin still on v0.4.0 (all new data-attrs fall back gracefully, all new endpoints return 404 cleanly if the plugin does not call them).
+
+## Next actions
+
+1. Confirm this plan covers the intent (especially: WI-1/2/3 backend endpoints as specified, no hidden surprises).
+2. Start WI-3 (PATCH endpoint) as the first implementation task.
+3. Create corresponding plan in vektra-moodle repo before touching that codebase.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c679a36..586d5e46 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,86 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+<!--
+Convention (Keep a Changelog 1.1.0):
+- Add new entries under "[Unreleased]" using sections: Added, Changed,
+  Deprecated, Removed, Fixed, Security.
+- At release time: rename "[Unreleased]" to "[X.Y.Z] - YYYY-MM-DD" AND
+  add a fresh empty "[Unreleased]" block above it. The file must always
+  have an "[Unreleased]" section at the top, even if empty.
+- Releases are listed newest-first below "[Unreleased]".
+- See CONTRIBUTING.md > Changelog for the full process.
+-->
+
+## [Unreleased]
+
+<!-- Add entries under: Added, Changed, Deprecated, Removed, Fixed, Security -->
+
+## [0.5.0] - 2026-04-27
+
+Widget production-ready + instructor configuration.
+
+### Added
+
+- **vektra-admin**: `PATCH /api/v1/admin/namespaces/{id}/config` endpoint for instructor configuration. Admin-scoped, whitelisted (v0.5.0 accepts `grounding_mode` and `show_sources`), partial updates, null removes a key. Backs the Moodle block form that lets teachers toggle strict/hybrid RAG and source-citation visibility per course without admin intervention.
+- **vektra-learn / widget**: configurable source citation visibility (FEAT-014). Resolution chain: `data-show-sources` attribute (client override) > `namespaces.config.show_sources` (per-course) > `VEKTRA_LEARN_SHOW_SOURCES` env var > default `true`. The learn query response (both JSON and the SSE `sources` event) now carries a `show_sources` flag the widget uses to decide whether to render the citations section. The API always returns the full sources list so analytics and QueryTrace keep complete data.
+- **vektra-admin**: `GET /api/v1/admin/namespaces/{id}/config` symmetric to the PATCH. Returns `{namespace_id, config: <stored JSONB>, resolved: <effective after env defaults>}`. The `resolved` block is what the upstream plugin form (e.g. Moodle block edit) needs to render the "Use default" / "Override" toggle without re-implementing the fallback chain.
+- **vektra-learn**: `GET /api/v1/learn/conversations/{id}/turns` JWT-scoped endpoint so the widget can restore a conversation after a page reload. Returns decrypted question/answer + created_at; admin-only metadata is not exposed. 403 on namespace mismatch, 404 on missing.
+- **vektra-core**: `document_name` field on every source citation, joined from `source_documents.filename` so the widget renders `[1] lecture-07.pdf` instead of chunk UUIDs. Propagates through both `SimpleQueryPipeline` and `AdvancedQueryPipeline`, JSON and SSE paths. Soft-deleted source documents (REQ-057) keep their citation with an `(archived)` suffix so answers stay traceable.
+- **vektra-learn**: content-access audit entry (`learn_conversation_turns_read`) written on every successful turns fetch via the shared `vektra_shared.audit` interface (NFR-007).
+- **widget**: white-label `data-*` attributes — `data-title`, `data-primary-color`, `data-icon` (emoji or URL), `data-welcome-message`, `data-powered-by`, `data-powered-by-text`, `data-powered-by-url`. All rendered via `textContent` / safe color whitelist to avoid XSS.
+- **widget**: tab-scoped conversation persistence via `sessionStorage` keyed by `course_id` (24h cutoff); history replay on load via the new turns endpoint; explicit "New chat" button in the header.
+- **errors**: new codes `ERR-ADMIN-005/006/007` (namespace config) and `ERR-LEARN-005/006` (conversation turns).
+- **docs**: consolidated [Widget integration guide](docs/guides/widget-integration.md) covering the LMS-agnostic embed flow (server-side JWT issuance, all `data-*` attributes, conversation persistence, token refresh, source citation visibility, error states, and end-to-end examples for PHP and Python backends). Linked from `docs/README.md` under Guides.
+
+### Changed
+
+- **User-facing branding**: README, top-level docs h1s, and external surfaces now use **Vektra RAG** as the product name. Coordinated with [vektralabs/vektra-moodle#14](https://github.com/vektralabs/vektra-moodle/pull/14) which renames its README h1 to "Vektra RAG for Moodle". Repo name (`vektra-stack`), Python package names (`vektra_*`), Docker images, container names, CLI commands, and internal code identifiers are unchanged.
+- **widget footer label**: default "Powered by" link text changed from "Vektra" to "VektraLabs" — clearer maintainer-credit pattern (the link points to vektralabs.github.io, the org landing page) and avoids the residual short form. Integrators using the default branding will see the new label after upgrading the bundle; custom `data-powered-by-text` overrides are unaffected.
+- **widget styles**: button and accent colors now use `var(--vektra-primary, …)` so `data-primary-color` takes effect without rebuilding the bundle. Hover states use `filter: brightness()` so custom colors still feel interactive.
+- **widget primary-color scope (DEBT-018)**: the `--vektra-primary` override is now scoped to widget roots (`.vektra-chat-btn, .vektra-chat-panel`) instead of `:root`, so it no longer clobbers any unrelated `--vektra-primary` declarations on the host page. Repeated widget initialization reuses a single `<style id="vektra-primary-override">` node instead of accumulating duplicates (multi-instance / hot-reload safety).
+
+### Fixed
+
+- **audit log fallback (DEBT-020, NFR-007)**: sensitive admin, learn, and ingest endpoints now always write an audit row, even if the request-id middleware doesn't populate `request.state.request_id`. Each component declares a private `_resolve_request_id` helper that synthesizes a `uuid4()` fallback and emits a structlog warning so middleware misconfiguration is observable. Applied to `POST /api-keys`, `DELETE /api-keys/{id}`, `PATCH /admin/namespaces/{id}/config`, `GET /admin/conversations/{id}/turns`, `GET /api/v1/learn/conversations/{id}/turns`, and the vektra-ingest async + direct audit writers (used by `POST /api/v1/ingest`, batch ingest, deletion). Previous code skipped the audit silently when `request_id` was missing.
+- **test fakes**: renamed `self_inner` to `self` in nested `_FakeResult` / `_FakeSession` helpers inside `test_fetch_document_names_marks_archived` (style consistency with PEP 8; no behaviour change).
+
+### Security
+
+- **deps**: bumped `litellm` from `>=1.40,<1.82.7` to `>=1.83.10,<1.83.11` — closes 2 critical CVEs (authentication bypass via OIDC userinfo cache key collision) and several high-severity findings (authenticated command execution via MCP stdio test endpoints, SSTI in `/prompts/test`).
+- **deps-dev**: bumped `pytest` from `>=8.0` to `>=9.0.3` (full test suite green on the new major version).
+- **deps-dev**: bumped widget `esbuild` from `^0.24` to `^0.25`.
+
+## [0.4.0] - 2026-04-11
+
+QueryTrace observability, eval harness, widget polish, and prompt hardening.
+
+### Added
+
+- **vektra-core**: configurable prompt grounding mode (FEAT-020, DEBT-016). `VEKTRA_PROMPT_GROUNDING_MODE=strict` (default) keeps the LLM tied to retrieved context + history; `hybrid` allows confident fallback to model knowledge. Foundation for the per-namespace override added in v0.5.0.
+- **vektra-core**: multilingual reranker upgrade (BUG-016, DEBT-010). Default reranker switched to `BAAI/bge-reranker-v2-m3` with a lower score threshold so non-English queries are no longer over-filtered.
+- **vektra-core**: `QueryTrace` persistence and an admin `GET /api/v1/admin/conversations/{id}/turns` endpoint (BUG-013, DEBT-011). Reranker scores, eval-mode metadata, and streaming model name are now captured in traces; gaps in the streaming path closed.
+- **vektra-learn**: SSE streaming in the learn query endpoint (FEAT-010). The `done` event now carries `conversation_id` so the widget keeps multi-turn continuity across SSE responses (BUG-018).
+- **widget**: Markdown rendering for assistant messages (FEAT-007), with code-block, list, and inline formatting; raw HTML stays sanitized.
+- **widget**: token auto-refresh on 401 (FEAT-009) via either an `onTokenExpired` callback or a `data-token-refresh-url` endpoint.
+- **widget**: API connectivity check and visible error feedback (FEAT-006) when the backend is unreachable.
+- **eval**: retrieval and end-to-end evaluation harness (TECH-002), plus a curated 55-question bilingual EN/IT evaluation dataset.
+- **config**: `VEKTRA_LLM_CONTEXT_WINDOW` propagation through `VektraSettings`, `VEKTRA_LLM_API_KEY` wired to litellm, and `VEKTRA_LLM_EXTRA_BODY` support for vLLM thinking-mode flags.
+
+### Fixed
+
+- **vektra-core**: warn (not crash) when `VEKTRA_LLM_CONTEXT_WINDOW` is unset for a model litellm does not know, falling back to 4096 (BUG-017).
+- **vektra-core**: conversation row now created before the first turn is persisted (BUG-014).
+- **vektra-core**: reranker scores propagated to `SearchResult` so observability and analytics see the post-rerank ranking (BUG-015).
+- **vektra-core**: register the conversation store in `ProviderRegistry` so dependent endpoints can resolve it.
+- **vektra-core**: distinguish "safeguard blocked" from "no relevant context" in the response so callers can tell apart a refusal from an empty result.
+- **vektra-core**: system prompt iteratively hardened to stop the LLM from leaking RAG internals (chunk IDs, scores, role names) in any language.
+- **vektra-learn**: audit logging on the conversation turns endpoint (NFR-007) was missing in the initial v0.4.0 release-review build.
+- **config**: `grounding_mode` validator added to `VektraSettings` so invalid values fail fast at startup.
+- **widget**: streaming token newlines and code-block formatting; centralized input-disabled state across sending and connection events; `<p>` no longer wraps inside `<code>` blocks.
+- **build**: removed redundant `uv sync` when `INSTALL_UNSTRUCTURED=true`; eliminated all `uv pip install` invocations outside the lockfile to harden the supply chain.
+- **CI**: latency measurement skipped on PR runs (post-merge only); perf-measurement queries reduced from 100 to 20 to keep workflow time bounded.
+
 ## [0.3.0] - 2026-03-21
 
 E-learning vertical refinements, widget UX improvements, and Phase 2 stabilization.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index def6de73..6c1353f6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,4 +1,4 @@
-# Contributing to Vektra
+# Contributing to Vektra RAG
 
 ## Quick start
 
@@ -124,6 +124,31 @@ git log --show-signature -1   # should show "Good ssh signature"
 **Remote servers without browser**: use `gh auth login --with-token` and add the
 `admin:ssh_signing_key` scope upfront to avoid needing browser-based re-auth later.
 
+## Changelog
+
+We follow [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/). The
+file must always have an `[Unreleased]` section at the top, even if empty.
+
+**During development** — every PR with user-visible impact adds an entry under
+`[Unreleased]` in `CHANGELOG.md`, using one of the six standard sections:
+
+- **Added** — new features
+- **Changed** — changes in existing functionality
+- **Deprecated** — features that will be removed in upcoming releases
+- **Removed** — features removed in this release
+- **Fixed** — bug fixes
+- **Security** — vulnerability fixes
+
+Internal-only changes (refactors with no behavior change, CI tweaks, test-only
+edits) do not require a changelog entry.
+
+**At release time** — in the release-prep PR (`chore/vX.Y.Z-release`):
+
+1. Rename `## [Unreleased]` to `## [X.Y.Z] - YYYY-MM-DD`
+2. Add a fresh empty `## [Unreleased]` block above the new release entry
+3. Bump versions in all `vektra-*/pyproject.toml` from `X.Y.Z-dev` to `X.Y.Z`
+4. Refresh `uv.lock` to match the new versions
+
 ## PR workflow
 
 1. Create a branch: `git checkout -b feat/core-streaming`
@@ -148,6 +173,7 @@ Before opening a PR:
 - [ ] Unit tests pass: `uv run pytest <component>/tests/ -m "not integration"`
 - [ ] New behavior has test coverage
 - [ ] Commit messages follow Conventional Commits with `-s` sign-off
+- [ ] `CHANGELOG.md` has an `[Unreleased]` entry for any user-visible change
 - [ ] PR description explains the change and motivation
 
 ## CI pipeline
diff --git a/GOVERNANCE.md b/GOVERNANCE.md
index 2b28ba43..5cbebf7a 100644
--- a/GOVERNANCE.md
+++ b/GOVERNANCE.md
@@ -1,4 +1,4 @@
-# Vektra Governance
+# Vektra RAG Governance
 
 This document describes the governance model for the Vektra project.
 
diff --git a/README.md b/README.md
index 23722091..cc2ccf8f 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# Vektra
+# Vektra RAG
 
 [![CI](https://github.com/vektralabs/vektra-stack/actions/workflows/ci-unit.yml/badge.svg?branch=main)](https://github.com/vektralabs/vektra-stack/actions/workflows/ci-unit.yml)
 [![Lint](https://github.com/vektralabs/vektra-stack/actions/workflows/lint.yml/badge.svg?branch=main)](https://github.com/vektralabs/vektra-stack/actions/workflows/lint.yml)
@@ -19,8 +19,8 @@ Plug in any LLM provider, vector store, or pipeline, keep data on-premises, and
 
 Unlike RAG toolkits (LangChain, LlamaIndex, Haystack), Vektra ships as a **deployable platform**:
 
-| Aspect | Toolkits | Vektra |
-|--------|----------|--------|
+| Aspect | Toolkits | Vektra RAG |
+|--------|----------|------------|
 | Deployment | Build your own | `docker compose up` |
 | Configuration | Code changes | YAML/environment |
 | On-premises | DIY | First-class support |
@@ -46,12 +46,14 @@ Vektra uses a hybrid monorepo approach ([ADR-0001](.s2s/decisions/ADR-0001-hybri
 
 ```text
 vektra-stack/              # This repository (monorepo)
-├── vektra-core/           # RAG engine, LLM abstraction
+├── vektra-app/            # FastAPI entrypoint, startup validation, middleware
+├── vektra-shared/         # Protocols, types, config, auth, registry
+├── vektra-core/           # RAG engine, LLM abstraction, conversations
 ├── vektra-ingest/         # Document processing (PDF, OCR, PPT, Word)
 ├── vektra-index/          # Vector store abstraction, embedding
-├── vektra-analytics/      # Metrics, reporting, alerting
-├── vektra-learn/          # E-learning vertical (chatbot, dashboard)
-├── vektra-admin/          # System administration
+├── vektra-analytics/      # QueryTrace storage, metrics, reporting
+├── vektra-learn/          # E-learning vertical (chatbot widget, JWT-scoped API)
+├── vektra-admin/          # System administration (health, keys, namespace config)
 ├── docs/                  # Documentation
 └── docker-compose.yml     # Orchestration
 
@@ -110,4 +112,4 @@ Apache License 2.0. See [LICENSE](LICENSE) for details.
 
 ---
 
-**Vektra** is maintained by [VektraLabs](https://github.com/vektralabs).
+**Vektra RAG** is maintained by [VektraLabs](https://github.com/vektralabs).
diff --git a/ROADMAP.md b/ROADMAP.md
index ce1e925f..72789ab2 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,4 +1,4 @@
-# Vektra Roadmap
+# Vektra RAG Roadmap
 
 This document outlines the phased development plan for Vektra.
 
diff --git a/docs/README.md b/docs/README.md
index fddb8ab2..bec982ab 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,4 +1,4 @@
-# Vektra documentation
+# Vektra RAG documentation
 
 ## Getting started
 
@@ -8,7 +8,7 @@
 ## Reference
 
 - [API reference](reference/api.md) - all endpoints with curl examples
-- [Configuration](reference/configuration.md) - 40 environment variables with defaults
+- [Configuration](reference/configuration.md) - 64 environment variables with defaults
 - [Error codes](reference/error-codes.md) - error response codes and remediation
 
 ## Architecture
@@ -17,6 +17,7 @@
 
 ## Guides
 
+- [Widget integration](guides/widget-integration.md) - embed the LMS-agnostic chatbot widget in any course page (data-* attributes, JWT flow, conversation persistence, token refresh)
 - [Contributors](guides/contributors/index.md) - dev setup, testing, extending providers
 
 ## Workflows
diff --git a/docs/architecture/index.md b/docs/architecture/index.md
index a1a5f129..0700893f 100644
--- a/docs/architecture/index.md
+++ b/docs/architecture/index.md
@@ -8,8 +8,10 @@ Vektra is a modular monolith: a single deployable container with internal packag
 vektra-app          Application entrypoint, startup validation, middleware
   vektra-core       RAG query pipeline, LLM abstraction, conversations
   vektra-ingest     Document processing (PDF, DOCX, PPTX), chunking, async jobs
-  vektra-index      Vector store (pgvector), embedding, semantic search
-  vektra-admin      Health endpoints, API key management, audit logging
+  vektra-index      Vector store (pgvector / qdrant), embedding, semantic search
+  vektra-analytics  QueryTrace storage, metrics aggregation, reporting (Phase 2)
+  vektra-learn      E-learning vertical: LMS-agnostic API and chatbot widget (Phase 2)
+  vektra-admin      Health endpoints, API key management, namespace config, audit logging
   vektra-shared     Protocols, types, config, auth, ProviderRegistry
 ```
 
@@ -31,8 +33,8 @@ Optional profiles:
 
 Architecture documentation is maintained in the `.s2s/` directory:
 
-- [`.s2s/architecture.md`](../../.s2s/architecture.md) - arc42 architecture document (60 decisions, 9 Protocol interfaces)
-- [`.s2s/decisions/`](../../.s2s/decisions/) - Architecture Decision Records (ADR-0001 through ADR-0023)
+- [`.s2s/architecture.md`](../../.s2s/architecture.md) - arc42 architecture document (64 decisions, 9 Protocol interfaces)
+- [`.s2s/decisions/`](../../.s2s/decisions/) - Architecture Decision Records (ADR-0001 through ADR-0025)
 - [`.s2s/requirements.md`](../../.s2s/requirements.md) - Software Requirements Specification (61 REQs, 13 NFRs)
 
 ### Key decisions
@@ -47,30 +49,38 @@ Architecture documentation is maintained in the `.s2s/` directory:
 | [ADR-0013](../../.s2s/decisions/ADR-0013-embedding-provider-protocol.md) | EmbeddingProvider Protocol |
 | [ADR-0014](../../.s2s/decisions/ADR-0014-query-pipeline-abstraction.md) | QueryPipeline abstraction |
 | [ADR-0022](../../.s2s/decisions/ADR-0022-orm-sqlalchemy-async.md) | SQLAlchemy 2.0 async with asyncpg |
+| [ADR-0023](../../.s2s/decisions/ADR-0023-conversational-query-rewriting.md) | Conversational query rewriting (Phase 2) |
+| [ADR-0024](../../.s2s/decisions/ADR-0024-admin-ui-server-side.md) | Admin UI with server-side rendering (Phase 2: HTMX + Jinja2) |
+| [ADR-0025](../../.s2s/decisions/ADR-0025-learn-chatbot-widget.md) | Learn chatbot widget as backend-served JS bundle |
 
 ### Protocol interfaces
 
 Vektra defines 9 Protocol interfaces in `vektra_shared` for pluggability:
 
-1. **LLMProvider** - multi-provider LLM abstraction with graceful degradation
-2. **EmbeddingProvider** - embedding generation (sentence-transformers in Phase 1)
-3. **SparseEmbeddingProvider** - sparse vectors for hybrid search (Phase 2)
-4. **VectorStoreProvider** - pluggable vector store (pgvector in Phase 1)
-5. **DocumentExtractor** - PDF, DOCX, PPTX extraction
-6. **ChunkingStrategy** - document chunking (fixed-size in Phase 1)
-7. **QueryPipeline** - RAG pipeline orchestration
-8. **SafeguardHook** - pre/post query safeguards
-9. **EventEmitter** - internal event hooks (no-op in Phase 1)
+1. **LLMProvider** - multi-provider LLM abstraction (litellm) with graceful degradation to fallback model and context-only mode.
+2. **EmbeddingProvider** - dense embedding generation. Default: `sentence-transformers` with `paraphrase-multilingual-MiniLM-L12-v2`.
+3. **SparseEmbeddingProvider** - sparse vectors for hybrid search. Phase 1: not registered. Phase 2: `FastEmbedBM25Provider` via `fastembed`.
+4. **VectorStoreProvider** - pluggable vector store with `SearchMode` enum (DENSE/SPARSE/HYBRID). Phase 1: pgvector. Phase 2: also Qdrant with native hybrid search.
+5. **DocumentExtractor** - PDF, DOCX, PPTX extraction. Phase 1: pdfplumber. Phase 2: also Unstructured (opt-in, adds OCR).
+6. **ChunkingStrategy** - document chunking. Phase 1: fixed-size. Phase 2: also dual-strategy (semantic + table preservation).
+7. **QueryPipeline** - RAG pipeline orchestration returning `QueryResponse` + `QueryTrace`. Phase 1: SimpleQueryPipeline. Phase 2: AdvancedQueryPipeline (query rewriting, reranking, hybrid retrieval).
+8. **SafeguardHook** - pre/post query safeguards at the three trust boundaries. Phase 1: passthrough. Phase 2: also Presidio (PII detection with content modification, ARCH-049).
+9. **EventEmitter** - internal event hooks. Phase 1: NoOpEventEmitter. Phase 2: WebhookEventEmitter (HMAC-SHA256 signed HTTP POST, activated via `VEKTRA_WEBHOOK_URL`).
 
 ### Startup validation
 
-The application runs an 8-step validation sequence at startup (ARCH-057):
+The application runs an 11-step validation sequence at startup (ARCH-057). Source of truth: `vektra-app/src/vektra_app/main.py:lifespan`.
 
-1. Configuration validation (Pydantic)
+1. Configuration validation: instantiate the flat `VektraSettings` aggregation. Sub-configs (`RewriteConfig`, `RerankConfig`, `WebhookConfig`) are validated independently by their consumers, not at this step.
 2. Database connectivity
 3. Database schema verification
 4. pgvector extension check
-5. Provider registration
+5. Provider registration (LLM, embedding, sparse embedding, vector store, safeguard, event emitter, key store, conversation store, analytics service, learn service)
 6. Embedding model warmup
 7. LLM connectivity check (warning-only)
-8. Prompt template verification
+8. Prompt template loading
+9. Analytics check: verify `AnalyticsService` is registered in `ProviderRegistry` (registration check only; no storage I/O).
+10. Learn check: when `VEKTRA_LEARN_JWT_SECRET` is set, verify a `LearnService` is registered (instantiation happens in step 5) and that the secret is at least 32 characters. Skipped when learn is not configured.
+11. Qdrant collection check (when `vector_store_provider=qdrant`)
+
+Steps 9–11 were added in Phase 2 to cover the analytics, e-learning, and hybrid-search features.
diff --git a/docs/getting-started/first-query.md b/docs/getting-started/first-query.md
index a51f5e8a..26ce1f65 100644
--- a/docs/getting-started/first-query.md
+++ b/docs/getting-started/first-query.md
@@ -79,7 +79,8 @@ scripts/query.sh "Summarize the main findings"
             "score": 0.912,
             "snippet": "Finding 1: The study reveals that...",
             "citation_id": "e5f6a7-...",
-            "document_version": 1
+            "document_version": 1,
+            "document_name": "your-document.pdf"
         },
         {
             "doc_id": "a1b2c3d4-...",
@@ -87,7 +88,8 @@ scripts/query.sh "Summarize the main findings"
             "score": 0.847,
             "snippet": "Finding 2: In contrast to previous work...",
             "citation_id": "b8c9d0-...",
-            "document_version": 1
+            "document_version": 1,
+            "document_name": "your-document.pdf"
         }
     ],
     "conversation_id": null,
@@ -105,6 +107,7 @@ scripts/query.sh "Summarize the main findings"
 | `sources[].chunk_id` | Unique identifier of the retrieved chunk |
 | `sources[].citation_id` | UUID citation reference for traceability |
 | `sources[].document_version` | Index version of the chunk |
+| `sources[].document_name` | Filename of the source document, or `null` when the document join returns no row. Soft-deleted documents keep their citation with an `(archived)` suffix so traceability is preserved. |
 | `sources[].score` | Cosine similarity score (0.0 - 1.0, higher is more relevant) |
 | `sources[].snippet` | Text excerpt from the chunk |
 | `conversation_id` | Echoed back if provided in the request (see below) |
diff --git a/docs/guides/contributors/index.md b/docs/guides/contributors/index.md
index ea2035fd..c1270c61 100644
--- a/docs/guides/contributors/index.md
+++ b/docs/guides/contributors/index.md
@@ -16,9 +16,12 @@ The file lives at `.github/CODEOWNERS`. Each component directory is mapped to on
 | Directory | Component | Owner(s) |
 |-----------|-----------|---------|
 | `vektra-shared/` | Shared protocols and types | @fvadicamo |
+| `vektra-app/` | Application entrypoint and startup validation | @fvadicamo |
 | `vektra-core/` | RAG engine and query pipeline | @fvadicamo |
 | `vektra-ingest/` | Document ingestion pipeline | @fvadicamo |
 | `vektra-index/` | Vector store and embedding | @fvadicamo |
+| `vektra-analytics/` | QueryTrace storage and metrics | @fvadicamo |
+| `vektra-learn/` | E-learning vertical (API + chatbot widget) | @fvadicamo |
 | `vektra-admin/` | Administration interface | @fvadicamo |
 | `.s2s/` | Specifications and architecture | @fvadicamo |
 | `docs/` | Documentation | @fvadicamo |
diff --git a/docs/guides/widget-integration.md b/docs/guides/widget-integration.md
new file mode 100644
index 00000000..1110b52f
--- /dev/null
+++ b/docs/guides/widget-integration.md
@@ -0,0 +1,260 @@
+# Widget integration guide
+
+The Vektra RAG chatbot widget is a self-contained vanilla-JS bundle that embeds course-scoped Q&A into any LMS or web page. This guide covers the full integration path: server-side token issuance, embedding the widget, all configuration attributes, and behaviors like conversation persistence, token refresh, and source citations.
+
+The widget is **LMS-agnostic**: it works with Moodle, Canvas, Blackboard, custom platforms, or plain HTML. For the Moodle plugin (which automates the integration), see [vektralabs/vektra-moodle](https://github.com/vektralabs/vektra-moodle).
+
+## Architecture
+
+The widget runs entirely client-side. All API calls go directly from the student's browser to the Vektra RAG backend, authenticated by a short-lived JWT that the LMS backend issues on the user's behalf.
+
+```text
+Student's browser
+  ├── widget bundle (vektra-chat.js)
+  └── HTTP/SSE → Vektra RAG /api/v1/learn/* (JWT auth)
+
+LMS backend (Moodle, custom, ...)
+  └── HTTP → Vektra RAG /api/v1/learn/tokens (API key auth, server-side only)
+            ← {"token": "<JWT>", "expires_at": "..."}
+```
+
+The API key never leaves the LMS backend. The browser only sees the JWT, which is scoped to a single course (namespace) and short-lived. If the JWT expires, the widget can refresh it transparently via a callback or refresh URL exposed by the LMS.
+
+## Quick start
+
+### 1. Issue a JWT (server-side)
+
+The LMS backend exchanges its admin API key for a JWT bound to a `(student_id, course_id)` pair:
+
+```bash
+curl -X POST https://your-vektra-host/api/v1/learn/tokens \
+  -H "Authorization: Bearer <admin-api-key>" \
+  -H "Content-Type: application/json" \
+  -d '{"student_id": "stu-12345", "course_id": "CS101"}'
+```
+
+Response (HTTP 201):
+
+```json
+{
+  "token": "eyJ...",
+  "expires_at": "2026-04-26T16:30:00Z"
+}
+```
+
+Required fields: `student_id`, `course_id`. Optional: `namespace` (defaults to `course_id`), `expires_in` (default 3600s, max 86400s). The JWT carries the `course_id` claim and is signed with `VEKTRA_LEARN_JWT_SECRET`. See [API reference > Learn](../reference/api.md#learn) for the full request/response shape.
+
+### 2. Embed the widget (HTML)
+
+Drop a single `<script>` tag with the JWT into any LMS course page:
+
+```html
+<script
+  src="https://your-vektra-host/static/learn/vektra-chat.js"
+  data-api-url="https://your-vektra-host"
+  data-course-id="CS101"
+  data-token="eyJ..."
+></script>
+```
+
+That's the minimum. The floating chat button appears in the bottom-right of the page; clicking it opens the chat panel.
+
+## Configuration: `data-*` attributes
+
+All customization lives on the `<script>` tag. No rebuild is needed to white-label the widget per course.
+
+### Required
+
+| Attribute | Description |
+|---|---|
+| `data-api-url` | Vektra RAG base URL the widget calls (e.g. `https://vektra.example.com`). |
+| `data-course-id` | Stable course identifier. Also used as the `sessionStorage` key for conversation persistence. |
+| `data-token` | JWT dashboard token issued by `POST /api/v1/learn/tokens`. |
+
+### White-label (FEAT-016)
+
+| Attribute | Default | Effect |
+|---|---|---|
+| `data-title` | "Course Assistant" / i18n | Chat panel header text and floating-button `aria-label`. |
+| `data-primary-color` | `#2563eb` | Bound to CSS var `--vektra-primary`. Drives the button, accents, and links. Hover states use `filter: brightness()` so any custom color stays interactive. |
+| `data-icon` | speech-bubble emoji | Floating button icon. Accepts an emoji (rendered as text) or a URL (rendered as `<img>`). |
+| `data-welcome-message` | (none) | First assistant message shown when the widget opens. |
+| `data-powered-by` | `true` | When `false` (case-insensitive), hide the attribution footer. |
+| `data-powered-by-text` | "Powered by VektraLabs" | Override the footer text (plain text only). |
+| `data-powered-by-url` | `https://vektralabs.github.io` | Override the footer link target. |
+| `data-show-sources` | (server-resolved) | Client-side override for the citations block (FEAT-014). See [Source citations](#source-citations-feat-014). |
+
+### Behavior
+
+| Attribute | Default | Effect |
+|---|---|---|
+| `data-theme` | `light` | Color theme: `light` or `dark`. |
+| `data-language` | `en` | UI strings language: `en`, `it`. |
+| `data-token-refresh-url` | (none) | URL the widget POSTs to after a `401` response, to obtain a refreshed JWT. See [Token refresh](#token-refresh-feat-009). |
+
+All `data-*` values are rendered via `textContent` (never `innerHTML`), `data-primary-color` is whitelist-validated, and `data-powered-by-url` / `data-token-refresh-url` are scheme-validated. XSS via attribute injection is neutralized.
+
+## Conversation persistence (FEAT-004)
+
+The widget keeps the active `conversation_id` in `sessionStorage` keyed by `course_id`. Reloading the page restores the chat history without leaking conversations across students on shared university computers (`sessionStorage` is tab-scoped and wiped on tab close; `localStorage` is intentionally not used).
+
+On widget init, if a stored conversation is present and not stale (24h cutoff), the widget calls `GET /api/v1/learn/conversations/{id}/turns` and replays the history before enabling input. The header "New chat" button resets the storage entry, the DOM, and the in-memory `conversation_id`.
+
+A `404` response from the turns endpoint (conversation deleted server-side) silently clears the entry. A `403` (different course/namespace) does the same.
+
+## Token refresh (FEAT-009)
+
+JWTs expire. Two patterns let the widget recover transparently after a `401`:
+
+### Pattern A — `data-token-refresh-url`
+
+Configure a URL on the LMS that issues a fresh JWT. After a `401`, the widget POSTs to that URL with `credentials: same-origin` and no body:
+
+```html
+<script
+  src=".../vektra-chat.js"
+  data-api-url="..."
+  data-course-id="CS101"
+  data-token="eyJ..."
+  data-token-refresh-url="/lms/api/refresh-vektra-token"
+></script>
+```
+
+The endpoint must return JSON `{"token": "<new-jwt>"}`. Any non-2xx status, malformed shape, or network error aborts the refresh and surfaces the original `401` to the user.
+
+The refresh endpoint validates the LMS user's session (cookie auth), then internally calls `POST /api/v1/learn/tokens` with the LMS's admin API key. The API key never reaches the browser.
+
+### Pattern B — `onTokenExpired` callback
+
+For programmatic embeds (not data-attribute driven), the widget exposes an `onTokenExpired` callback. See `vektra-learn/widget/src/index.js` for the entry-point shape.
+
+## Source citations (FEAT-014)
+
+The widget renders source citations under each assistant answer when sources are present. Visibility is controlled by a 4-level resolution chain (highest priority first):
+
+1. **`data-show-sources` attribute** — client-side override. The trimmed lowercase value is compared to `"false"`: only that exact string hides the section. Any other value (including `"true"`) forces it visible.
+2. **`namespaces.config.show_sources`** — per-course server config, set via `PATCH /api/v1/admin/namespaces/{id}/config`.
+3. **`VEKTRA_LEARN_SHOW_SOURCES`** environment variable — global default for the deployment.
+4. **Hardcoded `true`** — final fallback.
+
+The API always returns the full sources list regardless of visibility, so analytics and `QueryTrace` keep complete data. Visibility is purely a UI concern.
+
+When sources are hidden, the answer still displays normally. When shown, sources are collapsible (per the accessibility refactor in v0.3.0) with `aria-controls` / `aria-expanded`.
+
+## Error states
+
+The widget surfaces explicit feedback for non-happy-path scenarios:
+
+| State | When | UI |
+|---|---|---|
+| `unavailable` | Initial health check fails or repeated network errors. | Banner "The assistant is currently unavailable. Please try again later." Send button disabled. |
+| `reconnecting` | Background re-check after `unavailable`. | Banner "Reconnecting...". |
+| `sessionExpired` | `401` after refresh attempt fails (or no refresh URL configured). | Banner "Your session has expired. Please reload the page." Input disabled. |
+| `noRelevantContext` | Backend reports no chunks above the relevance threshold. | Inline message "I couldn't find relevant information in the course materials for this question." |
+| Generic error | Any other failure during a query. | Inline red message, last assistant message preserved. |
+
+All strings are i18n-localized (`en`, `it`). Add a language by extending `I18N` in `vektra-learn/widget/src/chat-ui.js` and rebuilding the bundle.
+
+## End-to-end example: PHP (Moodle-style)
+
+```php
+<?php
+// Server-side: issue JWT for the current student in this course.
+$ch = curl_init('https://vektra.example.com/api/v1/learn/tokens');
+curl_setopt($ch, CURLOPT_HTTPHEADER, [
+    'Authorization: Bearer ' . VEKTRA_ADMIN_KEY,    // never sent to browser
+    'Content-Type: application/json',
+]);
+curl_setopt($ch, CURLOPT_POST, true);
+curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
+    'student_id' => (string) $USER->id,
+    'course_id'  => $course->idnumber,
+]));
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+$response = json_decode(curl_exec($ch), true);
+$token = $response['token'];
+?>
+
+<!-- Client-side: embed widget with the JWT -->
+<script
+  src="https://vektra.example.com/static/learn/vektra-chat.js"
+  data-api-url="https://vektra.example.com"
+  data-course-id="<?= htmlspecialchars($course->idnumber) ?>"
+  data-token="<?= htmlspecialchars($token) ?>"
+  data-token-refresh-url="/local/vektra/refresh.php?course=<?= $course->id ?>"
+  data-language="<?= current_language() ?>"
+  data-title="<?= get_string('course_assistant', 'local_vektra') ?>"
+  data-primary-color="#1e3a8a"
+></script>
+```
+
+The Moodle plugin ([vektra-moodle](https://github.com/vektralabs/vektra-moodle)) automates this flow as a course block.
+
+## End-to-end example: Python (FastAPI)
+
+```python
+import html
+import httpx
+from fastapi import FastAPI, Request
+from fastapi.responses import HTMLResponse
+
+app = FastAPI()
+VEKTRA_HOST = "https://vektra.example.com"
+ADMIN_KEY = "..."
+
+@app.get("/course/{course_id}", response_class=HTMLResponse)
+async def course_page(course_id: str, request: Request):
+    # Validate user's session here and resolve student_id (omitted)
+    student_id = request.session["student_id"]
+    async with httpx.AsyncClient() as client:
+        r = await client.post(
+            f"{VEKTRA_HOST}/api/v1/learn/tokens",
+            headers={"Authorization": f"Bearer {ADMIN_KEY}"},
+            json={"student_id": student_id, "course_id": course_id},
+        )
+        token = r.json()["token"]
+    # Escape every value that lands in HTML: even though course_id is path-typed
+    # by FastAPI, students may control it via routing, and token comes from an
+    # external service — never trust either source for raw HTML interpolation.
+    safe_host = html.escape(VEKTRA_HOST, quote=True)
+    safe_course = html.escape(course_id, quote=True)
+    safe_token = html.escape(token, quote=True)
+    return f"""
+    <html>
+      <body>
+        <h1>Course {safe_course}</h1>
+        <script
+          src="{safe_host}/static/learn/vektra-chat.js"
+          data-api-url="{safe_host}"
+          data-course-id="{safe_course}"
+          data-token="{safe_token}"
+        ></script>
+      </body>
+    </html>
+    """
+```
+
+## Security notes
+
+- All `data-*` values are rendered via `textContent`. No XSS via attribute injection.
+- `data-primary-color` is whitelist-validated against safe CSS color formats (hex, `rgb[a]`, `hsl[a]`, named colors). Anything else is silently ignored.
+- `data-powered-by-url` and `data-token-refresh-url` accept only `http://`, `https://`, or same-origin paths. `javascript:`, `data:`, and other schemes are rejected.
+- The JWT is embedded in HTML and visible to the student. This is by design: the JWT is course-scoped and short-lived; the API key stays server-side.
+- `sessionStorage` is preferred over `localStorage` to avoid cross-student conversation leakage on shared computers.
+
+## Troubleshooting
+
+| Symptom | Likely cause | Fix |
+|---|---|---|
+| Floating button doesn't appear | Missing required `data-*` attribute | Browser console will log `[vektra-chat] Missing required attributes: data-api-url, data-course-id, data-token`. |
+| "Session expired" appears | JWT expired and no refresh path configured | Configure `data-token-refresh-url` or `onTokenExpired`. |
+| "Unavailable" banner | Health check failing | Verify `data-api-url` is reachable from the student's browser; check CORS on the Vektra host. |
+| Sources never appear | `data-show-sources="false"` or namespace config | Inspect the resolution chain. `GET /api/v1/admin/namespaces/{id}/config` returns the `resolved.show_sources` value. |
+| Custom color ignored | `data-primary-color` failed whitelist | Use a hex, `rgb()`, `hsl()`, or named color. No quotes, semicolons, or whitespace. |
+
+## Related documentation
+
+- [API reference > Learn](../reference/api.md#learn) — endpoint specs
+- [Configuration](../reference/configuration.md) — `VEKTRA_LEARN_*` environment variables
+- [Error codes](../reference/error-codes.md) — `ERR-LEARN-*` and `ERR-ADMIN-*` series
+- [vektra-learn component README](../../vektra-learn/README.md) — internal architecture
diff --git a/docs/reference/api.md b/docs/reference/api.md
index d686797d..99dd9ba5 100644
--- a/docs/reference/api.md
+++ b/docs/reference/api.md
@@ -140,6 +140,76 @@ curl -s -X DELETE \
 
 Returns HTTP 204 (no body).
 
+## Namespaces
+
+### GET /api/v1/admin/namespaces/{namespace_id}/config
+
+Read a namespace's stored config and the effective values after env-default fallback. Symmetric to the PATCH endpoint below.
+
+**Scopes**: `admin`
+
+```bash
+curl -s -H "Authorization: Bearer $VEKTRA_API_KEY" \
+  http://localhost:8000/api/v1/admin/namespaces/default/config | python3 -m json.tool
+```
+
+Response (HTTP 200):
+
+```json
+{
+    "namespace_id": "default",
+    "config": {"grounding_mode": "hybrid"},
+    "resolved": {
+        "grounding_mode": "hybrid",
+        "show_sources": true
+    }
+}
+```
+
+- `config` mirrors the raw JSONB stored in `namespaces.config` (`{}` when no key has ever been set).
+- `resolved` is the value queries actually observe at runtime, after the namespace > env > hardcoded-default chain. Always includes every key in the whitelist. Use this for "Use default" / "Override" form rendering in upstream plugins (e.g. the Moodle block edit form).
+
+Errors:
+- `404 ERR-ADMIN-005` if the namespace does not exist.
+
+### PATCH /api/v1/admin/namespaces/{namespace_id}/config
+
+Partially update a namespace's behavioral config (JSONB). Requires `admin` scope.
+
+**Scopes**: `admin`
+
+Used by upstream plugins (e.g. the Moodle block) to toggle per-course settings such as the grounding mode without touching environment variables. The read path is `resolve_grounding_mode()` in `vektra-shared/src/vektra_shared/namespace.py`.
+
+```bash
+curl -s -X PATCH \
+  -H "Authorization: Bearer $VEKTRA_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"grounding_mode":"hybrid"}' \
+  http://localhost:8000/api/v1/admin/namespaces/default/config | python3 -m json.tool
+```
+
+Request body (flat dict, one entry per config key):
+
+| Field | Type | Allowed values | Description |
+|-------|------|----------------|-------------|
+| `grounding_mode` | string or null | `"strict"`, `"hybrid"`, `null` | RAG grounding policy. `null` removes the key and falls back to `VEKTRA_PROMPT_GROUNDING_MODE`. |
+| `show_sources` | bool or null | `true`, `false`, `null` | Widget citation visibility (FEAT-014). `null` removes the key and falls back to `VEKTRA_LEARN_SHOW_SOURCES`. The API always returns the full sources list; the flag only instructs the widget whether to render them. Resolution chain: client `data-show-sources` attr > `namespaces.config.show_sources` > `VEKTRA_LEARN_SHOW_SOURCES` env > hardcoded `true`. |
+
+Behavior:
+- **Partial update**: keys not present in the body are preserved.
+- **Unknown keys rejected** with `400 ERR-ADMIN-006` (not silently ignored — surfaces typos early).
+- **Invalid values rejected** with `400 ERR-ADMIN-007` (includes type mismatches, e.g. a JSON string passed for a boolean key).
+- **Missing namespace** returns `404 ERR-ADMIN-005`.
+
+Response (HTTP 200):
+
+```json
+{
+    "namespace_id": "default",
+    "config": {"grounding_mode": "hybrid", "show_sources": false}
+}
+```
+
 ## Ingest
 
 ### POST /api/v1/ingest
@@ -254,7 +324,8 @@ Response:
             "score": 0.912,
             "snippet": "...",
             "citation_id": "d4e5f6-...",
-            "document_version": 1
+            "document_version": 1,
+            "document_name": "lecture-07.pdf"
         }
     ],
     "conversation_id": null,
@@ -268,6 +339,7 @@ Response:
 | `response_id` | Unique response identifier |
 | `answer` | LLM-generated answer grounded in sources |
 | `sources` | Ranked list of source chunks |
+| `sources[].document_name` | Filename of the source document (e.g. `lecture-07.pdf`), or `null` when the document join returns no row. Soft-deleted documents (REQ-057) keep their citation with an `(archived)` suffix so traceability is preserved. |
 | `conversation_id` | Echoed back if provided in request |
 | `context_only` | `true` if LLM failed and raw sources returned |
 | `no_relevant_context` | `true` if no chunks exceeded relevance threshold |
@@ -297,6 +369,214 @@ curl -s \
   http://localhost:8000/api/v1/providers | python3 -m json.tool
 ```
 
+## Learn
+
+The e-learning vertical (`vektra-learn`) exposes course-scoped endpoints authenticated via short-lived JWT dashboard tokens issued by `POST /api/v1/learn/tokens`. The `course_id` claim drives namespace isolation; the LMS-side integration (e.g. the Moodle plugin) is responsible for upstream auth before requesting a token.
+
+Two trust tiers:
+- **API key** (called server-side by the LMS): `/tokens`, `/enrollments`, `/content/ingest`. Each endpoint declares the minimum required scope below; `admin` is a project-wide superscope and always satisfies any required scope.
+- **JWT** (called from the browser by the widget, with the token issued by `/tokens`): `/query`, `/conversations/{id}/turns`. Namespace is derived from the JWT claims.
+
+### POST /api/v1/learn/tokens
+
+Issue a short-lived JWT dashboard token bound to a `(student_id, course_id)` pair. Called server-side by the LMS once it has authenticated the student.
+
+**Scopes**: `admin`
+
+```bash
+curl -s \
+  -H "Authorization: Bearer $VEKTRA_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"student_id":"u123","course_id":"CS101","expires_in":3600}' \
+  http://localhost:8000/api/v1/learn/tokens | python3 -m json.tool
+```
+
+Request body:
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `student_id` | string | (required) | Stable student identifier (1–255 chars). |
+| `course_id` | string | (required) | Stable course identifier (1–255 chars). |
+| `namespace` | string | (course_id) | Namespace embedded in the JWT. Defaults to the course id when omitted. |
+| `expires_in` | int | `3600` | Token lifetime in seconds (max `86400`, i.e. 24h). |
+
+Response (HTTP 201):
+
+```json
+{
+    "token": "eyJhbGciOi...",
+    "expires_at": "2026-04-25T15:00:00Z"
+}
+```
+
+### POST /api/v1/learn/enrollments
+
+Register a student in a course. Optional when `VEKTRA_LEARN_REQUIRE_ENROLLMENT=false` (the LMS is the source of truth for enrollment).
+
+**Scopes**: `ingest`
+
+```bash
+curl -s \
+  -H "Authorization: Bearer $VEKTRA_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"student_id":"u123","course_id":"CS101","namespace":"CS101"}' \
+  http://localhost:8000/api/v1/learn/enrollments | python3 -m json.tool
+```
+
+Request body:
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `student_id` | string | Stable student identifier (1–255 chars). |
+| `course_id` | string | Stable course identifier (1–255 chars). |
+| `namespace` | string | Target namespace for course content (1–64 chars). Auto-created if absent. |
+| `metadata` | object | Optional free-form metadata. |
+
+Response (HTTP 201): full enrollment record (`id`, `student_id`, `course_id`, `namespace`, `enrolled_at`, `metadata`).
+
+Errors: `409 ERR-LEARN-004` if the same `(student_id, course_id)` is already enrolled.
+
+### GET /api/v1/learn/enrollments
+
+List enrollments. Filter by `course_id`, `student_id`, or both via query parameters.
+
+**Scopes**: `admin`
+
+```bash
+curl -s \
+  -H "Authorization: Bearer $VEKTRA_API_KEY" \
+  "http://localhost:8000/api/v1/learn/enrollments?course_id=CS101&limit=50" | python3 -m json.tool
+```
+
+Query parameters: `course_id`, `student_id`, `limit` (1–500, default 50), `offset` (default 0).
+
+Response: `{"items": [...], "count": <int>}`.
+
+### DELETE /api/v1/learn/enrollments/{enrollment_id}
+
+Remove a single enrollment.
+
+**Scopes**: `admin`
+
+Returns HTTP 204 (no body). `404` if the enrollment id does not exist.
+
+### POST /api/v1/learn/content/ingest
+
+Trigger course-scoped ingestion. Used by automation (e.g. an n8n workflow watching a course folder) to push new material into the course namespace without going through the generic `/api/v1/ingest` endpoint.
+
+**Scopes**: `ingest`
+
+```bash
+curl -s \
+  -H "Authorization: Bearer $VEKTRA_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"course_id":"CS101","namespace":"CS101","document_url":"https://lms.example/files/lecture-07.pdf"}' \
+  http://localhost:8000/api/v1/learn/content/ingest | python3 -m json.tool
+```
+
+Request body: `course_id`, `namespace`, optional `document_url`, optional `metadata`. Response echoes the ingestion `status`, `namespace`, `course_id`, `metadata`, and (when synchronous) `document_id` + `chunk_count`.
+
+### POST /api/v1/learn/query
+
+Course-scoped RAG query. Authenticated via JWT (not API key). The namespace is derived from the token's `namespace` (or `course_id` fallback) claim.
+
+```bash
+curl -s \
+  -H "Authorization: Bearer $LEARN_JWT" \
+  -H "Content-Type: application/json" \
+  -d '{"question":"What did we cover in lecture 7?"}' \
+  http://localhost:8000/api/v1/learn/query | python3 -m json.tool
+```
+
+Request body:
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `question` | string | (required) | Query text |
+| `conversation_id` | UUID | - | Continue an existing conversation |
+| `top_k` | int | `5` | Number of chunks to retrieve |
+| `stream` | bool | `false` | Enable Server-Sent Events streaming |
+
+Response (HTTP 200, JSON):
+
+```json
+{
+    "response_id": "9f8e7d6c-...",
+    "answer": "Lecture 7 covered ...",
+    "sources": [
+        {
+            "doc_id": "550e8400-...",
+            "chunk_id": "c1a2b3...",
+            "score": 0.912,
+            "snippet": "...",
+            "document_name": "lecture-07.pdf"
+        }
+    ],
+    "conversation_id": "550e8400-...",
+    "no_relevant_context": false,
+    "show_sources": true
+}
+```
+
+| Field | Description |
+|-------|-------------|
+| `show_sources` | Server-resolved citation-visibility hint for the widget (FEAT-014). The full `sources` list is always returned regardless; the widget uses the flag to decide whether to render the citations block. See the resolution chain in [Namespaces PATCH](#patch-apiv1adminnamespacesnamespace_idconfig). |
+| `sources[].document_name` | Filename of the source document. Soft-deleted documents (REQ-057) keep an `(archived)` suffix so traceability is preserved. The field is `null` when the document join returns no row. |
+
+#### Streaming
+
+Set `stream: true` or send `Accept: text/event-stream`:
+
+```bash
+curl -s -N \
+  -H "Authorization: Bearer $LEARN_JWT" \
+  -H "Content-Type: application/json" \
+  -H "Accept: text/event-stream" \
+  -d '{"question":"What did we cover in lecture 7?","stream":true}' \
+  http://localhost:8000/api/v1/learn/query
+```
+
+The `sources` SSE event payload carries the same `show_sources` flag alongside the sources list.
+
+### GET /api/v1/learn/conversations/{conversation_id}/turns
+
+Return the decrypted turns of a conversation belonging to the token's course. Used by the widget to restore history after a page reload (FEAT-004).
+
+**Auth**: JWT dashboard token (same as `/learn/query`). The endpoint enforces `conversation.namespace_id == jwt.namespace`; a mismatch returns 403 (so the widget can distinguish "wrong course" from "deleted conversation" and reset its local state).
+
+```bash
+curl -s \
+  -H "Authorization: Bearer $LEARN_JWT" \
+  http://localhost:8000/api/v1/learn/conversations/550e8400-.../turns | python3 -m json.tool
+```
+
+Response (HTTP 200):
+
+```json
+{
+    "conversation_id": "550e8400-...",
+    "namespace": "course-101",
+    "turns": [
+        {
+            "turn_number": 1,
+            "question": "What is RAG?",
+            "answer": "RAG is ...",
+            "created_at": "2026-04-25T14:00:00Z",
+            "sources": []
+        }
+    ]
+}
+```
+
+The `turns[].sources` array is empty in v0.5.0 (admin-only metadata such as model, prompt tokens, and source enrichment from `query_traces` is intentionally not exposed to students). The `turns[].answer` field may be `null` for a turn that is still in-flight (the question is recorded immediately, the answer is filled in when the LLM completes).
+
+Errors:
+- `404 ERR-LEARN-005` if the conversation does not exist or has been deleted.
+- `403 ERR-LEARN-006` if the conversation belongs to a different course/namespace.
+- `503 ERR-LEARN-001` if the conversation store is not yet initialized or does not support decryption (e.g. in-memory store; production deployments must set `VEKTRA_CONVERSATION_KEY`).
+
+**Audit (NFR-007)**: every successful read writes a `learn_conversation_turns_read` audit row carrying `namespace`, `conversation_id`, `turn_count`, `student_id`, and `course_id`. The audit row is generated even if the upstream middleware did not set a request id.
+
 ## Index
 
 ### POST /api/v1/search
diff --git a/docs/reference/configuration.md b/docs/reference/configuration.md
index e16cdbd4..c0753eed 100644
--- a/docs/reference/configuration.md
+++ b/docs/reference/configuration.md
@@ -84,6 +84,7 @@ The model name must match the vLLM `--model` path exactly (e.g., `/models/qwen35
 | `VEKTRA_RESPONSE_TOKEN_RESERVE` | int | `2048` | Tokens reserved for LLM response generation |
 | `VEKTRA_CONTEXT_CHUNK_RATIO` | float | `0.6` | Fraction of context window allocated to retrieved chunks (0.0-1.0) |
 | `VEKTRA_PROMPT_TEMPLATES_DIR` | str | - | Directory for custom Jinja2 prompt templates (`system.j2`, `context.j2`, `conversation.j2`). Uses built-in defaults if unset. |
+| `VEKTRA_PROMPT_GROUNDING_MODE` | str | `strict` | Default RAG grounding policy. `strict` answers from retrieved context + history only; `hybrid` falls back to model knowledge when confident. Per-namespace override via `PATCH /api/v1/admin/namespaces/{id}/config`. |
 
 ### Query rewriting
 
@@ -138,6 +139,7 @@ The model name must match the vLLM `--model` path exactly (e.g., `/models/qwen35
 |----------|------|---------|-------------|
 | `VEKTRA_LEARN_JWT_SECRET` | str | - | JWT signing secret for dashboard tokens. Required when vektra-learn is active. Min 32 characters. |
 | `VEKTRA_LEARN_REQUIRE_ENROLLMENT` | bool | `true` | Require enrollment record for learn queries. Set to false when LMS manages enrollment externally. |
+| `VEKTRA_LEARN_SHOW_SOURCES` | bool | `true` | Default visibility of the source-citations section in the widget (FEAT-014). Per-namespace override via `PATCH /api/v1/admin/namespaces/{id}/config` > `show_sources`. Per-widget override via the `data-show-sources` script-tag attribute. The API always returns the full sources list; the flag only instructs the widget whether to render them. |
 
 ## Observability
 
@@ -173,9 +175,10 @@ The model name must match the vLLM `--model` path exactly (e.g., `/models/qwen35
 
 | Category | Count |
 |----------|-------|
-| VEKTRA_* variables (across VektraSettings + sub-configs) | 53 |
+| VEKTRA_* variables in `VektraSettings` and sub-configs (Pydantic-validated) | 59 |
+| VEKTRA_* variables read directly from env (`VEKTRA_CORS_ORIGINS`) | 1 |
 | External API keys (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`) | 2 |
 | Infrastructure (`POSTGRES_PASSWORD`, `CMD_TARGET`) | 2 |
-| **Total documented** | **57** |
+| **Total documented** | **64** |
 
-The 53 VEKTRA_* variables are declared across `VektraSettings` (flat aggregation) and sub-configs (`RewriteConfig`, `RerankConfig`, `WebhookConfig`, `IngestConfig` extensions). Sub-configs are validated independently at startup, not aggregated into VektraSettings. Infrastructure variables (`POSTGRES_PASSWORD`, `CMD_TARGET`) are used by Docker Compose or the entrypoint script.
+The 59 Pydantic-validated VEKTRA_* variables are declared across `VektraSettings` (flat aggregation) and sub-configs (`RewriteConfig`, `RerankConfig`, `WebhookConfig`, `IngestConfig` extensions). Sub-configs are validated independently at startup, not aggregated into VektraSettings. `VEKTRA_CORS_ORIGINS` is read directly via `os.environ.get` at app startup (see `vektra-app/src/vektra_app/main.py`). Infrastructure variables (`POSTGRES_PASSWORD`, `CMD_TARGET`) are used by Docker Compose or the entrypoint script.
diff --git a/docs/reference/error-codes.md b/docs/reference/error-codes.md
index ea6b5cd7..9eb598fb 100644
--- a/docs/reference/error-codes.md
+++ b/docs/reference/error-codes.md
@@ -81,11 +81,17 @@ These codes are used by specific components and are not part of the REQ-011 regi
 | ERR-ADMIN-001 | vektra-admin | 422 | Invalid scopes in API key creation request |
 | ERR-ADMIN-002 | vektra-admin | 404 | API key not found |
 | ERR-ADMIN-003 | vektra-admin | 409 | API key already revoked |
+| ERR-ADMIN-004 | vektra-admin | 422 | API key `expires_at` must be in the future |
+| ERR-ADMIN-005 | vektra-admin | 404 | Namespace not found (config PATCH) |
+| ERR-ADMIN-006 | vektra-admin | 400 | Unknown config key in namespace PATCH body |
+| ERR-ADMIN-007 | vektra-admin | 400 | Invalid value for namespace config key |
 | ERR-SAFEGUARD-001 | vektra-core | 400 | Query blocked by safeguard pre-check |
-| ERR-LEARN-001 | vektra-learn | 503 | Learn service unavailable or pipeline not configured |
+| ERR-LEARN-001 | vektra-learn | 503 / 500 | Learn service unavailable (503, registry not initialized) or misconfigured (500, conversation store does not support decryption — `VEKTRA_CONVERSATION_KEY` missing) |
 | ERR-LEARN-002 | vektra-learn | 404 | No enrollment found for student in course |
 | ERR-LEARN-003 | vektra-learn | 401 | Dashboard token missing required course_id claim |
-| ERR-LEARN-004 | vektra-learn | 422 | Invalid learn request (missing fields, bad format) |
+| ERR-LEARN-004 | vektra-learn | 409 | Duplicate enrollment (student already enrolled in course) |
+| ERR-LEARN-005 | vektra-learn | 404 | Conversation not found (GET conversations/turns) |
+| ERR-LEARN-006 | vektra-learn | 403 | Conversation belongs to a different course/namespace |
 
 ## Adding new error codes
 
diff --git a/pyproject.toml b/pyproject.toml
index 5db02b43..f369699a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -13,7 +13,7 @@ dev = [
     "alembic>=1.13",
     "pyyaml>=6.0",
     "testcontainers[postgres]>=4.8",
-    "pytest>=8.0",
+    "pytest>=9.0.3",
     "pytest-asyncio>=0.24",
     "pytest-cov>=5.0",
     "ruff>=0.15",
diff --git a/uv.lock b/uv.lock
index 7928b3a8..292b5847 100644
--- a/uv.lock
+++ b/uv.lock
@@ -3,16 +3,25 @@ revision = 3
 requires-python = ">=3.12"
 resolution-markers = [
     "python_full_version >= '3.14' and sys_platform == 'win32'",
-    "python_full_version >= '3.14' and sys_platform == 'emscripten'",
-    "python_full_version >= '3.14' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
-    "python_full_version >= '3.14' and sys_platform == 'darwin'",
+    "python_full_version >= '3.14' and platform_machine != 's390x' and sys_platform == 'emscripten'",
+    "python_full_version >= '3.14' and platform_machine == 's390x' and sys_platform == 'emscripten'",
+    "python_full_version >= '3.14' and platform_machine != 's390x' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
+    "python_full_version >= '3.14' and platform_machine == 's390x' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
+    "python_full_version >= '3.14' and platform_machine != 's390x' and sys_platform == 'darwin'",
+    "python_full_version >= '3.14' and platform_machine == 's390x' and sys_platform == 'darwin'",
     "python_full_version == '3.13.*' and sys_platform == 'win32'",
-    "python_full_version == '3.13.*' and sys_platform == 'emscripten'",
-    "python_full_version == '3.13.*' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
-    "python_full_version < '3.13' and sys_platform != 'darwin' and sys_platform != 'win32'",
-    "python_full_version < '3.13' and sys_platform == 'win32'",
-    "python_full_version == '3.13.*' and sys_platform == 'darwin'",
-    "python_full_version < '3.13' and sys_platform == 'darwin'",
+    "python_full_version == '3.13.*' and platform_machine != 's390x' and sys_platform == 'emscripten'",
+    "python_full_version == '3.13.*' and platform_machine == 's390x' and sys_platform == 'emscripten'",
+    "python_full_version == '3.13.*' and platform_machine != 's390x' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
+    "python_full_version == '3.13.*' and platform_machine == 's390x' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
+    "python_full_version < '3.13' and platform_machine != 's390x' and sys_platform != 'darwin' and sys_platform != 'win32'",
+    "python_full_version < '3.13' and platform_machine == 's390x' and sys_platform != 'darwin' and sys_platform != 'win32'",
+    "python_full_version < '3.13' and platform_machine != 's390x' and sys_platform == 'win32'",
+    "python_full_version < '3.13' and platform_machine == 's390x' and sys_platform == 'win32'",
+    "python_full_version == '3.13.*' and platform_machine != 's390x' and sys_platform == 'darwin'",
+    "python_full_version == '3.13.*' and platform_machine == 's390x' and sys_platform == 'darwin'",
+    "python_full_version < '3.13' and platform_machine != 's390x' and sys_platform == 'darwin'",
+    "python_full_version < '3.13' and platform_machine == 's390x' and sys_platform == 'darwin'",
 ]
 
 [manifest]
@@ -32,7 +41,7 @@ dev = [
     { name = "alembic", specifier = ">=1.13" },
     { name = "import-linter", specifier = ">=2.7" },
     { name = "mypy", specifier = ">=1.13" },
-    { name = "pytest", specifier = ">=8.0" },
+    { name = "pytest", specifier = ">=9.0.3" },
     { name = "pytest-asyncio", specifier = ">=0.24" },
     { name = "pytest-cov", specifier = ">=5.0" },
     { name = "pyyaml", specifier = ">=6.0" },
@@ -51,8 +60,8 @@ dependencies = [
     { name = "psutil", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
     { name = "pyyaml", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
     { name = "safetensors", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
-    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'darwin'" },
-    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "(python_full_version < '3.13' and sys_platform == 'win32') or (sys_platform != 'darwin' and sys_platform != 'win32')" },
+    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "(python_full_version < '3.13' and sys_platform == 'win32') or (platform_machine == 's390x' and sys_platform == 'darwin') or (sys_platform != 'darwin' and sys_platform != 'win32')" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/4a/8e/ac2a9566747a93f8be36ee08532eb0160558b07630a081a6056a9f89bf1d/accelerate-1.12.0.tar.gz", hash = "sha256:70988c352feb481887077d2ab845125024b2a137a5090d6d7a32b57d03a45df6", size = 398399, upload-time = "2025-11-21T11:27:46.973Z" }
 wheels = [
@@ -513,14 +522,14 @@ wheels = [
 
 [[package]]
 name = "click"
-version = "8.3.1"
+version = "8.1.8"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/3d/fa/656b739db8587d7b5dfa22e22ed02566950fbfbcdc20311993483657a5c0/click-8.3.1.tar.gz", hash = "sha256:12ff4785d337a1bb490bb7e9c2b1ee5da3112e94a8622f26a6c77f5d2fc6842a", size = 295065, upload-time = "2025-11-15T20:45:42.706Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b9/2e/0090cbf739cee7d23781ad4b89a9894a41538e4fcf4c31dcdd705b78eb8b/click-8.1.8.tar.gz", hash = "sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a", size = 226593, upload-time = "2024-12-21T18:38:44.339Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/98/78/01c019cdb5d6498122777c1a43056ebb3ebfeef2076d9d026bfe15583b2b/click-8.3.1-py3-none-any.whl", hash = "sha256:981153a64e25f12d547d3426c367a4857371575ee7ad18df2a6183ab0545b2a6", size = 108274, upload-time = "2025-11-15T20:45:41.139Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/d4/7ebdbd03970677812aac39c869717059dbb71a4cfc033ca6e5221787892c/click-8.1.8-py3-none-any.whl", hash = "sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2", size = 98188, upload-time = "2024-12-21T18:38:41.666Z" },
 ]
 
 [[package]]
@@ -706,55 +715,55 @@ wheels = [
 
 [[package]]
 name = "cryptography"
-version = "46.0.5"
+version = "46.0.7"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/60/04/ee2a9e8542e4fa2773b81771ff8349ff19cdd56b7258a0cc442639052edb/cryptography-46.0.5.tar.gz", hash = "sha256:abace499247268e3757271b2f1e244b36b06f8515cf27c4d49468fc9eb16e93d", size = 750064, upload-time = "2026-02-10T19:18:38.255Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/f7/81/b0bb27f2ba931a65409c6b8a8b358a7f03c0e46eceacddff55f7c84b1f3b/cryptography-46.0.5-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:351695ada9ea9618b3500b490ad54c739860883df6c1f555e088eaf25b1bbaad", size = 7176289, upload-time = "2026-02-10T19:17:08.274Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/9e/6b4397a3e3d15123de3b1806ef342522393d50736c13b20ec4c9ea6693a6/cryptography-46.0.5-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c18ff11e86df2e28854939acde2d003f7984f721eba450b56a200ad90eeb0e6b", size = 4275637, upload-time = "2026-02-10T19:17:10.53Z" },
-    { url = "https://files.pythonhosted.org/packages/63/e7/471ab61099a3920b0c77852ea3f0ea611c9702f651600397ac567848b897/cryptography-46.0.5-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:4d7e3d356b8cd4ea5aff04f129d5f66ebdc7b6f8eae802b93739ed520c47c79b", size = 4424742, upload-time = "2026-02-10T19:17:12.388Z" },
-    { url = "https://files.pythonhosted.org/packages/37/53/a18500f270342d66bf7e4d9f091114e31e5ee9e7375a5aba2e85a91e0044/cryptography-46.0.5-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:50bfb6925eff619c9c023b967d5b77a54e04256c4281b0e21336a130cd7fc263", size = 4277528, upload-time = "2026-02-10T19:17:13.853Z" },
-    { url = "https://files.pythonhosted.org/packages/22/29/c2e812ebc38c57b40e7c583895e73c8c5adb4d1e4a0cc4c5a4fdab2b1acc/cryptography-46.0.5-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:803812e111e75d1aa73690d2facc295eaefd4439be1023fefc4995eaea2af90d", size = 4947993, upload-time = "2026-02-10T19:17:15.618Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/e7/237155ae19a9023de7e30ec64e5d99a9431a567407ac21170a046d22a5a3/cryptography-46.0.5-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3ee190460e2fbe447175cda91b88b84ae8322a104fc27766ad09428754a618ed", size = 4456855, upload-time = "2026-02-10T19:17:17.221Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/87/fc628a7ad85b81206738abbd213b07702bcbdada1dd43f72236ef3cffbb5/cryptography-46.0.5-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:f145bba11b878005c496e93e257c1e88f154d278d2638e6450d17e0f31e558d2", size = 3984635, upload-time = "2026-02-10T19:17:18.792Z" },
-    { url = "https://files.pythonhosted.org/packages/84/29/65b55622bde135aedf4565dc509d99b560ee4095e56989e815f8fd2aa910/cryptography-46.0.5-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:e9251e3be159d1020c4030bd2e5f84d6a43fe54b6c19c12f51cde9542a2817b2", size = 4277038, upload-time = "2026-02-10T19:17:20.256Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/36/45e76c68d7311432741faf1fbf7fac8a196a0a735ca21f504c75d37e2558/cryptography-46.0.5-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:47fb8a66058b80e509c47118ef8a75d14c455e81ac369050f20ba0d23e77fee0", size = 4912181, upload-time = "2026-02-10T19:17:21.825Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/1a/c1ba8fead184d6e3d5afcf03d569acac5ad063f3ac9fb7258af158f7e378/cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:4c3341037c136030cb46e4b1e17b7418ea4cbd9dd207e4a6f3b2b24e0d4ac731", size = 4456482, upload-time = "2026-02-10T19:17:25.133Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/e5/3fb22e37f66827ced3b902cf895e6a6bc1d095b5b26be26bd13c441fdf19/cryptography-46.0.5-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:890bcb4abd5a2d3f852196437129eb3667d62630333aacc13dfd470fad3aaa82", size = 4405497, upload-time = "2026-02-10T19:17:26.66Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/df/9d58bb32b1121a8a2f27383fabae4d63080c7ca60b9b5c88be742be04ee7/cryptography-46.0.5-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:80a8d7bfdf38f87ca30a5391c0c9ce4ed2926918e017c29ddf643d0ed2778ea1", size = 4667819, upload-time = "2026-02-10T19:17:28.569Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/ed/325d2a490c5e94038cdb0117da9397ece1f11201f425c4e9c57fe5b9f08b/cryptography-46.0.5-cp311-abi3-win32.whl", hash = "sha256:60ee7e19e95104d4c03871d7d7dfb3d22ef8a9b9c6778c94e1c8fcc8365afd48", size = 3028230, upload-time = "2026-02-10T19:17:30.518Z" },
-    { url = "https://files.pythonhosted.org/packages/e9/5a/ac0f49e48063ab4255d9e3b79f5def51697fce1a95ea1370f03dc9db76f6/cryptography-46.0.5-cp311-abi3-win_amd64.whl", hash = "sha256:38946c54b16c885c72c4f59846be9743d699eee2b69b6988e0a00a01f46a61a4", size = 3480909, upload-time = "2026-02-10T19:17:32.083Z" },
-    { url = "https://files.pythonhosted.org/packages/00/13/3d278bfa7a15a96b9dc22db5a12ad1e48a9eb3d40e1827ef66a5df75d0d0/cryptography-46.0.5-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:94a76daa32eb78d61339aff7952ea819b1734b46f73646a07decb40e5b3448e2", size = 7119287, upload-time = "2026-02-10T19:17:33.801Z" },
-    { url = "https://files.pythonhosted.org/packages/67/c8/581a6702e14f0898a0848105cbefd20c058099e2c2d22ef4e476dfec75d7/cryptography-46.0.5-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:5be7bf2fb40769e05739dd0046e7b26f9d4670badc7b032d6ce4db64dddc0678", size = 4265728, upload-time = "2026-02-10T19:17:35.569Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/4a/ba1a65ce8fc65435e5a849558379896c957870dd64fecea97b1ad5f46a37/cryptography-46.0.5-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fe346b143ff9685e40192a4960938545c699054ba11d4f9029f94751e3f71d87", size = 4408287, upload-time = "2026-02-10T19:17:36.938Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/67/8ffdbf7b65ed1ac224d1c2df3943553766914a8ca718747ee3871da6107e/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:c69fd885df7d089548a42d5ec05be26050ebcd2283d89b3d30676eb32ff87dee", size = 4270291, upload-time = "2026-02-10T19:17:38.748Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/e5/f52377ee93bc2f2bba55a41a886fd208c15276ffbd2569f2ddc89d50e2c5/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:8293f3dea7fc929ef7240796ba231413afa7b68ce38fd21da2995549f5961981", size = 4927539, upload-time = "2026-02-10T19:17:40.241Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/02/cfe39181b02419bbbbcf3abdd16c1c5c8541f03ca8bda240debc467d5a12/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:1abfdb89b41c3be0365328a410baa9df3ff8a9110fb75e7b52e66803ddabc9a9", size = 4442199, upload-time = "2026-02-10T19:17:41.789Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/96/2fcaeb4873e536cf71421a388a6c11b5bc846e986b2b069c79363dc1648e/cryptography-46.0.5-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:d66e421495fdb797610a08f43b05269e0a5ea7f5e652a89bfd5a7d3c1dee3648", size = 3960131, upload-time = "2026-02-10T19:17:43.379Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/d2/b27631f401ddd644e94c5cf33c9a4069f72011821cf3dc7309546b0642a0/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:4e817a8920bfbcff8940ecfd60f23d01836408242b30f1a708d93198393a80b4", size = 4270072, upload-time = "2026-02-10T19:17:45.481Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/a7/60d32b0370dae0b4ebe55ffa10e8599a2a59935b5ece1b9f06edb73abdeb/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:68f68d13f2e1cb95163fa3b4db4bf9a159a418f5f6e7242564fc75fcae667fd0", size = 4892170, upload-time = "2026-02-10T19:17:46.997Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/b9/cf73ddf8ef1164330eb0b199a589103c363afa0cf794218c24d524a58eab/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:a3d1fae9863299076f05cb8a778c467578262fae09f9dc0ee9b12eb4268ce663", size = 4441741, upload-time = "2026-02-10T19:17:48.661Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/eb/eee00b28c84c726fe8fa0158c65afe312d9c3b78d9d01daf700f1f6e37ff/cryptography-46.0.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c4143987a42a2397f2fc3b4d7e3a7d313fbe684f67ff443999e803dd75a76826", size = 4396728, upload-time = "2026-02-10T19:17:50.058Z" },
-    { url = "https://files.pythonhosted.org/packages/65/f4/6bc1a9ed5aef7145045114b75b77c2a8261b4d38717bd8dea111a63c3442/cryptography-46.0.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:7d731d4b107030987fd61a7f8ab512b25b53cef8f233a97379ede116f30eb67d", size = 4652001, upload-time = "2026-02-10T19:17:51.54Z" },
-    { url = "https://files.pythonhosted.org/packages/86/ef/5d00ef966ddd71ac2e6951d278884a84a40ffbd88948ef0e294b214ae9e4/cryptography-46.0.5-cp314-cp314t-win32.whl", hash = "sha256:c3bcce8521d785d510b2aad26ae2c966092b7daa8f45dd8f44734a104dc0bc1a", size = 3003637, upload-time = "2026-02-10T19:17:52.997Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/57/f3f4160123da6d098db78350fdfd9705057aad21de7388eacb2401dceab9/cryptography-46.0.5-cp314-cp314t-win_amd64.whl", hash = "sha256:4d8ae8659ab18c65ced284993c2265910f6c9e650189d4e3f68445ef82a810e4", size = 3469487, upload-time = "2026-02-10T19:17:54.549Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/fa/a66aa722105ad6a458bebd64086ca2b72cdd361fed31763d20390f6f1389/cryptography-46.0.5-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:4108d4c09fbbf2789d0c926eb4152ae1760d5a2d97612b92d508d96c861e4d31", size = 7170514, upload-time = "2026-02-10T19:17:56.267Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/04/c85bdeab78c8bc77b701bf0d9bdcf514c044e18a46dcff330df5448631b0/cryptography-46.0.5-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7d1f30a86d2757199cb2d56e48cce14deddf1f9c95f1ef1b64ee91ea43fe2e18", size = 4275349, upload-time = "2026-02-10T19:17:58.419Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/32/9b87132a2f91ee7f5223b091dc963055503e9b442c98fc0b8a5ca765fab0/cryptography-46.0.5-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:039917b0dc418bb9f6edce8a906572d69e74bd330b0b3fea4f79dab7f8ddd235", size = 4420667, upload-time = "2026-02-10T19:18:00.619Z" },
-    { url = "https://files.pythonhosted.org/packages/a1/a6/a7cb7010bec4b7c5692ca6f024150371b295ee1c108bdc1c400e4c44562b/cryptography-46.0.5-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:ba2a27ff02f48193fc4daeadf8ad2590516fa3d0adeeb34336b96f7fa64c1e3a", size = 4276980, upload-time = "2026-02-10T19:18:02.379Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/7c/c4f45e0eeff9b91e3f12dbd0e165fcf2a38847288fcfd889deea99fb7b6d/cryptography-46.0.5-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:61aa400dce22cb001a98014f647dc21cda08f7915ceb95df0c9eaf84b4b6af76", size = 4939143, upload-time = "2026-02-10T19:18:03.964Z" },
-    { url = "https://files.pythonhosted.org/packages/37/19/e1b8f964a834eddb44fa1b9a9976f4e414cbb7aa62809b6760c8803d22d1/cryptography-46.0.5-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3ce58ba46e1bc2aac4f7d9290223cead56743fa6ab94a5d53292ffaac6a91614", size = 4453674, upload-time = "2026-02-10T19:18:05.588Z" },
-    { url = "https://files.pythonhosted.org/packages/db/ed/db15d3956f65264ca204625597c410d420e26530c4e2943e05a0d2f24d51/cryptography-46.0.5-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:420d0e909050490d04359e7fdb5ed7e667ca5c3c402b809ae2563d7e66a92229", size = 3978801, upload-time = "2026-02-10T19:18:07.167Z" },
-    { url = "https://files.pythonhosted.org/packages/41/e2/df40a31d82df0a70a0daf69791f91dbb70e47644c58581d654879b382d11/cryptography-46.0.5-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:582f5fcd2afa31622f317f80426a027f30dc792e9c80ffee87b993200ea115f1", size = 4276755, upload-time = "2026-02-10T19:18:09.813Z" },
-    { url = "https://files.pythonhosted.org/packages/33/45/726809d1176959f4a896b86907b98ff4391a8aa29c0aaaf9450a8a10630e/cryptography-46.0.5-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:bfd56bb4b37ed4f330b82402f6f435845a5f5648edf1ad497da51a8452d5d62d", size = 4901539, upload-time = "2026-02-10T19:18:11.263Z" },
-    { url = "https://files.pythonhosted.org/packages/99/0f/a3076874e9c88ecb2ecc31382f6e7c21b428ede6f55aafa1aa272613e3cd/cryptography-46.0.5-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:a3d507bb6a513ca96ba84443226af944b0f7f47dcc9a399d110cd6146481d24c", size = 4452794, upload-time = "2026-02-10T19:18:12.914Z" },
-    { url = "https://files.pythonhosted.org/packages/02/ef/ffeb542d3683d24194a38f66ca17c0a4b8bf10631feef44a7ef64e631b1a/cryptography-46.0.5-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:9f16fbdf4da055efb21c22d81b89f155f02ba420558db21288b3d0035bafd5f4", size = 4404160, upload-time = "2026-02-10T19:18:14.375Z" },
-    { url = "https://files.pythonhosted.org/packages/96/93/682d2b43c1d5f1406ed048f377c0fc9fc8f7b0447a478d5c65ab3d3a66eb/cryptography-46.0.5-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:ced80795227d70549a411a4ab66e8ce307899fad2220ce5ab2f296e687eacde9", size = 4667123, upload-time = "2026-02-10T19:18:15.886Z" },
-    { url = "https://files.pythonhosted.org/packages/45/2d/9c5f2926cb5300a8eefc3f4f0b3f3df39db7f7ce40c8365444c49363cbda/cryptography-46.0.5-cp38-abi3-win32.whl", hash = "sha256:02f547fce831f5096c9a567fd41bc12ca8f11df260959ecc7c3202555cc47a72", size = 3010220, upload-time = "2026-02-10T19:18:17.361Z" },
-    { url = "https://files.pythonhosted.org/packages/48/ef/0c2f4a8e31018a986949d34a01115dd057bf536905dca38897bacd21fac3/cryptography-46.0.5-cp38-abi3-win_amd64.whl", hash = "sha256:556e106ee01aa13484ce9b0239bca667be5004efb0aabbed28d353df86445595", size = 3467050, upload-time = "2026-02-10T19:18:18.899Z" },
+sdist = { url = "https://files.pythonhosted.org/packages/47/93/ac8f3d5ff04d54bc814e961a43ae5b0b146154c89c61b47bb07557679b18/cryptography-46.0.7.tar.gz", hash = "sha256:e4cfd68c5f3e0bfdad0d38e023239b96a2fe84146481852dffbcca442c245aa5", size = 750652, upload-time = "2026-04-08T01:57:54.692Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0b/5d/4a8f770695d73be252331e60e526291e3df0c9b27556a90a6b47bccca4c2/cryptography-46.0.7-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:ea42cbe97209df307fdc3b155f1b6fa2577c0defa8f1f7d3be7d31d189108ad4", size = 7179869, upload-time = "2026-04-08T01:56:17.157Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/45/6d80dc379b0bbc1f9d1e429f42e4cb9e1d319c7a8201beffd967c516ea01/cryptography-46.0.7-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b36a4695e29fe69215d75960b22577197aca3f7a25b9cf9d165dcfe9d80bc325", size = 4275492, upload-time = "2026-04-08T01:56:19.36Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/9a/1765afe9f572e239c3469f2cb429f3ba7b31878c893b246b4b2994ffe2fe/cryptography-46.0.7-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:5ad9ef796328c5e3c4ceed237a183f5d41d21150f972455a9d926593a1dcb308", size = 4426670, upload-time = "2026-04-08T01:56:21.415Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/3e/af9246aaf23cd4ee060699adab1e47ced3f5f7e7a8ffdd339f817b446462/cryptography-46.0.7-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:73510b83623e080a2c35c62c15298096e2a5dc8d51c3b4e1740211839d0dea77", size = 4280275, upload-time = "2026-04-08T01:56:23.539Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/54/6bbbfc5efe86f9d71041827b793c24811a017c6ac0fd12883e4caa86b8ed/cryptography-46.0.7-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cbd5fb06b62bd0721e1170273d3f4d5a277044c47ca27ee257025146c34cbdd1", size = 4928402, upload-time = "2026-04-08T01:56:25.624Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/cf/054b9d8220f81509939599c8bdbc0c408dbd2bdd41688616a20731371fe0/cryptography-46.0.7-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:420b1e4109cc95f0e5700eed79908cef9268265c773d3a66f7af1eef53d409ef", size = 4459985, upload-time = "2026-04-08T01:56:27.309Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/46/4e4e9c6040fb01c7467d47217d2f882daddeb8828f7df800cb806d8a2288/cryptography-46.0.7-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:24402210aa54baae71d99441d15bb5a1919c195398a87b563df84468160a65de", size = 3990652, upload-time = "2026-04-08T01:56:29.095Z" },
+    { url = "https://files.pythonhosted.org/packages/36/5f/313586c3be5a2fbe87e4c9a254207b860155a8e1f3cca99f9910008e7d08/cryptography-46.0.7-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:8a469028a86f12eb7d2fe97162d0634026d92a21f3ae0ac87ed1c4a447886c83", size = 4279805, upload-time = "2026-04-08T01:56:30.928Z" },
+    { url = "https://files.pythonhosted.org/packages/69/33/60dfc4595f334a2082749673386a4d05e4f0cf4df8248e63b2c3437585f2/cryptography-46.0.7-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:9694078c5d44c157ef3162e3bf3946510b857df5a3955458381d1c7cfc143ddb", size = 4892883, upload-time = "2026-04-08T01:56:32.614Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/0b/333ddab4270c4f5b972f980adef4faa66951a4aaf646ca067af597f15563/cryptography-46.0.7-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:42a1e5f98abb6391717978baf9f90dc28a743b7d9be7f0751a6f56a75d14065b", size = 4459756, upload-time = "2026-04-08T01:56:34.306Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/14/633913398b43b75f1234834170947957c6b623d1701ffc7a9600da907e89/cryptography-46.0.7-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:91bbcb08347344f810cbe49065914fe048949648f6bd5c2519f34619142bbe85", size = 4410244, upload-time = "2026-04-08T01:56:35.977Z" },
+    { url = "https://files.pythonhosted.org/packages/10/f2/19ceb3b3dc14009373432af0c13f46aa08e3ce334ec6eff13492e1812ccd/cryptography-46.0.7-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:5d1c02a14ceb9148cc7816249f64f623fbfee39e8c03b3650d842ad3f34d637e", size = 4674868, upload-time = "2026-04-08T01:56:38.034Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/bb/a5c213c19ee94b15dfccc48f363738633a493812687f5567addbcbba9f6f/cryptography-46.0.7-cp311-abi3-win32.whl", hash = "sha256:d23c8ca48e44ee015cd0a54aeccdf9f09004eba9fc96f38c911011d9ff1bd457", size = 3026504, upload-time = "2026-04-08T01:56:39.666Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/02/7788f9fefa1d060ca68717c3901ae7fffa21ee087a90b7f23c7a603c32ae/cryptography-46.0.7-cp311-abi3-win_amd64.whl", hash = "sha256:397655da831414d165029da9bc483bed2fe0e75dde6a1523ec2fe63f3c46046b", size = 3488363, upload-time = "2026-04-08T01:56:41.893Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/56/15619b210e689c5403bb0540e4cb7dbf11a6bf42e483b7644e471a2812b3/cryptography-46.0.7-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:d151173275e1728cf7839aaa80c34fe550c04ddb27b34f48c232193df8db5842", size = 7119671, upload-time = "2026-04-08T01:56:44Z" },
+    { url = "https://files.pythonhosted.org/packages/74/66/e3ce040721b0b5599e175ba91ab08884c75928fbeb74597dd10ef13505d2/cryptography-46.0.7-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:db0f493b9181c7820c8134437eb8b0b4792085d37dbb24da050476ccb664e59c", size = 4268551, upload-time = "2026-04-08T01:56:46.071Z" },
+    { url = "https://files.pythonhosted.org/packages/03/11/5e395f961d6868269835dee1bafec6a1ac176505a167f68b7d8818431068/cryptography-46.0.7-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ebd6daf519b9f189f85c479427bbd6e9c9037862cf8fe89ee35503bd209ed902", size = 4408887, upload-time = "2026-04-08T01:56:47.718Z" },
+    { url = "https://files.pythonhosted.org/packages/40/53/8ed1cf4c3b9c8e611e7122fb56f1c32d09e1fff0f1d77e78d9ff7c82653e/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:b7b412817be92117ec5ed95f880defe9cf18a832e8cafacf0a22337dc1981b4d", size = 4271354, upload-time = "2026-04-08T01:56:49.312Z" },
+    { url = "https://files.pythonhosted.org/packages/50/46/cf71e26025c2e767c5609162c866a78e8a2915bbcfa408b7ca495c6140c4/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:fbfd0e5f273877695cb93baf14b185f4878128b250cc9f8e617ea0c025dfb022", size = 4905845, upload-time = "2026-04-08T01:56:50.916Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/ea/01276740375bac6249d0a971ebdf6b4dc9ead0ee0a34ef3b5a88c1a9b0d4/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:ffca7aa1d00cf7d6469b988c581598f2259e46215e0140af408966a24cf086ce", size = 4444641, upload-time = "2026-04-08T01:56:52.882Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/4c/7d258f169ae71230f25d9f3d06caabcff8c3baf0978e2b7d65e0acac3827/cryptography-46.0.7-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:60627cf07e0d9274338521205899337c5d18249db56865f943cbe753aa96f40f", size = 3967749, upload-time = "2026-04-08T01:56:54.597Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/2a/2ea0767cad19e71b3530e4cad9605d0b5e338b6a1e72c37c9c1ceb86c333/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:80406c3065e2c55d7f49a9550fe0c49b3f12e5bfff5dedb727e319e1afb9bf99", size = 4270942, upload-time = "2026-04-08T01:56:56.416Z" },
+    { url = "https://files.pythonhosted.org/packages/41/3d/fe14df95a83319af25717677e956567a105bb6ab25641acaa093db79975d/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:c5b1ccd1239f48b7151a65bc6dd54bcfcc15e028c8ac126d3fada09db0e07ef1", size = 4871079, upload-time = "2026-04-08T01:56:58.31Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/59/4a479e0f36f8f378d397f4eab4c850b4ffb79a2f0d58704b8fa0703ddc11/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d5f7520159cd9c2154eb61eb67548ca05c5774d39e9c2c4339fd793fe7d097b2", size = 4443999, upload-time = "2026-04-08T01:57:00.508Z" },
+    { url = "https://files.pythonhosted.org/packages/28/17/b59a741645822ec6d04732b43c5d35e4ef58be7bfa84a81e5ae6f05a1d33/cryptography-46.0.7-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:fcd8eac50d9138c1d7fc53a653ba60a2bee81a505f9f8850b6b2888555a45d0e", size = 4399191, upload-time = "2026-04-08T01:57:02.654Z" },
+    { url = "https://files.pythonhosted.org/packages/59/6a/bb2e166d6d0e0955f1e9ff70f10ec4b2824c9cfcdb4da772c7dd69cc7d80/cryptography-46.0.7-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:65814c60f8cc400c63131584e3e1fad01235edba2614b61fbfbfa954082db0ee", size = 4655782, upload-time = "2026-04-08T01:57:04.592Z" },
+    { url = "https://files.pythonhosted.org/packages/95/b6/3da51d48415bcb63b00dc17c2eff3a651b7c4fed484308d0f19b30e8cb2c/cryptography-46.0.7-cp314-cp314t-win32.whl", hash = "sha256:fdd1736fed309b4300346f88f74cd120c27c56852c3838cab416e7a166f67298", size = 3002227, upload-time = "2026-04-08T01:57:06.91Z" },
+    { url = "https://files.pythonhosted.org/packages/32/a8/9f0e4ed57ec9cebe506e58db11ae472972ecb0c659e4d52bbaee80ca340a/cryptography-46.0.7-cp314-cp314t-win_amd64.whl", hash = "sha256:e06acf3c99be55aa3b516397fe42f5855597f430add9c17fa46bf2e0fb34c9bb", size = 3475332, upload-time = "2026-04-08T01:57:08.807Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/7f/cd42fc3614386bc0c12f0cb3c4ae1fc2bbca5c9662dfed031514911d513d/cryptography-46.0.7-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:462ad5cb1c148a22b2e3bcc5ad52504dff325d17daf5df8d88c17dda1f75f2a4", size = 7165618, upload-time = "2026-04-08T01:57:10.645Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/d0/36a49f0262d2319139d2829f773f1b97ef8aef7f97e6e5bd21455e5a8fb5/cryptography-46.0.7-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:84d4cced91f0f159a7ddacad249cc077e63195c36aac40b4150e7a57e84fffe7", size = 4270628, upload-time = "2026-04-08T01:57:12.885Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/6c/1a42450f464dda6ffbe578a911f773e54dd48c10f9895a23a7e88b3e7db5/cryptography-46.0.7-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:128c5edfe5e5938b86b03941e94fac9ee793a94452ad1365c9fc3f4f62216832", size = 4415405, upload-time = "2026-04-08T01:57:14.923Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/92/4ed714dbe93a066dc1f4b4581a464d2d7dbec9046f7c8b7016f5286329e2/cryptography-46.0.7-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:5e51be372b26ef4ba3de3c167cd3d1022934bc838ae9eaad7e644986d2a3d163", size = 4272715, upload-time = "2026-04-08T01:57:16.638Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/e6/a26b84096eddd51494bba19111f8fffe976f6a09f132706f8f1bf03f51f7/cryptography-46.0.7-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cdf1a610ef82abb396451862739e3fc93b071c844399e15b90726ef7470eeaf2", size = 4918400, upload-time = "2026-04-08T01:57:19.021Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/08/ffd537b605568a148543ac3c2b239708ae0bd635064bab41359252ef88ed/cryptography-46.0.7-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:1d25aee46d0c6f1a501adcddb2d2fee4b979381346a78558ed13e50aa8a59067", size = 4450634, upload-time = "2026-04-08T01:57:21.185Z" },
+    { url = "https://files.pythonhosted.org/packages/16/01/0cd51dd86ab5b9befe0d031e276510491976c3a80e9f6e31810cce46c4ad/cryptography-46.0.7-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:cdfbe22376065ffcf8be74dc9a909f032df19bc58a699456a21712d6e5eabfd0", size = 3985233, upload-time = "2026-04-08T01:57:22.862Z" },
+    { url = "https://files.pythonhosted.org/packages/92/49/819d6ed3a7d9349c2939f81b500a738cb733ab62fbecdbc1e38e83d45e12/cryptography-46.0.7-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:abad9dac36cbf55de6eb49badd4016806b3165d396f64925bf2999bcb67837ba", size = 4271955, upload-time = "2026-04-08T01:57:24.814Z" },
+    { url = "https://files.pythonhosted.org/packages/80/07/ad9b3c56ebb95ed2473d46df0847357e01583f4c52a85754d1a55e29e4d0/cryptography-46.0.7-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:935ce7e3cfdb53e3536119a542b839bb94ec1ad081013e9ab9b7cfd478b05006", size = 4879888, upload-time = "2026-04-08T01:57:26.88Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/c7/201d3d58f30c4c2bdbe9b03844c291feb77c20511cc3586daf7edc12a47b/cryptography-46.0.7-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:35719dc79d4730d30f1c2b6474bd6acda36ae2dfae1e3c16f2051f215df33ce0", size = 4449961, upload-time = "2026-04-08T01:57:29.068Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/ef/649750cbf96f3033c3c976e112265c33906f8e462291a33d77f90356548c/cryptography-46.0.7-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:7bbc6ccf49d05ac8f7d7b5e2e2c33830d4fe2061def88210a126d130d7f71a85", size = 4401696, upload-time = "2026-04-08T01:57:31.029Z" },
+    { url = "https://files.pythonhosted.org/packages/41/52/a8908dcb1a389a459a29008c29966c1d552588d4ae6d43f3a1a4512e0ebe/cryptography-46.0.7-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a1529d614f44b863a7b480c6d000fe93b59acee9c82ffa027cfadc77521a9f5e", size = 4664256, upload-time = "2026-04-08T01:57:33.144Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/fa/f0ab06238e899cc3fb332623f337a7364f36f4bb3f2534c2bb95a35b132c/cryptography-46.0.7-cp38-abi3-win32.whl", hash = "sha256:f247c8c1a1fb45e12586afbb436ef21ff1e80670b2861a90353d9b025583d246", size = 3013001, upload-time = "2026-04-08T01:57:34.933Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/f1/00ce3bde3ca542d1acd8f8cfa38e446840945aa6363f9b74746394b14127/cryptography-46.0.7-cp38-abi3-win_amd64.whl", hash = "sha256:506c4ff91eff4f82bdac7633318a526b1d1309fc07ca76a3ad182cb5b686d6d3", size = 3472985, upload-time = "2026-04-08T01:57:36.714Z" },
 ]
 
 [[package]]
@@ -876,7 +885,7 @@ wheels = [
 
 [[package]]
 name = "fastembed"
-version = "0.7.4"
+version = "0.8.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "huggingface-hub" },
@@ -890,9 +899,9 @@ dependencies = [
     { name = "tokenizers" },
     { name = "tqdm" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/4c/c2/9c708680de1b54480161e0505f9d6d3d8eb47a1dc1a1f7f3c5106ba355d2/fastembed-0.7.4.tar.gz", hash = "sha256:8b8a4ea860ca295002f4754e8f5820a636e1065a9444959e18d5988d7f27093b", size = 68807, upload-time = "2025-12-05T12:08:10.447Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/26/25/58865e36b6e8a9a0d0ff905b5601aa30db97956327c0df42ec4ed6accc21/fastembed-0.8.0.tar.gz", hash = "sha256:75966edfa8b006ee78514c726bd7f6a50721dadc89305279052be9db72fd53e8", size = 75115, upload-time = "2026-03-23T16:34:41.699Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/10/3b/8da01492bc8b69184257d0c951bf0e77aec8ce110f06d8ce16c6ed9084f7/fastembed-0.7.4-py3-none-any.whl", hash = "sha256:79250a775f70bd6addb0e054204df042b5029ecae501e40e5bbd08e75844ad83", size = 108491, upload-time = "2025-12-05T12:08:09.059Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/e8/26b7d78bb8972498c467ca34cb12ee2e60d26ba5eae6d8443189a1af37a5/fastembed-0.8.0-py3-none-any.whl", hash = "sha256:40bee672657574a1009e35ec50030a55f2b426842cb011845379817641bbbbd0", size = 116572, upload-time = "2026-03-23T16:34:40.69Z" },
 ]
 
 [[package]]
@@ -1601,14 +1610,14 @@ wheels = [
 
 [[package]]
 name = "importlib-metadata"
-version = "8.7.1"
+version = "8.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "zipp" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/f3/49/3b30cad09e7771a4982d9975a8cbf64f00d4a1ececb53297f1d9a7be1b10/importlib_metadata-8.7.1.tar.gz", hash = "sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb", size = 57107, upload-time = "2025-12-21T10:00:19.278Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/cd/12/33e59336dca5be0c398a7482335911a33aa0e20776128f038019f1a95f1b/importlib_metadata-8.5.0.tar.gz", hash = "sha256:71522656f0abace1d072b9e5481a48f07c138e00f079c38c8f883823f9c26bd7", size = 55304, upload-time = "2024-09-11T14:56:08.937Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fa/5e/f8e9a1d23b9c20a551a8a02ea3637b4642e22c2626e3a13a9a29cdea99eb/importlib_metadata-8.7.1-py3-none-any.whl", hash = "sha256:5a1f80bf1daa489495071efbb095d75a634cf28a8bc299581244063b53176151", size = 27865, upload-time = "2025-12-21T10:00:18.329Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/d9/a1e041c5e7caa9a05c925f4bdbdfb7f006d1f74996af53467bc394c97be7/importlib_metadata-8.5.0-py3-none-any.whl", hash = "sha256:45e54197d28b7a7f1559e60b95e7c567032b602131fbd588f1497f47880aa68b", size = 26514, upload-time = "2024-09-11T14:56:07.019Z" },
 ]
 
 [[package]]
@@ -1720,7 +1729,7 @@ wheels = [
 
 [[package]]
 name = "jsonschema"
-version = "4.26.0"
+version = "4.23.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "attrs" },
@@ -1728,9 +1737,9 @@ dependencies = [
     { name = "referencing" },
     { name = "rpds-py" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/b3/fc/e067678238fa451312d4c62bf6e6cf5ec56375422aee02f9cb5f909b3047/jsonschema-4.26.0.tar.gz", hash = "sha256:0c26707e2efad8aa1bfc5b7ce170f3fccc2e4918ff85989ba9ffa9facb2be326", size = 366583, upload-time = "2026-01-07T13:41:07.246Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/38/2e/03362ee4034a4c917f697890ccd4aec0800ccf9ded7f511971c75451deec/jsonschema-4.23.0.tar.gz", hash = "sha256:d71497fef26351a33265337fa77ffeb82423f3ea21283cd9467bb03999266bc4", size = 325778, upload-time = "2024-07-08T18:40:05.546Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/69/90/f63fb5873511e014207a475e2bb4e8b2e570d655b00ac19a9a0ca0a385ee/jsonschema-4.26.0-py3-none-any.whl", hash = "sha256:d489f15263b8d200f8387e64b4c3a75f06629559fb73deb8fdfb525f2dab50ce", size = 90630, upload-time = "2026-01-07T13:41:05.306Z" },
+    { url = "https://files.pythonhosted.org/packages/69/4a/4f9dbeb84e8850557c02365a0eee0649abe5eb1d84af92a25731c6c0f922/jsonschema-4.23.0-py3-none-any.whl", hash = "sha256:fbadb6f8b144a8f8cf9f0b89ba94501d143e50411a1278633f56a7acf7fd5566", size = 88462, upload-time = "2024-07-08T18:40:00.165Z" },
 ]
 
 [[package]]
@@ -1888,7 +1897,7 @@ wheels = [
 
 [[package]]
 name = "litellm"
-version = "1.81.13"
+version = "1.83.10"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohttp" },
@@ -1904,9 +1913,9 @@ dependencies = [
     { name = "tiktoken" },
     { name = "tokenizers" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/72/80/b6cb799e7100953d848e106d0575db34c75bc3b57f31f2eefdfb1e23655f/litellm-1.81.13.tar.gz", hash = "sha256:083788d9c94e3371ff1c42e40e0e8198c497772643292a65b1bc91a3b3b537ea", size = 16562861, upload-time = "2026-02-17T02:00:47.466Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e2/16/fc51935e406887079f0d7c20427b9a15b9fc1d558e68b4e7072331b70db4/litellm-1.83.10.tar.gz", hash = "sha256:d54eaa98f93a1eb02decf593dbb525fa1ddd4cf03686c1d5c7bb69c2a9ba2a41", size = 14726546, upload-time = "2026-04-19T02:36:28.586Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/be/f3/fffb7932870163cea7addc392165647a9a8a5489967de486c854226f1141/litellm-1.81.13-py3-none-any.whl", hash = "sha256:ae4aea2a55e85993f5f6dd36d036519422d24812a1a3e8540d9e987f2d7a4304", size = 14587505, upload-time = "2026-02-17T02:00:44.22Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/58/8dd69d5b1ab11f206a9c9f21b6fd191bcdd4fb3ed90b8efbf3a1291fd47c/litellm-1.83.10-py3-none-any.whl", hash = "sha256:55203a7b5551efec8f2fccde29ee045ba057e768591e0b6b9fe1d12f00685ff8", size = 16334780, upload-time = "2026-04-19T02:36:25.274Z" },
 ]
 
 [[package]]
@@ -1944,82 +1953,82 @@ wheels = [
 
 [[package]]
 name = "lxml"
-version = "6.0.2"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/aa/88/262177de60548e5a2bfc46ad28232c9e9cbde697bd94132aeb80364675cb/lxml-6.0.2.tar.gz", hash = "sha256:cd79f3367bd74b317dda655dc8fcfa304d9eb6e4fb06b7168c5cf27f96e0cd62", size = 4073426, upload-time = "2025-09-22T04:04:59.287Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/f3/c8/8ff2bc6b920c84355146cd1ab7d181bc543b89241cfb1ebee824a7c81457/lxml-6.0.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:a59f5448ba2ceccd06995c95ea59a7674a10de0810f2ce90c9006f3cbc044456", size = 8661887, upload-time = "2025-09-22T04:01:17.265Z" },
-    { url = "https://files.pythonhosted.org/packages/37/6f/9aae1008083bb501ef63284220ce81638332f9ccbfa53765b2b7502203cf/lxml-6.0.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:e8113639f3296706fbac34a30813929e29247718e88173ad849f57ca59754924", size = 4667818, upload-time = "2025-09-22T04:01:19.688Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/ca/31fb37f99f37f1536c133476674c10b577e409c0a624384147653e38baf2/lxml-6.0.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:a8bef9b9825fa8bc816a6e641bb67219489229ebc648be422af695f6e7a4fa7f", size = 4950807, upload-time = "2025-09-22T04:01:21.487Z" },
-    { url = "https://files.pythonhosted.org/packages/da/87/f6cb9442e4bada8aab5ae7e1046264f62fdbeaa6e3f6211b93f4c0dd97f1/lxml-6.0.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:65ea18d710fd14e0186c2f973dc60bb52039a275f82d3c44a0e42b43440ea534", size = 5109179, upload-time = "2025-09-22T04:01:23.32Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/20/a7760713e65888db79bbae4f6146a6ae5c04e4a204a3c48896c408cd6ed2/lxml-6.0.2-cp312-cp312-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c371aa98126a0d4c739ca93ceffa0fd7a5d732e3ac66a46e74339acd4d334564", size = 5023044, upload-time = "2025-09-22T04:01:25.118Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/b0/7e64e0460fcb36471899f75831509098f3fd7cd02a3833ac517433cb4f8f/lxml-6.0.2-cp312-cp312-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:700efd30c0fa1a3581d80a748157397559396090a51d306ea59a70020223d16f", size = 5359685, upload-time = "2025-09-22T04:01:27.398Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/e1/e5df362e9ca4e2f48ed6411bd4b3a0ae737cc842e96877f5bf9428055ab4/lxml-6.0.2-cp312-cp312-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c33e66d44fe60e72397b487ee92e01da0d09ba2d66df8eae42d77b6d06e5eba0", size = 5654127, upload-time = "2025-09-22T04:01:29.629Z" },
-    { url = "https://files.pythonhosted.org/packages/c6/d1/232b3309a02d60f11e71857778bfcd4acbdb86c07db8260caf7d008b08f8/lxml-6.0.2-cp312-cp312-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:90a345bbeaf9d0587a3aaffb7006aa39ccb6ff0e96a57286c0cb2fd1520ea192", size = 5253958, upload-time = "2025-09-22T04:01:31.535Z" },
-    { url = "https://files.pythonhosted.org/packages/35/35/d955a070994725c4f7d80583a96cab9c107c57a125b20bb5f708fe941011/lxml-6.0.2-cp312-cp312-manylinux_2_31_armv7l.whl", hash = "sha256:064fdadaf7a21af3ed1dcaa106b854077fbeada827c18f72aec9346847cd65d0", size = 4711541, upload-time = "2025-09-22T04:01:33.801Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/be/667d17363b38a78c4bd63cfd4b4632029fd68d2c2dc81f25ce9eb5224dd5/lxml-6.0.2-cp312-cp312-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:fbc74f42c3525ac4ffa4b89cbdd00057b6196bcefe8bce794abd42d33a018092", size = 5267426, upload-time = "2025-09-22T04:01:35.639Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/47/62c70aa4a1c26569bc958c9ca86af2bb4e1f614e8c04fb2989833874f7ae/lxml-6.0.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:6ddff43f702905a4e32bc24f3f2e2edfe0f8fde3277d481bffb709a4cced7a1f", size = 5064917, upload-time = "2025-09-22T04:01:37.448Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/55/6ceddaca353ebd0f1908ef712c597f8570cc9c58130dbb89903198e441fd/lxml-6.0.2-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:6da5185951d72e6f5352166e3da7b0dc27aa70bd1090b0eb3f7f7212b53f1bb8", size = 4788795, upload-time = "2025-09-22T04:01:39.165Z" },
-    { url = "https://files.pythonhosted.org/packages/cf/e8/fd63e15da5e3fd4c2146f8bbb3c14e94ab850589beab88e547b2dbce22e1/lxml-6.0.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:57a86e1ebb4020a38d295c04fc79603c7899e0df71588043eb218722dabc087f", size = 5676759, upload-time = "2025-09-22T04:01:41.506Z" },
-    { url = "https://files.pythonhosted.org/packages/76/47/b3ec58dc5c374697f5ba37412cd2728f427d056315d124dd4b61da381877/lxml-6.0.2-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:2047d8234fe735ab77802ce5f2297e410ff40f5238aec569ad7c8e163d7b19a6", size = 5255666, upload-time = "2025-09-22T04:01:43.363Z" },
-    { url = "https://files.pythonhosted.org/packages/19/93/03ba725df4c3d72afd9596eef4a37a837ce8e4806010569bedfcd2cb68fd/lxml-6.0.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:6f91fd2b2ea15a6800c8e24418c0775a1694eefc011392da73bc6cef2623b322", size = 5277989, upload-time = "2025-09-22T04:01:45.215Z" },
-    { url = "https://files.pythonhosted.org/packages/c6/80/c06de80bfce881d0ad738576f243911fccf992687ae09fd80b734712b39c/lxml-6.0.2-cp312-cp312-win32.whl", hash = "sha256:3ae2ce7d6fedfb3414a2b6c5e20b249c4c607f72cb8d2bb7cc9c6ec7c6f4e849", size = 3611456, upload-time = "2025-09-22T04:01:48.243Z" },
-    { url = "https://files.pythonhosted.org/packages/f7/d7/0cdfb6c3e30893463fb3d1e52bc5f5f99684a03c29a0b6b605cfae879cd5/lxml-6.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:72c87e5ee4e58a8354fb9c7c84cbf95a1c8236c127a5d1b7683f04bed8361e1f", size = 4011793, upload-time = "2025-09-22T04:01:50.042Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/7b/93c73c67db235931527301ed3785f849c78991e2e34f3fd9a6663ffda4c5/lxml-6.0.2-cp312-cp312-win_arm64.whl", hash = "sha256:61cb10eeb95570153e0c0e554f58df92ecf5109f75eacad4a95baa709e26c3d6", size = 3672836, upload-time = "2025-09-22T04:01:52.145Z" },
-    { url = "https://files.pythonhosted.org/packages/53/fd/4e8f0540608977aea078bf6d79f128e0e2c2bba8af1acf775c30baa70460/lxml-6.0.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:9b33d21594afab46f37ae58dfadd06636f154923c4e8a4d754b0127554eb2e77", size = 8648494, upload-time = "2025-09-22T04:01:54.242Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/f4/2a94a3d3dfd6c6b433501b8d470a1960a20ecce93245cf2db1706adf6c19/lxml-6.0.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:6c8963287d7a4c5c9a432ff487c52e9c5618667179c18a204bdedb27310f022f", size = 4661146, upload-time = "2025-09-22T04:01:56.282Z" },
-    { url = "https://files.pythonhosted.org/packages/25/2e/4efa677fa6b322013035d38016f6ae859d06cac67437ca7dc708a6af7028/lxml-6.0.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:1941354d92699fb5ffe6ed7b32f9649e43c2feb4b97205f75866f7d21aa91452", size = 4946932, upload-time = "2025-09-22T04:01:58.989Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/0f/526e78a6d38d109fdbaa5049c62e1d32fdd70c75fb61c4eadf3045d3d124/lxml-6.0.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:bb2f6ca0ae2d983ded09357b84af659c954722bbf04dea98030064996d156048", size = 5100060, upload-time = "2025-09-22T04:02:00.812Z" },
-    { url = "https://files.pythonhosted.org/packages/81/76/99de58d81fa702cc0ea7edae4f4640416c2062813a00ff24bd70ac1d9c9b/lxml-6.0.2-cp313-cp313-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:eb2a12d704f180a902d7fa778c6d71f36ceb7b0d317f34cdc76a5d05aa1dd1df", size = 5019000, upload-time = "2025-09-22T04:02:02.671Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/35/9e57d25482bc9a9882cb0037fdb9cc18f4b79d85df94fa9d2a89562f1d25/lxml-6.0.2-cp313-cp313-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:6ec0e3f745021bfed19c456647f0298d60a24c9ff86d9d051f52b509663feeb1", size = 5348496, upload-time = "2025-09-22T04:02:04.904Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/8e/cb99bd0b83ccc3e8f0f528e9aa1f7a9965dfec08c617070c5db8d63a87ce/lxml-6.0.2-cp313-cp313-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:846ae9a12d54e368933b9759052d6206a9e8b250291109c48e350c1f1f49d916", size = 5643779, upload-time = "2025-09-22T04:02:06.689Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/34/9e591954939276bb679b73773836c6684c22e56d05980e31d52a9a8deb18/lxml-6.0.2-cp313-cp313-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ef9266d2aa545d7374938fb5c484531ef5a2ec7f2d573e62f8ce722c735685fd", size = 5244072, upload-time = "2025-09-22T04:02:08.587Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/27/b29ff065f9aaca443ee377aff699714fcbffb371b4fce5ac4ca759e436d5/lxml-6.0.2-cp313-cp313-manylinux_2_31_armv7l.whl", hash = "sha256:4077b7c79f31755df33b795dc12119cb557a0106bfdab0d2c2d97bd3cf3dffa6", size = 4718675, upload-time = "2025-09-22T04:02:10.783Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/9f/f756f9c2cd27caa1a6ef8c32ae47aadea697f5c2c6d07b0dae133c244fbe/lxml-6.0.2-cp313-cp313-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a7c5d5e5f1081955358533be077166ee97ed2571d6a66bdba6ec2f609a715d1a", size = 5255171, upload-time = "2025-09-22T04:02:12.631Z" },
-    { url = "https://files.pythonhosted.org/packages/61/46/bb85ea42d2cb1bd8395484fd72f38e3389611aa496ac7772da9205bbda0e/lxml-6.0.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:8f8d0cbd0674ee89863a523e6994ac25fd5be9c8486acfc3e5ccea679bad2679", size = 5057175, upload-time = "2025-09-22T04:02:14.718Z" },
-    { url = "https://files.pythonhosted.org/packages/95/0c/443fc476dcc8e41577f0af70458c50fe299a97bb6b7505bb1ae09aa7f9ac/lxml-6.0.2-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:2cbcbf6d6e924c28f04a43f3b6f6e272312a090f269eff68a2982e13e5d57659", size = 4785688, upload-time = "2025-09-22T04:02:16.957Z" },
-    { url = "https://files.pythonhosted.org/packages/48/78/6ef0b359d45bb9697bc5a626e1992fa5d27aa3f8004b137b2314793b50a0/lxml-6.0.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:dfb874cfa53340009af6bdd7e54ebc0d21012a60a4e65d927c2e477112e63484", size = 5660655, upload-time = "2025-09-22T04:02:18.815Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/ea/e1d33808f386bc1339d08c0dcada6e4712d4ed8e93fcad5f057070b7988a/lxml-6.0.2-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:fb8dae0b6b8b7f9e96c26fdd8121522ce5de9bb5538010870bd538683d30e9a2", size = 5247695, upload-time = "2025-09-22T04:02:20.593Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/47/eba75dfd8183673725255247a603b4ad606f4ae657b60c6c145b381697da/lxml-6.0.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:358d9adae670b63e95bc59747c72f4dc97c9ec58881d4627fe0120da0f90d314", size = 5269841, upload-time = "2025-09-22T04:02:22.489Z" },
-    { url = "https://files.pythonhosted.org/packages/76/04/5c5e2b8577bc936e219becb2e98cdb1aca14a4921a12995b9d0c523502ae/lxml-6.0.2-cp313-cp313-win32.whl", hash = "sha256:e8cd2415f372e7e5a789d743d133ae474290a90b9023197fd78f32e2dc6873e2", size = 3610700, upload-time = "2025-09-22T04:02:24.465Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/0a/4643ccc6bb8b143e9f9640aa54e38255f9d3b45feb2cbe7ae2ca47e8782e/lxml-6.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:b30d46379644fbfc3ab81f8f82ae4de55179414651f110a1514f0b1f8f6cb2d7", size = 4010347, upload-time = "2025-09-22T04:02:26.286Z" },
-    { url = "https://files.pythonhosted.org/packages/31/ef/dcf1d29c3f530577f61e5fe2f1bd72929acf779953668a8a47a479ae6f26/lxml-6.0.2-cp313-cp313-win_arm64.whl", hash = "sha256:13dcecc9946dca97b11b7c40d29fba63b55ab4170d3c0cf8c0c164343b9bfdcf", size = 3671248, upload-time = "2025-09-22T04:02:27.918Z" },
-    { url = "https://files.pythonhosted.org/packages/03/15/d4a377b385ab693ce97b472fe0c77c2b16ec79590e688b3ccc71fba19884/lxml-6.0.2-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:b0c732aa23de8f8aec23f4b580d1e52905ef468afb4abeafd3fec77042abb6fe", size = 8659801, upload-time = "2025-09-22T04:02:30.113Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/e8/c128e37589463668794d503afaeb003987373c5f94d667124ffd8078bbd9/lxml-6.0.2-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:4468e3b83e10e0317a89a33d28f7aeba1caa4d1a6fd457d115dd4ffe90c5931d", size = 4659403, upload-time = "2025-09-22T04:02:32.119Z" },
-    { url = "https://files.pythonhosted.org/packages/00/ce/74903904339decdf7da7847bb5741fc98a5451b42fc419a86c0c13d26fe2/lxml-6.0.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:abd44571493973bad4598a3be7e1d807ed45aa2adaf7ab92ab7c62609569b17d", size = 4966974, upload-time = "2025-09-22T04:02:34.155Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/d3/131dec79ce61c5567fecf82515bd9bc36395df42501b50f7f7f3bd065df0/lxml-6.0.2-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:370cd78d5855cfbffd57c422851f7d3864e6ae72d0da615fca4dad8c45d375a5", size = 5102953, upload-time = "2025-09-22T04:02:36.054Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/ea/a43ba9bb750d4ffdd885f2cd333572f5bb900cd2408b67fdda07e85978a0/lxml-6.0.2-cp314-cp314-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:901e3b4219fa04ef766885fb40fa516a71662a4c61b80c94d25336b4934b71c0", size = 5055054, upload-time = "2025-09-22T04:02:38.154Z" },
-    { url = "https://files.pythonhosted.org/packages/60/23/6885b451636ae286c34628f70a7ed1fcc759f8d9ad382d132e1c8d3d9bfd/lxml-6.0.2-cp314-cp314-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:a4bf42d2e4cf52c28cc1812d62426b9503cdb0c87a6de81442626aa7d69707ba", size = 5352421, upload-time = "2025-09-22T04:02:40.413Z" },
-    { url = "https://files.pythonhosted.org/packages/48/5b/fc2ddfc94ddbe3eebb8e9af6e3fd65e2feba4967f6a4e9683875c394c2d8/lxml-6.0.2-cp314-cp314-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:b2c7fdaa4d7c3d886a42534adec7cfac73860b89b4e5298752f60aa5984641a0", size = 5673684, upload-time = "2025-09-22T04:02:42.288Z" },
-    { url = "https://files.pythonhosted.org/packages/29/9c/47293c58cc91769130fbf85531280e8cc7868f7fbb6d92f4670071b9cb3e/lxml-6.0.2-cp314-cp314-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:98a5e1660dc7de2200b00d53fa00bcd3c35a3608c305d45a7bbcaf29fa16e83d", size = 5252463, upload-time = "2025-09-22T04:02:44.165Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/da/ba6eceb830c762b48e711ded880d7e3e89fc6c7323e587c36540b6b23c6b/lxml-6.0.2-cp314-cp314-manylinux_2_31_armv7l.whl", hash = "sha256:dc051506c30b609238d79eda75ee9cab3e520570ec8219844a72a46020901e37", size = 4698437, upload-time = "2025-09-22T04:02:46.524Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/24/7be3f82cb7990b89118d944b619e53c656c97dc89c28cfb143fdb7cd6f4d/lxml-6.0.2-cp314-cp314-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:8799481bbdd212470d17513a54d568f44416db01250f49449647b5ab5b5dccb9", size = 5269890, upload-time = "2025-09-22T04:02:48.812Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/bd/dcfb9ea1e16c665efd7538fc5d5c34071276ce9220e234217682e7d2c4a5/lxml-6.0.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:9261bb77c2dab42f3ecd9103951aeca2c40277701eb7e912c545c1b16e0e4917", size = 5097185, upload-time = "2025-09-22T04:02:50.746Z" },
-    { url = "https://files.pythonhosted.org/packages/21/04/a60b0ff9314736316f28316b694bccbbabe100f8483ad83852d77fc7468e/lxml-6.0.2-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:65ac4a01aba353cfa6d5725b95d7aed6356ddc0a3cd734de00124d285b04b64f", size = 4745895, upload-time = "2025-09-22T04:02:52.968Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/bd/7d54bd1846e5a310d9c715921c5faa71cf5c0853372adf78aee70c8d7aa2/lxml-6.0.2-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:b22a07cbb82fea98f8a2fd814f3d1811ff9ed76d0fc6abc84eb21527596e7cc8", size = 5695246, upload-time = "2025-09-22T04:02:54.798Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/32/5643d6ab947bc371da21323acb2a6e603cedbe71cb4c99c8254289ab6f4e/lxml-6.0.2-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:d759cdd7f3e055d6bc8d9bec3ad905227b2e4c785dc16c372eb5b5e83123f48a", size = 5260797, upload-time = "2025-09-22T04:02:57.058Z" },
-    { url = "https://files.pythonhosted.org/packages/33/da/34c1ec4cff1eea7d0b4cd44af8411806ed943141804ac9c5d565302afb78/lxml-6.0.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:945da35a48d193d27c188037a05fec5492937f66fb1958c24fc761fb9d40d43c", size = 5277404, upload-time = "2025-09-22T04:02:58.966Z" },
-    { url = "https://files.pythonhosted.org/packages/82/57/4eca3e31e54dc89e2c3507e1cd411074a17565fa5ffc437c4ae0a00d439e/lxml-6.0.2-cp314-cp314-win32.whl", hash = "sha256:be3aaa60da67e6153eb15715cc2e19091af5dc75faef8b8a585aea372507384b", size = 3670072, upload-time = "2025-09-22T04:03:38.05Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/e0/c96cf13eccd20c9421ba910304dae0f619724dcf1702864fd59dd386404d/lxml-6.0.2-cp314-cp314-win_amd64.whl", hash = "sha256:fa25afbadead523f7001caf0c2382afd272c315a033a7b06336da2637d92d6ed", size = 4080617, upload-time = "2025-09-22T04:03:39.835Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/5d/b3f03e22b3d38d6f188ef044900a9b29b2fe0aebb94625ce9fe244011d34/lxml-6.0.2-cp314-cp314-win_arm64.whl", hash = "sha256:063eccf89df5b24e361b123e257e437f9e9878f425ee9aae3144c77faf6da6d8", size = 3754930, upload-time = "2025-09-22T04:03:41.565Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/5c/42c2c4c03554580708fc738d13414801f340c04c3eff90d8d2d227145275/lxml-6.0.2-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:6162a86d86893d63084faaf4ff937b3daea233e3682fb4474db07395794fa80d", size = 8910380, upload-time = "2025-09-22T04:03:01.645Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/4f/12df843e3e10d18d468a7557058f8d3733e8b6e12401f30b1ef29360740f/lxml-6.0.2-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:414aaa94e974e23a3e92e7ca5b97d10c0cf37b6481f50911032c69eeb3991bba", size = 4775632, upload-time = "2025-09-22T04:03:03.814Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/0c/9dc31e6c2d0d418483cbcb469d1f5a582a1cd00a1f4081953d44051f3c50/lxml-6.0.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:48461bd21625458dd01e14e2c38dd0aea69addc3c4f960c30d9f59d7f93be601", size = 4975171, upload-time = "2025-09-22T04:03:05.651Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/2b/9b870c6ca24c841bdd887504808f0417aa9d8d564114689266f19ddf29c8/lxml-6.0.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:25fcc59afc57d527cfc78a58f40ab4c9b8fd096a9a3f964d2781ffb6eb33f4ed", size = 5110109, upload-time = "2025-09-22T04:03:07.452Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/0c/4f5f2a4dd319a178912751564471355d9019e220c20d7db3fb8307ed8582/lxml-6.0.2-cp314-cp314t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5179c60288204e6ddde3f774a93350177e08876eaf3ab78aa3a3649d43eb7d37", size = 5041061, upload-time = "2025-09-22T04:03:09.297Z" },
-    { url = "https://files.pythonhosted.org/packages/12/64/554eed290365267671fe001a20d72d14f468ae4e6acef1e179b039436967/lxml-6.0.2-cp314-cp314t-manylinux_2_26_i686.manylinux_2_28_i686.whl", hash = "sha256:967aab75434de148ec80597b75062d8123cadf2943fb4281f385141e18b21338", size = 5306233, upload-time = "2025-09-22T04:03:11.651Z" },
-    { url = "https://files.pythonhosted.org/packages/7a/31/1d748aa275e71802ad9722df32a7a35034246b42c0ecdd8235412c3396ef/lxml-6.0.2-cp314-cp314t-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:d100fcc8930d697c6561156c6810ab4a508fb264c8b6779e6e61e2ed5e7558f9", size = 5604739, upload-time = "2025-09-22T04:03:13.592Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/41/2c11916bcac09ed561adccacceaedd2bf0e0b25b297ea92aab99fd03d0fa/lxml-6.0.2-cp314-cp314t-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2ca59e7e13e5981175b8b3e4ab84d7da57993eeff53c07764dcebda0d0e64ecd", size = 5225119, upload-time = "2025-09-22T04:03:15.408Z" },
-    { url = "https://files.pythonhosted.org/packages/99/05/4e5c2873d8f17aa018e6afde417c80cc5d0c33be4854cce3ef5670c49367/lxml-6.0.2-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:957448ac63a42e2e49531b9d6c0fa449a1970dbc32467aaad46f11545be9af1d", size = 4633665, upload-time = "2025-09-22T04:03:17.262Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/c9/dcc2da1bebd6275cdc723b515f93edf548b82f36a5458cca3578bc899332/lxml-6.0.2-cp314-cp314t-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b7fc49c37f1786284b12af63152fe1d0990722497e2d5817acfe7a877522f9a9", size = 5234997, upload-time = "2025-09-22T04:03:19.14Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/e2/5172e4e7468afca64a37b81dba152fc5d90e30f9c83c7c3213d6a02a5ce4/lxml-6.0.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e19e0643cc936a22e837f79d01a550678da8377d7d801a14487c10c34ee49c7e", size = 5090957, upload-time = "2025-09-22T04:03:21.436Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/b3/15461fd3e5cd4ddcb7938b87fc20b14ab113b92312fc97afe65cd7c85de1/lxml-6.0.2-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:1db01e5cf14345628e0cbe71067204db658e2fb8e51e7f33631f5f4735fefd8d", size = 4764372, upload-time = "2025-09-22T04:03:23.27Z" },
-    { url = "https://files.pythonhosted.org/packages/05/33/f310b987c8bf9e61c4dd8e8035c416bd3230098f5e3cfa69fc4232de7059/lxml-6.0.2-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:875c6b5ab39ad5291588aed6925fac99d0097af0dd62f33c7b43736043d4a2ec", size = 5634653, upload-time = "2025-09-22T04:03:25.767Z" },
-    { url = "https://files.pythonhosted.org/packages/70/ff/51c80e75e0bc9382158133bdcf4e339b5886c6ee2418b5199b3f1a61ed6d/lxml-6.0.2-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:cdcbed9ad19da81c480dfd6dd161886db6096083c9938ead313d94b30aadf272", size = 5233795, upload-time = "2025-09-22T04:03:27.62Z" },
-    { url = "https://files.pythonhosted.org/packages/56/4d/4856e897df0d588789dd844dbed9d91782c4ef0b327f96ce53c807e13128/lxml-6.0.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:80dadc234ebc532e09be1975ff538d154a7fa61ea5031c03d25178855544728f", size = 5257023, upload-time = "2025-09-22T04:03:30.056Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/85/86766dfebfa87bea0ab78e9ff7a4b4b45225df4b4d3b8cc3c03c5cd68464/lxml-6.0.2-cp314-cp314t-win32.whl", hash = "sha256:da08e7bb297b04e893d91087df19638dc7a6bb858a954b0cc2b9f5053c922312", size = 3911420, upload-time = "2025-09-22T04:03:32.198Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/1a/b248b355834c8e32614650b8008c69ffeb0ceb149c793961dd8c0b991bb3/lxml-6.0.2-cp314-cp314t-win_amd64.whl", hash = "sha256:252a22982dca42f6155125ac76d3432e548a7625d56f5a273ee78a5057216eca", size = 4406837, upload-time = "2025-09-22T04:03:34.027Z" },
-    { url = "https://files.pythonhosted.org/packages/92/aa/df863bcc39c5e0946263454aba394de8a9084dbaff8ad143846b0d844739/lxml-6.0.2-cp314-cp314t-win_arm64.whl", hash = "sha256:bb4c1847b303835d89d785a18801a883436cdfd5dc3d62947f9c49e24f0f5a2c", size = 3822205, upload-time = "2025-09-22T04:03:36.249Z" },
+version = "6.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/28/30/9abc9e34c657c33834eaf6cd02124c61bdf5944d802aa48e69be8da3585d/lxml-6.1.0.tar.gz", hash = "sha256:bfd57d8008c4965709a919c3e9a98f76c2c7cb319086b3d26858250620023b13", size = 4197006, upload-time = "2026-04-18T04:32:51.613Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d2/d4/9326838b59dc36dfae42eec9656b97520f9997eee1de47b8316aaeed169c/lxml-6.1.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:d2f17a16cd8751e8eb233a7e41aecdf8e511712e00088bf9be455f604cd0d28d", size = 8570663, upload-time = "2026-04-18T04:27:48.253Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/a4/053745ce1f8303ccbb788b86c0db3a91b973675cefc42566a188637b7c40/lxml-6.1.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:f0cea5b1d3e6e77d71bd2b9972eb2446221a69dc52bb0b9c3c6f6e5700592d93", size = 4624024, upload-time = "2026-04-18T04:27:52.594Z" },
+    { url = "https://files.pythonhosted.org/packages/90/97/a517944b20f8fd0932ad2109482bee4e29fe721416387a363306667941f6/lxml-6.1.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:fc46da94826188ed45cb53bd8e3fc076ae22675aea2087843d4735627f867c6d", size = 4930895, upload-time = "2026-04-18T04:32:56.29Z" },
+    { url = "https://files.pythonhosted.org/packages/94/7c/e08a970727d556caa040a44773c7b7e3ad0f0d73dedc863543e9a8b931f2/lxml-6.1.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:9147d8e386ec3b82c3b15d88927f734f565b0aaadef7def562b853adca45784a", size = 5093820, upload-time = "2026-04-18T04:32:58.94Z" },
+    { url = "https://files.pythonhosted.org/packages/88/ee/2a5c2aa2c32016a226ca25d3e1056a8102ea6e1fe308bf50213586635400/lxml-6.1.0-cp312-cp312-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5715e0e28736a070f3f34a7ccc09e2fdcba0e3060abbcf61a1a5718ff6d6b105", size = 5005790, upload-time = "2026-04-18T04:33:01.272Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/38/a0db9be8f38ad6043ab9429487c128dd1d30f07956ef43040402f8da49e8/lxml-6.1.0-cp312-cp312-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:4937460dc5df0cdd2f06a86c285c28afda06aefa3af949f9477d3e8df430c485", size = 5630827, upload-time = "2026-04-18T04:33:04.036Z" },
+    { url = "https://files.pythonhosted.org/packages/31/ba/3c13d3fc24b7cacf675f808a3a1baabf43a30d0cd24c98f94548e9aa58eb/lxml-6.1.0-cp312-cp312-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bc783ee3147e60a25aa0445ea82b3e8aabb83b240f2b95d32cb75587ff781814", size = 5240445, upload-time = "2026-04-18T04:33:06.87Z" },
+    { url = "https://files.pythonhosted.org/packages/55/ba/eeef4ccba09b2212fe239f46c1692a98db1878e0872ae320756488878a94/lxml-6.1.0-cp312-cp312-manylinux_2_28_i686.whl", hash = "sha256:40d9189f80075f2e1f88db21ef815a2b17b28adf8e50aaf5c789bfe737027f32", size = 5350121, upload-time = "2026-04-18T04:33:09.365Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/01/1da87c7b587c38d0cbe77a01aae3b9c1c49ed47d76918ef3db8fc151b1ca/lxml-6.1.0-cp312-cp312-manylinux_2_31_armv7l.whl", hash = "sha256:05b9b8787e35bec69e68daf4952b2e6dfcfb0db7ecf1a06f8cdfbbac4eb71aad", size = 4694949, upload-time = "2026-04-18T04:33:11.628Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/88/7db0fe66d5aaf128443ee1623dec3db1576f3e4c17751ec0ef5866468590/lxml-6.1.0-cp312-cp312-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0f0f08beb0182e3e9a86fae124b3c47a7b41b7b69b225e1377db983802404e54", size = 5243901, upload-time = "2026-04-18T04:33:13.95Z" },
+    { url = "https://files.pythonhosted.org/packages/00/a8/1346726af7d1f6fca1f11223ba34001462b0a3660416986d37641708d57c/lxml-6.1.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:73becf6d8c81d4c76b1014dbd3584cb26d904492dcf73ca85dc8bff08dcd6d2d", size = 5048054, upload-time = "2026-04-18T04:33:16.965Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/b7/85057012f035d1a0c87e02f8c723ca3c3e6e0728bcf4cb62080b21b1c1e3/lxml-6.1.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:1ae225f66e5938f4fa29d37e009a3bb3b13032ac57eb4eb42afa44f6e4054e69", size = 4777324, upload-time = "2026-04-18T04:33:19.832Z" },
+    { url = "https://files.pythonhosted.org/packages/75/6c/ad2f94a91073ef570f33718040e8e160d5fb93331cf1ab3ca1323f939e2d/lxml-6.1.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:690022c7fae793b0489aa68a658822cea83e0d5933781811cabbf5ea3bcfe73d", size = 5645702, upload-time = "2026-04-18T04:33:22.436Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/89/0bb6c0bd549c19004c60eea9dc554dd78fd647b72314ef25d460e0d208c6/lxml-6.1.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:63aeafc26aac0be8aff14af7871249e87ea1319be92090bfd632ec68e03b16a5", size = 5232901, upload-time = "2026-04-18T04:33:26.21Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/d9/d609a11fb567da9399f525193e2b49847b5a409cdebe737f06a8b7126bdc/lxml-6.1.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:264c605ab9c0e4aa1a679636f4582c4d3313700009fac3ec9c3412ed0d8f3e1d", size = 5261333, upload-time = "2026-04-18T04:33:28.984Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/3a/ac3f99ec8ac93089e7dd556f279e0d14c24de0a74a507e143a2e4b496e7c/lxml-6.1.0-cp312-cp312-win32.whl", hash = "sha256:56971379bc5ee8037c5a0f09fa88f66cdb7d37c3e38af3e45cf539f41131ac1f", size = 3596289, upload-time = "2026-04-18T04:27:42.819Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/a7/0a915557538593cb1bbeedcd40e13c7a261822c26fecbbdb71dad0c2f540/lxml-6.1.0-cp312-cp312-win_amd64.whl", hash = "sha256:bba078de0031c219e5dd06cf3e6bf8fb8e6e64a77819b358f53bb132e3e03366", size = 3997059, upload-time = "2026-04-18T04:27:46.764Z" },
+    { url = "https://files.pythonhosted.org/packages/92/96/a5dc078cf0126fbfbc35611d77ecd5da80054b5893e28fb213a5613b9e1d/lxml-6.1.0-cp312-cp312-win_arm64.whl", hash = "sha256:c3592631e652afa34999a088f98ba7dfc7d6aff0d535c410bea77a71743f3819", size = 3659552, upload-time = "2026-04-18T04:27:51.133Z" },
+    { url = "https://files.pythonhosted.org/packages/08/03/69347590f1cf4a6d5a4944bb6099e6d37f334784f16062234e1f892fdb1d/lxml-6.1.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:a0092f2b107b69601adf562a57c956fbb596e05e3e6651cabd3054113b007e45", size = 8559689, upload-time = "2026-04-18T04:31:57.785Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/58/25e00bb40b185c974cfe156c110474d9a8a8390d5f7c92a4e328189bb60e/lxml-6.1.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:fc7140d7a7386e6b545d41b7358f4d02b656d4053f5fa6859f92f4b9c2572c4d", size = 4617892, upload-time = "2026-04-18T04:32:01.78Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/54/92ad98a94ac318dc4f97aaac22ff8d1b94212b2ae8af5b6e9b354bf825f7/lxml-6.1.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:419c58fc92cc3a2c3fa5f78c63dbf5da70c1fa9c1b25f25727ecee89a96c7de2", size = 4923489, upload-time = "2026-04-18T04:33:31.401Z" },
+    { url = "https://files.pythonhosted.org/packages/15/3b/a20aecfab42bdf4f9b390590d345857ad3ffd7c51988d1c89c53a0c73faf/lxml-6.1.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:37fabd1452852636cf38ecdcc9dd5ca4bba7a35d6c53fa09725deeb894a87491", size = 5082162, upload-time = "2026-04-18T04:33:34.262Z" },
+    { url = "https://files.pythonhosted.org/packages/45/26/2cdb3d281ac1bd175603e290cbe4bad6eff127c0f8de90bafd6f8548f0fd/lxml-6.1.0-cp313-cp313-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a2853c8b2170cc6cd54a6b4d50d2c1a8a7aeca201f23804b4898525c7a152cfc", size = 4993247, upload-time = "2026-04-18T04:33:36.674Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/05/d735aef963740022a08185c84821f689fc903acb3d50326e6b1e9886cc22/lxml-6.1.0-cp313-cp313-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8e369cbd690e788c8d15e56222d91a09c6a417f49cbc543040cba0fe2e25a79e", size = 5613042, upload-time = "2026-04-18T04:33:39.205Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/b8/ead7c10efff731738c72e59ed6eb5791854879fbed7ae98781a12006263a/lxml-6.1.0-cp313-cp313-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e69aa6805905807186eb00e66c6d97a935c928275182eb02ee40ba00da9623b2", size = 5228304, upload-time = "2026-04-18T04:33:41.647Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/10/e9842d2ec322ea65f0a7270aa0315a53abed06058b88ef1b027f620e7a5f/lxml-6.1.0-cp313-cp313-manylinux_2_28_i686.whl", hash = "sha256:4bd1bdb8a9e0e2dd229de19b5f8aebac80e916921b4b2c6ef8a52bc131d0c1f9", size = 5341578, upload-time = "2026-04-18T04:33:44.596Z" },
+    { url = "https://files.pythonhosted.org/packages/89/54/40d9403d7c2775fa7301d3ddd3464689bfe9ba71acc17dfff777071b4fdc/lxml-6.1.0-cp313-cp313-manylinux_2_31_armv7l.whl", hash = "sha256:cbd7b79cdcb4986ad78a2662625882747f09db5e4cd7b2ae178a88c9c51b3dfe", size = 4700209, upload-time = "2026-04-18T04:33:47.552Z" },
+    { url = "https://files.pythonhosted.org/packages/85/b2/bbdcc2cf45dfc7dfffef4fd97e5c47b15919b6a365247d95d6f684ef5e82/lxml-6.1.0-cp313-cp313-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:43e4d297f11080ec9d64a4b1ad7ac02b4484c9f0e2179d9c4ef78e886e747b88", size = 5232365, upload-time = "2026-04-18T04:33:50.249Z" },
+    { url = "https://files.pythonhosted.org/packages/48/5a/b06875665e53aaba7127611a7bed3b7b9658e20b22bc2dd217a0b7ab0091/lxml-6.1.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:cc16682cc987a3da00aa56a3aa3075b08edb10d9b1e476938cfdbee8f3b67181", size = 5043654, upload-time = "2026-04-18T04:33:52.71Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/9c/e71a069d09641c1a7abeb30e693f828c7c90a41cbe3d650b2d734d876f85/lxml-6.1.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:d6d8efe71429635f0559579092bb5e60560d7b9115ee38c4adbea35632e7fa24", size = 4769326, upload-time = "2026-04-18T04:33:55.244Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/06/7a9cd84b3d4ed79adf35f874750abb697dec0b4a81a836037b36e47c091a/lxml-6.1.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:7e39ab3a28af7784e206d8606ec0e4bcad0190f63a492bca95e94e5a4aef7f6e", size = 5635879, upload-time = "2026-04-18T04:33:58.509Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/f0/9d57916befc1e54c451712c7ee48e9e74e80ae4d03bdce49914e0aee42cd/lxml-6.1.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:9eb667bf50856c4a58145f8ca2d5e5be160191e79eb9e30855a476191b3c3495", size = 5224048, upload-time = "2026-04-18T04:34:00.943Z" },
+    { url = "https://files.pythonhosted.org/packages/99/75/90c4eefda0c08c92221fe0753db2d6699a4c628f76ff4465ec20dea84cc1/lxml-6.1.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:7f4a77d6f7edf9230cee3e1f7f6764722a41604ee5681844f18db9a81ea0ec33", size = 5250241, upload-time = "2026-04-18T04:34:03.365Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/73/16596f7e4e38fa33084b9ccbccc22a15f82a290a055126f2c1541236d2ff/lxml-6.1.0-cp313-cp313-win32.whl", hash = "sha256:28902146ffbe5222df411c5d19e5352490122e14447e98cd118907ee3fd6ee62", size = 3596938, upload-time = "2026-04-18T04:31:56.206Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/63/981401c5680c1eb30893f00a19641ac80db5d1e7086c62cb4b13ed813038/lxml-6.1.0-cp313-cp313-win_amd64.whl", hash = "sha256:4a1503c56e4e2b38dc76f2f2da7bae69670c0f1933e27cfa34b2fa5876410b16", size = 3995728, upload-time = "2026-04-18T04:31:58.763Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/e8/c358a38ac3e541d16a1b527e4e9cb78c0419b0506a070ace11777e5e8404/lxml-6.1.0-cp313-cp313-win_arm64.whl", hash = "sha256:e0af85773850417d994d019741239b901b22c6680206f46a34766926e466141d", size = 3658372, upload-time = "2026-04-18T04:32:03.629Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/45/cee4cf203ef0bab5c52afc118da61d6b460c928f2893d40023cfa27e0b80/lxml-6.1.0-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:ab863fd37458fed6456525f297d21239d987800c46e67da5ef04fc6b3dd93ac8", size = 8576713, upload-time = "2026-04-18T04:32:06.831Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/a7/eda05babeb7e046839204eaf254cd4d7c9130ce2bbf0d9e90ea41af5654d/lxml-6.1.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:6fd8b1df8254ff4fd93fd31da1fc15770bde23ac045be9bb1f87425702f61cc9", size = 4623874, upload-time = "2026-04-18T04:32:10.755Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/e9/db5846de9b436b91890a62f29d80cd849ea17948a49bf532d5278ee69a9e/lxml-6.1.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:47024feaae386a92a146af0d2aeed65229bf6fff738e6a11dda6b0015fb8fd03", size = 4949535, upload-time = "2026-04-18T04:34:06.657Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/ba/0d3593373dcae1d68f40dc3c41a5a92f2544e68115eb2f62319a4c2a6500/lxml-6.1.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:3f00972f84450204cd5d93a5395965e348956aaceaadec693a22ec743f8ae3eb", size = 5086881, upload-time = "2026-04-18T04:34:09.556Z" },
+    { url = "https://files.pythonhosted.org/packages/43/76/759a7484539ad1af0d125a9afe9c3fb5f82a8779fd1f5f56319d9e4ea2fd/lxml-6.1.0-cp314-cp314-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:97faa0860e13b05b15a51fb4986421ef7a30f0b3334061c416e0981e9450ca4c", size = 5031305, upload-time = "2026-04-18T04:34:12.336Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/b9/c1f0daf981a11e47636126901fd4ab82429e18c57aeb0fc3ad2940b42d8b/lxml-6.1.0-cp314-cp314-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:972a6451204798675407beaad97b868d0c733d9a74dafefc63120b81b8c2de28", size = 5647522, upload-time = "2026-04-18T04:34:14.89Z" },
+    { url = "https://files.pythonhosted.org/packages/31/e6/1f533dcd205275363d9ba3511bcec52fa2df86abf8abe6a5f2c599f0dc31/lxml-6.1.0-cp314-cp314-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fe022f20bc4569ec66b63b3fb275a3d628d9d32da6326b2982584104db6d3086", size = 5239310, upload-time = "2026-04-18T04:34:17.652Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/8c/4175fb709c78a6e315ed814ed33be3defd8b8721067e70419a6cf6f971da/lxml-6.1.0-cp314-cp314-manylinux_2_28_i686.whl", hash = "sha256:75c4c7c619a744f972f4451bf5adf6d0fb00992a1ffc9fd78e13b0bc817cc99f", size = 5350799, upload-time = "2026-04-18T04:34:20.529Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/77/6ffdebc5994975f0dde4acb59761902bd9d9bb84422b9a0bd239a7da9ca8/lxml-6.1.0-cp314-cp314-manylinux_2_31_armv7l.whl", hash = "sha256:3648f20d25102a22b6061c688beb3a805099ea4beb0a01ce62975d926944d292", size = 4697693, upload-time = "2026-04-18T04:34:23.541Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/f1/565f36bd5c73294602d48e04d23f81ff4c8736be6ba5e1d1ec670ac9be80/lxml-6.1.0-cp314-cp314-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:77b9f99b17cbf14026d1e618035077060fc7195dd940d025149f3e2e830fbfcb", size = 5250708, upload-time = "2026-04-18T04:34:26.001Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/11/a68ab9dd18c5c499404deb4005f4bc4e0e88e5b72cd755ad96efec81d18d/lxml-6.1.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:32662519149fd7a9db354175aa5e417d83485a8039b8aaa62f873ceee7ea4cad", size = 5084737, upload-time = "2026-04-18T04:34:28.32Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/78/e8f41e2c74f4af564e6a0348aea69fb6daaefa64bc071ef469823d22cc18/lxml-6.1.0-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:73d658216fc173cf2c939e90e07b941c5e12736b0bf6a99e7af95459cfe8eabb", size = 4737817, upload-time = "2026-04-18T04:34:30.784Z" },
+    { url = "https://files.pythonhosted.org/packages/06/2d/aa4e117aa2ce2f3b35d9ff246be74a2f8e853baba5d2a92c64744474603a/lxml-6.1.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:ac4db068889f8772a4a698c5980ec302771bb545e10c4b095d4c8be26749616f", size = 5670753, upload-time = "2026-04-18T04:34:33.675Z" },
+    { url = "https://files.pythonhosted.org/packages/08/f5/dd745d50c0409031dbfcc4881740542a01e54d6f0110bd420fa7782110b8/lxml-6.1.0-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:45e9dfbd1b661eb64ba0d4dbe762bd210c42d86dd1e5bd2bdf89d634231beb43", size = 5238071, upload-time = "2026-04-18T04:34:36.12Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/74/ad424f36d0340a904665867dab310a3f1f4c96ff4039698de83b77f44c1f/lxml-6.1.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:89e8d73d09ac696a5ba42ec69787913d53284f12092f651506779314f10ba585", size = 5264319, upload-time = "2026-04-18T04:34:39.035Z" },
+    { url = "https://files.pythonhosted.org/packages/53/36/a15d8b3514ec889bfd6aa3609107fcb6c9189f8dc347f1c0b81eded8d87c/lxml-6.1.0-cp314-cp314-win32.whl", hash = "sha256:ebe33f4ec1b2de38ceb225a1749a2965855bffeef435ba93cd2d5d540783bf2f", size = 3657139, upload-time = "2026-04-18T04:32:20.006Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/a4/263ebb0710851a3c6c937180a9a86df1206fdfe53cc43005aa2237fd7736/lxml-6.1.0-cp314-cp314-win_amd64.whl", hash = "sha256:398443df51c538bd578529aa7e5f7afc6c292644174b47961f3bf87fe5741120", size = 4064195, upload-time = "2026-04-18T04:32:23.876Z" },
+    { url = "https://files.pythonhosted.org/packages/80/68/2000f29d323b6c286de077ad20b429fc52272e44eae6d295467043e56012/lxml-6.1.0-cp314-cp314-win_arm64.whl", hash = "sha256:8c8984e1d8c4b3949e419158fda14d921ff703a9ed8a47236c6eb7a2b6cb4946", size = 3741870, upload-time = "2026-04-18T04:32:27.922Z" },
+    { url = "https://files.pythonhosted.org/packages/30/e9/21383c7c8d43799f0da90224c0d7c921870d476ec9b3e01e1b2c0b8237c5/lxml-6.1.0-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:1081dd10bc6fa437db2500e13993abf7cc30716d0a2f40e65abb935f02ec559c", size = 8827548, upload-time = "2026-04-18T04:32:15.094Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/01/c6bc11cd587030dd4f719f65c5657960649fe3e19196c844c75bf32cd0d6/lxml-6.1.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:dabecc48db5f42ba348d1f5d5afdc54c6c4cc758e676926c7cd327045749517d", size = 4735866, upload-time = "2026-04-18T04:32:18.924Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/01/757132fff5f4acf25463b5298f1a46099f3a94480b806547b29ce5e385de/lxml-6.1.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:e3dd5fe19c9e0ac818a9c7f132a5e43c1339ec1cbbfecb1a938bd3a47875b7c9", size = 4969476, upload-time = "2026-04-18T04:34:41.889Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/fb/1bc8b9d27ed64be7c8903db6c89e74dc8c2cd9ec630a7462e4654316dc5b/lxml-6.1.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:9e7b0a4ca6dcc007a4cef00a761bba2dea959de4bd2df98f926b33c92ca5dfb9", size = 5103719, upload-time = "2026-04-18T04:34:44.797Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/e7/5bf82fa28133536a54601aae633b14988e89ed61d4c1eb6b899b023233aa/lxml-6.1.0-cp314-cp314t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5d27bbe326c6b539c64b42638b18bc6003a8d88f76213a97ac9ed4f885efeab7", size = 5027890, upload-time = "2026-04-18T04:34:47.634Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/20/e048db5d4b4ea0366648aa595f26bb764b2670903fc585b87436d0a5032c/lxml-6.1.0-cp314-cp314t-manylinux_2_26_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c4e425db0c5445ef0ad56b0eec54f89b88b2d884656e536a90b2f52aecb4ca86", size = 5596008, upload-time = "2026-04-18T04:34:51.503Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/c2/d10807bc8da4824b39e5bd01b5d05c077b6fd01bd91584167edf6b269d22/lxml-6.1.0-cp314-cp314t-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4b89b098105b8599dc57adac95d1813409ac476d3c948a498775d3d0c6124bfb", size = 5224451, upload-time = "2026-04-18T04:34:54.263Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/15/2ebea45bea427e7f0057e9ce7b2d62c5aba20c6b001cca89ed0aadb3ad41/lxml-6.1.0-cp314-cp314t-manylinux_2_28_i686.whl", hash = "sha256:c4a699432846df86cc3de502ee85f445ebad748a1c6021d445f3e514d2cd4b1c", size = 5312135, upload-time = "2026-04-18T04:34:56.818Z" },
+    { url = "https://files.pythonhosted.org/packages/31/e2/87eeae151b0be2a308d49a7ec444ff3eb192b14251e62addb29d0bf3778f/lxml-6.1.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:30e7b2ed63b6c8e97cca8af048589a788ab5c9c905f36d9cf1c2bb549f450d2f", size = 4639126, upload-time = "2026-04-18T04:34:59.704Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/51/8a3f6a20902ad604dd746ec7b4000311b240d389dac5e9d95adefd349e0c/lxml-6.1.0-cp314-cp314t-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:022981127642fe19866d2907d76241bb07ed21749601f727d5d5dd1ce5d1b773", size = 5232579, upload-time = "2026-04-18T04:35:02.658Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/d2/650d619bdbe048d2c3f2c31edb00e35670a5e2d65b4fe3b61bce37b19121/lxml-6.1.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:23cad0cc86046d4222f7f418910e46b89971c5a45d3c8abfad0f64b7b05e4a9b", size = 5084206, upload-time = "2026-04-18T04:35:05.175Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/8a/672ca1a3cbeabd1f511ca275a916c0514b747f4b85bdaae103b8fa92f307/lxml-6.1.0-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:21c3302068f50d1e8728c67c87ba92aa87043abee517aa2576cca1855326b405", size = 4758906, upload-time = "2026-04-18T04:35:08.098Z" },
+    { url = "https://files.pythonhosted.org/packages/be/f1/ef4b691da85c916cb2feb1eec7414f678162798ac85e042fa164419ac05c/lxml-6.1.0-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:be10838781cb3be19251e276910cd508fe127e27c3242e50521521a0f3781690", size = 5620553, upload-time = "2026-04-18T04:35:11.23Z" },
+    { url = "https://files.pythonhosted.org/packages/59/17/94e81def74107809755ac2782fdad4404420f1c92ca83433d117a6d5acf0/lxml-6.1.0-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:2173a7bffe97667bbf0767f8a99e587740a8c56fdf3befac4b09cb29a80276fd", size = 5229458, upload-time = "2026-04-18T04:35:14.254Z" },
+    { url = "https://files.pythonhosted.org/packages/21/55/c4be91b0f830a871fc1b0d730943d56013b683d4671d5198260e2eae722b/lxml-6.1.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:c6854e9cf99c84beb004eecd7d3a3868ef1109bf2b1df92d7bc11e96a36c2180", size = 5247861, upload-time = "2026-04-18T04:35:17.006Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/ca/77123e4d77df3cb1e968ade7b1f808f5d3a5c1c96b18a33895397de292c1/lxml-6.1.0-cp314-cp314t-win32.whl", hash = "sha256:00750d63ef0031a05331b9223463b1c7c02b9004cef2346a5b2877f0f9494dd2", size = 3897377, upload-time = "2026-04-18T04:32:07.656Z" },
+    { url = "https://files.pythonhosted.org/packages/64/ce/3554833989d074267c063209bae8b09815e5656456a2d332b947806b05ff/lxml-6.1.0-cp314-cp314t-win_amd64.whl", hash = "sha256:80410c3a7e3c617af04de17caa9f9f20adaa817093293d69eae7d7d0522836f5", size = 4392701, upload-time = "2026-04-18T04:32:12.113Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/a0/9b916c68c0e57752c07f8f64b30138d9d4059dbeb27b90274dedbea128ff/lxml-6.1.0-cp314-cp314t-win_arm64.whl", hash = "sha256:26dd9f57ee3bd41e7d35b4c98a2ffd89ed11591649f421f0ec19f67d50ec67ac", size = 3817120, upload-time = "2026-04-18T04:32:15.803Z" },
 ]
 
 [[package]]
@@ -2591,7 +2600,7 @@ wheels = [
 
 [[package]]
 name = "onnx"
-version = "1.20.1"
+version = "1.21.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "ml-dtypes", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
@@ -2599,19 +2608,24 @@ dependencies = [
     { name = "protobuf", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
     { name = "typing-extensions", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/3b/8a/335c03a8683a88a32f9a6bb98899ea6df241a41df64b37b9696772414794/onnx-1.20.1.tar.gz", hash = "sha256:ded16de1df563d51fbc1ad885f2a426f814039d8b5f4feb77febe09c0295ad67", size = 12048980, upload-time = "2026-01-10T01:40:03.043Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c5/93/942d2a0f6a70538eea042ce0445c8aefd46559ad153469986f29a743c01c/onnx-1.21.0.tar.gz", hash = "sha256:4d8b67d0aaec5864c87633188b91cc520877477ec0254eda122bef8be43cd764", size = 12074608, upload-time = "2026-03-27T21:33:36.118Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7c/4c/4b17e82f91ab9aa07ff595771e935ca73547b035030dc5f5a76e63fbfea9/onnx-1.20.1-cp312-abi3-macosx_12_0_universal2.whl", hash = "sha256:1d923bb4f0ce1b24c6859222a7e6b2f123e7bfe7623683662805f2e7b9e95af2", size = 17903547, upload-time = "2026-01-10T01:39:31.015Z" },
-    { url = "https://files.pythonhosted.org/packages/64/5e/1bfa100a9cb3f2d3d5f2f05f52f7e60323b0e20bb0abace1ae64dbc88f25/onnx-1.20.1-cp312-abi3-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ddc0b7d8b5a94627dc86c533d5e415af94cbfd103019a582669dad1f56d30281", size = 17412021, upload-time = "2026-01-10T01:39:33.885Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/71/d3fec0dcf9a7a99e7368112d9c765154e81da70fcba1e3121131a45c245b/onnx-1.20.1-cp312-abi3-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9336b6b8e6efcf5c490a845f6afd7e041c89a56199aeda384ed7d58fb953b080", size = 17510450, upload-time = "2026-01-10T01:39:36.589Z" },
-    { url = "https://files.pythonhosted.org/packages/74/a7/edce1403e05a46e59b502fae8e3350ceeac5841f8e8f1561e98562ed9b09/onnx-1.20.1-cp312-abi3-win32.whl", hash = "sha256:564c35a94811979808ab5800d9eb4f3f32c12daedba7e33ed0845f7c61ef2431", size = 16238216, upload-time = "2026-01-10T01:39:39.46Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/c7/8690c81200ae652ac550c1df52f89d7795e6cc941f3cb38c9ef821419e80/onnx-1.20.1-cp312-abi3-win_amd64.whl", hash = "sha256:9fe7f9a633979d50984b94bda8ceb7807403f59a341d09d19342dc544d0ca1d5", size = 16389207, upload-time = "2026-01-10T01:39:41.955Z" },
-    { url = "https://files.pythonhosted.org/packages/01/a0/4fb0e6d36eaf079af366b2c1f68bafe92df6db963e2295da84388af64abc/onnx-1.20.1-cp312-abi3-win_arm64.whl", hash = "sha256:21d747348b1c8207406fa2f3e12b82f53e0d5bb3958bcd0288bd27d3cb6ebb00", size = 16344155, upload-time = "2026-01-10T01:39:45.536Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/bb/715fad292b255664f0e603f1b2ef7bf2b386281775f37406beb99fa05957/onnx-1.20.1-cp313-cp313t-macosx_12_0_universal2.whl", hash = "sha256:29197b768f5acdd1568ddeb0a376407a2817844f6ac1ef8c8dd2d974c9ab27c3", size = 17912296, upload-time = "2026-01-10T01:39:48.21Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/c3/541af12c3d45e159a94ee701100ba9e94b7bd8b7a8ac5ca6838569f894f8/onnx-1.20.1-cp313-cp313t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1f0371aa67f51917a09cc829ada0f9a79a58f833449e03d748f7f7f53787c43c", size = 17416925, upload-time = "2026-01-10T01:39:50.82Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/3b/d5660a7d2ddf14f531ca66d409239f543bb290277c3f14f4b4b78e32efa3/onnx-1.20.1-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:be1e5522200b203b34327b2cf132ddec20ab063469476e1f5b02bb7bd259a489", size = 17515602, upload-time = "2026-01-10T01:39:54.132Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/b4/47225ab2a92562eff87ba9a1a028e3535d659a7157d7cde659003998b8e3/onnx-1.20.1-cp313-cp313t-win_amd64.whl", hash = "sha256:15c815313bbc4b2fdc7e4daeb6e26b6012012adc4d850f4e3b09ed327a7ea92a", size = 16395729, upload-time = "2026-01-10T01:39:57.577Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/7d/1bbe626ff6b192c844d3ad34356840cc60fca02e2dea0db95e01645758b1/onnx-1.20.1-cp313-cp313t-win_arm64.whl", hash = "sha256:eb335d7bcf9abac82a0d6a0fda0363531ae0b22cfd0fc6304bff32ee29905def", size = 16348968, upload-time = "2026-01-10T01:40:00.491Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/ae/cb644ec84c25e63575d9d8790fdcc5d1a11d67d3f62f872edb35fa38d158/onnx-1.21.0-cp312-abi3-macosx_12_0_universal2.whl", hash = "sha256:fc2635400fe39ff37ebc4e75342cc54450eadadf39c540ff132c319bf4960095", size = 17965930, upload-time = "2026-03-27T21:32:48.089Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/b6/eeb5903586645ef8a49b4b7892580438741acc3df91d7a5bd0f3a59ea9cb/onnx-1.21.0-cp312-abi3-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9003d5206c01fa2ff4b46311566865d8e493e1a6998d4009ec6de39843f1b59b", size = 17531344, upload-time = "2026-03-27T21:32:50.837Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/00/4823f06357892d1e60d6f34e7299d2ba4ed2108c487cc394f7ce85a3ff14/onnx-1.21.0-cp312-abi3-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a9261bd580fb8548c9c37b3c6750387eb8f21ea43c63880d37b2c622e1684285", size = 17613697, upload-time = "2026-03-27T21:32:54.222Z" },
+    { url = "https://files.pythonhosted.org/packages/23/1d/391f3c567ae068c8ac4f1d1316bae97c9eb45e702f05975fe0e17ad441f0/onnx-1.21.0-cp312-abi3-win32.whl", hash = "sha256:9ea4e824964082811938a9250451d89c4ec474fe42dd36c038bfa5df31993d1e", size = 16287200, upload-time = "2026-03-27T21:32:57.277Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/a6/5eefbe5b40ea96de95a766bd2e0e751f35bdea2d4b951991ec9afaa69531/onnx-1.21.0-cp312-abi3-win_amd64.whl", hash = "sha256:458d91948ad9a7729a347550553b49ab6939f9af2cddf334e2116e45467dc61f", size = 16441045, upload-time = "2026-03-27T21:33:00.081Z" },
+    { url = "https://files.pythonhosted.org/packages/63/c4/0ed8dc037a39113d2a4d66e0005e07751c299c46b993f1ad5c2c35664c20/onnx-1.21.0-cp312-abi3-win_arm64.whl", hash = "sha256:ca14bc4842fccc3187eb538f07eabeb25a779b39388b006db4356c07403a7bbb", size = 16403134, upload-time = "2026-03-27T21:33:03.987Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/89/0e1a9beb536401e2f45ac88735e123f2735e12fc7b56ff6c11727e097526/onnx-1.21.0-cp313-cp313t-macosx_12_0_universal2.whl", hash = "sha256:257d1d1deb6a652913698f1e3f33ef1ca0aa69174892fe38946d4572d89dd94f", size = 17975430, upload-time = "2026-03-27T21:33:07.005Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/46/e6dc71a7b3b317265591b20a5f71d0ff5c0d26c24e52283139dc90c66038/onnx-1.21.0-cp313-cp313t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7cd7cb8f6459311bdb557cbf6c0ccc6d8ace11c304d1bba0a30b4a4688e245f8", size = 17537435, upload-time = "2026-03-27T21:33:09.765Z" },
+    { url = "https://files.pythonhosted.org/packages/49/2e/27affcac63eaf2ef183a44fd1a1354b11da64a6c72fe6f3fdcf5571bcee5/onnx-1.21.0-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7b58a4cfec8d9311b73dc083e4c1fa362069267881144c05139b3eba5dc3a840", size = 17617687, upload-time = "2026-03-27T21:33:12.619Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/5c/ac8ed15e941593a3672ce424280b764979026317811f2e8508432bfc3429/onnx-1.21.0-cp313-cp313t-win_amd64.whl", hash = "sha256:1a9baf882562c4cebf79589bebb7cd71a20e30b51158cac3e3bbaf27da6163bd", size = 16449402, upload-time = "2026-03-27T21:33:15.555Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/aa/d2231e0dcaad838217afc64c306c8152a080134d2034e247cc973d577674/onnx-1.21.0-cp313-cp313t-win_arm64.whl", hash = "sha256:bba12181566acf49b35875838eba49536a327b2944664b17125577d230c637ad", size = 16408273, upload-time = "2026-03-27T21:33:18.599Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/0a/8905b14694def6ad23edf1011fdd581500384062f8c4c567e114be7aa272/onnx-1.21.0-cp314-cp314t-macosx_12_0_universal2.whl", hash = "sha256:7ee9d8fd6a4874a5fa8b44bbcabea104ce752b20469b88bc50c7dcf9030779ad", size = 17975331, upload-time = "2026-03-27T21:33:21.69Z" },
+    { url = "https://files.pythonhosted.org/packages/61/28/f4e401e5199d1b9c8b76c7e7ae1169e050515258e877b58fa8bb49d3bdcc/onnx-1.21.0-cp314-cp314t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5489f25fe461e7f32128218251a466cabbeeaf1eaa791c79daebf1a80d5a2cc9", size = 17537430, upload-time = "2026-03-27T21:33:24.547Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/cf/5d13320eb3660d5af360ea3b43aa9c63a70c92a9b4d1ea0d34501a32fcb8/onnx-1.21.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:db17fc0fec46180b6acbd1d5d8650a04e5527c02b09381da0b5b888d02a204c8", size = 17617662, upload-time = "2026-03-27T21:33:27.418Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/50/3eaa1878338247be021e6423696813d61e77e534dccbd15a703a144e703d/onnx-1.21.0-cp314-cp314t-win_amd64.whl", hash = "sha256:19d9971a3e52a12968ae6c70fd0f86c349536de0b0c33922ecdbe52d1972fe60", size = 16463688, upload-time = "2026-03-27T21:33:30.229Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/48/38d46b43bbb525e0b6a4c2c4204cc6795d67e45687a2f7403e06d8e7053d/onnx-1.21.0-cp314-cp314t-win_arm64.whl", hash = "sha256:efba467efb316baf2a9452d892c2f982b9b758c778d23e38c7f44fa211b30bb9", size = 16423387, upload-time = "2026-03-27T21:33:33.446Z" },
 ]
 
 [[package]]
@@ -2649,7 +2663,7 @@ wheels = [
 
 [[package]]
 name = "openai"
-version = "2.21.0"
+version = "2.24.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -2661,9 +2675,9 @@ dependencies = [
     { name = "tqdm" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/92/e5/3d197a0947a166649f566706d7a4c8f7fe38f1fa7b24c9bcffe4c7591d44/openai-2.21.0.tar.gz", hash = "sha256:81b48ce4b8bbb2cc3af02047ceb19561f7b1dc0d4e52d1de7f02abfd15aa59b7", size = 644374, upload-time = "2026-02-14T00:12:01.577Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/55/13/17e87641b89b74552ed408a92b231283786523edddc95f3545809fab673c/openai-2.24.0.tar.gz", hash = "sha256:1e5769f540dbd01cb33bc4716a23e67b9d695161a734aff9c5f925e2bf99a673", size = 658717, upload-time = "2026-02-24T20:02:07.958Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/cc/56/0a89092a453bb2c676d66abee44f863e742b2110d4dbb1dbcca3f7e5fc33/openai-2.21.0-py3-none-any.whl", hash = "sha256:0bc1c775e5b1536c294eded39ee08f8407656537ccc71b1004104fe1602e267c", size = 1103065, upload-time = "2026-02-14T00:11:59.603Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/30/844dc675ee6902579b8eef01ed23917cc9319a1c9c0c14ec6e39340c96d0/openai-2.24.0-py3-none-any.whl", hash = "sha256:fed30480d7d6c884303287bde864980a4b137b60553ffbcf9ab4a233b7a73d94", size = 1120122, upload-time = "2026-02-24T20:02:05.669Z" },
 ]
 
 [[package]]
@@ -2890,68 +2904,71 @@ wheels = [
 
 [[package]]
 name = "pillow"
-version = "11.3.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f3/0d/d0d6dea55cd152ce3d6767bb38a8fc10e33796ba4ba210cbab9354b6d238/pillow-11.3.0.tar.gz", hash = "sha256:3828ee7586cd0b2091b6209e5ad53e20d0649bbe87164a459d0676e035e8f523", size = 47113069, upload-time = "2025-07-01T09:16:30.666Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/40/fe/1bc9b3ee13f68487a99ac9529968035cca2f0a51ec36892060edcc51d06a/pillow-11.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:fdae223722da47b024b867c1ea0be64e0df702c5e0a60e27daad39bf960dd1e4", size = 5278800, upload-time = "2025-07-01T09:14:17.648Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/32/7e2ac19b5713657384cec55f89065fb306b06af008cfd87e572035b27119/pillow-11.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:921bd305b10e82b4d1f5e802b6850677f965d8394203d182f078873851dada69", size = 4686296, upload-time = "2025-07-01T09:14:19.828Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/1e/b9e12bbe6e4c2220effebc09ea0923a07a6da1e1f1bfbc8d7d29a01ce32b/pillow-11.3.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:eb76541cba2f958032d79d143b98a3a6b3ea87f0959bbe256c0b5e416599fd5d", size = 5871726, upload-time = "2025-07-03T13:10:04.448Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/33/e9200d2bd7ba00dc3ddb78df1198a6e80d7669cce6c2bdbeb2530a74ec58/pillow-11.3.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:67172f2944ebba3d4a7b54f2e95c786a3a50c21b88456329314caaa28cda70f6", size = 7644652, upload-time = "2025-07-03T13:10:10.391Z" },
-    { url = "https://files.pythonhosted.org/packages/41/f1/6f2427a26fc683e00d985bc391bdd76d8dd4e92fac33d841127eb8fb2313/pillow-11.3.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:97f07ed9f56a3b9b5f49d3661dc9607484e85c67e27f3e8be2c7d28ca032fec7", size = 5977787, upload-time = "2025-07-01T09:14:21.63Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/c9/06dd4a38974e24f932ff5f98ea3c546ce3f8c995d3f0985f8e5ba48bba19/pillow-11.3.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:676b2815362456b5b3216b4fd5bd89d362100dc6f4945154ff172e206a22c024", size = 6645236, upload-time = "2025-07-01T09:14:23.321Z" },
-    { url = "https://files.pythonhosted.org/packages/40/e7/848f69fb79843b3d91241bad658e9c14f39a32f71a301bcd1d139416d1be/pillow-11.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3e184b2f26ff146363dd07bde8b711833d7b0202e27d13540bfe2e35a323a809", size = 6086950, upload-time = "2025-07-01T09:14:25.237Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/1a/7cff92e695a2a29ac1958c2a0fe4c0b2393b60aac13b04a4fe2735cad52d/pillow-11.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:6be31e3fc9a621e071bc17bb7de63b85cbe0bfae91bb0363c893cbe67247780d", size = 6723358, upload-time = "2025-07-01T09:14:27.053Z" },
-    { url = "https://files.pythonhosted.org/packages/26/7d/73699ad77895f69edff76b0f332acc3d497f22f5d75e5360f78cbcaff248/pillow-11.3.0-cp312-cp312-win32.whl", hash = "sha256:7b161756381f0918e05e7cb8a371fff367e807770f8fe92ecb20d905d0e1c149", size = 6275079, upload-time = "2025-07-01T09:14:30.104Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/ce/e7dfc873bdd9828f3b6e5c2bbb74e47a98ec23cc5c74fc4e54462f0d9204/pillow-11.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:a6444696fce635783440b7f7a9fc24b3ad10a9ea3f0ab66c5905be1c19ccf17d", size = 6986324, upload-time = "2025-07-01T09:14:31.899Z" },
-    { url = "https://files.pythonhosted.org/packages/16/8f/b13447d1bf0b1f7467ce7d86f6e6edf66c0ad7cf44cf5c87a37f9bed9936/pillow-11.3.0-cp312-cp312-win_arm64.whl", hash = "sha256:2aceea54f957dd4448264f9bf40875da0415c83eb85f55069d89c0ed436e3542", size = 2423067, upload-time = "2025-07-01T09:14:33.709Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/93/0952f2ed8db3a5a4c7a11f91965d6184ebc8cd7cbb7941a260d5f018cd2d/pillow-11.3.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:1c627742b539bba4309df89171356fcb3cc5a9178355b2727d1b74a6cf155fbd", size = 2128328, upload-time = "2025-07-01T09:14:35.276Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/e8/100c3d114b1a0bf4042f27e0f87d2f25e857e838034e98ca98fe7b8c0a9c/pillow-11.3.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:30b7c02f3899d10f13d7a48163c8969e4e653f8b43416d23d13d1bbfdc93b9f8", size = 2170652, upload-time = "2025-07-01T09:14:37.203Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/86/3f758a28a6e381758545f7cdb4942e1cb79abd271bea932998fc0db93cb6/pillow-11.3.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:7859a4cc7c9295f5838015d8cc0a9c215b77e43d07a25e460f35cf516df8626f", size = 2227443, upload-time = "2025-07-01T09:14:39.344Z" },
-    { url = "https://files.pythonhosted.org/packages/01/f4/91d5b3ffa718df2f53b0dc109877993e511f4fd055d7e9508682e8aba092/pillow-11.3.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:ec1ee50470b0d050984394423d96325b744d55c701a439d2bd66089bff963d3c", size = 5278474, upload-time = "2025-07-01T09:14:41.843Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/0e/37d7d3eca6c879fbd9dba21268427dffda1ab00d4eb05b32923d4fbe3b12/pillow-11.3.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:7db51d222548ccfd274e4572fdbf3e810a5e66b00608862f947b163e613b67dd", size = 4686038, upload-time = "2025-07-01T09:14:44.008Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/b0/3426e5c7f6565e752d81221af9d3676fdbb4f352317ceafd42899aaf5d8a/pillow-11.3.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:2d6fcc902a24ac74495df63faad1884282239265c6839a0a6416d33faedfae7e", size = 5864407, upload-time = "2025-07-03T13:10:15.628Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/c1/c6c423134229f2a221ee53f838d4be9d82bab86f7e2f8e75e47b6bf6cd77/pillow-11.3.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f0f5d8f4a08090c6d6d578351a2b91acf519a54986c055af27e7a93feae6d3f1", size = 7639094, upload-time = "2025-07-03T13:10:21.857Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/c9/09e6746630fe6372c67c648ff9deae52a2bc20897d51fa293571977ceb5d/pillow-11.3.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c37d8ba9411d6003bba9e518db0db0c58a680ab9fe5179f040b0463644bc9805", size = 5973503, upload-time = "2025-07-01T09:14:45.698Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/1c/a2a29649c0b1983d3ef57ee87a66487fdeb45132df66ab30dd37f7dbe162/pillow-11.3.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:13f87d581e71d9189ab21fe0efb5a23e9f28552d5be6979e84001d3b8505abe8", size = 6642574, upload-time = "2025-07-01T09:14:47.415Z" },
-    { url = "https://files.pythonhosted.org/packages/36/de/d5cc31cc4b055b6c6fd990e3e7f0f8aaf36229a2698501bcb0cdf67c7146/pillow-11.3.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:023f6d2d11784a465f09fd09a34b150ea4672e85fb3d05931d89f373ab14abb2", size = 6084060, upload-time = "2025-07-01T09:14:49.636Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/ea/502d938cbaeec836ac28a9b730193716f0114c41325db428e6b280513f09/pillow-11.3.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:45dfc51ac5975b938e9809451c51734124e73b04d0f0ac621649821a63852e7b", size = 6721407, upload-time = "2025-07-01T09:14:51.962Z" },
-    { url = "https://files.pythonhosted.org/packages/45/9c/9c5e2a73f125f6cbc59cc7087c8f2d649a7ae453f83bd0362ff7c9e2aee2/pillow-11.3.0-cp313-cp313-win32.whl", hash = "sha256:a4d336baed65d50d37b88ca5b60c0fa9d81e3a87d4a7930d3880d1624d5b31f3", size = 6273841, upload-time = "2025-07-01T09:14:54.142Z" },
-    { url = "https://files.pythonhosted.org/packages/23/85/397c73524e0cd212067e0c969aa245b01d50183439550d24d9f55781b776/pillow-11.3.0-cp313-cp313-win_amd64.whl", hash = "sha256:0bce5c4fd0921f99d2e858dc4d4d64193407e1b99478bc5cacecba2311abde51", size = 6978450, upload-time = "2025-07-01T09:14:56.436Z" },
-    { url = "https://files.pythonhosted.org/packages/17/d2/622f4547f69cd173955194b78e4d19ca4935a1b0f03a302d655c9f6aae65/pillow-11.3.0-cp313-cp313-win_arm64.whl", hash = "sha256:1904e1264881f682f02b7f8167935cce37bc97db457f8e7849dc3a6a52b99580", size = 2423055, upload-time = "2025-07-01T09:14:58.072Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/80/a8a2ac21dda2e82480852978416cfacd439a4b490a501a288ecf4fe2532d/pillow-11.3.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:4c834a3921375c48ee6b9624061076bc0a32a60b5532b322cc0ea64e639dd50e", size = 5281110, upload-time = "2025-07-01T09:14:59.79Z" },
-    { url = "https://files.pythonhosted.org/packages/44/d6/b79754ca790f315918732e18f82a8146d33bcd7f4494380457ea89eb883d/pillow-11.3.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:5e05688ccef30ea69b9317a9ead994b93975104a677a36a8ed8106be9260aa6d", size = 4689547, upload-time = "2025-07-01T09:15:01.648Z" },
-    { url = "https://files.pythonhosted.org/packages/49/20/716b8717d331150cb00f7fdd78169c01e8e0c219732a78b0e59b6bdb2fd6/pillow-11.3.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:1019b04af07fc0163e2810167918cb5add8d74674b6267616021ab558dc98ced", size = 5901554, upload-time = "2025-07-03T13:10:27.018Z" },
-    { url = "https://files.pythonhosted.org/packages/74/cf/a9f3a2514a65bb071075063a96f0a5cf949c2f2fce683c15ccc83b1c1cab/pillow-11.3.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f944255db153ebb2b19c51fe85dd99ef0ce494123f21b9db4877ffdfc5590c7c", size = 7669132, upload-time = "2025-07-03T13:10:33.01Z" },
-    { url = "https://files.pythonhosted.org/packages/98/3c/da78805cbdbee9cb43efe8261dd7cc0b4b93f2ac79b676c03159e9db2187/pillow-11.3.0-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1f85acb69adf2aaee8b7da124efebbdb959a104db34d3a2cb0f3793dbae422a8", size = 6005001, upload-time = "2025-07-01T09:15:03.365Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/fa/ce044b91faecf30e635321351bba32bab5a7e034c60187fe9698191aef4f/pillow-11.3.0-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:05f6ecbeff5005399bb48d198f098a9b4b6bdf27b8487c7f38ca16eeb070cd59", size = 6668814, upload-time = "2025-07-01T09:15:05.655Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/51/90f9291406d09bf93686434f9183aba27b831c10c87746ff49f127ee80cb/pillow-11.3.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:a7bc6e6fd0395bc052f16b1a8670859964dbd7003bd0af2ff08342eb6e442cfe", size = 6113124, upload-time = "2025-07-01T09:15:07.358Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/5a/6fec59b1dfb619234f7636d4157d11fb4e196caeee220232a8d2ec48488d/pillow-11.3.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:83e1b0161c9d148125083a35c1c5a89db5b7054834fd4387499e06552035236c", size = 6747186, upload-time = "2025-07-01T09:15:09.317Z" },
-    { url = "https://files.pythonhosted.org/packages/49/6b/00187a044f98255225f172de653941e61da37104a9ea60e4f6887717e2b5/pillow-11.3.0-cp313-cp313t-win32.whl", hash = "sha256:2a3117c06b8fb646639dce83694f2f9eac405472713fcb1ae887469c0d4f6788", size = 6277546, upload-time = "2025-07-01T09:15:11.311Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/5c/6caaba7e261c0d75bab23be79f1d06b5ad2a2ae49f028ccec801b0e853d6/pillow-11.3.0-cp313-cp313t-win_amd64.whl", hash = "sha256:857844335c95bea93fb39e0fa2726b4d9d758850b34075a7e3ff4f4fa3aa3b31", size = 6985102, upload-time = "2025-07-01T09:15:13.164Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/7e/b623008460c09a0cb38263c93b828c666493caee2eb34ff67f778b87e58c/pillow-11.3.0-cp313-cp313t-win_arm64.whl", hash = "sha256:8797edc41f3e8536ae4b10897ee2f637235c94f27404cac7297f7b607dd0716e", size = 2424803, upload-time = "2025-07-01T09:15:15.695Z" },
-    { url = "https://files.pythonhosted.org/packages/73/f4/04905af42837292ed86cb1b1dabe03dce1edc008ef14c473c5c7e1443c5d/pillow-11.3.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:d9da3df5f9ea2a89b81bb6087177fb1f4d1c7146d583a3fe5c672c0d94e55e12", size = 5278520, upload-time = "2025-07-01T09:15:17.429Z" },
-    { url = "https://files.pythonhosted.org/packages/41/b0/33d79e377a336247df6348a54e6d2a2b85d644ca202555e3faa0cf811ecc/pillow-11.3.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:0b275ff9b04df7b640c59ec5a3cb113eefd3795a8df80bac69646ef699c6981a", size = 4686116, upload-time = "2025-07-01T09:15:19.423Z" },
-    { url = "https://files.pythonhosted.org/packages/49/2d/ed8bc0ab219ae8768f529597d9509d184fe8a6c4741a6864fea334d25f3f/pillow-11.3.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0743841cabd3dba6a83f38a92672cccbd69af56e3e91777b0ee7f4dba4385632", size = 5864597, upload-time = "2025-07-03T13:10:38.404Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/3d/b932bb4225c80b58dfadaca9d42d08d0b7064d2d1791b6a237f87f661834/pillow-11.3.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:2465a69cf967b8b49ee1b96d76718cd98c4e925414ead59fdf75cf0fd07df673", size = 7638246, upload-time = "2025-07-03T13:10:44.987Z" },
-    { url = "https://files.pythonhosted.org/packages/09/b5/0487044b7c096f1b48f0d7ad416472c02e0e4bf6919541b111efd3cae690/pillow-11.3.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:41742638139424703b4d01665b807c6468e23e699e8e90cffefe291c5832b027", size = 5973336, upload-time = "2025-07-01T09:15:21.237Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/2d/524f9318f6cbfcc79fbc004801ea6b607ec3f843977652fdee4857a7568b/pillow-11.3.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:93efb0b4de7e340d99057415c749175e24c8864302369e05914682ba642e5d77", size = 6642699, upload-time = "2025-07-01T09:15:23.186Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/d2/a9a4f280c6aefedce1e8f615baaa5474e0701d86dd6f1dede66726462bbd/pillow-11.3.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7966e38dcd0fa11ca390aed7c6f20454443581d758242023cf36fcb319b1a874", size = 6083789, upload-time = "2025-07-01T09:15:25.1Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/54/86b0cd9dbb683a9d5e960b66c7379e821a19be4ac5810e2e5a715c09a0c0/pillow-11.3.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:98a9afa7b9007c67ed84c57c9e0ad86a6000da96eaa638e4f8abe5b65ff83f0a", size = 6720386, upload-time = "2025-07-01T09:15:27.378Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/95/88efcaf384c3588e24259c4203b909cbe3e3c2d887af9e938c2022c9dd48/pillow-11.3.0-cp314-cp314-win32.whl", hash = "sha256:02a723e6bf909e7cea0dac1b0e0310be9d7650cd66222a5f1c571455c0a45214", size = 6370911, upload-time = "2025-07-01T09:15:29.294Z" },
-    { url = "https://files.pythonhosted.org/packages/2e/cc/934e5820850ec5eb107e7b1a72dd278140731c669f396110ebc326f2a503/pillow-11.3.0-cp314-cp314-win_amd64.whl", hash = "sha256:a418486160228f64dd9e9efcd132679b7a02a5f22c982c78b6fc7dab3fefb635", size = 7117383, upload-time = "2025-07-01T09:15:31.128Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/e9/9c0a616a71da2a5d163aa37405e8aced9a906d574b4a214bede134e731bc/pillow-11.3.0-cp314-cp314-win_arm64.whl", hash = "sha256:155658efb5e044669c08896c0c44231c5e9abcaadbc5cd3648df2f7c0b96b9a6", size = 2511385, upload-time = "2025-07-01T09:15:33.328Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/33/c88376898aff369658b225262cd4f2659b13e8178e7534df9e6e1fa289f6/pillow-11.3.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:59a03cdf019efbfeeed910bf79c7c93255c3d54bc45898ac2a4140071b02b4ae", size = 5281129, upload-time = "2025-07-01T09:15:35.194Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/70/d376247fb36f1844b42910911c83a02d5544ebd2a8bad9efcc0f707ea774/pillow-11.3.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:f8a5827f84d973d8636e9dc5764af4f0cf2318d26744b3d902931701b0d46653", size = 4689580, upload-time = "2025-07-01T09:15:37.114Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/1c/537e930496149fbac69efd2fc4329035bbe2e5475b4165439e3be9cb183b/pillow-11.3.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:ee92f2fd10f4adc4b43d07ec5e779932b4eb3dbfbc34790ada5a6669bc095aa6", size = 5902860, upload-time = "2025-07-03T13:10:50.248Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/57/80f53264954dcefeebcf9dae6e3eb1daea1b488f0be8b8fef12f79a3eb10/pillow-11.3.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c96d333dcf42d01f47b37e0979b6bd73ec91eae18614864622d9b87bbd5bbf36", size = 7670694, upload-time = "2025-07-03T13:10:56.432Z" },
-    { url = "https://files.pythonhosted.org/packages/70/ff/4727d3b71a8578b4587d9c276e90efad2d6fe0335fd76742a6da08132e8c/pillow-11.3.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4c96f993ab8c98460cd0c001447bff6194403e8b1d7e149ade5f00594918128b", size = 6005888, upload-time = "2025-07-01T09:15:39.436Z" },
-    { url = "https://files.pythonhosted.org/packages/05/ae/716592277934f85d3be51d7256f3636672d7b1abfafdc42cf3f8cbd4b4c8/pillow-11.3.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:41342b64afeba938edb034d122b2dda5db2139b9a4af999729ba8818e0056477", size = 6670330, upload-time = "2025-07-01T09:15:41.269Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/bb/7fe6cddcc8827b01b1a9766f5fdeb7418680744f9082035bdbabecf1d57f/pillow-11.3.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:068d9c39a2d1b358eb9f245ce7ab1b5c3246c7c8c7d9ba58cfa5b43146c06e50", size = 6114089, upload-time = "2025-07-01T09:15:43.13Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/f5/06bfaa444c8e80f1a8e4bff98da9c83b37b5be3b1deaa43d27a0db37ef84/pillow-11.3.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:a1bc6ba083b145187f648b667e05a2534ecc4b9f2784c2cbe3089e44868f2b9b", size = 6748206, upload-time = "2025-07-01T09:15:44.937Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/77/bc6f92a3e8e6e46c0ca78abfffec0037845800ea38c73483760362804c41/pillow-11.3.0-cp314-cp314t-win32.whl", hash = "sha256:118ca10c0d60b06d006be10a501fd6bbdfef559251ed31b794668ed569c87e12", size = 6377370, upload-time = "2025-07-01T09:15:46.673Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/82/3a721f7d69dca802befb8af08b7c79ebcab461007ce1c18bd91a5d5896f9/pillow-11.3.0-cp314-cp314t-win_amd64.whl", hash = "sha256:8924748b688aa210d79883357d102cd64690e56b923a186f35a82cbc10f997db", size = 7121500, upload-time = "2025-07-01T09:15:48.512Z" },
-    { url = "https://files.pythonhosted.org/packages/89/c7/5572fa4a3f45740eaab6ae86fcdf7195b55beac1371ac8c619d880cfe948/pillow-11.3.0-cp314-cp314t-win_arm64.whl", hash = "sha256:79ea0d14d3ebad43ec77ad5272e6ff9bba5b679ef73375ea760261207fa8e0aa", size = 2512835, upload-time = "2025-07-01T09:15:50.399Z" },
+version = "12.2.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/8c/21/c2bcdd5906101a30244eaffc1b6e6ce71a31bd0742a01eb89e660ebfac2d/pillow-12.2.0.tar.gz", hash = "sha256:a830b1a40919539d07806aa58e1b114df53ddd43213d9c8b75847eee6c0182b5", size = 46987819, upload-time = "2026-04-01T14:46:17.687Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/58/be/7482c8a5ebebbc6470b3eb791812fff7d5e0216c2be3827b30b8bb6603ed/pillow-12.2.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:2d192a155bbcec180f8564f693e6fd9bccff5a7af9b32e2e4bf8c9c69dbad6b5", size = 5308279, upload-time = "2026-04-01T14:43:13.246Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/95/0a351b9289c2b5cbde0bacd4a83ebc44023e835490a727b2a3bd60ddc0f4/pillow-12.2.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:f3f40b3c5a968281fd507d519e444c35f0ff171237f4fdde090dd60699458421", size = 4695490, upload-time = "2026-04-01T14:43:15.584Z" },
+    { url = "https://files.pythonhosted.org/packages/de/af/4e8e6869cbed569d43c416fad3dc4ecb944cb5d9492defaed89ddd6fe871/pillow-12.2.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:03e7e372d5240cc23e9f07deca4d775c0817bffc641b01e9c3af208dbd300987", size = 6284462, upload-time = "2026-04-01T14:43:18.268Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/9e/c05e19657fd57841e476be1ab46c4d501bffbadbafdc31a6d665f8b737b6/pillow-12.2.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:b86024e52a1b269467a802258c25521e6d742349d760728092e1bc2d135b4d76", size = 8094744, upload-time = "2026-04-01T14:43:20.716Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/54/1789c455ed10176066b6e7e6da1b01e50e36f94ba584dc68d9eebfe9156d/pillow-12.2.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7371b48c4fa448d20d2714c9a1f775a81155050d383333e0a6c15b1123dda005", size = 6398371, upload-time = "2026-04-01T14:43:23.443Z" },
+    { url = "https://files.pythonhosted.org/packages/43/e3/fdc657359e919462369869f1c9f0e973f353f9a9ee295a39b1fea8ee1a77/pillow-12.2.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:62f5409336adb0663b7caa0da5c7d9e7bdbaae9ce761d34669420c2a801b2780", size = 7087215, upload-time = "2026-04-01T14:43:26.758Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/f8/2f6825e441d5b1959d2ca5adec984210f1ec086435b0ed5f52c19b3b8a6e/pillow-12.2.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:01afa7cf67f74f09523699b4e88c73fb55c13346d212a59a2db1f86b0a63e8c5", size = 6509783, upload-time = "2026-04-01T14:43:29.56Z" },
+    { url = "https://files.pythonhosted.org/packages/67/f9/029a27095ad20f854f9dba026b3ea6428548316e057e6fc3545409e86651/pillow-12.2.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:fc3d34d4a8fbec3e88a79b92e5465e0f9b842b628675850d860b8bd300b159f5", size = 7212112, upload-time = "2026-04-01T14:43:32.091Z" },
+    { url = "https://files.pythonhosted.org/packages/be/42/025cfe05d1be22dbfdb4f264fe9de1ccda83f66e4fc3aac94748e784af04/pillow-12.2.0-cp312-cp312-win32.whl", hash = "sha256:58f62cc0f00fd29e64b29f4fd923ffdb3859c9f9e6105bfc37ba1d08994e8940", size = 6378489, upload-time = "2026-04-01T14:43:34.601Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/7b/25a221d2c761c6a8ae21bfa3874988ff2583e19cf8a27bf2fee358df7942/pillow-12.2.0-cp312-cp312-win_amd64.whl", hash = "sha256:7f84204dee22a783350679a0333981df803dac21a0190d706a50475e361c93f5", size = 7084129, upload-time = "2026-04-01T14:43:37.213Z" },
+    { url = "https://files.pythonhosted.org/packages/10/e1/542a474affab20fd4a0f1836cb234e8493519da6b76899e30bcc5d990b8b/pillow-12.2.0-cp312-cp312-win_arm64.whl", hash = "sha256:af73337013e0b3b46f175e79492d96845b16126ddf79c438d7ea7ff27783a414", size = 2463612, upload-time = "2026-04-01T14:43:39.421Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/01/53d10cf0dbad820a8db274d259a37ba50b88b24768ddccec07355382d5ad/pillow-12.2.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:8297651f5b5679c19968abefd6bb84d95fe30ef712eb1b2d9b2d31ca61267f4c", size = 4100837, upload-time = "2026-04-01T14:43:41.506Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/98/f3a6657ecb698c937f6c76ee564882945f29b79bad496abcba0e84659ec5/pillow-12.2.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:50d8520da2a6ce0af445fa6d648c4273c3eeefbc32d7ce049f22e8b5c3daecc2", size = 4176528, upload-time = "2026-04-01T14:43:43.773Z" },
+    { url = "https://files.pythonhosted.org/packages/69/bc/8986948f05e3ea490b8442ea1c1d4d990b24a7e43d8a51b2c7d8b1dced36/pillow-12.2.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:766cef22385fa1091258ad7e6216792b156dc16d8d3fa607e7545b2b72061f1c", size = 3640401, upload-time = "2026-04-01T14:43:45.87Z" },
+    { url = "https://files.pythonhosted.org/packages/34/46/6c717baadcd62bc8ed51d238d521ab651eaa74838291bda1f86fe1f864c9/pillow-12.2.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:5d2fd0fa6b5d9d1de415060363433f28da8b1526c1c129020435e186794b3795", size = 5308094, upload-time = "2026-04-01T14:43:48.438Z" },
+    { url = "https://files.pythonhosted.org/packages/71/43/905a14a8b17fdb1ccb58d282454490662d2cb89a6bfec26af6d3520da5ec/pillow-12.2.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:56b25336f502b6ed02e889f4ece894a72612fe885889a6e8c4c80239ff6e5f5f", size = 4695402, upload-time = "2026-04-01T14:43:51.292Z" },
+    { url = "https://files.pythonhosted.org/packages/73/dd/42107efcb777b16fa0393317eac58f5b5cf30e8392e266e76e51cff28c3d/pillow-12.2.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f1c943e96e85df3d3478f7b691f229887e143f81fedab9b20205349ab04d73ed", size = 6280005, upload-time = "2026-04-01T14:43:54.242Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/68/b93e09e5e8549019e61acf49f65b1a8530765a7f812c77a7461bca7e4494/pillow-12.2.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:03f6fab9219220f041c74aeaa2939ff0062bd5c364ba9ce037197f4c6d498cd9", size = 8090669, upload-time = "2026-04-01T14:43:57.335Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/6e/3ccb54ce8ec4ddd1accd2d89004308b7b0b21c4ac3d20fa70af4760a4330/pillow-12.2.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5cdfebd752ec52bf5bb4e35d9c64b40826bc5b40a13df7c3cda20a2c03a0f5ed", size = 6395194, upload-time = "2026-04-01T14:43:59.864Z" },
+    { url = "https://files.pythonhosted.org/packages/67/ee/21d4e8536afd1a328f01b359b4d3997b291ffd35a237c877b331c1c3b71c/pillow-12.2.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:eedf4b74eda2b5a4b2b2fb4c006d6295df3bf29e459e198c90ea48e130dc75c3", size = 7082423, upload-time = "2026-04-01T14:44:02.74Z" },
+    { url = "https://files.pythonhosted.org/packages/78/5f/e9f86ab0146464e8c133fe85df987ed9e77e08b29d8d35f9f9f4d6f917ba/pillow-12.2.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:00a2865911330191c0b818c59103b58a5e697cae67042366970a6b6f1b20b7f9", size = 6505667, upload-time = "2026-04-01T14:44:05.381Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/1e/409007f56a2fdce61584fd3acbc2bbc259857d555196cedcadc68c015c82/pillow-12.2.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:1e1757442ed87f4912397c6d35a0db6a7b52592156014706f17658ff58bbf795", size = 7208580, upload-time = "2026-04-01T14:44:08.39Z" },
+    { url = "https://files.pythonhosted.org/packages/23/c4/7349421080b12fb35414607b8871e9534546c128a11965fd4a7002ccfbee/pillow-12.2.0-cp313-cp313-win32.whl", hash = "sha256:144748b3af2d1b358d41286056d0003f47cb339b8c43a9ea42f5fea4d8c66b6e", size = 6375896, upload-time = "2026-04-01T14:44:11.197Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/82/8a3739a5e470b3c6cbb1d21d315800d8e16bff503d1f16b03a4ec3212786/pillow-12.2.0-cp313-cp313-win_amd64.whl", hash = "sha256:390ede346628ccc626e5730107cde16c42d3836b89662a115a921f28440e6a3b", size = 7081266, upload-time = "2026-04-01T14:44:13.947Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/25/f968f618a062574294592f668218f8af564830ccebdd1fa6200f598e65c5/pillow-12.2.0-cp313-cp313-win_arm64.whl", hash = "sha256:8023abc91fba39036dbce14a7d6535632f99c0b857807cbbbf21ecc9f4717f06", size = 2463508, upload-time = "2026-04-01T14:44:16.312Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/a4/b342930964e3cb4dce5038ae34b0eab4653334995336cd486c5a8c25a00c/pillow-12.2.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:042db20a421b9bafecc4b84a8b6e444686bd9d836c7fd24542db3e7df7baad9b", size = 5309927, upload-time = "2026-04-01T14:44:18.89Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/de/23198e0a65a9cf06123f5435a5d95cea62a635697f8f03d134d3f3a96151/pillow-12.2.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:dd025009355c926a84a612fecf58bb315a3f6814b17ead51a8e48d3823d9087f", size = 4698624, upload-time = "2026-04-01T14:44:21.115Z" },
+    { url = "https://files.pythonhosted.org/packages/01/a6/1265e977f17d93ea37aa28aa81bad4fa597933879fac2520d24e021c8da3/pillow-12.2.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:88ddbc66737e277852913bd1e07c150cc7bb124539f94c4e2df5344494e0a612", size = 6321252, upload-time = "2026-04-01T14:44:23.663Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/83/5982eb4a285967baa70340320be9f88e57665a387e3a53a7f0db8231a0cd/pillow-12.2.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:d362d1878f00c142b7e1a16e6e5e780f02be8195123f164edf7eddd911eefe7c", size = 8126550, upload-time = "2026-04-01T14:44:26.772Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/48/6ffc514adce69f6050d0753b1a18fd920fce8cac87620d5a31231b04bfc5/pillow-12.2.0-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2c727a6d53cb0018aadd8018c2b938376af27914a68a492f59dfcaca650d5eea", size = 6433114, upload-time = "2026-04-01T14:44:29.615Z" },
+    { url = "https://files.pythonhosted.org/packages/36/a3/f9a77144231fb8d40ee27107b4463e205fa4677e2ca2548e14da5cf18dce/pillow-12.2.0-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:efd8c21c98c5cc60653bcb311bef2ce0401642b7ce9d09e03a7da87c878289d4", size = 7115667, upload-time = "2026-04-01T14:44:32.773Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/fc/ac4ee3041e7d5a565e1c4fd72a113f03b6394cc72ab7089d27608f8aaccb/pillow-12.2.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:9f08483a632889536b8139663db60f6724bfcb443c96f1b18855860d7d5c0fd4", size = 6538966, upload-time = "2026-04-01T14:44:35.252Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/a8/27fb307055087f3668f6d0a8ccb636e7431d56ed0750e07a60547b1e083e/pillow-12.2.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:dac8d77255a37e81a2efcbd1fc05f1c15ee82200e6c240d7e127e25e365c39ea", size = 7238241, upload-time = "2026-04-01T14:44:37.875Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/4b/926ab182c07fccae9fcb120043464e1ff1564775ec8864f21a0ebce6ac25/pillow-12.2.0-cp313-cp313t-win32.whl", hash = "sha256:ee3120ae9dff32f121610bb08e4313be87e03efeadfc6c0d18f89127e24d0c24", size = 6379592, upload-time = "2026-04-01T14:44:40.336Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/c4/f9e476451a098181b30050cc4c9a3556b64c02cf6497ea421ac047e89e4b/pillow-12.2.0-cp313-cp313t-win_amd64.whl", hash = "sha256:325ca0528c6788d2a6c3d40e3568639398137346c3d6e66bb61db96b96511c98", size = 7085542, upload-time = "2026-04-01T14:44:43.251Z" },
+    { url = "https://files.pythonhosted.org/packages/00/a4/285f12aeacbe2d6dc36c407dfbbe9e96d4a80b0fb710a337f6d2ad978c75/pillow-12.2.0-cp313-cp313t-win_arm64.whl", hash = "sha256:2e5a76d03a6c6dcef67edabda7a52494afa4035021a79c8558e14af25313d453", size = 2465765, upload-time = "2026-04-01T14:44:45.996Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/98/4595daa2365416a86cb0d495248a393dfc84e96d62ad080c8546256cb9c0/pillow-12.2.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:3adc9215e8be0448ed6e814966ecf3d9952f0ea40eb14e89a102b87f450660d8", size = 4100848, upload-time = "2026-04-01T14:44:48.48Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/79/40184d464cf89f6663e18dfcf7ca21aae2491fff1a16127681bf1fa9b8cf/pillow-12.2.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:6a9adfc6d24b10f89588096364cc726174118c62130c817c2837c60cf08a392b", size = 4176515, upload-time = "2026-04-01T14:44:51.353Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/63/703f86fd4c422a9cf722833670f4f71418fb116b2853ff7da722ea43f184/pillow-12.2.0-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:6a6e67ea2e6feda684ed370f9a1c52e7a243631c025ba42149a2cc5934dec295", size = 3640159, upload-time = "2026-04-01T14:44:53.588Z" },
+    { url = "https://files.pythonhosted.org/packages/71/e0/fb22f797187d0be2270f83500aab851536101b254bfa1eae10795709d283/pillow-12.2.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:2bb4a8d594eacdfc59d9e5ad972aa8afdd48d584ffd5f13a937a664c3e7db0ed", size = 5312185, upload-time = "2026-04-01T14:44:56.039Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/8c/1a9e46228571de18f8e28f16fabdfc20212a5d019f3e3303452b3f0a580d/pillow-12.2.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:80b2da48193b2f33ed0c32c38140f9d3186583ce7d516526d462645fd98660ae", size = 4695386, upload-time = "2026-04-01T14:44:58.663Z" },
+    { url = "https://files.pythonhosted.org/packages/70/62/98f6b7f0c88b9addd0e87c217ded307b36be024d4ff8869a812b241d1345/pillow-12.2.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:22db17c68434de69d8ecfc2fe821569195c0c373b25cccb9cbdacf2c6e53c601", size = 6280384, upload-time = "2026-04-01T14:45:01.5Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/03/688747d2e91cfbe0e64f316cd2e8005698f76ada3130d0194664174fa5de/pillow-12.2.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7b14cc0106cd9aecda615dd6903840a058b4700fcb817687d0ee4fc8b6e389be", size = 8091599, upload-time = "2026-04-01T14:45:04.5Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/35/577e22b936fcdd66537329b33af0b4ccfefaeabd8aec04b266528cddb33c/pillow-12.2.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8cbeb542b2ebc6fcdacabf8aca8c1a97c9b3ad3927d46b8723f9d4f033288a0f", size = 6396021, upload-time = "2026-04-01T14:45:07.117Z" },
+    { url = "https://files.pythonhosted.org/packages/11/8d/d2532ad2a603ca2b93ad9f5135732124e57811d0168155852f37fbce2458/pillow-12.2.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4bfd07bc812fbd20395212969e41931001fd59eb55a60658b0e5710872e95286", size = 7083360, upload-time = "2026-04-01T14:45:09.763Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/26/d325f9f56c7e039034897e7380e9cc202b1e368bfd04d4cbe6a441f02885/pillow-12.2.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:9aba9a17b623ef750a4d11b742cbafffeb48a869821252b30ee21b5e91392c50", size = 6507628, upload-time = "2026-04-01T14:45:12.378Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/f7/769d5632ffb0988f1c5e7660b3e731e30f7f8ec4318e94d0a5d674eb65a4/pillow-12.2.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:deede7c263feb25dba4e82ea23058a235dcc2fe1f6021025dc71f2b618e26104", size = 7209321, upload-time = "2026-04-01T14:45:15.122Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/7a/c253e3c645cd47f1aceea6a8bacdba9991bf45bb7dfe927f7c893e89c93c/pillow-12.2.0-cp314-cp314-win32.whl", hash = "sha256:632ff19b2778e43162304d50da0181ce24ac5bb8180122cbe1bf4673428328c7", size = 6479723, upload-time = "2026-04-01T14:45:17.797Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/8b/601e6566b957ca50e28725cb6c355c59c2c8609751efbecd980db44e0349/pillow-12.2.0-cp314-cp314-win_amd64.whl", hash = "sha256:4e6c62e9d237e9b65fac06857d511e90d8461a32adcc1b9065ea0c0fa3a28150", size = 7217400, upload-time = "2026-04-01T14:45:20.529Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/94/220e46c73065c3e2951bb91c11a1fb636c8c9ad427ac3ce7d7f3359b9b2f/pillow-12.2.0-cp314-cp314-win_arm64.whl", hash = "sha256:b1c1fbd8a5a1af3412a0810d060a78b5136ec0836c8a4ef9aa11807f2a22f4e1", size = 2554835, upload-time = "2026-04-01T14:45:23.162Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/ab/1b426a3974cb0e7da5c29ccff4807871d48110933a57207b5a676cccc155/pillow-12.2.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:57850958fe9c751670e49b2cecf6294acc99e562531f4bd317fa5ddee2068463", size = 5314225, upload-time = "2026-04-01T14:45:25.637Z" },
+    { url = "https://files.pythonhosted.org/packages/19/1e/dce46f371be2438eecfee2a1960ee2a243bbe5e961890146d2dee1ff0f12/pillow-12.2.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:d5d38f1411c0ed9f97bcb49b7bd59b6b7c314e0e27420e34d99d844b9ce3b6f3", size = 4698541, upload-time = "2026-04-01T14:45:28.355Z" },
+    { url = "https://files.pythonhosted.org/packages/55/c3/7fbecf70adb3a0c33b77a300dc52e424dc22ad8cdc06557a2e49523b703d/pillow-12.2.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:5c0a9f29ca8e79f09de89293f82fc9b0270bb4af1d58bc98f540cc4aedf03166", size = 6322251, upload-time = "2026-04-01T14:45:30.924Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/3c/7fbc17cfb7e4fe0ef1642e0abc17fc6c94c9f7a16be41498e12e2ba60408/pillow-12.2.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:1610dd6c61621ae1cf811bef44d77e149ce3f7b95afe66a4512f8c59f25d9ebe", size = 8127807, upload-time = "2026-04-01T14:45:33.908Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/c3/a8ae14d6defd2e448493ff512fae903b1e9bd40b72efb6ec55ce0048c8ce/pillow-12.2.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0a34329707af4f73cf1782a36cd2289c0368880654a2c11f027bcee9052d35dd", size = 6433935, upload-time = "2026-04-01T14:45:36.623Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/32/2880fb3a074847ac159d8f902cb43278a61e85f681661e7419e6596803ed/pillow-12.2.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8e9c4f5b3c546fa3458a29ab22646c1c6c787ea8f5ef51300e5a60300736905e", size = 7116720, upload-time = "2026-04-01T14:45:39.258Z" },
+    { url = "https://files.pythonhosted.org/packages/46/87/495cc9c30e0129501643f24d320076f4cc54f718341df18cc70ec94c44e1/pillow-12.2.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:fb043ee2f06b41473269765c2feae53fc2e2fbf96e5e22ca94fb5ad677856f06", size = 6540498, upload-time = "2026-04-01T14:45:41.879Z" },
+    { url = "https://files.pythonhosted.org/packages/18/53/773f5edca692009d883a72211b60fdaf8871cbef075eaa9d577f0a2f989e/pillow-12.2.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:f278f034eb75b4e8a13a54a876cc4a5ab39173d2cdd93a638e1b467fc545ac43", size = 7239413, upload-time = "2026-04-01T14:45:44.705Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/e4/4b64a97d71b2a83158134abbb2f5bd3f8a2ea691361282f010998f339ec7/pillow-12.2.0-cp314-cp314t-win32.whl", hash = "sha256:6bb77b2dcb06b20f9f4b4a8454caa581cd4dd0643a08bacf821216a16d9c8354", size = 6482084, upload-time = "2026-04-01T14:45:47.568Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/13/306d275efd3a3453f72114b7431c877d10b1154014c1ebbedd067770d629/pillow-12.2.0-cp314-cp314t-win_amd64.whl", hash = "sha256:6562ace0d3fb5f20ed7290f1f929cae41b25ae29528f2af1722966a0a02e2aa1", size = 7225152, upload-time = "2026-04-01T14:45:50.032Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/6e/cf826fae916b8658848d7b9f38d88da6396895c676e8086fc0988073aaf8/pillow-12.2.0-cp314-cp314t-win_arm64.whl", hash = "sha256:aa88ccfe4e32d362816319ed727a004423aab09c5cea43c01a4b435643fa34eb", size = 2556579, upload-time = "2026-04-01T14:45:52.529Z" },
 ]
 
 [[package]]
@@ -3224,11 +3241,11 @@ wheels = [
 
 [[package]]
 name = "pyasn1"
-version = "0.6.2"
+version = "0.6.3"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/fe/b6/6e630dff89739fcd427e3f72b3d905ce0acb85a45d4ec3e2678718a3487f/pyasn1-0.6.2.tar.gz", hash = "sha256:9b59a2b25ba7e4f8197db7686c09fb33e658b98339fadb826e9512629017833b", size = 146586, upload-time = "2026-01-16T18:04:18.534Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5c/5f/6583902b6f79b399c9c40674ac384fd9cd77805f9e6205075f828ef11fb2/pyasn1-0.6.3.tar.gz", hash = "sha256:697a8ecd6d98891189184ca1fa05d1bb00e2f84b5977c481452050549c8a72cf", size = 148685, upload-time = "2026-03-17T01:06:53.382Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/44/b5/a96872e5184f354da9c84ae119971a0a4c221fe9b27a4d94bd43f2596727/pyasn1-0.6.2-py3-none-any.whl", hash = "sha256:1eb26d860996a18e9b6ed05e7aae0e9fc21619fcee6af91cca9bad4fbea224bf", size = 83371, upload-time = "2026-01-16T18:04:17.174Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/a0/7d793dce3fa811fe047d6ae2431c672364b462850c6235ae306c0efd025f/pyasn1-0.6.3-py3-none-any.whl", hash = "sha256:a80184d120f0864a52a073acc6fc642847d0be408e7c7252f31390c0f4eadcde", size = 83997, upload-time = "2026-03-17T01:06:52.036Z" },
 ]
 
 [[package]]
@@ -3381,11 +3398,11 @@ wheels = [
 
 [[package]]
 name = "pypdf"
-version = "6.7.5"
+version = "6.10.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f6/52/37cc0aa9e9d1bf7729a737a0d83f8b3f851c8eb137373d9f71eafb0a3405/pypdf-6.7.5.tar.gz", hash = "sha256:40bb2e2e872078655f12b9b89e2f900888bb505e88a82150b64f9f34fa25651d", size = 5304278, upload-time = "2026-03-02T09:05:21.464Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7b/3f/9f2167401c2e94833ca3b69535bad89e533b5de75fefe4197a2c224baec2/pypdf-6.10.2.tar.gz", hash = "sha256:7d09ce108eff6bf67465d461b6ef352dcb8d84f7a91befc02f904455c6eea11d", size = 5315679, upload-time = "2026-04-15T16:37:36.978Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/05/89/336673efd0a88956562658aba4f0bbef7cb92a6fbcbcaf94926dbc82b408/pypdf-6.7.5-py3-none-any.whl", hash = "sha256:07ba7f1d6e6d9aa2a17f5452e320a84718d4ce863367f7ede2fd72280349ab13", size = 331421, upload-time = "2026-03-02T09:05:19.722Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/d6/1d5c60cc17bbdf37c1552d9c03862fc6d32c5836732a0415b2d637edc2d0/pypdf-6.10.2-py3-none-any.whl", hash = "sha256:aa53be9826655b51c96741e5d7983ca224d898ac0a77896e64636810517624aa", size = 336308, upload-time = "2026-04-15T16:37:34.851Z" },
 ]
 
 [[package]]
@@ -3419,7 +3436,7 @@ wheels = [
 
 [[package]]
 name = "pytest"
-version = "9.0.2"
+version = "9.0.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
@@ -3428,9 +3445,9 @@ dependencies = [
     { name = "pluggy" },
     { name = "pygments" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/d1/db/7ef3487e0fb0049ddb5ce41d3a49c235bf9ad299b6a25d5780a89f19230f/pytest-9.0.2.tar.gz", hash = "sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11", size = 1568901, upload-time = "2025-12-06T21:30:51.014Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/3b/ab/b3226f0bd7cdcf710fbede2b3548584366da3b19b5021e74f5bde2a8fa3f/pytest-9.0.2-py3-none-any.whl", hash = "sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b", size = 374801, upload-time = "2025-12-06T21:30:49.154Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
 ]
 
 [[package]]
@@ -3487,11 +3504,11 @@ wheels = [
 
 [[package]]
 name = "python-dotenv"
-version = "1.2.1"
+version = "1.0.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f0/26/19cadc79a718c5edbec86fd4919a6b6d3f681039a2f6d66d14be94e75fb9/python_dotenv-1.2.1.tar.gz", hash = "sha256:42667e897e16ab0d66954af0e60a9caa94f0fd4ecf3aaf6d2d260eec1aa36ad6", size = 44221, upload-time = "2025-10-26T15:12:10.434Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/bc/57/e84d88dfe0aec03b7a2d4327012c1627ab5f03652216c63d49846d7a6c58/python-dotenv-1.0.1.tar.gz", hash = "sha256:e324ee90a023d808f1959c46bcbc04446a10ced277783dc6ee09987c37ec10ca", size = 39115, upload-time = "2024-01-23T06:33:00.505Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/14/1b/a298b06749107c305e1fe0f814c6c74aea7b2f1e10989cb30f544a1b3253/python_dotenv-1.2.1-py3-none-any.whl", hash = "sha256:b81ee9561e9ca4004139c6cbba3a238c32b03e4894671e181b671e8cb8425d61", size = 21230, upload-time = "2025-10-26T15:12:09.109Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/3e/b68c118422ec867fa7ab88444e1274aa40681c606d59ac27de5a5588f082/python_dotenv-1.0.1-py3-none-any.whl", hash = "sha256:f7b63ef50f1b690dddf550d03497b66d609393b40b564ed0d674909a68ebf16a", size = 19863, upload-time = "2024-01-23T06:32:58.246Z" },
 ]
 
 [[package]]
@@ -3514,11 +3531,11 @@ wheels = [
 
 [[package]]
 name = "python-multipart"
-version = "0.0.22"
+version = "0.0.26"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/94/01/979e98d542a70714b0cb2b6728ed0b7c46792b695e3eaec3e20711271ca3/python_multipart-0.0.22.tar.gz", hash = "sha256:7340bef99a7e0032613f56dc36027b959fd3b30a787ed62d310e951f7c3a3a58", size = 37612, upload-time = "2026-01-25T10:15:56.219Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/88/71/b145a380824a960ebd60e1014256dbb7d2253f2316ff2d73dfd8928ec2c3/python_multipart-0.0.26.tar.gz", hash = "sha256:08fadc45918cd615e26846437f50c5d6d23304da32c341f289a617127b081f17", size = 43501, upload-time = "2026-04-10T14:09:59.473Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/1b/d0/397f9626e711ff749a95d96b7af99b9c566a9bb5129b8e4c10fc4d100304/python_multipart-0.0.22-py3-none-any.whl", hash = "sha256:2b2cd894c83d21bf49d702499531c7bafd057d730c201782048f7945d82de155", size = 24579, upload-time = "2026-01-25T10:15:54.811Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/22/f1925cdda983ab66fc8ec6ec8014b959262747e58bdca26a4e3d1da29d56/python_multipart-0.0.26-py3-none-any.whl", hash = "sha256:c0b169f8c4484c13b0dcf2ef0ec3a4adb255c4b7d18d8e420477d2b1dd03f185", size = 28847, upload-time = "2026-04-10T14:09:58.131Z" },
 ]
 
 [[package]]
@@ -3814,7 +3831,7 @@ wheels = [
 
 [[package]]
 name = "requests"
-version = "2.32.5"
+version = "2.33.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "certifi" },
@@ -3822,9 +3839,9 @@ dependencies = [
     { name = "idna" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517, upload-time = "2025-08-18T20:46:02.573Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/34/64/8860370b167a9721e8956ae116825caff829224fbca0ca6e7bf8ddef8430/requests-2.33.0.tar.gz", hash = "sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652", size = 134232, upload-time = "2026-03-25T15:10:41.586Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738, upload-time = "2025-08-18T20:46:00.542Z" },
+    { url = "https://files.pythonhosted.org/packages/56/5d/c814546c2333ceea4ba42262d8c4d55763003e767fa169adc693bd524478/requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b", size = 65017, upload-time = "2026-03-25T15:10:40.382Z" },
 ]
 
 [[package]]
@@ -4132,8 +4149,8 @@ dependencies = [
     { name = "numpy" },
     { name = "scikit-learn" },
     { name = "scipy" },
-    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'darwin'" },
-    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform != 'darwin'" },
+    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "platform_machine == 's390x' or sys_platform != 'darwin'" },
     { name = "tqdm" },
     { name = "transformers" },
     { name = "typing-extensions" },
@@ -4529,8 +4546,8 @@ dependencies = [
     { name = "huggingface-hub", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
     { name = "pyyaml", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
     { name = "safetensors", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
-    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'darwin'" },
-    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "(python_full_version < '3.13' and sys_platform == 'win32') or (sys_platform != 'darwin' and sys_platform != 'win32')" },
+    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "(python_full_version < '3.13' and sys_platform == 'win32') or (platform_machine == 's390x' and sys_platform == 'darwin') or (sys_platform != 'darwin' and sys_platform != 'win32')" },
     { name = "torchvision", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/d7/2c/593109822fe735e637382aca6640c1102c19797f7791f1fd1dab2d6c3cb1/timm-1.0.25.tar.gz", hash = "sha256:47f59fc2754725735cc81bb83bcbfce5bec4ebd5d4bb9e69da57daa92fcfa768", size = 2414743, upload-time = "2026-02-23T16:49:00.137Z" }
@@ -4584,29 +4601,29 @@ name = "torch"
 version = "2.10.0"
 source = { registry = "https://download.pytorch.org/whl/cpu" }
 resolution-markers = [
-    "python_full_version >= '3.14' and sys_platform == 'darwin'",
-    "python_full_version == '3.13.*' and sys_platform == 'darwin'",
-    "python_full_version < '3.13' and sys_platform == 'darwin'",
+    "python_full_version >= '3.14' and platform_machine != 's390x' and sys_platform == 'darwin'",
+    "python_full_version == '3.13.*' and platform_machine != 's390x' and sys_platform == 'darwin'",
+    "python_full_version < '3.13' and platform_machine != 's390x' and sys_platform == 'darwin'",
 ]
 dependencies = [
-    { name = "filelock", marker = "sys_platform == 'darwin'" },
-    { name = "fsspec", marker = "sys_platform == 'darwin'" },
-    { name = "jinja2", marker = "sys_platform == 'darwin'" },
-    { name = "networkx", marker = "sys_platform == 'darwin'" },
-    { name = "setuptools", marker = "sys_platform == 'darwin'" },
-    { name = "sympy", marker = "sys_platform == 'darwin'" },
-    { name = "typing-extensions", marker = "sys_platform == 'darwin'" },
+    { name = "filelock", marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "fsspec", marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "jinja2", marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "networkx", marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "setuptools", marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "sympy", marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "typing-extensions", marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
 ]
 wheels = [
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0-1-cp312-none-macosx_11_0_arm64.whl", hash = "sha256:7fbbf409143a4fe0812a40c0b46a436030a7e1d14fe8c5234dfbe44df47f617e" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0-1-cp313-none-macosx_11_0_arm64.whl", hash = "sha256:b39cafff7229699f9d6e172cac74d85fd71b568268e439e08d9c540e54732a3e" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0-2-cp312-none-macosx_11_0_arm64.whl", hash = "sha256:358bd7125cbec6e692d60618a5eec7f55a51b29e3652a849fd42af021d818023" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0-2-cp313-none-macosx_11_0_arm64.whl", hash = "sha256:470de4176007c2700735e003a830828a88d27129032a3add07291da07e2a94e8" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0-cp312-none-macosx_11_0_arm64.whl", hash = "sha256:45a1c5057629444aeb1c452c18298fa7f30f2f7aeadd4dc41f9d340980294407" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0-cp313-cp313t-macosx_14_0_arm64.whl", hash = "sha256:339e05502b6c839db40e88720cb700f5a3b50cda332284873e851772d41b2c1e" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0-cp313-none-macosx_11_0_arm64.whl", hash = "sha256:840351da59cedb7bcbc51981880050813c19ef6b898a7fecf73a3afc71aff3fe" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0-cp314-cp314-macosx_14_0_arm64.whl", hash = "sha256:c88b1129fd4e14f0f882963c6728315caae35d2f47374d17edeed1edc7697497" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0-cp314-cp314t-macosx_14_0_arm64.whl", hash = "sha256:f4bea7dc451267c028593751612ad559299589304e68df54ae7672427893ff2c" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0-1-cp312-none-macosx_11_0_arm64.whl", hash = "sha256:7fbbf409143a4fe0812a40c0b46a436030a7e1d14fe8c5234dfbe44df47f617e", upload-time = "2026-02-06T16:27:14Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0-1-cp313-none-macosx_11_0_arm64.whl", hash = "sha256:b39cafff7229699f9d6e172cac74d85fd71b568268e439e08d9c540e54732a3e", upload-time = "2026-02-06T16:27:17Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0-2-cp312-none-macosx_11_0_arm64.whl", hash = "sha256:358bd7125cbec6e692d60618a5eec7f55a51b29e3652a849fd42af021d818023", upload-time = "2026-02-10T19:55:42Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0-2-cp313-none-macosx_11_0_arm64.whl", hash = "sha256:470de4176007c2700735e003a830828a88d27129032a3add07291da07e2a94e8", upload-time = "2026-02-10T19:55:43Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0-cp312-none-macosx_11_0_arm64.whl", hash = "sha256:45a1c5057629444aeb1c452c18298fa7f30f2f7aeadd4dc41f9d340980294407", upload-time = "2026-01-23T15:09:55Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0-cp313-cp313t-macosx_14_0_arm64.whl", hash = "sha256:339e05502b6c839db40e88720cb700f5a3b50cda332284873e851772d41b2c1e", upload-time = "2026-01-23T15:09:57Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0-cp313-none-macosx_11_0_arm64.whl", hash = "sha256:840351da59cedb7bcbc51981880050813c19ef6b898a7fecf73a3afc71aff3fe", upload-time = "2026-01-23T15:09:59Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0-cp314-cp314-macosx_14_0_arm64.whl", hash = "sha256:c88b1129fd4e14f0f882963c6728315caae35d2f47374d17edeed1edc7697497", upload-time = "2026-01-23T15:09:59Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0-cp314-cp314t-macosx_14_0_arm64.whl", hash = "sha256:f4bea7dc451267c028593751612ad559299589304e68df54ae7672427893ff2c", upload-time = "2026-01-23T15:10:01Z" },
 ]
 
 [[package]]
@@ -4615,51 +4632,60 @@ version = "2.10.0+cpu"
 source = { registry = "https://download.pytorch.org/whl/cpu" }
 resolution-markers = [
     "python_full_version >= '3.14' and sys_platform == 'win32'",
-    "python_full_version >= '3.14' and sys_platform == 'emscripten'",
-    "python_full_version >= '3.14' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
+    "python_full_version >= '3.14' and platform_machine != 's390x' and sys_platform == 'emscripten'",
+    "python_full_version >= '3.14' and platform_machine == 's390x' and sys_platform == 'emscripten'",
+    "python_full_version >= '3.14' and platform_machine != 's390x' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
+    "python_full_version >= '3.14' and platform_machine == 's390x' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
+    "python_full_version >= '3.14' and platform_machine == 's390x' and sys_platform == 'darwin'",
     "python_full_version == '3.13.*' and sys_platform == 'win32'",
-    "python_full_version == '3.13.*' and sys_platform == 'emscripten'",
-    "python_full_version == '3.13.*' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
-    "python_full_version < '3.13' and sys_platform != 'darwin' and sys_platform != 'win32'",
-    "python_full_version < '3.13' and sys_platform == 'win32'",
+    "python_full_version == '3.13.*' and platform_machine != 's390x' and sys_platform == 'emscripten'",
+    "python_full_version == '3.13.*' and platform_machine == 's390x' and sys_platform == 'emscripten'",
+    "python_full_version == '3.13.*' and platform_machine != 's390x' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
+    "python_full_version == '3.13.*' and platform_machine == 's390x' and sys_platform != 'darwin' and sys_platform != 'emscripten' and sys_platform != 'win32'",
+    "python_full_version < '3.13' and platform_machine != 's390x' and sys_platform != 'darwin' and sys_platform != 'win32'",
+    "python_full_version < '3.13' and platform_machine == 's390x' and sys_platform != 'darwin' and sys_platform != 'win32'",
+    "python_full_version < '3.13' and platform_machine != 's390x' and sys_platform == 'win32'",
+    "python_full_version < '3.13' and platform_machine == 's390x' and sys_platform == 'win32'",
+    "python_full_version == '3.13.*' and platform_machine == 's390x' and sys_platform == 'darwin'",
+    "python_full_version < '3.13' and platform_machine == 's390x' and sys_platform == 'darwin'",
 ]
 dependencies = [
-    { name = "filelock", marker = "sys_platform != 'darwin'" },
-    { name = "fsspec", marker = "sys_platform != 'darwin'" },
-    { name = "jinja2", marker = "sys_platform != 'darwin'" },
-    { name = "networkx", marker = "sys_platform != 'darwin'" },
-    { name = "setuptools", marker = "sys_platform != 'darwin'" },
-    { name = "sympy", marker = "sys_platform != 'darwin'" },
-    { name = "typing-extensions", marker = "sys_platform != 'darwin'" },
-]
-wheels = [
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-linux_aarch64.whl", hash = "sha256:8de5a36371b775e2d4881ed12cc7f2de400b1ad3d728aa74a281f649f87c9b8c" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-linux_s390x.whl", hash = "sha256:9accc30b56cb6756d4a9d04fcb8ebc0bb68c7d55c1ed31a8657397d316d31596" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:179451716487f8cb09b56459667fa1f5c4c0946c1e75fbeae77cfc40a5768d87" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:ee40b8a4b4b2cf0670c6fd4f35a7ef23871af956fecb238fbf5da15a72650b1d" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-win_amd64.whl", hash = "sha256:21cb5436978ef47c823b7a813ff0f8c2892e266cfe0f1d944879b5fba81bf4e1" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-win_arm64.whl", hash = "sha256:3eaa727e6a73affa61564d86b9d03191df45c8650d0666bd3d57c8597ef61e78" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-linux_aarch64.whl", hash = "sha256:fd215f3d0f681905c5b56b0630a3d666900a37fcc3ca5b937f95275c66f9fd9c" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-linux_s390x.whl", hash = "sha256:170a0623108055be5199370335cf9b41ba6875b3cb6f086db4aee583331a4899" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-manylinux_2_28_aarch64.whl", hash = "sha256:e51994492cdb76edce29da88de3672a3022f9ef0ffd90345436948d4992be2c7" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:8d316e5bf121f1eab1147e49ad0511a9d92e4c45cc357d1ab0bee440da71a095" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-win_amd64.whl", hash = "sha256:b719da5af01b59126ac13eefd6ba3dd12d002dc0e8e79b8b365e55267a8189d3" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-win_arm64.whl", hash = "sha256:b67d91326e4ed9eccbd6b7d84ed7ffa43f93103aa3f0b24145f3001f3b11b714" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313t-linux_aarch64.whl", hash = "sha256:5af75e5f49de21b0bdf7672bc27139bd285f9e8dbcabe2d617a2eb656514ac36" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313t-linux_s390x.whl", hash = "sha256:ba51ef01a510baf8fff576174f702c47e1aa54389a9f1fba323bb1a5003ff0bf" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313t-manylinux_2_28_aarch64.whl", hash = "sha256:0fedcb1a77e8f2aaf7bfd21591bf6d1e0b207473268c9be16b17cb7783253969" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313t-manylinux_2_28_x86_64.whl", hash = "sha256:106dd1930cb30a4a337366ba3f9b25318ebf940f51fd46f789281dd9e736bdc4" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313t-win_amd64.whl", hash = "sha256:eb1bde1ce198f05c8770017de27e001d404499cf552aaaa014569eff56ca25c0" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314-linux_aarch64.whl", hash = "sha256:ea2bcc9d1fca66974a71d4bf9a502539283f35d61fcab5a799b4e120846f1e02" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314-linux_s390x.whl", hash = "sha256:f8294fd2fc6dd8f4435a891a0122307a043b14b21f0dac1bca63c85bfb59e586" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314-manylinux_2_28_aarch64.whl", hash = "sha256:a28fdbcfa2fbacffec81300f24dd1bed2b0ccfdbed107a823cff12bc1db070f6" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314-manylinux_2_28_x86_64.whl", hash = "sha256:aada8afc068add586464b2a55adb7cc9091eec55caf5320447204741cb6a0604" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314-win_amd64.whl", hash = "sha256:2adc71fe471e98a608723bfc837f7e1929885ebb912c693597711e139c1cda41" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314t-linux_aarch64.whl", hash = "sha256:9412bd37b70f5ebd1205242c4ba4cabae35a605947f2b30806d5c9b467936db9" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314t-linux_s390x.whl", hash = "sha256:e71c476517c33e7db69825a9ff46c7f47a723ec4dac5b2481cff4246d1c632be" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:23882f8d882460aca809882fc42f5e343bf07585274f929ced00177d1be1eb67" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:4fcd8b4cc2ae20f2b7749fb275349c55432393868778c2d50a08e81d5ee5591e" },
-    { url = "https://download.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314t-win_amd64.whl", hash = "sha256:ffc8da9a1341092d6a90cb5b1c1a33cd61abf0fb43f0cd88443c27fa372c26ae" },
+    { name = "filelock", marker = "platform_machine == 's390x' or sys_platform != 'darwin'" },
+    { name = "fsspec", marker = "platform_machine == 's390x' or sys_platform != 'darwin'" },
+    { name = "jinja2", marker = "platform_machine == 's390x' or sys_platform != 'darwin'" },
+    { name = "networkx", marker = "platform_machine == 's390x' or sys_platform != 'darwin'" },
+    { name = "setuptools", marker = "platform_machine == 's390x' or sys_platform != 'darwin'" },
+    { name = "sympy", marker = "platform_machine == 's390x' or sys_platform != 'darwin'" },
+    { name = "typing-extensions", marker = "platform_machine == 's390x' or sys_platform != 'darwin'" },
+]
+wheels = [
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-linux_aarch64.whl", hash = "sha256:8de5a36371b775e2d4881ed12cc7f2de400b1ad3d728aa74a281f649f87c9b8c", upload-time = "2026-01-23T15:10:22Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-linux_s390x.whl", hash = "sha256:9accc30b56cb6756d4a9d04fcb8ebc0bb68c7d55c1ed31a8657397d316d31596", upload-time = "2026-01-23T15:10:24Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:179451716487f8cb09b56459667fa1f5c4c0946c1e75fbeae77cfc40a5768d87", upload-time = "2026-01-23T15:10:25Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:ee40b8a4b4b2cf0670c6fd4f35a7ef23871af956fecb238fbf5da15a72650b1d", upload-time = "2026-01-23T15:10:27Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-win_amd64.whl", hash = "sha256:21cb5436978ef47c823b7a813ff0f8c2892e266cfe0f1d944879b5fba81bf4e1", upload-time = "2026-01-23T15:10:30Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp312-cp312-win_arm64.whl", hash = "sha256:3eaa727e6a73affa61564d86b9d03191df45c8650d0666bd3d57c8597ef61e78", upload-time = "2026-01-23T15:10:31Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-linux_aarch64.whl", hash = "sha256:fd215f3d0f681905c5b56b0630a3d666900a37fcc3ca5b937f95275c66f9fd9c", upload-time = "2026-01-23T15:10:34Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-linux_s390x.whl", hash = "sha256:170a0623108055be5199370335cf9b41ba6875b3cb6f086db4aee583331a4899", upload-time = "2026-01-23T15:10:35Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-manylinux_2_28_aarch64.whl", hash = "sha256:e51994492cdb76edce29da88de3672a3022f9ef0ffd90345436948d4992be2c7", upload-time = "2026-01-23T15:10:37Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:8d316e5bf121f1eab1147e49ad0511a9d92e4c45cc357d1ab0bee440da71a095", upload-time = "2026-01-23T15:10:38Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-win_amd64.whl", hash = "sha256:b719da5af01b59126ac13eefd6ba3dd12d002dc0e8e79b8b365e55267a8189d3", upload-time = "2026-01-23T15:10:41Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313-win_arm64.whl", hash = "sha256:b67d91326e4ed9eccbd6b7d84ed7ffa43f93103aa3f0b24145f3001f3b11b714", upload-time = "2026-01-23T15:10:42Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313t-linux_aarch64.whl", hash = "sha256:5af75e5f49de21b0bdf7672bc27139bd285f9e8dbcabe2d617a2eb656514ac36", upload-time = "2026-01-23T15:10:44Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313t-linux_s390x.whl", hash = "sha256:ba51ef01a510baf8fff576174f702c47e1aa54389a9f1fba323bb1a5003ff0bf", upload-time = "2026-01-23T15:10:48Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313t-manylinux_2_28_aarch64.whl", hash = "sha256:0fedcb1a77e8f2aaf7bfd21591bf6d1e0b207473268c9be16b17cb7783253969", upload-time = "2026-01-23T15:10:48Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313t-manylinux_2_28_x86_64.whl", hash = "sha256:106dd1930cb30a4a337366ba3f9b25318ebf940f51fd46f789281dd9e736bdc4", upload-time = "2026-01-23T15:10:50Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp313-cp313t-win_amd64.whl", hash = "sha256:eb1bde1ce198f05c8770017de27e001d404499cf552aaaa014569eff56ca25c0", upload-time = "2026-01-23T15:10:50Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314-linux_aarch64.whl", hash = "sha256:ea2bcc9d1fca66974a71d4bf9a502539283f35d61fcab5a799b4e120846f1e02", upload-time = "2026-01-23T15:10:53Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314-linux_s390x.whl", hash = "sha256:f8294fd2fc6dd8f4435a891a0122307a043b14b21f0dac1bca63c85bfb59e586", upload-time = "2026-01-23T15:10:55Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314-manylinux_2_28_aarch64.whl", hash = "sha256:a28fdbcfa2fbacffec81300f24dd1bed2b0ccfdbed107a823cff12bc1db070f6", upload-time = "2026-01-23T15:10:56Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314-manylinux_2_28_x86_64.whl", hash = "sha256:aada8afc068add586464b2a55adb7cc9091eec55caf5320447204741cb6a0604", upload-time = "2026-01-23T15:10:58Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314-win_amd64.whl", hash = "sha256:2adc71fe471e98a608723bfc837f7e1929885ebb912c693597711e139c1cda41", upload-time = "2026-01-23T15:11:01Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314t-linux_aarch64.whl", hash = "sha256:9412bd37b70f5ebd1205242c4ba4cabae35a605947f2b30806d5c9b467936db9", upload-time = "2026-01-23T15:11:03Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314t-linux_s390x.whl", hash = "sha256:e71c476517c33e7db69825a9ff46c7f47a723ec4dac5b2481cff4246d1c632be", upload-time = "2026-01-23T15:11:04Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:23882f8d882460aca809882fc42f5e343bf07585274f929ced00177d1be1eb67", upload-time = "2026-01-23T15:11:07Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:4fcd8b4cc2ae20f2b7749fb275349c55432393868778c2d50a08e81d5ee5591e", upload-time = "2026-01-23T15:11:07Z" },
+    { url = "https://download-r2.pytorch.org/whl/cpu/torch-2.10.0%2Bcpu-cp314-cp314t-win_amd64.whl", hash = "sha256:ffc8da9a1341092d6a90cb5b1c1a33cd61abf0fb43f0cd88443c27fa372c26ae", upload-time = "2026-01-23T15:11:10Z" },
 ]
 
 [[package]]
@@ -4669,8 +4695,8 @@ source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "numpy", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
     { name = "pillow", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
-    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'darwin'" },
-    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "(python_full_version < '3.13' and sys_platform == 'win32') or (sys_platform != 'darwin' and sys_platform != 'win32')" },
+    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "(python_full_version < '3.13' and sys_platform == 'win32') or (platform_machine == 's390x' and sys_platform == 'darwin') or (sys_platform != 'darwin' and sys_platform != 'win32')" },
 ]
 wheels = [
     { url = "https://files.pythonhosted.org/packages/56/3a/6ea0d73f49a9bef38a1b3a92e8dd455cea58470985d25635beab93841748/torchvision-0.25.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:c2abe430c90b1d5e552680037d68da4eb80a5852ebb1c811b2b89d299b10573b", size = 1874920, upload-time = "2026-01-21T16:27:45.348Z" },
@@ -4729,7 +4755,7 @@ wheels = [
 
 [[package]]
 name = "typer"
-version = "0.24.0"
+version = "0.23.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "annotated-doc" },
@@ -4737,21 +4763,21 @@ dependencies = [
     { name = "rich" },
     { name = "shellingham" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/5a/b6/3e681d3b6bb22647509bdbfdd18055d5adc0dce5c5585359fa46ff805fdc/typer-0.24.0.tar.gz", hash = "sha256:f9373dc4eff901350694f519f783c29b6d7a110fc0dcc11b1d7e353b85ca6504", size = 118380, upload-time = "2026-02-16T22:08:48.496Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/fd/07/b822e1b307d40e263e8253d2384cf98c51aa2368cc7ba9a07e523a1d964b/typer-0.23.1.tar.gz", hash = "sha256:2070374e4d31c83e7b61362fd859aa683576432fd5b026b060ad6b4cd3b86134", size = 120047, upload-time = "2026-02-13T10:04:30.984Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/85/d0/4da85c2a45054bb661993c93524138ace4956cb075a7ae0c9d1deadc331b/typer-0.24.0-py3-none-any.whl", hash = "sha256:5fc435a9c8356f6160ed6e85a6301fdd6e3d8b2851da502050d1f92c5e9eddc8", size = 56441, upload-time = "2026-02-16T22:08:47.535Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/91/9b286ab899c008c2cb05e8be99814807e7fbbd33f0c0c960470826e5ac82/typer-0.23.1-py3-none-any.whl", hash = "sha256:3291ad0d3c701cbf522012faccfbb29352ff16ad262db2139e6b01f15781f14e", size = 56813, upload-time = "2026-02-13T10:04:32.008Z" },
 ]
 
 [[package]]
 name = "typer-slim"
-version = "0.24.0"
+version = "0.23.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a7/a7/e6aecc4b4eb59598829a3b5076a93aff291b4fdaa2ded25efc4e1f4d219c/typer_slim-0.24.0.tar.gz", hash = "sha256:f0ed36127183f52ae6ced2ecb2521789995992c521a46083bfcdbb652d22ad34", size = 4776, upload-time = "2026-02-16T22:08:51.2Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/da/22/b9c47b8655937b6877d40791b937931702ba9c5f9d28753199266aa96f50/typer_slim-0.23.1.tar.gz", hash = "sha256:dfe92a6317030ee2380f65bf92e540d7c77fefcc689e10d585b4925b45b5e06a", size = 4762, upload-time = "2026-02-13T10:04:26.416Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a7/24/5480c20380dfd18cf33d14784096dca45a24eae6102e91d49a718d3b6855/typer_slim-0.24.0-py3-none-any.whl", hash = "sha256:d5d7ee1ee2834d5020c7c616ed5e0d0f29b9a4b1dd283bdebae198ec09778d0e", size = 3394, upload-time = "2026-02-16T22:08:49.92Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/8a/5764b851659345f34787f1b6eb30b9d308bbd6c294825cbe38b6b869c97a/typer_slim-0.23.1-py3-none-any.whl", hash = "sha256:8146d5df1eb89f628191c4c604c8464fa841885d0733c58e6e700ff0228adac5", size = 3397, upload-time = "2026-02-13T10:04:27.132Z" },
 ]
 
 [[package]]
@@ -4866,8 +4892,8 @@ dependencies = [
     { name = "rapidfuzz", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
     { name = "scipy", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
     { name = "timm", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
-    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'darwin'" },
-    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "(python_full_version < '3.13' and sys_platform == 'win32') or (sys_platform != 'darwin' and sys_platform != 'win32')" },
+    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "(python_full_version < '3.13' and sys_platform == 'win32') or (platform_machine == 's390x' and sys_platform == 'darwin') or (sys_platform != 'darwin' and sys_platform != 'win32')" },
     { name = "transformers", marker = "python_full_version < '3.13' or sys_platform != 'win32'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/60/eb/7f19073948f50dacd2f4997b88207eb4ba12ad2ecb94e416b55849940564/unstructured_inference-1.5.2.tar.gz", hash = "sha256:5aa8e81009763fe44d17fc9305589ff5ffc168152d0edb73bc02978af49490bd", size = 46613, upload-time = "2026-02-13T01:01:38.702Z" }
@@ -4955,7 +4981,7 @@ wheels = [
 
 [[package]]
 name = "vektra-admin"
-version = "0.4.0.dev0"
+version = "0.5.0"
 source = { editable = "vektra-admin" }
 dependencies = [
     { name = "argon2-cffi" },
@@ -5004,7 +5030,7 @@ dev = [
 
 [[package]]
 name = "vektra-analytics"
-version = "0.4.0.dev0"
+version = "0.5.0"
 source = { editable = "vektra-analytics" }
 dependencies = [
     { name = "fastapi" },
@@ -5039,7 +5065,7 @@ dev = [
 
 [[package]]
 name = "vektra-app"
-version = "0.4.0.dev0"
+version = "0.5.0"
 source = { editable = "vektra-app" }
 dependencies = [
     { name = "alembic" },
@@ -5088,7 +5114,7 @@ dev = [
 
 [[package]]
 name = "vektra-core"
-version = "0.4.0.dev0"
+version = "0.5.0"
 source = { editable = "vektra-core" }
 dependencies = [
     { name = "fastapi" },
@@ -5113,7 +5139,7 @@ dev = [
 requires-dist = [
     { name = "fastapi", specifier = ">=0.115" },
     { name = "jinja2", specifier = ">=3.1" },
-    { name = "litellm", specifier = ">=1.40,<1.82.7" },
+    { name = "litellm", specifier = ">=1.83.10" },
     { name = "presidio-analyzer", specifier = ">=2.2" },
     { name = "presidio-anonymizer", specifier = ">=2.2" },
     { name = "pydantic", specifier = ">=2,<3" },
@@ -5125,13 +5151,13 @@ requires-dist = [
 [package.metadata.requires-dev]
 dev = [
     { name = "httpx", specifier = ">=0.27" },
-    { name = "pytest", specifier = ">=8.0" },
+    { name = "pytest", specifier = ">=9.0.3" },
     { name = "pytest-asyncio", specifier = ">=1.0" },
 ]
 
 [[package]]
 name = "vektra-index"
-version = "0.4.0.dev0"
+version = "0.5.0"
 source = { editable = "vektra-index" }
 dependencies = [
     { name = "asyncpg" },
@@ -5140,8 +5166,8 @@ dependencies = [
     { name = "pydantic" },
     { name = "sentence-transformers" },
     { name = "sqlalchemy", extra = ["asyncio"] },
-    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'darwin'" },
-    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform != 'darwin'" },
+    { name = "torch", version = "2.10.0", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "platform_machine != 's390x' and sys_platform == 'darwin'" },
+    { name = "torch", version = "2.10.0+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "platform_machine == 's390x' or sys_platform != 'darwin'" },
     { name = "vektra-shared" },
 ]
 
@@ -5186,7 +5212,7 @@ dev = [
 
 [[package]]
 name = "vektra-ingest"
-version = "0.4.0.dev0"
+version = "0.5.0"
 source = { editable = "vektra-ingest" }
 dependencies = [
     { name = "arq" },
@@ -5248,7 +5274,7 @@ dev = [
 
 [[package]]
 name = "vektra-learn"
-version = "0.4.0.dev0"
+version = "0.5.0"
 source = { editable = "vektra-learn" }
 dependencies = [
     { name = "fastapi" },
@@ -5285,7 +5311,7 @@ dev = [
 
 [[package]]
 name = "vektra-shared"
-version = "0.4.0.dev0"
+version = "0.5.0"
 source = { editable = "vektra-shared" }
 dependencies = [
     { name = "asyncpg" },
diff --git a/vektra-admin/README.md b/vektra-admin/README.md
index 0eb9ae27..4cf9d594 100644
--- a/vektra-admin/README.md
+++ b/vektra-admin/README.md
@@ -4,4 +4,14 @@ System administration interface for the Vektra platform.
 
 Phase 1: minimal admin endpoints included in vektra-core (namespace management, API key management, system health). Phase 2: full admin SPA with separate deployment.
 
+## Endpoints
+
+See [API reference](../docs/reference/api.md) for full request/response shapes:
+
+- `POST/GET/DELETE /api/v1/api-keys` — API key lifecycle (`admin` scope)
+- `GET /api/v1/admin/namespaces/{id}/config` — read namespace behavioral config (stored JSONB + resolved view)
+- `PATCH /api/v1/admin/namespaces/{id}/config` — partial update of namespace behavioral config (current whitelist: `grounding_mode`, `show_sources`)
+
+The PATCH endpoint backs upstream LMS plugins (e.g. the Moodle block edit form) so professors can toggle per-course behavior — strict/hybrid RAG, citation visibility — without touching environment variables or invoking platform admins.
+
 See [architecture.md](../.s2s/architecture.md) for the component specification.
diff --git a/vektra-admin/pyproject.toml b/vektra-admin/pyproject.toml
index be40f26a..d5e72887 100644
--- a/vektra-admin/pyproject.toml
+++ b/vektra-admin/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "vektra-admin"
-version = "0.4.0-dev"
+version = "0.5.0"
 description = "System administration interface: health, API key management, audit log"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/vektra-admin/src/vektra_admin/api.py b/vektra-admin/src/vektra_admin/api.py
index 60154039..aa7ae1b5 100644
--- a/vektra-admin/src/vektra_admin/api.py
+++ b/vektra-admin/src/vektra_admin/api.py
@@ -14,7 +14,7 @@
 
 from datetime import UTC, datetime
 from typing import Any
-from uuid import UUID
+from uuid import UUID, uuid4
 
 import structlog
 from fastapi import (
@@ -29,6 +29,7 @@
 from pydantic import BaseModel, field_validator
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm.attributes import flag_modified
 
 from vektra_admin import audit as _audit
 from vektra_admin import bootstrap as _bootstrap
@@ -43,8 +44,52 @@
     http_status_for,
 )
 
+# ---------------------------------------------------------------------------
+# Namespace config whitelist (WI-3)
+# ---------------------------------------------------------------------------
+# Tight whitelist: unknown keys are rejected (not silently ignored) so that
+# typos from upstream clients (e.g. Moodle plugin) surface immediately. Each
+# key is a public contract — extend cautiously.
+#
+# Validation model: every allowed key MUST be declared in exactly one of the
+# two maps below.
+#   - ALLOWED_CONFIG_VALUES[key]: set of allowed values (enum-style key)
+#   - ALLOWED_CONFIG_TYPES[key]: required runtime type (type-validated key)
+# ALLOWED_CONFIG_KEYS is derived (not hand-maintained) so a key cannot reach
+# the whitelist without a corresponding validation rule. The disjoint check
+# below fails at import if the same key is wired into both maps.
+ALLOWED_CONFIG_VALUES: dict[str, set[str]] = {
+    "grounding_mode": {"strict", "hybrid"},
+}
+ALLOWED_CONFIG_TYPES: dict[str, type] = {
+    "show_sources": bool,
+}
+assert ALLOWED_CONFIG_VALUES.keys().isdisjoint(ALLOWED_CONFIG_TYPES.keys()), (
+    "Each config key must appear in exactly one of "
+    "ALLOWED_CONFIG_VALUES / ALLOWED_CONFIG_TYPES, never both."
+)
+ALLOWED_CONFIG_KEYS: set[str] = (
+    ALLOWED_CONFIG_VALUES.keys() | ALLOWED_CONFIG_TYPES.keys()
+)
+
 log = structlog.get_logger(__name__)
 
+
+def _resolve_request_id(request: Request) -> UUID:
+    """Return ``request.state.request_id`` or synthesize a fallback ``uuid4()``.
+
+    Always returns a UUID so audit logging never silently skips sensitive
+    endpoints (NFR-007) when the request-id middleware misbehaves. Emits a
+    structlog warning on the fallback path so misconfiguration is observable.
+    """
+    rid: UUID | None = getattr(request.state, "request_id", None)
+    if rid is not None:
+        return rid
+    fallback = uuid4()
+    log.warning("request_id_middleware_missing_fallback", fallback=str(fallback))
+    return fallback
+
+
 router = APIRouter()
 _bearer = HTTPBearer(auto_error=False)
 
@@ -229,9 +274,10 @@ async def create_api_key(
     registry = getattr(request.app.state, "registry", None)
 
     key_info: ApiKeyInfo | None = None
+    is_bootstrap = _bootstrap.is_bootstrap_key(token)
 
     # --- Authenticate: bootstrap or admin key ---
-    if _bootstrap.is_bootstrap_key(token):
+    if is_bootstrap:
         # Check consumption before proceeding
         consumed = await _bootstrap.is_bootstrap_consumed(session)
         if consumed:
@@ -302,7 +348,7 @@ async def create_api_key(
     )
     session.add(new_key)
 
-    if _bootstrap.is_bootstrap_key(token):
+    if is_bootstrap:
         await _bootstrap.consume_bootstrap_key(session)
 
     await session.commit()
@@ -326,19 +372,17 @@ async def create_api_key(
     # NFR-007: log ALL authenticated requests, including bootstrap key usage.
     # AuditLogOrm.key_id is NOT a FK, so UUID(int=0) is safe as sentinel.
     _BOOTSTRAP_SENTINEL = UUID(int=0)
-    request_id = getattr(request.state, "request_id", None)
-    if request_id:
-        is_bootstrap = _bootstrap.is_bootstrap_key(token)
-        background_tasks.add_task(
-            _audit.log_event,
-            key_id=key_info.key_id if key_info else _BOOTSTRAP_SENTINEL,
-            endpoint="/api/v1/api-keys",
-            method="POST",
-            status_code=201,
-            request_id=request_id,
-            action="apikey_created_bootstrap" if is_bootstrap else "apikey_created",
-            log_metadata={"new_key_id": str(new_key.id)},
-        )
+    request_id = _resolve_request_id(request)
+    background_tasks.add_task(
+        _audit.log_event,
+        key_id=key_info.key_id if key_info else _BOOTSTRAP_SENTINEL,
+        endpoint="/api/v1/api-keys",
+        method="POST",
+        status_code=201,
+        request_id=request_id,
+        action="apikey_created_bootstrap" if is_bootstrap else "apikey_created",
+        log_metadata={"new_key_id": str(new_key.id)},
+    )
 
     log.info("api_key_created", key_id=str(new_key.id), scopes=requested_scopes)
 
@@ -420,18 +464,17 @@ async def revoke_api_key(
             pass
 
     # Audit log (async background task; log_event creates its own session)
-    request_id = getattr(request.state, "request_id", None)
-    if request_id:
-        background_tasks.add_task(
-            _audit.log_event,
-            key_id=key_info.key_id,
-            endpoint=f"/api/v1/api-keys/{key_id}",
-            method="DELETE",
-            status_code=204,
-            request_id=request_id,
-            action="apikey_revoked",
-            log_metadata={"revoked_key_id": str(key_id)},
-        )
+    request_id = _resolve_request_id(request)
+    background_tasks.add_task(
+        _audit.log_event,
+        key_id=key_info.key_id,
+        endpoint=f"/api/v1/api-keys/{key_id}",
+        method="DELETE",
+        status_code=204,
+        request_id=request_id,
+        action="apikey_revoked",
+        log_metadata={"revoked_key_id": str(key_id)},
+    )
 
     log.info("api_key_revoked", key_id=str(key_id), revoked_by=str(key_info.key_id))
 
@@ -490,26 +533,262 @@ async def get_conversation_turns(
         raise HTTPException(status_code=404, detail="Conversation not found")
 
     # Audit log: sensitive content access
-    request_id = getattr(request.state, "request_id", None)
-    if request_id:
-        background_tasks.add_task(
-            _audit.log_event,
-            key_id=_key.key_id,
-            endpoint=f"/api/v1/admin/conversations/{conversation_id}/turns",
-            method="GET",
-            status_code=200,
-            request_id=request_id,
-            action="conversation_turns_read",
-            log_metadata={
-                "namespace": getattr(request.state, "rls_namespace", None),
-                "conversation_id": str(conversation_id),
-                "turn_count": len(turns),
-            },
-        )
+    request_id = _resolve_request_id(request)
+    background_tasks.add_task(
+        _audit.log_event,
+        key_id=_key.key_id,
+        endpoint=f"/api/v1/admin/conversations/{conversation_id}/turns",
+        method="GET",
+        status_code=200,
+        request_id=request_id,
+        action="conversation_turns_read",
+        log_metadata={
+            "namespace": getattr(request.state, "rls_namespace", None),
+            "conversation_id": str(conversation_id),
+            "turn_count": len(turns),
+        },
+    )
 
     return turns
 
 
+# ---------------------------------------------------------------------------
+# Namespace configuration (WI-3, FEAT-020 write path)
+# ---------------------------------------------------------------------------
+
+
+class NamespaceConfigResponse(BaseModel):
+    """Full namespace config after a PATCH merge."""
+
+    namespace_id: str
+    config: dict[str, Any]
+
+
+class NamespaceConfigDetailResponse(BaseModel):
+    """Full namespace config plus the effective values after env-default fallback.
+
+    *config* mirrors what is physically stored in ``namespaces.config``.
+    *resolved* is what queries actually see at runtime, after the resolvers
+    in :mod:`vektra_shared.namespace` apply the env-var fallback chain
+    (namespace JSONB > env var > hardcoded default). Consumers like the
+    Moodle block edit form use *resolved* to render the "Use default" /
+    "Override" toggle without having to re-implement the chain client-side.
+    """
+
+    namespace_id: str
+    config: dict[str, Any]
+    resolved: dict[str, Any]
+
+
+def _resolved_from_stored(
+    stored: dict[str, Any],
+    defaults: dict[str, Any],
+) -> dict[str, Any]:
+    """Apply the namespace > env > hardcoded-default chain to a loaded JSONB.
+
+    Operates on an already-loaded config dict so the GET endpoint can avoid
+    opening extra DB sessions (the standalone resolvers in
+    :mod:`vektra_shared.namespace` remain for callers that hold only a
+    namespace id).
+
+    Validation is derived from the module-level ``ALLOWED_CONFIG_VALUES`` /
+    ``ALLOWED_CONFIG_TYPES`` maps and the result is built by iterating
+    ``ALLOWED_CONFIG_KEYS``, so adding a new whitelist key automatically
+    flows through here without further edits — the only requirement is that
+    *defaults* provides an entry for the new key (assertion below).
+    """
+    assert ALLOWED_CONFIG_KEYS <= defaults.keys(), (
+        "defaults must provide a fallback for every key in "
+        "ALLOWED_CONFIG_KEYS; missing: "
+        f"{sorted(ALLOWED_CONFIG_KEYS - defaults.keys())}"
+    )
+    resolved: dict[str, Any] = {}
+    for key in ALLOWED_CONFIG_KEYS:
+        raw = stored.get(key)
+        allowed_values = ALLOWED_CONFIG_VALUES.get(key)
+        allowed_type = ALLOWED_CONFIG_TYPES.get(key)
+        if allowed_values is not None and raw in allowed_values:
+            resolved[key] = raw
+        elif allowed_type is not None and isinstance(raw, allowed_type):
+            resolved[key] = raw
+        else:
+            resolved[key] = defaults[key]
+    return resolved
+
+
+@router.get(
+    "/api/v1/admin/namespaces/{namespace_id}/config",
+    response_model=NamespaceConfigDetailResponse,
+)
+async def get_namespace_config(
+    namespace_id: str,
+    request: Request,
+    session: AsyncSession = Depends(get_session),
+    key_info: ApiKeyInfo = Depends(require_scope("admin")),
+) -> NamespaceConfigDetailResponse:
+    """Return the stored namespace config and the effective resolved values.
+
+    Behavior:
+      - 404 with ``ERR-ADMIN-005`` if the namespace does not exist.
+      - ``config`` is the raw JSONB (``{}`` when no key has ever been set).
+      - ``resolved`` is the value that queries observe, computed via the
+        same resolvers used by the runtime path. Always includes every
+        key in ``ALLOWED_CONFIG_KEYS``.
+    """
+    from vektra_admin.models import NamespaceOrm  # late import
+
+    result = await session.execute(
+        select(NamespaceOrm).where(NamespaceOrm.id == namespace_id)
+    )
+    ns = result.scalar_one_or_none()
+    if ns is None:
+        err = ErrorResponse(
+            category=ErrorCategory.PERMANENT,
+            code="ERR-ADMIN-005",
+            message=f"Namespace '{namespace_id}' not found.",
+            remediation="Verify the namespace id or create it via the admin UI.",
+        )
+        raise HTTPException(status_code=404, detail=err.to_envelope())
+
+    stored = dict(ns.ns_config or {})
+    resolved = _resolved_from_stored(
+        stored,
+        defaults={
+            "grounding_mode": getattr(
+                request.app.state, "grounding_mode_default", "strict"
+            ),
+            "show_sources": getattr(
+                request.app.state, "learn_show_sources_default", True
+            ),
+        },
+    )
+    return NamespaceConfigDetailResponse(
+        namespace_id=namespace_id,
+        config=stored,
+        resolved=resolved,
+    )
+
+
+@router.patch(
+    "/api/v1/admin/namespaces/{namespace_id}/config",
+    response_model=NamespaceConfigResponse,
+)
+async def patch_namespace_config(
+    namespace_id: str,
+    body: dict[str, Any],
+    request: Request,
+    background_tasks: BackgroundTasks,
+    session: AsyncSession = Depends(get_session),
+    key_info: ApiKeyInfo = Depends(require_scope("admin")),
+) -> NamespaceConfigResponse:
+    """Partially update a namespace's config JSONB.
+
+    Behavior:
+      - Flat body, one entry per config key (e.g. ``{"grounding_mode": "hybrid"}``).
+      - Partial update: keys not present in the body are preserved.
+      - ``null`` value removes the key from config (falls back to env default
+        when resolved downstream, see :mod:`vektra_shared.namespace`).
+      - Unknown keys are rejected with 400 (not silently ignored) to surface
+        typos from upstream clients (e.g. Moodle plugin) during development.
+    """
+    from vektra_admin.models import NamespaceOrm  # late import
+
+    # --- Validate body: unknown keys rejected (ERR-ADMIN-006) ---
+    unknown_keys = set(body.keys()) - ALLOWED_CONFIG_KEYS
+    if unknown_keys:
+        err = ErrorResponse(
+            category=ErrorCategory.PERMANENT,
+            code="ERR-ADMIN-006",
+            message=f"Unknown config keys: {sorted(unknown_keys)}.",
+            remediation=(
+                f"Use only allowed keys: {sorted(ALLOWED_CONFIG_KEYS)}. "
+                "Unknown keys are rejected to surface typos early."
+            ),
+        )
+        raise HTTPException(status_code=400, detail=err.to_envelope())
+
+    # --- Validate each value: enum or runtime type per key, or null (ERR-ADMIN-007) ---
+    for key, value in body.items():
+        if value is None:
+            continue  # null = remove the key
+        allowed_values = ALLOWED_CONFIG_VALUES.get(key)
+        allowed_type = ALLOWED_CONFIG_TYPES.get(key)
+        if allowed_values is not None and value not in allowed_values:
+            err = ErrorResponse(
+                category=ErrorCategory.PERMANENT,
+                code="ERR-ADMIN-007",
+                message=f"Invalid value for '{key}': {value!r}.",
+                remediation=(
+                    f"Use one of: {sorted(allowed_values)}, or null to unset."
+                ),
+            )
+            raise HTTPException(status_code=400, detail=err.to_envelope())
+        if allowed_type is not None and not isinstance(value, allowed_type):
+            # isinstance(True, bool) is True and isinstance(1, bool) is False,
+            # so a JSON integer cannot impersonate a bool here.
+            err = ErrorResponse(
+                category=ErrorCategory.PERMANENT,
+                code="ERR-ADMIN-007",
+                message=f"Invalid value for '{key}': {value!r}.",
+                remediation=(
+                    f"Value must be of type {allowed_type.__name__}, or null to unset."
+                ),
+            )
+            raise HTTPException(status_code=400, detail=err.to_envelope())
+
+    # --- Load namespace (ERR-ADMIN-005 if missing) ---
+    result = await session.execute(
+        select(NamespaceOrm).where(NamespaceOrm.id == namespace_id)
+    )
+    ns = result.scalar_one_or_none()
+    if ns is None:
+        err = ErrorResponse(
+            category=ErrorCategory.PERMANENT,
+            code="ERR-ADMIN-005",
+            message=f"Namespace '{namespace_id}' not found.",
+            remediation="Verify the namespace id or create it via the admin UI.",
+        )
+        raise HTTPException(status_code=404, detail=err.to_envelope())
+
+    # --- Merge: null removes, non-null sets ---
+    current_config: dict[str, Any] = dict(ns.ns_config or {})
+    for key, value in body.items():
+        if value is None:
+            current_config.pop(key, None)
+        else:
+            current_config[key] = value
+
+    ns.ns_config = current_config
+    ns.updated_at = datetime.now(UTC)
+    # JSONB mutation tracking: reassignment above is sufficient, but be explicit
+    flag_modified(ns, "ns_config")
+    await session.commit()
+
+    # --- Audit log (NFR-007): config change is an administrative event ---
+    request_id = _resolve_request_id(request)
+    background_tasks.add_task(
+        _audit.log_event,
+        key_id=key_info.key_id,
+        endpoint=f"/api/v1/admin/namespaces/{namespace_id}/config",
+        method="PATCH",
+        status_code=200,
+        request_id=request_id,
+        action="namespace_config_updated",
+        log_metadata={
+            "namespace_id": namespace_id,
+            "updated_keys": sorted(body.keys()),
+        },
+    )
+
+    log.info(
+        "namespace_config_updated",
+        namespace_id=namespace_id,
+        updated_keys=sorted(body.keys()),
+    )
+
+    return NamespaceConfigResponse(namespace_id=namespace_id, config=current_config)
+
+
 # ---------------------------------------------------------------------------
 # Admin HTML dashboard (REQ-006)
 # ---------------------------------------------------------------------------
diff --git a/vektra-admin/tests/test_admin_turns.py b/vektra-admin/tests/test_admin_turns.py
index 97f4e54a..a87f7b6d 100644
--- a/vektra-admin/tests/test_admin_turns.py
+++ b/vektra-admin/tests/test_admin_turns.py
@@ -1,12 +1,13 @@
-"""Unit tests for admin conversation turns endpoint (DEBT-011)."""
+"""Unit tests for admin conversation turns endpoint (DEBT-011) and the
+shared request_id fallback helper (DEBT-020)."""
 
 from unittest.mock import AsyncMock, MagicMock
-from uuid import uuid4
+from uuid import UUID, uuid4
 
 import pytest
 from fastapi import HTTPException
 
-from vektra_admin.api import get_conversation_turns
+from vektra_admin.api import _resolve_request_id, get_conversation_turns
 
 
 @pytest.mark.asyncio
@@ -78,6 +79,74 @@ async def test_returns_404_when_conversation_not_found():
     assert exc_info.value.status_code == 404
 
 
+@pytest.mark.asyncio
+async def test_audits_with_synthetic_request_id_when_middleware_missing():
+    """Sensitive read endpoints must audit even if the request-id middleware
+    didn't populate ``request.state.request_id`` (NFR-007 / DEBT-020).
+    """
+    cid = uuid4()
+    turns = [
+        {
+            "turn_number": 1,
+            "question": "Q",
+            "answer": "A",
+            "response_id": uuid4(),
+            "model": "x",
+            "prompt_tokens": 1,
+            "completion_tokens": 1,
+            "created_at": "2026-03-28T10:00:00+00:00",
+        }
+    ]
+
+    conv_store = MagicMock()
+    conv_store.get_turns_detail = AsyncMock(return_value=turns)
+
+    registry = MagicMock()
+    registry.get = MagicMock(return_value=conv_store)
+
+    app_state = MagicMock()
+    app_state.registry = registry
+
+    request = MagicMock()
+    request.app.state = app_state
+    request.state.request_id = None  # middleware did not set it
+
+    background_tasks = MagicMock()
+    key_info = MagicMock()
+    key_info.scopes = ["admin"]
+
+    result = await get_conversation_turns(cid, request, background_tasks, key_info)
+    assert result == turns
+
+    # Audit must fire with a synthetic UUID request_id rather than skip.
+    background_tasks.add_task.assert_called_once()
+    call_kwargs = background_tasks.add_task.call_args.kwargs
+    assert call_kwargs["action"] == "conversation_turns_read"
+    assert isinstance(call_kwargs["request_id"], UUID)
+
+
+def test_resolve_request_id_returns_existing_when_present():
+    """Helper should pass through a UUID set by the middleware."""
+    rid = uuid4()
+    request = MagicMock()
+    request.state.request_id = rid
+    assert _resolve_request_id(request) == rid
+
+
+def test_resolve_request_id_synthesizes_uuid_when_missing():
+    """Helper should synthesize a fresh UUID per call when state attr missing."""
+    request = MagicMock()
+    request.state.request_id = None
+
+    result = _resolve_request_id(request)
+
+    assert isinstance(result, UUID)
+    # Two distinct calls produce distinct UUIDs (no shared state).
+    request2 = MagicMock()
+    request2.state.request_id = None
+    assert _resolve_request_id(request2) != result
+
+
 @pytest.mark.asyncio
 async def test_returns_501_for_inmemory_store():
     """Should raise 501 when conversation store has no get_turns_detail method."""
diff --git a/vektra-admin/tests/test_integration.py b/vektra-admin/tests/test_integration.py
index 09ac9cb4..50c550bf 100644
--- a/vektra-admin/tests/test_integration.py
+++ b/vektra-admin/tests/test_integration.py
@@ -531,3 +531,453 @@ async def test_ui_config_page(client, bootstrap_key):
     assert resp.status_code == 200
     assert "System configuration" in resp.text
     assert "Active providers" in resp.text
+
+
+# ---------------------------------------------------------------------------
+# Namespace config PATCH (WI-3)
+# ---------------------------------------------------------------------------
+#
+# These tests use short-lived sessions (via ``fresh_engine`` factory) for DB
+# setup and verification instead of the long-lived ``session`` fixture. The
+# test engine has ``pool_size=2, max_overflow=0``; holding the session while
+# the HTTP request path also needs a connection (plus the audit background
+# task scheduled inside the PATCH handler) can exhaust the pool and time out.
+
+
+async def _seed_namespace(fresh_engine, ns_id: str, config: dict | None = None) -> None:
+    """Insert (or replace) a namespace with the given config, releasing the
+    connection immediately after commit."""
+    import json
+
+    cfg_json = json.dumps(config or {})
+    async with fresh_engine() as s:
+        await s.execute(text("DELETE FROM namespaces WHERE id = :ns"), {"ns": ns_id})
+        await s.execute(
+            text(
+                "INSERT INTO namespaces (id, display_name, config) "
+                "VALUES (:ns, :name, CAST(:cfg AS jsonb))"
+            ),
+            {"ns": ns_id, "name": f"Test {ns_id}", "cfg": cfg_json},
+        )
+        await s.commit()
+
+
+async def _read_namespace_config(fresh_engine, ns_id: str) -> dict:
+    async with fresh_engine() as s:
+        result = await s.execute(
+            text("SELECT config FROM namespaces WHERE id = :ns"), {"ns": ns_id}
+        )
+        return result.scalar_one()
+
+
+async def test_namespace_config_patch_sets_grounding_mode(
+    client, bootstrap_key, fresh_engine
+):
+    """PATCH with grounding_mode=hybrid persists in namespaces.config JSONB."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "wi3-set-grounding"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    resp = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"grounding_mode": "hybrid"},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert body["namespace_id"] == ns_id
+    assert body["config"] == {"grounding_mode": "hybrid"}
+
+    # Allow the audit background task to complete before reading the DB
+    await asyncio.sleep(0.2)
+    stored = await _read_namespace_config(fresh_engine, ns_id)
+    assert stored == {"grounding_mode": "hybrid"}
+
+
+async def test_namespace_config_patch_rejects_unknown_key(
+    client, bootstrap_key, fresh_engine
+):
+    """PATCH with unknown key returns 400 + ERR-ADMIN-006, includes key in message."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "wi3-unknown-key"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    resp = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"not_a_real_key": "whatever"},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 400, resp.text
+    err = resp.json()["detail"]["error"]
+    assert err["code"] == "ERR-ADMIN-006"
+    assert "not_a_real_key" in err["message"]
+
+
+async def test_namespace_config_patch_rejects_invalid_value(
+    client, bootstrap_key, fresh_engine
+):
+    """PATCH with grounding_mode='banana' returns 400 + ERR-ADMIN-007."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "wi3-invalid-value"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    resp = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"grounding_mode": "banana"},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 400, resp.text
+    err = resp.json()["detail"]["error"]
+    assert err["code"] == "ERR-ADMIN-007"
+    assert "banana" in err["message"]
+
+
+async def test_namespace_config_patch_rejects_non_string_value(
+    client, bootstrap_key, fresh_engine
+):
+    """Guard against clients (e.g. Moodle plugin) sending the wrong JSON type.
+
+    42 is not in the allowed enum; the whitelist check rejects it regardless
+    of runtime type. Without this test the behaviour would silently work
+    today but could regress to a permissive type-coercing check.
+    """
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "wi3-nonstring-value"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    resp = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"grounding_mode": 42},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 400, resp.text
+    err = resp.json()["detail"]["error"]
+    assert err["code"] == "ERR-ADMIN-007"
+
+
+async def test_namespace_config_patch_null_removes_key(
+    client, bootstrap_key, fresh_engine
+):
+    """PATCH with null value removes the key from config (falls back to env default)."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "wi3-null-removes"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    r1 = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"grounding_mode": "strict"},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert r1.status_code == 200
+    assert r1.json()["config"] == {"grounding_mode": "strict"}
+
+    r2 = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"grounding_mode": None},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert r2.status_code == 200, r2.text
+    assert r2.json()["config"] == {}
+
+    await asyncio.sleep(0.2)
+    stored = await _read_namespace_config(fresh_engine, ns_id)
+    assert stored == {}
+
+
+async def test_namespace_config_patch_is_partial(client, bootstrap_key, fresh_engine):
+    """PATCH merges: existing keys not in the body are preserved.
+
+    Seed with a "legacy" key that the whitelist does not recognise; it must
+    survive the PATCH even though it is not writable via the API.
+    """
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "wi3-partial-merge"
+    await _seed_namespace(
+        fresh_engine,
+        ns_id,
+        config={"grounding_mode": "strict", "legacy_field": "keep"},
+    )
+
+    resp = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"grounding_mode": "hybrid"},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert body["config"]["grounding_mode"] == "hybrid"
+    assert body["config"]["legacy_field"] == "keep"
+
+
+async def test_namespace_config_patch_not_found(client, bootstrap_key):
+    """PATCH on non-existent namespace returns 404 + ERR-ADMIN-005."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    resp = await client.patch(
+        "/api/v1/admin/namespaces/does-not-exist/config",
+        json={"grounding_mode": "strict"},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 404, resp.text
+    assert resp.json()["detail"]["error"]["code"] == "ERR-ADMIN-005"
+
+
+async def test_namespace_config_patch_requires_admin_scope(
+    client, bootstrap_key, fresh_engine
+):
+    """PATCH with a non-admin (query-only) key returns 403."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "wi3-scope-check"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    resp = await client.post(
+        "/api/v1/api-keys",
+        json={"label": "query-only", "scopes": ["query"]},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 201
+    query_key = resp.json()["key"]
+
+    resp = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"grounding_mode": "hybrid"},
+        headers={"Authorization": f"Bearer {query_key}"},
+    )
+    assert resp.status_code == 403, resp.text
+
+
+async def test_namespace_config_patch_resolves_via_shared_helper(
+    client, bootstrap_key, fresh_engine
+):
+    """End-to-end: PATCH → resolve_grounding_mode returns the persisted value.
+
+    Proves WI-3 write path is read by FEAT-020's resolver with no cache in between.
+    """
+    from vektra_shared.namespace import resolve_grounding_mode
+
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "wi3-end-to-end"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    resp = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"grounding_mode": "hybrid"},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 200
+    await asyncio.sleep(0.2)  # let audit background task complete before re-using pool
+
+    mode = await resolve_grounding_mode(ns_id, fresh_engine, default_mode="strict")
+    assert mode == "hybrid"
+
+
+# ---------------------------------------------------------------------------
+# FEAT-014: show_sources per-namespace override
+# ---------------------------------------------------------------------------
+
+
+async def test_namespace_config_patch_sets_show_sources_false(
+    client, bootstrap_key, fresh_engine
+):
+    """PATCH with show_sources=false persists as a bool in namespaces.config."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "feat14-show-sources-false"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    resp = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"show_sources": False},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert body["config"] == {"show_sources": False}
+
+    await asyncio.sleep(0.2)
+    stored = await _read_namespace_config(fresh_engine, ns_id)
+    assert stored == {"show_sources": False}
+
+
+async def test_namespace_config_patch_sets_show_sources_true(
+    client, bootstrap_key, fresh_engine
+):
+    """PATCH with show_sources=true persists the explicit override."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "feat14-show-sources-true"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    resp = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"show_sources": True},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["config"] == {"show_sources": True}
+
+
+async def test_namespace_config_patch_rejects_show_sources_non_bool(
+    client, bootstrap_key, fresh_engine
+):
+    """show_sources is strictly bool: strings and ints are rejected with ERR-ADMIN-007."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "feat14-show-sources-nonbool"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    for bad_value in ["true", 1, "yes"]:
+        resp = await client.patch(
+            f"/api/v1/admin/namespaces/{ns_id}/config",
+            json={"show_sources": bad_value},
+            headers={"Authorization": f"Bearer {admin_key}"},
+        )
+        assert resp.status_code == 400, (bad_value, resp.text)
+        err = resp.json()["detail"]["error"]
+        assert err["code"] == "ERR-ADMIN-007"
+
+
+async def test_namespace_config_patch_show_sources_partial_with_grounding(
+    client, bootstrap_key, fresh_engine
+):
+    """show_sources and grounding_mode coexist; PATCH is partial across both keys."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "feat14-mixed-keys"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    r1 = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"grounding_mode": "hybrid", "show_sources": False},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert r1.status_code == 200, r1.text
+    assert r1.json()["config"] == {"grounding_mode": "hybrid", "show_sources": False}
+
+    # Update only show_sources: grounding_mode must survive
+    r2 = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"show_sources": True},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert r2.status_code == 200, r2.text
+    assert r2.json()["config"] == {"grounding_mode": "hybrid", "show_sources": True}
+
+
+async def test_namespace_config_patch_resolves_show_sources_via_shared_helper(
+    client, bootstrap_key, fresh_engine
+):
+    """End-to-end: PATCH show_sources=False → resolve_show_sources returns False.
+
+    Mirrors test_namespace_config_patch_resolves_via_shared_helper for the
+    grounding_mode path. Proves the FEAT-014 write/read loop works with no
+    cache or stale resolver in between.
+    """
+    from vektra_shared.namespace import resolve_show_sources
+
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "feat14-resolver-end-to-end"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    resp = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"show_sources": False},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 200, resp.text
+    await asyncio.sleep(0.2)  # let audit background task complete before re-using pool
+
+    # default_value=True would be the env-var fallback; the namespace override
+    # must take precedence and force False.
+    value = await resolve_show_sources(ns_id, fresh_engine, default_value=True)
+    assert value is False
+
+
+# ---------------------------------------------------------------------------
+# GET /admin/namespaces/{id}/config (read-side symmetric to PATCH)
+# ---------------------------------------------------------------------------
+
+
+async def test_namespace_config_get_returns_empty_with_resolved_defaults(
+    client, bootstrap_key, fresh_engine
+):
+    """Fresh namespace: config={} and resolved exposes hardcoded defaults."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "feat14-get-empty"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    resp = await client.get(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert body["namespace_id"] == ns_id
+    assert body["config"] == {}
+    # Hardcoded resolver defaults: grounding_mode="strict", show_sources=True.
+    # In CI the env vars may shift these; assert the keys are present and bool/string-typed
+    # rather than a fixed value, so the test stays independent of test env config.
+    assert set(body["resolved"]) == {"grounding_mode", "show_sources"}
+    assert body["resolved"]["grounding_mode"] in {"strict", "hybrid"}
+    assert isinstance(body["resolved"]["show_sources"], bool)
+
+
+async def test_namespace_config_get_reflects_stored_overrides(
+    client, bootstrap_key, fresh_engine
+):
+    """After PATCH, GET returns the stored values in config and they win in resolved."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "feat14-get-overrides"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    # Store both keys
+    patch = await client.patch(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        json={"grounding_mode": "hybrid", "show_sources": False},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert patch.status_code == 200, patch.text
+    await asyncio.sleep(0.2)
+
+    resp = await client.get(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert body["config"] == {"grounding_mode": "hybrid", "show_sources": False}
+    # Resolver must mirror the stored value (no env fallback when key is set)
+    assert body["resolved"]["grounding_mode"] == "hybrid"
+    assert body["resolved"]["show_sources"] is False
+
+
+async def test_namespace_config_get_404_on_missing(client, bootstrap_key):
+    """Missing namespace → 404 ERR-ADMIN-005, mirroring the PATCH error."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+
+    resp = await client.get(
+        "/api/v1/admin/namespaces/does-not-exist/config",
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert resp.status_code == 404, resp.text
+    err = resp.json()["detail"]["error"]
+    assert err["code"] == "ERR-ADMIN-005"
+
+
+async def test_namespace_config_get_requires_admin_scope(
+    client, bootstrap_key, fresh_engine
+):
+    """A non-admin (query-only) key must not be able to read the config."""
+    admin_key = await _create_admin_key(client, bootstrap_key)
+    ns_id = "feat14-get-scope"
+    await _seed_namespace(fresh_engine, ns_id)
+
+    # Create a query-only key and attempt the GET with it
+    create = await client.post(
+        "/api/v1/api-keys",
+        json={"label": "query-only", "scopes": ["query"]},
+        headers={"Authorization": f"Bearer {admin_key}"},
+    )
+    assert create.status_code == 201, create.text
+    query_key = create.json()["key"]
+
+    resp = await client.get(
+        f"/api/v1/admin/namespaces/{ns_id}/config",
+        headers={"Authorization": f"Bearer {query_key}"},
+    )
+    assert resp.status_code == 403, resp.text
diff --git a/vektra-analytics/README.md b/vektra-analytics/README.md
index 80cff684..11c7ea6f 100644
--- a/vektra-analytics/README.md
+++ b/vektra-analytics/README.md
@@ -2,4 +2,26 @@
 
 QueryTrace storage, metrics aggregation, and reporting API for the Vektra platform.
 
-Part of the [vektra-stack](../README.md) monorepo.
+Phase 2 component (ADR-0017). Decouples observability data (per-query traces with retrieval/rerank/LLM metadata) from the audit log so privacy-sensitive content can be retained on a different schedule than operational metrics.
+
+## What it stores
+
+`QueryTrace` rows (`query_traces` table) carry, for every query that runs through the pipeline:
+
+- Pipeline-level: `request_id`, `namespace`, `pipeline_version`, latency, `grounding_mode`, `query_pipeline`, `eval_mode` flag.
+- Retrieval: number of chunks fetched, retained after dedup/threshold, reranker provider/scores when `VEKTRA_RERANK_ENABLED=true`.
+- Generation: model name (including streaming responses), prompt/completion token counts, `no_relevant_context` and `context_only` flags.
+
+Conversation question/answer text is captured **only** when `VEKTRA_EVAL_MODE=true` (staging-only batch evaluation use case, ARCH-050). Production traces are metadata-only.
+
+## Reporting
+
+The analytics router (prefix `/api/v1`) exposes three admin-scoped endpoints:
+
+- `GET /api/v1/traces` — paginated `QueryTrace` listing. Filters: `namespace`, `from`, `to`, `model`, `min_duration_ms`, `limit` (max 500), `offset`.
+- `GET /api/v1/traces/{response_id}` — single trace by `response_id` (`404 ERR-ANALYTICS-002` when missing).
+- `GET /api/v1/metrics` — aggregated metrics over an optional `(namespace, from, to)` window: `total_queries`, `avg_latency_ms`, `p95_latency_ms`, `avg_retrieval_score`, `queries_per_hour`, and a `model_distribution` map (LLM model → query count).
+
+Storage is optional and gated by `VEKTRA_ANALYTICS_STORE_TRACES`. Retention is independent (`VEKTRA_ANALYTICS_RETENTION_DAYS`) so traces can outlive the audit log or vice versa.
+
+See [architecture.md](../.s2s/architecture.md) for the component specification.
diff --git a/vektra-analytics/pyproject.toml b/vektra-analytics/pyproject.toml
index 6deb1c90..18afcfe1 100644
--- a/vektra-analytics/pyproject.toml
+++ b/vektra-analytics/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "vektra-analytics"
-version = "0.4.0-dev"
+version = "0.5.0"
 description = "QueryTrace storage, metrics aggregation, and reporting API"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/vektra-app/README.md b/vektra-app/README.md
index 06ebea2d..c2b18ce0 100644
--- a/vektra-app/README.md
+++ b/vektra-app/README.md
@@ -2,9 +2,11 @@
 
 FastAPI application assembly and startup validation for the Vektra platform.
 
-This package wires all component modules (vektra-admin, vektra-core, vektra-ingest,
-vektra-index) into a single FastAPI application with the 8-step startup validation
-sequence (ARCH-057).
+This package wires all component modules (vektra-shared, vektra-core, vektra-ingest,
+vektra-index, vektra-analytics, vektra-learn, vektra-admin) into a single FastAPI
+application with the 11-step startup validation sequence (ARCH-057). It also mounts
+the chatbot widget bundle at `/static/learn/vektra-chat.js` and the admin static
+assets at `/admin/static`.
 
 ## Usage
 
diff --git a/vektra-app/pyproject.toml b/vektra-app/pyproject.toml
index 4aab9522..b81f38e6 100644
--- a/vektra-app/pyproject.toml
+++ b/vektra-app/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "vektra-app"
-version = "0.4.0-dev"
+version = "0.5.0"
 description = "FastAPI application assembly and startup validation (ARCH-015, ARCH-057)"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/vektra-app/src/vektra_app/main.py b/vektra-app/src/vektra_app/main.py
index e3175ebd..31bf2948 100644
--- a/vektra-app/src/vektra_app/main.py
+++ b/vektra-app/src/vektra_app/main.py
@@ -527,6 +527,9 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     # Expose grounding mode default for API layer resolution (FEAT-020)
     app.state.grounding_mode_default = settings.prompt_grounding_mode
 
+    # Expose show_sources default for learn API resolution (FEAT-014)
+    app.state.learn_show_sources_default = settings.learn_show_sources
+
     if registry.has("learn", "default"):
         app.state.learn_service = registry.get("learn", "default")
         app.state.learn_require_enrollment = settings.learn_require_enrollment
diff --git a/vektra-core/README.md b/vektra-core/README.md
index e0318dd0..8cb8f68e 100644
--- a/vektra-core/README.md
+++ b/vektra-core/README.md
@@ -4,4 +4,10 @@ RAG engine, LLM abstraction, conversation management, and API gateway.
 
 This is the primary deployable component of the Vektra platform. It provides the FastAPI HTTP API, implements `QueryPipeline`, manages API key authentication, and coordinates with `vektra-ingest` and `vektra-index` for document ingestion and retrieval.
 
+## Source citations
+
+Every source in a query response carries a `document_name` field, joined from `source_documents.filename`, so consumers (the chatbot widget, analytics, manual inspection) display human-readable labels instead of chunk UUIDs. Soft-deleted documents (REQ-057) keep their citation with an `(archived)` suffix so traceability is preserved when an answer references content that has since been removed.
+
+The field propagates through both `SimpleQueryPipeline` and `AdvancedQueryPipeline`, in the JSON and SSE response paths.
+
 See [architecture.md](../.s2s/architecture.md) for the component specification.
diff --git a/vektra-core/pyproject.toml b/vektra-core/pyproject.toml
index a14a1d12..9add4036 100644
--- a/vektra-core/pyproject.toml
+++ b/vektra-core/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "vektra-core"
-version = "0.4.0-dev"
+version = "0.5.0"
 description = "RAG engine, LLM abstraction, and conversation management"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -8,7 +8,7 @@ dependencies = [
     "vektra-shared",
     "fastapi>=0.115",
     "pydantic>=2,<3",
-    "litellm>=1.40,<1.82.7",
+    "litellm>=1.83.10",
     "jinja2>=3.1",
     "structlog>=24.0",
     "presidio-analyzer>=2.2",
@@ -33,7 +33,7 @@ vektra-shared = { workspace = true }
 
 [dependency-groups]
 dev = [
-    "pytest>=8.0",
+    "pytest>=9.0.3",
     "pytest-asyncio>=1.0",
     "httpx>=0.27",
 ]
diff --git a/vektra-core/src/vektra_core/advanced_pipeline.py b/vektra-core/src/vektra_core/advanced_pipeline.py
index 4e1984c5..68cee4aa 100644
--- a/vektra-core/src/vektra_core/advanced_pipeline.py
+++ b/vektra-core/src/vektra_core/advanced_pipeline.py
@@ -32,6 +32,7 @@
     _context_window_impl,
     _count_tokens_impl,
     _elapsed_ms,
+    _fetch_document_names,
     _history_to_messages,
     _trace_to_dict,
 )
@@ -544,6 +545,18 @@ async def execute(
         steps.append(prompt_step)
 
         # Sources from budget-selected chunks only (not all filtered)
+        t0 = time.monotonic()
+        name_map = await _fetch_document_names([r.document_id for r in selected_chunks])
+        steps.append(
+            StepTrace(
+                name="document_names",
+                duration_ms=_elapsed_ms(t0),
+                metadata={
+                    "requested": len(selected_chunks),
+                    "resolved": len(name_map),
+                },
+            )
+        )
         sources = [
             SourceRef(
                 doc_id=r.document_id,
@@ -552,6 +565,7 @@ async def execute(
                 snippet=r.text_snippet,
                 citation_id=uuid4(),
                 document_version=r.document_version,
+                document_name=name_map.get(str(r.document_id)),
             )
             for r in selected_chunks
         ]
@@ -791,6 +805,18 @@ async def _stream(
                 log.warning("conversation_turn_store_failed", error=str(exc))
 
         # Yield sources (only budget-selected chunks, not all filtered)
+        t0 = time.monotonic()
+        name_map = await _fetch_document_names([r.document_id for r in selected_chunks])
+        steps.append(
+            StepTrace(
+                name="document_names",
+                duration_ms=_elapsed_ms(t0),
+                metadata={
+                    "requested": len(selected_chunks),
+                    "resolved": len(name_map),
+                },
+            )
+        )
         sources_data = [
             {
                 "doc_id": str(r.document_id),
@@ -799,6 +825,7 @@ async def _stream(
                 "snippet": r.text_snippet,
                 "citation_id": str(uuid4()),
                 "document_version": r.document_version,
+                "document_name": name_map.get(str(r.document_id)),
             }
             for r in selected_chunks
         ]
diff --git a/vektra-core/src/vektra_core/api.py b/vektra-core/src/vektra_core/api.py
index f1b39b16..023c563d 100644
--- a/vektra-core/src/vektra_core/api.py
+++ b/vektra-core/src/vektra_core/api.py
@@ -76,6 +76,7 @@ class SourceRefBody(BaseModel):
     snippet: str
     citation_id: UUID
     document_version: int = 1
+    document_name: str | None = None  # FEAT-012
 
 
 class QueryResponseBody(BaseModel):
@@ -354,6 +355,7 @@ async def query(
                 snippet=s.snippet,
                 citation_id=s.citation_id,
                 document_version=s.document_version,
+                document_name=s.document_name,
             )
             for s in response.sources
         ],
diff --git a/vektra-core/src/vektra_core/pipeline.py b/vektra-core/src/vektra_core/pipeline.py
index e8d58f6a..cd950372 100644
--- a/vektra-core/src/vektra_core/pipeline.py
+++ b/vektra-core/src/vektra_core/pipeline.py
@@ -24,6 +24,7 @@
 
 import litellm
 import structlog
+from sqlalchemy import text
 
 from vektra_core.budget import allocate_token_budget
 from vektra_core.conversation import ConversationStore
@@ -70,6 +71,60 @@ def _history_to_messages(history: list[dict[str, str | None]]) -> list[Message]:
     return messages
 
 
+async def _fetch_document_names(
+    doc_ids: list[Any],
+) -> dict[str, str]:
+    """Resolve document IDs to their filenames for source citations (FEAT-012).
+
+    Batch lookup against ``source_documents``. Soft-deleted documents
+    (REQ-057) are still returned with an ``(archived)`` suffix rather than
+    hidden: the citation must match what was actually retrieved from the
+    vector store, otherwise students see answers with no traceable source.
+
+    Keys are always stringified: asyncpg returns ``uuid.UUID`` objects for
+    UUID columns and callers may pass either ``UUID`` or ``str`` ids, so
+    the map is normalised to ``str`` on both ends to avoid silent lookup
+    misses. Call sites use ``name_map.get(str(r.document_id))``.
+
+    Returns an empty map on any failure (DB not initialized in tests,
+    transient DB error, etc.) — the pipeline must continue to respond even
+    if citations lose their human-readable label. Widget falls back to
+    ``chunk_id`` when a name is missing.
+    """
+    if not doc_ids:
+        return {}
+
+    # Late import to avoid initialization ordering issues in tests that stub
+    # out the DB layer.
+    from vektra_shared.db import get_session_factory
+
+    try:
+        factory = get_session_factory()
+    except RuntimeError:
+        return {}
+
+    unique_ids = list({str(d) for d in doc_ids})
+    try:
+        async with factory() as session:
+            result = await session.execute(
+                text(
+                    "SELECT id, filename, deleted_at FROM source_documents "
+                    "WHERE id = ANY(CAST(:ids AS uuid[]))"
+                ),
+                {"ids": unique_ids},
+            )
+            out: dict[str, str] = {}
+            for row in result.all():
+                name = row[1]
+                if row[2] is not None:
+                    name = f"{name} (archived)"
+                out[str(row[0])] = name
+            return out
+    except Exception as exc:
+        log.debug("document_names_fetch_failed", error=str(exc))
+        return {}
+
+
 # ---------------------------------------------------------------------------
 # Retrieval filter (ARCH-056)
 # ---------------------------------------------------------------------------
@@ -519,6 +574,18 @@ async def execute(
         )
 
         # Sources from budget-selected chunks only (not all filtered)
+        t0 = time.monotonic()
+        name_map = await _fetch_document_names([r.document_id for r in selected_chunks])
+        steps.append(
+            StepTrace(
+                name="document_names",
+                duration_ms=_elapsed_ms(t0),
+                metadata={
+                    "requested": len(selected_chunks),
+                    "resolved": len(name_map),
+                },
+            )
+        )
         sources = [
             SourceRef(
                 doc_id=r.document_id,
@@ -527,6 +594,7 @@ async def execute(
                 snippet=r.text_snippet,
                 citation_id=uuid4(),
                 document_version=r.document_version,
+                document_name=name_map.get(str(r.document_id)),
             )
             for r in selected_chunks
         ]
@@ -912,6 +980,18 @@ async def _stream(self, query: QueryRequest) -> AsyncGenerator[QueryChunk, None]
                 log.warning("conversation_turn_store_failed", error=str(exc))
 
         # Yield sources (only budget-selected chunks)
+        t0 = time.monotonic()
+        name_map = await _fetch_document_names([r.document_id for r in selected_chunks])
+        steps.append(
+            StepTrace(
+                name="document_names",
+                duration_ms=_elapsed_ms(t0),
+                metadata={
+                    "requested": len(selected_chunks),
+                    "resolved": len(name_map),
+                },
+            )
+        )
         sources_data = [
             {
                 "doc_id": str(r.document_id),
@@ -920,6 +1000,7 @@ async def _stream(self, query: QueryRequest) -> AsyncGenerator[QueryChunk, None]
                 "snippet": r.text_snippet,
                 "citation_id": str(uuid4()),
                 "document_version": r.document_version,
+                "document_name": name_map.get(str(r.document_id)),
             }
             for r in selected_chunks
         ]
diff --git a/vektra-core/tests/test_pipeline.py b/vektra-core/tests/test_pipeline.py
index b3d42807..ba03600c 100644
--- a/vektra-core/tests/test_pipeline.py
+++ b/vektra-core/tests/test_pipeline.py
@@ -183,13 +183,14 @@ async def test_execute_returns_response_and_trace():
     assert response.answer == "The answer."
     assert len(response.sources) == 1
     assert trace.response_id == response.response_id
-    assert (
-        len(trace.steps) == 8
-    )  # pre_query, embed, search, filter, post_retrieval, build_prompt, llm, safeguard
+    # pre_query, embed, search, filter, post_retrieval, build_prompt,
+    # document_names, llm, safeguard
+    assert len(trace.steps) == 9
     step_names = [s.name for s in trace.steps]
     assert "pre_query_safeguard" in step_names
     assert "embed_query" in step_names
     assert "post_retrieval_safeguard" in step_names
+    assert "document_names" in step_names
     assert "llm_call" in step_names
     assert "safeguard" in step_names
 
@@ -420,6 +421,83 @@ async def test_execute_post_retrieval_blocked():
     assert sg_steps[0].metadata.get("allowed") is False
 
 
+async def test_execute_populates_document_name(monkeypatch):
+    """FEAT-012: execute() attaches document filename to each SourceRef when the
+    DB lookup succeeds, and leaves document_name=None when it returns an empty map
+    (DB not initialised or all documents missing)."""
+    from vektra_core import pipeline as pipeline_mod
+
+    doc_a = uuid4()
+    doc_b = uuid4()
+    results = [
+        _make_search_result(0.9, "chunk from A", doc_id=doc_a),
+        _make_search_result(0.8, "chunk from B", doc_id=doc_b),
+    ]
+    vector_store = AsyncMock()
+    vector_store.search = AsyncMock(return_value=results)
+
+    # Case 1: DB lookup returns a mapping (keys stringified per helper contract)
+    async def _fake_fetch_hit(doc_ids):
+        # Called with the list of document ids from selected_chunks
+        assert set(doc_ids) == {doc_a, doc_b}
+        return {str(doc_a): "lecture-07.pdf", str(doc_b): "slides.pptx"}
+
+    monkeypatch.setattr(pipeline_mod, "_fetch_document_names", _fake_fetch_hit)
+
+    pipeline = _make_pipeline(vector_store=vector_store)
+    response, _ = await pipeline.execute(QueryRequest(question="Q?"))
+    names = {s.doc_id: s.document_name for s in response.sources}
+    assert names == {doc_a: "lecture-07.pdf", doc_b: "slides.pptx"}
+
+    # Case 2: DB lookup returns empty → document_name stays None for all sources
+    async def _fake_fetch_miss(doc_ids):
+        return {}
+
+    monkeypatch.setattr(pipeline_mod, "_fetch_document_names", _fake_fetch_miss)
+    response2, _ = await pipeline.execute(QueryRequest(question="Q?"))
+    assert all(s.document_name is None for s in response2.sources)
+
+
+async def test_fetch_document_names_marks_archived(monkeypatch):
+    """Soft-deleted documents are returned with ``(archived)`` suffix (REQ-057).
+
+    The citation must still match what was retrieved from the vector store;
+    we append a marker rather than hiding the document so students can see
+    that the source exists but is no longer available.
+    """
+    from vektra_core import pipeline as pipeline_mod
+
+    rows = [
+        ("doc-a", "active.pdf", None),
+        ("doc-b", "gone.pdf", "2026-04-20T10:00:00+00:00"),
+    ]
+
+    class _FakeResult:
+        def all(self):
+            return rows
+
+    class _FakeSession:
+        async def __aenter__(self):
+            return self
+
+        async def __aexit__(self, *_):
+            return False
+
+        async def execute(self, *_a, **_k):
+            return _FakeResult()
+
+    def _factory():
+        return _FakeSession()
+
+    # Bypass get_session_factory() so the helper uses our fake session
+    from vektra_shared import db as db_mod
+
+    monkeypatch.setattr(db_mod, "get_session_factory", lambda: _factory)
+
+    result = await pipeline_mod._fetch_document_names(["doc-a", "doc-b"])
+    assert result == {"doc-a": "active.pdf", "doc-b": "gone.pdf (archived)"}
+
+
 # ---------------------------------------------------------------------------
 # Streaming tests (_stream / execute_stream)
 # ---------------------------------------------------------------------------
diff --git a/vektra-index/README.md b/vektra-index/README.md
index bfc5a053..6231d0b7 100644
--- a/vektra-index/README.md
+++ b/vektra-index/README.md
@@ -1,7 +1,27 @@
 # vektra-index
 
-Vector store abstraction and semantic search for the Vektra platform.
+Vector store abstraction, embedding generation, and semantic search for the Vektra platform.
 
-Implements the `VectorStoreProvider` protocol with pgvector as the Phase 1 backend and the `EmbeddingProvider` protocol using sentence-transformers.
+## Protocol implementations
+
+- **`VectorStoreProvider`** with two backends:
+  - **pgvector** (default, Phase 1): PostgreSQL extension. Single-deployable, no extra service.
+  - **Qdrant** (Phase 2, opt-in via `VEKTRA_VECTOR_STORE_PROVIDER=qdrant`): adds native dense + sparse + hybrid search modes via Qdrant's REST API. Includes the `qdrant` Docker Compose profile and the 11th startup validation step (collection check).
+- **`EmbeddingProvider`** with `sentence-transformers` (default model `paraphrase-multilingual-MiniLM-L12-v2`).
+- **`SparseEmbeddingProvider`** (Phase 2): `FastEmbedBM25Provider` via `fastembed` for BM25 sparse vectors. Activated via `VEKTRA_SPARSE_EMBEDDING_PROVIDER=fastembed-bm25`.
+
+## Search modes
+
+`SearchMode` enum (Phase 2):
+
+- `DENSE` — vector similarity only (Phase 1 behavior).
+- `SPARSE` — BM25-only (lexical match).
+- `HYBRID` — fusion of dense and sparse, native to Qdrant.
+
+The provider also exposes a `raw_filters` escape hatch for backend-specific metadata filtering, namespace isolation enforcement, and atomic index version switching for zero-downtime reindex.
+
+## Reindex
+
+Operator script `scripts/reindex.sh` triggers a full re-embedding into a new index version while serving from the active one. After completion, `VEKTRA_ACTIVE_INDEX_VERSION` is bumped atomically (provider-specific transaction).
 
 See [architecture.md](../.s2s/architecture.md) for the component specification.
diff --git a/vektra-index/pyproject.toml b/vektra-index/pyproject.toml
index d894e32f..4e155f11 100644
--- a/vektra-index/pyproject.toml
+++ b/vektra-index/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "vektra-index"
-version = "0.4.0-dev"
+version = "0.5.0"
 description = "Vector store abstraction and semantic search for the Vektra platform"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/vektra-ingest/README.md b/vektra-ingest/README.md
index 61939008..813138ab 100644
--- a/vektra-ingest/README.md
+++ b/vektra-ingest/README.md
@@ -2,6 +2,33 @@
 
 Document processing pipeline for the Vektra platform.
 
-Handles PDF, Word, and PowerPoint extraction via the `DocumentExtractor` protocol, text chunking via the `ChunkingStrategy` protocol, and background job execution via arq.
+Handles document extraction (`DocumentExtractor` protocol), chunking (`ChunkingStrategy` protocol), and background job execution via arq with PostgreSQL job persistence.
+
+## Extractors
+
+- **pdfplumber** (default): native text extraction from PDFs, DOCX, PPTX. No external runtime dependencies.
+- **Unstructured** (Phase 2, opt-in via the `INSTALL_UNSTRUCTURED=true` Docker build arg, not a runtime env var): adds OCR support for scanned PDFs (Tesseract + Poppler) and 10-class element classification (text, title, list, table, image, header, footer, figure caption, page break, formula). Heavier install footprint.
+
+Provider selected via `VEKTRA_DOCUMENT_EXTRACTOR=pdfplumber|unstructured`.
+
+## Chunking
+
+- **Fixed-size** (default): token-based chunks with configurable overlap. Predictable and fast.
+- **Dual strategy** (Phase 2): semantic splitting with table preservation, optional parent-child hierarchy. Activate via `VEKTRA_CHUNKING_STRATEGY=dual`.
+
+Sparse embeddings (Phase 2, BM25 via `fastembed`) are computed during ingestion when `VEKTRA_SPARSE_EMBEDDING_PROVIDER` is set, enabling hybrid search at query time.
+
+## Async ingest
+
+Files larger than 10 MB are processed asynchronously via arq. The ingestion endpoint returns a `job_id`; clients poll `GET /api/v1/ingest/jobs/{job_id}/status` until completion.
+
+The job row distinguishes:
+
+- **Status** — terminal-or-running state: `processing`, `indexed`, `failed`.
+- **Phase** — fine-grained progress while `status=processing`: `extracting`, `chunking`, `embedding`. Cleared once the job reaches a terminal status.
+
+Clients typically watch `status` to decide when to stop polling; `phase` and `percentage` drive progress UI.
+
+Batch operations (`POST /api/v1/ingest/batch`, batch deletion) and document version tracking are also implemented in Phase 2.
 
 See [architecture.md](../.s2s/architecture.md) for the component specification.
diff --git a/vektra-ingest/pyproject.toml b/vektra-ingest/pyproject.toml
index 185800ef..44f61ea6 100644
--- a/vektra-ingest/pyproject.toml
+++ b/vektra-ingest/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "vektra-ingest"
-version = "0.4.0-dev"
+version = "0.5.0"
 description = "Document processing pipeline for the Vektra platform"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/vektra-ingest/src/vektra_ingest/api.py b/vektra-ingest/src/vektra_ingest/api.py
index a4d078c6..32f17983 100644
--- a/vektra-ingest/src/vektra_ingest/api.py
+++ b/vektra-ingest/src/vektra_ingest/api.py
@@ -17,7 +17,7 @@
 
 from datetime import UTC, datetime
 from typing import Any
-from uuid import UUID
+from uuid import UUID, uuid4
 
 import structlog
 from fastapi import (
@@ -51,6 +51,22 @@
 
 log = structlog.get_logger(__name__)
 
+
+def _resolve_request_id(request: Request) -> UUID:
+    """Return ``request.state.request_id`` or synthesize a fallback ``uuid4()``.
+
+    Always returns a UUID so audit logging never silently skips sensitive
+    endpoints (NFR-007) when the request-id middleware misbehaves. Emits a
+    structlog warning on the fallback path so misconfiguration is observable.
+    """
+    rid: UUID | None = getattr(request.state, "request_id", None)
+    if rid is not None:
+        return rid
+    fallback = uuid4()
+    log.warning("request_id_middleware_missing_fallback", fallback=str(fallback))
+    return fallback
+
+
 router = APIRouter()
 
 # Sync/async file size threshold (REQ-029)
@@ -893,9 +909,7 @@ def _write_audit_log(
     """Fire-and-forget audit log write via background task."""
     from vektra_shared.audit import log_event
 
-    request_id = getattr(request.state, "request_id", None)
-    if request_id is None:
-        return
+    request_id = _resolve_request_id(request)
 
     background_tasks.add_task(
         log_event,
@@ -920,9 +934,7 @@ async def _write_audit_log_direct(
     """Write audit log directly (for error paths where BackgroundTasks don't run)."""
     from vektra_shared.audit import log_event
 
-    request_id = getattr(request.state, "request_id", None)
-    if request_id is None:
-        return
+    request_id = _resolve_request_id(request)
 
     try:
         await log_event(
diff --git a/vektra-learn/README.md b/vektra-learn/README.md
index 18ff2784..bf6ab315 100644
--- a/vektra-learn/README.md
+++ b/vektra-learn/README.md
@@ -4,7 +4,7 @@ E-learning vertical for the Vektra platform. Provides LMS-agnostic REST APIs for
 
 ## Components
 
-- **Python backend** (`src/vektra_learn/`): FastAPI router with enrollment, content ingestion, token, and query endpoints
+- **Python backend** (`src/vektra_learn/`): FastAPI router with enrollment, content ingestion, token, conversation, and query endpoints
 - **Chatbot widget** (`widget/`): Vanilla JS chat interface built with esbuild
 
 ## Widget build
@@ -14,3 +14,78 @@ cd widget && npm install && npm run build
 ```
 
 Output: `static/vektra-chat.js`
+
+## Widget integration
+
+The widget is loaded via a `<script>` tag on the host LMS page. All customization is driven by `data-*` attributes on the script tag itself; no rebuild is needed to white-label the widget per course.
+
+```html
+<script
+  src="https://your-vektra-host/static/learn/vektra-chat.js"
+  data-api-url="https://your-vektra-host"
+  data-course-id="CS101"
+  data-token="<jwt-dashboard-token>"
+  data-token-refresh-url="/my-app/refresh-token"
+  data-theme="light"
+  data-language="en"
+  data-title="Course Assistant"
+  data-primary-color="#2563eb"
+  data-icon="💬"
+  data-welcome-message="Hi! Ask me anything about this course."
+  data-powered-by="true"
+  data-powered-by-text="Supported by University of X"
+  data-powered-by-url="https://univ.example/help"
+  data-show-sources="true"
+></script>
+```
+
+### Required attributes
+
+| Attribute | Description |
+|-----------|-------------|
+| `data-api-url` | Vektra base URL the widget calls (e.g. `https://vektra.example.com`). |
+| `data-course-id` | Stable course identifier; also used as the `sessionStorage` key for conversation persistence. |
+| `data-token` | JWT dashboard token issued by `POST /api/v1/learn/tokens` (server-side, by the LMS). |
+
+### Optional white-label attributes (FEAT-016)
+
+| Attribute | Default | Effect |
+|-----------|---------|--------|
+| `data-title` | "Course Assistant" / i18n | Chat panel header text and button aria-label. |
+| `data-primary-color` | `#2563eb` | Bound to CSS var `--vektra-primary`. Drives the floating button, accents, and links. Hover states use `filter: brightness()` so any custom color stays interactive. |
+| `data-icon` | speech-bubble emoji | Floating button icon. Accepts an emoji (rendered as text) or a URL (rendered as image). |
+| `data-welcome-message` | (none) | First assistant message shown when the widget opens. |
+| `data-powered-by` | `true` | When `false` (case-insensitive), hide the attribution footer. |
+| `data-powered-by-text` | "Powered by VektraLabs" | Override the footer text (plain text only). |
+| `data-powered-by-url` | `https://vektralabs.github.io` | Override the footer link target. |
+| `data-show-sources` | (server-resolved) | Client-side override for the citations block (FEAT-014). When absent, defer to the server-resolved value. When present, the trimmed lowercase value is compared to `"false"`: only that exact string hides the section; any other value (including `"true"`) forces it visible. Resolution chain: this attr > `namespaces.config.show_sources` > `VEKTRA_LEARN_SHOW_SOURCES` env > hardcoded `true`. |
+
+### Other attributes
+
+| Attribute | Default | Effect |
+|-----------|---------|--------|
+| `data-theme` | `light` | Color theme: `light` or `dark`. |
+| `data-language` | `en` | UI strings language: `en`, `it`. |
+| `data-token-refresh-url` | (none) | URL the widget POSTs to (with `credentials: same-origin`, no body) after a `401` response, to obtain a refreshed JWT (FEAT-009). The endpoint must return JSON `{"token": "<new-jwt>"}`; any other shape, non-2xx status, or network error aborts the refresh and surfaces the original 401 to the user. |
+
+All `data-*` values are rendered via `textContent` (never `innerHTML`), and `data-primary-color` is validated against a safe whitelist, so XSS via attribute injection is neutralized.
+
+## Conversation persistence (FEAT-004)
+
+The widget keeps the active `conversation_id` in `sessionStorage` keyed by `course_id`, so reloading the page restores the chat history without leaking conversations across students on shared university computers (sessionStorage is tab-scoped, wiped on tab close — `localStorage` is intentionally not used).
+
+On widget init, if a stored conversation is present and not stale (24h cutoff), the widget calls `GET /api/v1/learn/conversations/{id}/turns` and replays the history before enabling input. The header "New chat" button resets the storage entry, the DOM, and the in-memory `conversation_id`. A `404` response from the turns endpoint (conversation deleted server-side) silently clears the entry; a `403` (different course/namespace) does the same.
+
+## Endpoints
+
+See [API reference > Learn](../docs/reference/api.md#learn) for full request/response shapes:
+
+| Method | Path | Auth | Purpose |
+|--------|------|------|---------|
+| `POST` | `/api/v1/learn/tokens` | API key (`admin`) | Issue a JWT dashboard token (called server-side by the LMS). |
+| `POST` | `/api/v1/learn/enrollments` | API key (`ingest`) | Register a student in a course (optional when `VEKTRA_LEARN_REQUIRE_ENROLLMENT=false`). |
+| `GET` | `/api/v1/learn/enrollments` | API key (`admin`) | List enrollments. |
+| `DELETE` | `/api/v1/learn/enrollments/{id}` | API key (`admin`) | Remove an enrollment. |
+| `POST` | `/api/v1/learn/content/ingest` | API key (`ingest`) | Trigger course-scoped ingestion. |
+| `POST` | `/api/v1/learn/query` | JWT | Course-scoped RAG query. Returns `show_sources` flag + `document_name` per source. |
+| `GET` | `/api/v1/learn/conversations/{id}/turns` | JWT | Replay decrypted conversation history (namespace-scoped; emits `learn_conversation_turns_read` audit row per NFR-007). |
diff --git a/vektra-learn/pyproject.toml b/vektra-learn/pyproject.toml
index ea184cfe..c355ff79 100644
--- a/vektra-learn/pyproject.toml
+++ b/vektra-learn/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "vektra-learn"
-version = "0.4.0-dev"
+version = "0.5.0"
 description = "E-learning vertical: LMS-agnostic API and chatbot widget"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/vektra-learn/src/vektra_learn/api.py b/vektra-learn/src/vektra_learn/api.py
index 2d325cf5..a5ee5ca9 100644
--- a/vektra-learn/src/vektra_learn/api.py
+++ b/vektra-learn/src/vektra_learn/api.py
@@ -10,6 +10,7 @@
 import json
 import socket
 from collections.abc import AsyncGenerator
+from datetime import datetime
 from typing import Any
 from urllib.parse import urlparse
 from uuid import UUID, uuid4
@@ -17,7 +18,7 @@
 import httpx
 import jwt
 import structlog
-from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Query, Request
 from fastapi.responses import StreamingResponse
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from pydantic import BaseModel
@@ -37,22 +38,43 @@
     TokenRequest,
     TokenResponse,
 )
+from vektra_shared.audit import log_event as _audit_log_event
 from vektra_shared.auth import ApiKeyInfo, require_scope
 from vektra_shared.errors import (
     ERR_LEARN_001,
     ERR_LEARN_002,
     ERR_LEARN_003,
     ERR_LEARN_004,
+    ERR_LEARN_005,
+    ERR_LEARN_006,
     ErrorCategory,
     ErrorResponse,
     http_status_for,
 )
-from vektra_shared.namespace import resolve_grounding_mode
+from vektra_shared.namespace import resolve_grounding_mode, resolve_show_sources
 from vektra_shared.types import trace_from_dict
 
 # Sentinel key_id for learn-originated conversations (JWT auth has no API key).
 _LEARN_SENTINEL_KEY_ID = UUID("00000000-0000-0000-0000-000000000000")
 
+
+def _resolve_request_id(request: Request) -> UUID:
+    """Return ``request.state.request_id`` or synthesize a fallback ``uuid4()``.
+
+    Always returns a UUID so audit logging never silently skips sensitive
+    endpoints (NFR-007) when the request-id middleware misbehaves. Emits a
+    structlog warning on the fallback path so misconfiguration is observable.
+    """
+    rid: UUID | None = getattr(request.state, "request_id", None)
+    if rid is not None:
+        return rid
+    fallback = uuid4()
+    structlog.get_logger(__name__).warning(
+        "request_id_middleware_missing_fallback", fallback=str(fallback)
+    )
+    return fallback
+
+
 router = APIRouter(prefix="/api/v1/learn", tags=["learn"])
 
 
@@ -65,8 +87,14 @@ async def _learn_sse_generator(
     db_session_factory: Any | None = None,
     namespace: str = "default",
     store_traces: bool = False,
+    show_sources: bool = True,
 ) -> AsyncGenerator[str, None]:
-    """Format QueryChunk events as SSE lines for learn endpoint."""
+    """Format QueryChunk events as SSE lines for learn endpoint.
+
+    The *show_sources* flag (FEAT-014) is attached to the ``sources`` event
+    so the widget can decide whether to render citations for this response.
+    The payload itself is always sent in full for analytics/debugging.
+    """
     log = structlog.get_logger(__name__)
     try:
         async for chunk in stream:
@@ -76,7 +104,10 @@ async def _learn_sse_generator(
                 payload = json.dumps({"type": "token", "data": chunk.data})
                 yield f"data: {payload}\n\n"
             elif chunk.type in ("sources", "error", "trace"):
-                payload = json.dumps({"type": chunk.type, "data": chunk.data})
+                event: dict[str, Any] = {"type": chunk.type, "data": chunk.data}
+                if chunk.type == "sources":
+                    event["show_sources"] = show_sources
+                payload = json.dumps(event)
                 yield f"data: {payload}\n\n"
                 # Persist trace (best-effort, BUG-013)
                 if (
@@ -465,6 +496,176 @@ async def generate_token(
     return token_resp
 
 
+# ---------------------------------------------------------------------------
+# Conversation turns (WI-1, FEAT-004)
+# ---------------------------------------------------------------------------
+
+
+class ConversationTurnItem(BaseModel):
+    """Decrypted student-facing conversation turn.
+
+    Intentionally omits admin-only metadata (model, prompt_tokens,
+    completion_tokens, response_id). v0.5.0 returns an empty ``sources``
+    list; source enrichment from query_traces is deferred.
+    """
+
+    turn_number: int
+    question: str
+    answer: str | None
+    created_at: datetime
+    sources: list[dict[str, Any]] = []
+
+
+class ConversationTurnsResponse(BaseModel):
+    conversation_id: UUID
+    namespace: str
+    turns: list[ConversationTurnItem]
+
+
+def _resolve_namespace_from_token(
+    token_payload: dict[str, Any], request: Request
+) -> str:
+    """Same fallback chain used by /query: namespace claim, else course_id."""
+    course_id = token_payload.get("course_id")
+    if not course_id:
+        err = ErrorResponse(
+            category=ErrorCategory.PERMANENT,
+            code=ERR_LEARN_003,
+            message="Dashboard token is missing 'course_id' claim.",
+            remediation="Request a new dashboard token with a valid 'course_id'.",
+        )
+        raise HTTPException(status_code=http_status_for(err), detail=err.to_envelope())
+    ns = token_payload.get("namespace") or course_id
+    return str(ns)
+
+
+@router.get(
+    "/conversations/{conversation_id}/turns",
+    response_model=ConversationTurnsResponse,
+)
+async def get_conversation_turns(
+    conversation_id: UUID,
+    request: Request,
+    background_tasks: BackgroundTasks,
+    token_payload: dict[str, Any] = Depends(_validate_dashboard_token),
+) -> ConversationTurnsResponse:
+    """Return decrypted turns for a conversation belonging to the token's course.
+
+    Authorization is namespace-scoped: the conversation must match the namespace
+    derived from the JWT (``namespace`` claim or ``course_id`` fallback). A
+    mismatch returns 403 so the widget can distinguish "wrong course" from
+    "deleted conversation" (404) and reset its local state accordingly.
+    """
+    namespace = _resolve_namespace_from_token(token_payload, request)
+
+    registry = getattr(request.app.state, "registry", None)
+    if registry is None:
+        err = ErrorResponse(
+            category=ErrorCategory.TRANSIENT,
+            code=ERR_LEARN_001,
+            message="Conversation store not available.",
+            remediation="The service may be starting up. Try again shortly.",
+        )
+        raise HTTPException(status_code=http_status_for(err), detail=err.to_envelope())
+
+    try:
+        conv_store = registry.get("conversation_store", "default")
+    except ValueError:
+        err = ErrorResponse(
+            category=ErrorCategory.TRANSIENT,
+            code=ERR_LEARN_001,
+            message="Conversation store not configured.",
+            remediation="The service may be starting up. Try again shortly.",
+        )
+        raise HTTPException(status_code=http_status_for(err), detail=err.to_envelope())
+
+    # In-memory store (test/dev) does not support decryption — treat as 501-ish.
+    if not hasattr(conv_store, "get_metadata") or not hasattr(
+        conv_store, "get_turns_detail"
+    ):
+        err = ErrorResponse(
+            category=ErrorCategory.CONFIGURATION,
+            code=ERR_LEARN_001,
+            message="Conversation store does not support turn retrieval.",
+            remediation=(
+                "Configure a persistent conversation store "
+                "(VEKTRA_CONVERSATION_KEY must be set)."
+            ),
+        )
+        raise HTTPException(status_code=http_status_for(err), detail=err.to_envelope())
+
+    meta = await conv_store.get_metadata(conversation_id)
+    if meta is None or meta.get("deleted_at") is not None:
+        err = ErrorResponse(
+            category=ErrorCategory.PERMANENT,
+            code=ERR_LEARN_005,
+            message=f"Conversation '{conversation_id}' not found.",
+            remediation="Start a new conversation from the widget.",
+        )
+        raise HTTPException(status_code=http_status_for(err), detail=err.to_envelope())
+
+    if meta["namespace_id"] != namespace:
+        err = ErrorResponse(
+            category=ErrorCategory.PERMANENT,
+            code=ERR_LEARN_006,
+            message="Conversation belongs to a different course.",
+            remediation="Open the course this conversation was created in.",
+        )
+        raise HTTPException(status_code=http_status_for(err), detail=err.to_envelope())
+
+    turns = await conv_store.get_turns_detail(conversation_id)
+    if turns is None:
+        # Race: metadata said present, now it's gone. Same envelope as 404.
+        err = ErrorResponse(
+            category=ErrorCategory.PERMANENT,
+            code=ERR_LEARN_005,
+            message=f"Conversation '{conversation_id}' not found.",
+            remediation="Start a new conversation from the widget.",
+        )
+        raise HTTPException(status_code=http_status_for(err), detail=err.to_envelope())
+
+    items = [
+        ConversationTurnItem(
+            turn_number=t["turn_number"],
+            question=t["question"],
+            answer=t.get("answer"),
+            created_at=t["created_at"],
+            sources=[],
+        )
+        for t in turns
+    ]
+
+    # NFR-007: log sensitive content access (decrypted conversation turns).
+    # Learn endpoints authenticate via JWT and do not carry a key_id, so we
+    # use the sentinel defined for learn-originated rows. Fire the audit
+    # unconditionally with a synthesized request_id if the middleware hasn't
+    # set one — a missing correlation id must not silently skip the audit
+    # row (compliance gap otherwise invisible).
+    request_id = _resolve_request_id(request)
+    background_tasks.add_task(
+        _audit_log_event,
+        key_id=_LEARN_SENTINEL_KEY_ID,
+        endpoint=f"/api/v1/learn/conversations/{conversation_id}/turns",
+        method="GET",
+        status_code=200,
+        request_id=request_id,
+        action="learn_conversation_turns_read",
+        log_metadata={
+            "namespace": namespace,
+            "conversation_id": str(conversation_id),
+            "turn_count": len(items),
+            "student_id": token_payload.get("sub"),
+            "course_id": token_payload.get("course_id"),
+        },
+    )
+
+    return ConversationTurnsResponse(
+        conversation_id=conversation_id,
+        namespace=namespace,
+        turns=items,
+    )
+
+
 # ---------------------------------------------------------------------------
 # Course-scoped query
 # ---------------------------------------------------------------------------
@@ -565,6 +766,17 @@ async def course_query(
         _gm = _default_mode
     query_req.grounding_mode = _gm
 
+    # Resolve show_sources: namespace config > env var > default true (FEAT-014)
+    _default_show_sources = getattr(
+        request.app.state, "learn_show_sources_default", True
+    )
+    if _db_factory_gm:
+        _show_sources = await resolve_show_sources(
+            namespace, _db_factory_gm, default_value=_default_show_sources
+        )
+    else:
+        _show_sources = _default_show_sources
+
     if registry is None:
         err = ErrorResponse(
             category=ErrorCategory.TRANSIENT,
@@ -600,6 +812,7 @@ async def course_query(
                 db_session_factory=_db_factory,
                 namespace=namespace,
                 store_traces=_store_traces,
+                show_sources=_show_sources,
             ),
             media_type="text/event-stream",
             headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
@@ -620,4 +833,4 @@ async def course_query(
                 exc_info=True,
             )
 
-    return pipeline_response_to_course_response(response)
+    return pipeline_response_to_course_response(response, show_sources=_show_sources)
diff --git a/vektra-learn/src/vektra_learn/query.py b/vektra-learn/src/vektra_learn/query.py
index 9c0cec88..6762d63c 100644
--- a/vektra-learn/src/vektra_learn/query.py
+++ b/vektra-learn/src/vektra_learn/query.py
@@ -35,6 +35,10 @@ class CourseQueryResponse(BaseModel):
     sources: list[dict[str, Any]]
     conversation_id: UUID | None
     no_relevant_context: bool = False
+    # FEAT-014: server-resolved citation visibility (namespace config > env > default).
+    # The API always returns the sources list so analytics and QueryTrace keep
+    # full information; the flag only instructs the widget whether to render them.
+    show_sources: bool = True
 
 
 def build_course_query(
@@ -59,8 +63,14 @@ def build_course_query(
 
 def pipeline_response_to_course_response(
     resp: QueryResponse,
+    *,
+    show_sources: bool = True,
 ) -> CourseQueryResponse:
-    """Convert a QueryResponse to a CourseQueryResponse for the learn API."""
+    """Convert a QueryResponse to a CourseQueryResponse for the learn API.
+
+    *show_sources* is the server-resolved FEAT-014 flag. The API always
+    returns the full sources list; the flag is a hint for the widget.
+    """
     return CourseQueryResponse(
         response_id=resp.response_id,
         answer=resp.answer,
@@ -70,9 +80,11 @@ def pipeline_response_to_course_response(
                 "chunk_id": s.chunk_id,
                 "score": s.score,
                 "snippet": s.snippet,
+                "document_name": s.document_name,  # FEAT-012
             }
             for s in resp.sources
         ],
         conversation_id=resp.conversation_id,
         no_relevant_context=resp.no_relevant_context,
+        show_sources=show_sources,
     )
diff --git a/vektra-learn/tests/test_api.py b/vektra-learn/tests/test_api.py
index 984365eb..bdcbf047 100644
--- a/vektra-learn/tests/test_api.py
+++ b/vektra-learn/tests/test_api.py
@@ -440,3 +440,385 @@ def test_learn_error_status_codes(self):
             remediation="Check existing",
         )
         assert http_status_for(err_dup) == 409
+
+
+# ---------------------------------------------------------------------------
+# Conversation turns endpoint (WI-1 / FEAT-004)
+# ---------------------------------------------------------------------------
+
+
+class TestConversationTurnsEndpoint:
+    """JWT-scoped GET /api/v1/learn/conversations/{id}/turns."""
+
+    @staticmethod
+    def _make_request(conv_store):
+        app = MagicMock()
+        registry = MagicMock()
+        registry.get = MagicMock(return_value=conv_store)
+        app.state.registry = registry
+        request = MagicMock()
+        request.app = app
+        return request
+
+    async def test_returns_decrypted_turns_on_namespace_match(self):
+        from vektra_learn.api import get_conversation_turns
+
+        cid = uuid4()
+        conv_store = MagicMock()
+        conv_store.get_metadata = AsyncMock(
+            return_value={
+                "id": cid,
+                "namespace_id": "CS101",
+                "deleted_at": None,
+                "turn_count": 2,
+            }
+        )
+        conv_store.get_turns_detail = AsyncMock(
+            return_value=[
+                {
+                    "turn_number": 1,
+                    "question": "What is RAG?",
+                    "answer": "Retrieval-augmented generation.",
+                    "response_id": uuid4(),
+                    "model": "gpt-4o",
+                    "prompt_tokens": 10,
+                    "completion_tokens": 20,
+                    "created_at": datetime.now(UTC),
+                },
+                {
+                    "turn_number": 2,
+                    "question": "Follow up?",
+                    "answer": "Sure.",
+                    "response_id": None,
+                    "model": None,
+                    "prompt_tokens": None,
+                    "completion_tokens": None,
+                    "created_at": datetime.now(UTC),
+                },
+            ]
+        )
+
+        request = self._make_request(conv_store)
+        bg = MagicMock()
+        token_payload = {"sub": "s1", "course_id": "CS101"}
+
+        resp = await get_conversation_turns(cid, request, bg, token_payload)
+        assert resp.conversation_id == cid
+        assert resp.namespace == "CS101"
+        assert len(resp.turns) == 2
+        assert resp.turns[0].question == "What is RAG?"
+        assert resp.turns[0].answer == "Retrieval-augmented generation."
+        assert resp.turns[0].sources == []
+        # Admin-only metadata must not be exposed
+        assert not hasattr(resp.turns[0], "model")
+        assert not hasattr(resp.turns[0], "response_id")
+        # Audit log scheduled for content access (NFR-007)
+        bg.add_task.assert_called_once()
+        call_kwargs = bg.add_task.call_args.kwargs
+        assert call_kwargs["action"] == "learn_conversation_turns_read"
+        assert call_kwargs["log_metadata"]["conversation_id"] == str(cid)
+        assert call_kwargs["log_metadata"]["namespace"] == "CS101"
+        assert call_kwargs["log_metadata"]["turn_count"] == 2
+        assert call_kwargs["log_metadata"]["student_id"] == "s1"
+
+    async def test_403_on_namespace_mismatch(self):
+        """Conversation exists but belongs to a different course."""
+        from vektra_learn.api import get_conversation_turns
+
+        cid = uuid4()
+        conv_store = MagicMock()
+        conv_store.get_metadata = AsyncMock(
+            return_value={
+                "id": cid,
+                "namespace_id": "OTHER-COURSE",
+                "deleted_at": None,
+                "turn_count": 1,
+            }
+        )
+        conv_store.get_turns_detail = AsyncMock()
+
+        request = self._make_request(conv_store)
+        bg = MagicMock()
+        token_payload = {"sub": "s1", "course_id": "CS101"}
+
+        with pytest.raises(HTTPException) as exc_info:
+            await get_conversation_turns(cid, request, bg, token_payload)
+        assert exc_info.value.status_code == 403
+        assert exc_info.value.detail["error"]["code"] == "ERR-LEARN-006"
+        # Must not leak the actual content of the other-namespace conversation
+        conv_store.get_turns_detail.assert_not_awaited()
+        # No audit log on denied access (we only log successful reads)
+        bg.add_task.assert_not_called()
+
+    async def test_404_on_missing_conversation(self):
+        from vektra_learn.api import get_conversation_turns
+
+        conv_store = MagicMock()
+        conv_store.get_metadata = AsyncMock(return_value=None)
+        conv_store.get_turns_detail = AsyncMock()
+
+        request = self._make_request(conv_store)
+        bg = MagicMock()
+        token_payload = {"sub": "s1", "course_id": "CS101"}
+
+        with pytest.raises(HTTPException) as exc_info:
+            await get_conversation_turns(uuid4(), request, bg, token_payload)
+        assert exc_info.value.status_code == 404
+        assert exc_info.value.detail["error"]["code"] == "ERR-LEARN-005"
+        conv_store.get_turns_detail.assert_not_awaited()
+
+    async def test_404_on_soft_deleted_conversation(self):
+        """Soft-deleted conversations behave as if they don't exist."""
+        from vektra_learn.api import get_conversation_turns
+
+        cid = uuid4()
+        conv_store = MagicMock()
+        conv_store.get_metadata = AsyncMock(
+            return_value={
+                "id": cid,
+                "namespace_id": "CS101",
+                "deleted_at": datetime.now(UTC),  # soft-deleted
+                "turn_count": 0,
+            }
+        )
+        conv_store.get_turns_detail = AsyncMock()
+
+        request = self._make_request(conv_store)
+        bg = MagicMock()
+        token_payload = {"sub": "s1", "course_id": "CS101"}
+
+        with pytest.raises(HTTPException) as exc_info:
+            await get_conversation_turns(cid, request, bg, token_payload)
+        assert exc_info.value.status_code == 404
+
+    async def test_rejects_token_without_course_id(self):
+        from vektra_learn.api import get_conversation_turns
+
+        conv_store = MagicMock()
+        request = self._make_request(conv_store)
+        bg = MagicMock()
+        token_payload = {"sub": "s1"}  # no course_id
+
+        with pytest.raises(HTTPException) as exc_info:
+            await get_conversation_turns(uuid4(), request, bg, token_payload)
+        assert exc_info.value.status_code == 401
+        assert exc_info.value.detail["error"]["code"] == "ERR-LEARN-003"
+
+    async def test_respects_namespace_claim_over_course_id(self):
+        """Namespace claim in JWT takes precedence over course_id."""
+        from vektra_learn.api import get_conversation_turns
+
+        cid = uuid4()
+        conv_store = MagicMock()
+        conv_store.get_metadata = AsyncMock(
+            return_value={
+                "id": cid,
+                "namespace_id": "shared-materials",
+                "deleted_at": None,
+                "turn_count": 0,
+            }
+        )
+        conv_store.get_turns_detail = AsyncMock(return_value=[])
+
+        request = self._make_request(conv_store)
+        bg = MagicMock()
+        token_payload = {
+            "sub": "s1",
+            "course_id": "CS101",
+            "namespace": "shared-materials",
+        }
+
+        resp = await get_conversation_turns(cid, request, bg, token_payload)
+        assert resp.namespace == "shared-materials"
+
+    async def test_500_err_learn_001_when_store_lacks_decryption(self):
+        """In-memory store (no get_metadata / get_turns_detail) returns 500.
+
+        ERR-LEARN-001 is CONFIGURATION → 500.
+        """
+        from vektra_learn.api import get_conversation_turns
+
+        # bare object with none of the required methods
+        class _BareStore:
+            pass
+
+        conv_store = _BareStore()
+        request = self._make_request(conv_store)
+        bg = MagicMock()
+        token_payload = {"sub": "s1", "course_id": "CS101"}
+
+        with pytest.raises(HTTPException) as exc_info:
+            await get_conversation_turns(uuid4(), request, bg, token_payload)
+        assert exc_info.value.status_code == 500
+        assert exc_info.value.detail["error"]["code"] == "ERR-LEARN-001"
+
+    async def test_audit_fires_even_without_request_id(self):
+        """NFR-007: audit must fire unconditionally on successful turns read.
+
+        If the RequestIdMiddleware isn't wired (tests, early boot), a missing
+        request.state.request_id must not silently skip the audit row — the
+        handler synthesizes a UUID fallback so every authenticated content
+        access leaves an audit trail.
+        """
+        from vektra_learn.api import get_conversation_turns
+
+        cid = uuid4()
+        conv_store = MagicMock()
+        conv_store.get_metadata = AsyncMock(
+            return_value={
+                "id": cid,
+                "namespace_id": "CS101",
+                "deleted_at": None,
+                "turn_count": 0,
+            }
+        )
+        conv_store.get_turns_detail = AsyncMock(return_value=[])
+
+        # Simulate middleware not wired: request.state has no attribute
+        request = self._make_request(conv_store)
+
+        class _EmptyState:
+            pass
+
+        request.state = _EmptyState()
+
+        bg = MagicMock()
+        token_payload = {"sub": "s1", "course_id": "CS101"}
+
+        await get_conversation_turns(cid, request, bg, token_payload)
+        bg.add_task.assert_called_once()
+        call_kwargs = bg.add_task.call_args.kwargs
+        assert call_kwargs["action"] == "learn_conversation_turns_read"
+        # Synthesized request_id must still be a UUID (not None)
+        from uuid import UUID as _UUID
+
+        assert isinstance(call_kwargs["request_id"], _UUID)
+
+
+# ---------------------------------------------------------------------------
+# FEAT-014: show_sources propagation
+# ---------------------------------------------------------------------------
+
+
+class TestShowSourcesPropagation:
+    """show_sources flag resolution and propagation to non-stream + SSE responses."""
+
+    def _make_pipeline_mock(self) -> tuple[MagicMock, MagicMock]:
+        mock_response = MagicMock()
+        mock_response.response_id = uuid4()
+        mock_response.answer = "answer"
+        mock_response.sources = []
+        mock_response.conversation_id = None
+        mock_response.no_relevant_context = False
+        mock_pipeline = AsyncMock()
+        mock_pipeline.execute = AsyncMock(return_value=(mock_response, None))
+        return mock_pipeline, mock_response
+
+    def _make_app(
+        self, pipeline: MagicMock, *, show_sources_default: bool
+    ) -> MagicMock:
+        mock_app = MagicMock()
+        mock_app.state.learn_require_enrollment = False
+        mock_app.state.learn_show_sources_default = show_sources_default
+        # No DB factory: the resolver falls back to the env-default directly.
+        mock_app.state.db_session_factory = None
+        mock_registry = MagicMock()
+        mock_registry.get.return_value = pipeline
+        mock_app.state.registry = mock_registry
+        return mock_app
+
+    async def test_non_stream_response_carries_env_default_true(self):
+        """When namespace has no override, the env-default (true) reaches the client."""
+        from vektra_learn.api import course_query
+        from vektra_learn.query import CourseQueryRequest
+
+        pipeline, _ = self._make_pipeline_mock()
+        mock_app = self._make_app(pipeline, show_sources_default=True)
+        mock_request = MagicMock()
+        mock_request.app = mock_app
+        req = CourseQueryRequest(question="Q")
+
+        result = await course_query(
+            req,
+            mock_request,
+            {"sub": "s1", "course_id": "CS101"},
+            MagicMock(),
+            AsyncMock(),
+        )
+        assert result.show_sources is True
+
+    async def test_non_stream_response_carries_env_default_false(self):
+        """VEKTRA_LEARN_SHOW_SOURCES=false is surfaced when no namespace override exists."""
+        from vektra_learn.api import course_query
+        from vektra_learn.query import CourseQueryRequest
+
+        pipeline, _ = self._make_pipeline_mock()
+        mock_app = self._make_app(pipeline, show_sources_default=False)
+        mock_request = MagicMock()
+        mock_request.app = mock_app
+        req = CourseQueryRequest(question="Q")
+
+        result = await course_query(
+            req,
+            mock_request,
+            {"sub": "s1", "course_id": "CS101"},
+            MagicMock(),
+            AsyncMock(),
+        )
+        assert result.show_sources is False
+
+    async def test_sse_sources_event_carries_show_sources(self):
+        """The SSE ``sources`` event payload includes the flag for the widget."""
+        import json as _json
+
+        from vektra_learn.api import _learn_sse_generator
+
+        chunk = MagicMock()
+        chunk.type = "sources"
+        chunk.data = [{"doc_id": "d1", "chunk_id": "c1", "score": 0.9, "snippet": "s"}]
+
+        async def _stream():
+            yield chunk
+
+        request = MagicMock()
+        request.is_disconnected = AsyncMock(return_value=False)
+
+        events = []
+        async for ev in _learn_sse_generator(
+            _stream(), request, "conv-1", show_sources=False
+        ):
+            events.append(ev)
+
+        assert any("sources" in ev for ev in events)
+        sources_event = next(ev for ev in events if '"type": "sources"' in ev)
+        # Strip SSE framing ("data: ...\n\n") before parsing.
+        payload = _json.loads(sources_event.removeprefix("data: ").strip())
+        assert payload["type"] == "sources"
+        assert payload["show_sources"] is False
+        assert payload["data"] == chunk.data
+
+    async def test_sse_non_sources_events_do_not_include_flag(self):
+        """Only the ``sources`` event carries the flag; tokens and errors don't."""
+        import json as _json
+
+        from vektra_learn.api import _learn_sse_generator
+
+        token_chunk = MagicMock()
+        token_chunk.type = "token"
+        token_chunk.data = "hello"
+
+        async def _stream():
+            yield token_chunk
+
+        request = MagicMock()
+        request.is_disconnected = AsyncMock(return_value=False)
+
+        events = []
+        async for ev in _learn_sse_generator(
+            _stream(), request, "conv-1", show_sources=False
+        ):
+            events.append(ev)
+
+        token_event = next(ev for ev in events if '"type": "token"' in ev)
+        payload = _json.loads(token_event.removeprefix("data: ").strip())
+        assert "show_sources" not in payload
diff --git a/vektra-learn/tests/test_query.py b/vektra-learn/tests/test_query.py
index 019ebe92..b3c1f783 100644
--- a/vektra-learn/tests/test_query.py
+++ b/vektra-learn/tests/test_query.py
@@ -107,3 +107,40 @@ def test_handles_empty_sources(self):
 
         result = pipeline_response_to_course_response(resp)
         assert result.sources == []
+
+    def test_show_sources_defaults_to_true(self):
+        """FEAT-014: unset show_sources defaults to True (current behaviour)."""
+        resp = QueryResponse(
+            response_id=uuid4(), answer="x", sources=[], conversation_id=None
+        )
+        result = pipeline_response_to_course_response(resp)
+        assert result.show_sources is True
+
+    def test_show_sources_propagates_false(self):
+        """FEAT-014: explicit show_sources=False carries through to the response."""
+        resp = QueryResponse(
+            response_id=uuid4(), answer="x", sources=[], conversation_id=None
+        )
+        result = pipeline_response_to_course_response(resp, show_sources=False)
+        assert result.show_sources is False
+
+    def test_show_sources_false_does_not_strip_sources(self):
+        """FEAT-014: the API still emits the full sources list regardless of the flag."""
+        doc_id = uuid4()
+        resp = QueryResponse(
+            response_id=uuid4(),
+            answer="x",
+            sources=[
+                SourceRef(
+                    doc_id=doc_id,
+                    chunk_id="c1",
+                    score=0.9,
+                    snippet="...",
+                    citation_id=uuid4(),
+                ),
+            ],
+            conversation_id=None,
+        )
+        result = pipeline_response_to_course_response(resp, show_sources=False)
+        assert len(result.sources) == 1
+        assert result.show_sources is False
diff --git a/vektra-learn/widget/package-lock.json b/vektra-learn/widget/package-lock.json
index 842d387f..6647b3c7 100644
--- a/vektra-learn/widget/package-lock.json
+++ b/vektra-learn/widget/package-lock.json
@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "devDependencies": {
-        "esbuild": "^0.24"
+        "esbuild": "^0.25"
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.24.2.tgz",
-      "integrity": "sha512-thpVCb/rhxE/BnMLQ7GReQLLN8q9qbHmI55F4489/ByVg2aQaQ6kbcLb6FHkocZzQhxc4gx0sCk0tJkKBFzDhA==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.0.tgz",
+      "integrity": "sha512-O7vun9Sf8DFjH2UtqK8Ku3LkquL9SZL8OLY1T5NZkA34+wG3OQF7cl4Ql8vdNzM6fzBbYfLaiRLIOZ+2FOCgBQ==",
       "cpu": [
         "ppc64"
       ],
@@ -26,9 +26,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.24.2.tgz",
-      "integrity": "sha512-tmwl4hJkCfNHwFB3nBa8z1Uy3ypZpxqxfTQOcHX+xRByyYgunVbZ9MzUUfb0RxaHIMnbHagwAxuTL+tnNM+1/Q==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.0.tgz",
+      "integrity": "sha512-PTyWCYYiU0+1eJKmw21lWtC+d08JDZPQ5g+kFyxP0V+es6VPPSUhM6zk8iImp2jbV6GwjX4pap0JFbUQN65X1g==",
       "cpu": [
         "arm"
       ],
@@ -43,9 +43,9 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.24.2.tgz",
-      "integrity": "sha512-cNLgeqCqV8WxfcTIOeL4OAtSmL8JjcN6m09XIgro1Wi7cF4t/THaWEa7eL5CMoMBdjoHOTh/vwTO/o2TRXIyzg==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.0.tgz",
+      "integrity": "sha512-grvv8WncGjDSyUBjN9yHXNt+cq0snxXbDxy5pJtzMKGmmpPxeAmAhWxXI+01lU5rwZomDgD3kJwulEnhTRUd6g==",
       "cpu": [
         "arm64"
       ],
@@ -60,9 +60,9 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.24.2.tgz",
-      "integrity": "sha512-B6Q0YQDqMx9D7rvIcsXfmJfvUYLoP722bgfBlO5cGvNVb5V/+Y7nhBE3mHV9OpxBf4eAS2S68KZztiPaWq4XYw==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.0.tgz",
+      "integrity": "sha512-m/ix7SfKG5buCnxasr52+LI78SQ+wgdENi9CqyCXwjVR2X4Jkz+BpC3le3AoBPYTC9NHklwngVXvbJ9/Akhrfg==",
       "cpu": [
         "x64"
       ],
@@ -77,9 +77,9 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.24.2.tgz",
-      "integrity": "sha512-kj3AnYWc+CekmZnS5IPu9D+HWtUI49hbnyqk0FLEJDbzCIQt7hg7ucF1SQAilhtYpIujfaHr6O0UHlzzSPdOeA==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.0.tgz",
+      "integrity": "sha512-mVwdUb5SRkPayVadIOI78K7aAnPamoeFR2bT5nszFUZ9P8UpK4ratOdYbZZXYSqPKMHfS1wdHCJk1P1EZpRdvw==",
       "cpu": [
         "arm64"
       ],
@@ -94,9 +94,9 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.24.2.tgz",
-      "integrity": "sha512-WeSrmwwHaPkNR5H3yYfowhZcbriGqooyu3zI/3GGpF8AyUdsrrP0X6KumITGA9WOyiJavnGZUwPGvxvwfWPHIA==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.0.tgz",
+      "integrity": "sha512-DgDaYsPWFTS4S3nWpFcMn/33ZZwAAeAFKNHNa1QN0rI4pUjgqf0f7ONmXf6d22tqTY+H9FNdgeaAa+YIFUn2Rg==",
       "cpu": [
         "x64"
       ],
@@ -111,9 +111,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.24.2.tgz",
-      "integrity": "sha512-UN8HXjtJ0k/Mj6a9+5u6+2eZ2ERD7Edt1Q9IZiB5UZAIdPnVKDoG7mdTVGhHJIeEml60JteamR3qhsr1r8gXvg==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.0.tgz",
+      "integrity": "sha512-VN4ocxy6dxefN1MepBx/iD1dH5K8qNtNe227I0mnTRjry8tj5MRk4zprLEdG8WPyAPb93/e4pSgi1SoHdgOa4w==",
       "cpu": [
         "arm64"
       ],
@@ -128,9 +128,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.24.2.tgz",
-      "integrity": "sha512-TvW7wE/89PYW+IevEJXZ5sF6gJRDY/14hyIGFXdIucxCsbRmLUcjseQu1SyTko+2idmCw94TgyaEZi9HUSOe3Q==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.0.tgz",
+      "integrity": "sha512-mrSgt7lCh07FY+hDD1TxiTyIHyttn6vnjesnPoVDNmDfOmggTLXRv8Id5fNZey1gl/V2dyVK1VXXqVsQIiAk+A==",
       "cpu": [
         "x64"
       ],
@@ -145,9 +145,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.24.2.tgz",
-      "integrity": "sha512-n0WRM/gWIdU29J57hJyUdIsk0WarGd6To0s+Y+LwvlC55wt+GT/OgkwoXCXvIue1i1sSNWblHEig00GBWiJgfA==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.0.tgz",
+      "integrity": "sha512-vkB3IYj2IDo3g9xX7HqhPYxVkNQe8qTK55fraQyTzTX/fxaDtXiEnavv9geOsonh2Fd2RMB+i5cbhu2zMNWJwg==",
       "cpu": [
         "arm"
       ],
@@ -162,9 +162,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.24.2.tgz",
-      "integrity": "sha512-7HnAD6074BW43YvvUmE/35Id9/NB7BeX5EoNkK9obndmZBUk8xmJJeU7DwmUeN7tkysslb2eSl6CTrYz6oEMQg==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.0.tgz",
+      "integrity": "sha512-9QAQjTWNDM/Vk2bgBl17yWuZxZNQIF0OUUuPZRKoDtqF2k4EtYbpyiG5/Dk7nqeK6kIJWPYldkOcBqjXjrUlmg==",
       "cpu": [
         "arm64"
       ],
@@ -179,9 +179,9 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.24.2.tgz",
-      "integrity": "sha512-sfv0tGPQhcZOgTKO3oBE9xpHuUqguHvSo4jl+wjnKwFpapx+vUDcawbwPNuBIAYdRAvIDBfZVvXprIj3HA+Ugw==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.0.tgz",
+      "integrity": "sha512-43ET5bHbphBegyeqLb7I1eYn2P/JYGNmzzdidq/w0T8E2SsYL1U6un2NFROFRg1JZLTzdCoRomg8Rvf9M6W6Gg==",
       "cpu": [
         "ia32"
       ],
@@ -196,9 +196,9 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.24.2.tgz",
-      "integrity": "sha512-CN9AZr8kEndGooS35ntToZLTQLHEjtVB5n7dl8ZcTZMonJ7CCfStrYhrzF97eAecqVbVJ7APOEe18RPI4KLhwQ==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.0.tgz",
+      "integrity": "sha512-fC95c/xyNFueMhClxJmeRIj2yrSMdDfmqJnyOY4ZqsALkDrrKJfIg5NTMSzVBr5YW1jf+l7/cndBfP3MSDpoHw==",
       "cpu": [
         "loong64"
       ],
@@ -213,9 +213,9 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.24.2.tgz",
-      "integrity": "sha512-iMkk7qr/wl3exJATwkISxI7kTcmHKE+BlymIAbHO8xanq/TjHaaVThFF6ipWzPHryoFsesNQJPE/3wFJw4+huw==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.0.tgz",
+      "integrity": "sha512-nkAMFju7KDW73T1DdH7glcyIptm95a7Le8irTQNO/qtkoyypZAnjchQgooFUDQhNAy4iu08N79W4T4pMBwhPwQ==",
       "cpu": [
         "mips64el"
       ],
@@ -230,9 +230,9 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.24.2.tgz",
-      "integrity": "sha512-shsVrgCZ57Vr2L8mm39kO5PPIb+843FStGt7sGGoqiiWYconSxwTiuswC1VJZLCjNiMLAMh34jg4VSEQb+iEbw==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.0.tgz",
+      "integrity": "sha512-NhyOejdhRGS8Iwv+KKR2zTq2PpysF9XqY+Zk77vQHqNbo/PwZCzB5/h7VGuREZm1fixhs4Q/qWRSi5zmAiO4Fw==",
       "cpu": [
         "ppc64"
       ],
@@ -247,9 +247,9 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.24.2.tgz",
-      "integrity": "sha512-4eSFWnU9Hhd68fW16GD0TINewo1L6dRrB+oLNNbYyMUAeOD2yCK5KXGK1GH4qD/kT+bTEXjsyTCiJGHPZ3eM9Q==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.0.tgz",
+      "integrity": "sha512-5S/rbP5OY+GHLC5qXp1y/Mx//e92L1YDqkiBbO9TQOvuFXM+iDqUNG5XopAnXoRH3FjIUDkeGcY1cgNvnXp/kA==",
       "cpu": [
         "riscv64"
       ],
@@ -264,9 +264,9 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.24.2.tgz",
-      "integrity": "sha512-S0Bh0A53b0YHL2XEXC20bHLuGMOhFDO6GN4b3YjRLK//Ep3ql3erpNcPlEFed93hsQAjAQDNsvcK+hV90FubSw==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.0.tgz",
+      "integrity": "sha512-XM2BFsEBz0Fw37V0zU4CXfcfuACMrppsMFKdYY2WuTS3yi8O1nFOhil/xhKTmE1nPmVyvQJjJivgDT+xh8pXJA==",
       "cpu": [
         "s390x"
       ],
@@ -281,9 +281,9 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.24.2.tgz",
-      "integrity": "sha512-8Qi4nQcCTbLnK9WoMjdC9NiTG6/E38RNICU6sUNqK0QFxCYgoARqVqxdFmWkdonVsvGqWhmm7MO0jyTqLqwj0Q==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.0.tgz",
+      "integrity": "sha512-9yl91rHw/cpwMCNytUDxwj2XjFpxML0y9HAOH9pNVQDpQrBxHy01Dx+vaMu0N1CKa/RzBD2hB4u//nfc+Sd3Cw==",
       "cpu": [
         "x64"
       ],
@@ -298,9 +298,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.24.2.tgz",
-      "integrity": "sha512-wuLK/VztRRpMt9zyHSazyCVdCXlpHkKm34WUyinD2lzK07FAHTq0KQvZZlXikNWkDGoT6x3TD51jKQ7gMVpopw==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.0.tgz",
+      "integrity": "sha512-RuG4PSMPFfrkH6UwCAqBzauBWTygTvb1nxWasEJooGSJ/NwRw7b2HOwyRTQIU97Hq37l3npXoZGYMy3b3xYvPw==",
       "cpu": [
         "arm64"
       ],
@@ -315,9 +315,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.24.2.tgz",
-      "integrity": "sha512-VefFaQUc4FMmJuAxmIHgUmfNiLXY438XrL4GDNV1Y1H/RW3qow68xTwjZKfj/+Plp9NANmzbH5R40Meudu8mmw==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.0.tgz",
+      "integrity": "sha512-jl+qisSB5jk01N5f7sPCsBENCOlPiS/xptD5yxOx2oqQfyourJwIKLRA2yqWdifj3owQZCL2sn6o08dBzZGQzA==",
       "cpu": [
         "x64"
       ],
@@ -332,9 +332,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.24.2.tgz",
-      "integrity": "sha512-YQbi46SBct6iKnszhSvdluqDmxCJA+Pu280Av9WICNwQmMxV7nLRHZfjQzwbPs3jeWnuAhE9Jy0NrnJ12Oz+0A==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.0.tgz",
+      "integrity": "sha512-21sUNbq2r84YE+SJDfaQRvdgznTD8Xc0oc3p3iW/a1EVWeNj/SdUCbm5U0itZPQYRuRTW20fPMWMpcrciH2EJw==",
       "cpu": [
         "arm64"
       ],
@@ -349,9 +349,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.24.2.tgz",
-      "integrity": "sha512-+iDS6zpNM6EnJyWv0bMGLWSWeXGN/HTaF/LXHXHwejGsVi+ooqDfMCCTerNFxEkM3wYVcExkeGXNqshc9iMaOA==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.0.tgz",
+      "integrity": "sha512-2gwwriSMPcCFRlPlKx3zLQhfN/2WjJ2NSlg5TKLQOJdV0mSxIcYNTMhk3H3ulL/cak+Xj0lY1Ym9ysDV1igceg==",
       "cpu": [
         "x64"
       ],
@@ -366,9 +366,9 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.24.2.tgz",
-      "integrity": "sha512-hTdsW27jcktEvpwNHJU4ZwWFGkz2zRJUz8pvddmXPtXDzVKTTINmlmga3ZzwcuMpUvLw7JkLy9QLKyGpD2Yxig==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.0.tgz",
+      "integrity": "sha512-bxI7ThgLzPrPz484/S9jLlvUAHYMzy6I0XiU1ZMeAEOBcS0VePBFxh1JjTQt3Xiat5b6Oh4x7UC7IwKQKIJRIg==",
       "cpu": [
         "x64"
       ],
@@ -383,9 +383,9 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.24.2.tgz",
-      "integrity": "sha512-LihEQ2BBKVFLOC9ZItT9iFprsE9tqjDjnbulhHoFxYQtQfai7qfluVODIYxt1PgdoyQkz23+01rzwNwYfutxUQ==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.0.tgz",
+      "integrity": "sha512-ZUAc2YK6JW89xTbXvftxdnYy3m4iHIkDtK3CLce8wg8M2L+YZhIvO1DKpxrd0Yr59AeNNkTiic9YLf6FTtXWMw==",
       "cpu": [
         "arm64"
       ],
@@ -400,9 +400,9 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.24.2.tgz",
-      "integrity": "sha512-q+iGUwfs8tncmFC9pcnD5IvRHAzmbwQ3GPS5/ceCyHdjXubwQWI12MKWSNSMYLJMq23/IUCvJMS76PDqXe1fxA==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.0.tgz",
+      "integrity": "sha512-eSNxISBu8XweVEWG31/JzjkIGbGIJN/TrRoiSVZwZ6pkC6VX4Im/WV2cz559/TXLcYbcrDN8JtKgd9DJVIo8GA==",
       "cpu": [
         "ia32"
       ],
@@ -417,9 +417,9 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.24.2.tgz",
-      "integrity": "sha512-7VTgWzgMGvup6aSqDPLiW5zHaxYJGTO4OokMjIlrCtf+VpEL+cXKtCvg723iguPYI5oaUNdS+/V7OU2gvXVWEg==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.0.tgz",
+      "integrity": "sha512-ZENoHJBxA20C2zFzh6AI4fT6RraMzjYw4xKWemRTRmRVtN9c5DcH9r/f2ihEkMjOW5eGgrwCslG/+Y/3bL+DHQ==",
       "cpu": [
         "x64"
       ],
@@ -434,9 +434,9 @@
       }
     },
     "node_modules/esbuild": {
-      "version": "0.24.2",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.24.2.tgz",
-      "integrity": "sha512-+9egpBW8I3CD5XPe0n6BfT5fxLzxrlDzqydF3aviG+9ni1lDC/OvMHcxqEFV0+LANZG5R1bFMWfUrjVsdwxJvA==",
+      "version": "0.25.0",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.0.tgz",
+      "integrity": "sha512-BXq5mqc8ltbaN34cDqWuYKyNhX8D/Z0J1xdtdQ8UcIIIyJyz+ZMKUt58tF3SrZ85jcfN/PZYhjR5uDQAYNVbuw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -447,31 +447,31 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.24.2",
-        "@esbuild/android-arm": "0.24.2",
-        "@esbuild/android-arm64": "0.24.2",
-        "@esbuild/android-x64": "0.24.2",
-        "@esbuild/darwin-arm64": "0.24.2",
-        "@esbuild/darwin-x64": "0.24.2",
-        "@esbuild/freebsd-arm64": "0.24.2",
-        "@esbuild/freebsd-x64": "0.24.2",
-        "@esbuild/linux-arm": "0.24.2",
-        "@esbuild/linux-arm64": "0.24.2",
-        "@esbuild/linux-ia32": "0.24.2",
-        "@esbuild/linux-loong64": "0.24.2",
-        "@esbuild/linux-mips64el": "0.24.2",
-        "@esbuild/linux-ppc64": "0.24.2",
-        "@esbuild/linux-riscv64": "0.24.2",
-        "@esbuild/linux-s390x": "0.24.2",
-        "@esbuild/linux-x64": "0.24.2",
-        "@esbuild/netbsd-arm64": "0.24.2",
-        "@esbuild/netbsd-x64": "0.24.2",
-        "@esbuild/openbsd-arm64": "0.24.2",
-        "@esbuild/openbsd-x64": "0.24.2",
-        "@esbuild/sunos-x64": "0.24.2",
-        "@esbuild/win32-arm64": "0.24.2",
-        "@esbuild/win32-ia32": "0.24.2",
-        "@esbuild/win32-x64": "0.24.2"
+        "@esbuild/aix-ppc64": "0.25.0",
+        "@esbuild/android-arm": "0.25.0",
+        "@esbuild/android-arm64": "0.25.0",
+        "@esbuild/android-x64": "0.25.0",
+        "@esbuild/darwin-arm64": "0.25.0",
+        "@esbuild/darwin-x64": "0.25.0",
+        "@esbuild/freebsd-arm64": "0.25.0",
+        "@esbuild/freebsd-x64": "0.25.0",
+        "@esbuild/linux-arm": "0.25.0",
+        "@esbuild/linux-arm64": "0.25.0",
+        "@esbuild/linux-ia32": "0.25.0",
+        "@esbuild/linux-loong64": "0.25.0",
+        "@esbuild/linux-mips64el": "0.25.0",
+        "@esbuild/linux-ppc64": "0.25.0",
+        "@esbuild/linux-riscv64": "0.25.0",
+        "@esbuild/linux-s390x": "0.25.0",
+        "@esbuild/linux-x64": "0.25.0",
+        "@esbuild/netbsd-arm64": "0.25.0",
+        "@esbuild/netbsd-x64": "0.25.0",
+        "@esbuild/openbsd-arm64": "0.25.0",
+        "@esbuild/openbsd-x64": "0.25.0",
+        "@esbuild/sunos-x64": "0.25.0",
+        "@esbuild/win32-arm64": "0.25.0",
+        "@esbuild/win32-ia32": "0.25.0",
+        "@esbuild/win32-x64": "0.25.0"
       }
     }
   }
diff --git a/vektra-learn/widget/package.json b/vektra-learn/widget/package.json
index a33e4caf..32421588 100644
--- a/vektra-learn/widget/package.json
+++ b/vektra-learn/widget/package.json
@@ -4,6 +4,6 @@
     "build": "node esbuild.config.mjs"
   },
   "devDependencies": {
-    "esbuild": "^0.24"
+    "esbuild": "^0.25"
   }
 }
diff --git a/vektra-learn/widget/src/api-client.js b/vektra-learn/widget/src/api-client.js
index b24ecdf9..e0fecb8a 100644
--- a/vektra-learn/widget/src/api-client.js
+++ b/vektra-learn/widget/src/api-client.js
@@ -32,6 +32,51 @@ export class ApiClient {
     return this._conversationId;
   }
 
+  /**
+   * Manually set the current conversation ID (e.g. restored from sessionStorage).
+   * Use null to clear it.
+   */
+  setConversationId(id) {
+    this._conversationId = id || null;
+  }
+
+  /**
+   * Fetch decrypted turns for a stored conversation (WI-1 / FEAT-004).
+   * Returns null on 404/403 (so the caller can reset local state silently),
+   * throws on other errors so that a transient network failure does not
+   * wipe the sessionStorage entry.
+   *
+   * @param {string} conversationId
+   * @returns {Promise<{conversation_id: string, namespace: string, turns: Array}|null>}
+   */
+  async getConversationTurns(conversationId, _retried = false) {
+    // Bounded timeout so a stalled backend doesn't block widget init.
+    // AbortSignal.timeout rejects the fetch with an AbortError; callers
+    // already handle thrown errors by leaving stored state untouched.
+    const resp = await fetch(
+      `${this._apiUrl}/api/v1/learn/conversations/${encodeURIComponent(conversationId)}/turns`,
+      {
+        method: "GET",
+        headers: { Authorization: `Bearer ${this._token}` },
+        signal: AbortSignal.timeout(8000),
+      }
+    );
+    if (resp.status === 401 && !_retried) {
+      const newToken = await this._refreshToken();
+      if (newToken) {
+        this._token = newToken;
+        return this.getConversationTurns(conversationId, true);
+      }
+    }
+    if (resp.status === 404 || resp.status === 403) {
+      return null; // caller clears local state, no error surfaced to the user
+    }
+    if (!resp.ok) {
+      throw new Error(`HTTP ${resp.status}`);
+    }
+    return resp.json();
+  }
+
   /**
    * Check if the Vektra API is reachable.
    * @returns {Promise<boolean>}
@@ -130,7 +175,9 @@ export class ApiClient {
                   onToken(event.data);
                   receivedTokens = true;
                 } else if (event.type === "sources" && onSources) {
-                  onSources(event.data);
+                  // FEAT-014: forward the server-resolved show_sources hint
+                  // alongside the sources list (undefined on older servers).
+                  onSources(event.data, event.show_sources);
                 } else if (event.type === "done") {
                   if (event.data?.conversation_id) {
                     this._conversationId = event.data.conversation_id;
@@ -163,7 +210,8 @@ export class ApiClient {
           onToken(data.answer);
         }
         if (onSources && data.sources && data.sources.length > 0) {
-          onSources(data.sources);
+          // FEAT-014: pass server-resolved show_sources hint to caller.
+          onSources(data.sources, data.show_sources);
         }
         if (onDone) onDone();
       }
diff --git a/vektra-learn/widget/src/chat-ui.js b/vektra-learn/widget/src/chat-ui.js
index 402ac345..f2291075 100644
--- a/vektra-learn/widget/src/chat-ui.js
+++ b/vektra-learn/widget/src/chat-ui.js
@@ -20,6 +20,8 @@ const I18N = {
     reconnecting: "Reconnecting...",
     sessionExpired: "Your session has expired. Please reload the page.",
     close: "Close",
+    newChat: "New chat",
+    poweredBy: "Powered by",
   },
   it: {
     title: "Assistente del corso",
@@ -34,24 +36,98 @@ const I18N = {
     reconnecting: "Riconnessione...",
     sessionExpired: "La sessione è scaduta. Ricarica la pagina.",
     close: "Chiudi",
+    newChat: "Nuova chat",
+    poweredBy: "Offerto da",
   },
 };
 
+// Accept CSS colors that are hex (#rgb, #rgba, #rrggbb, #rrggbbaa),
+// rgb[a](), hsl[a](), or named (alphanumeric). Rejects anything with
+// quotes, semicolons, or whitespace that could break out into a style rule.
+// Matches the conservative set proposed by the plan's XSS mitigation.
+const _VALID_COLOR_RE =
+  /^(#[0-9a-fA-F]{3,8}|rgba?\([0-9.,\s%]+\)|hsla?\([0-9.,\s%]+\)|[a-zA-Z]+)$/;
+
+function _isSafeColor(value) {
+  return typeof value === "string" && _VALID_COLOR_RE.test(value.trim());
+}
+
+// An icon value that looks like a URL becomes an <img>; otherwise it is
+// rendered as plain text (emoji or short string) via textContent to avoid
+// HTML injection via data-icon.
+function _iconIsUrl(value) {
+  if (typeof value !== "string") return false;
+  const v = value.trim();
+  return (
+    v.startsWith("http://") ||
+    v.startsWith("https://") ||
+    v.startsWith("/") ||
+    v.startsWith("data:image/")
+  );
+}
+
+// Only http(s) and same-origin paths are allowed as link targets. Rejects
+// javascript:, data:, and other schemes that could enable XSS when the
+// operator-controlled attribute is combined with custom text.
+function _isSafeLinkUrl(value) {
+  if (typeof value !== "string") return false;
+  const v = value.trim();
+  return (
+    v.startsWith("http://") || v.startsWith("https://") || v.startsWith("/")
+  );
+}
+
 export class ChatUI {
   /**
    * @param {object} opts
    * @param {string} opts.theme - "light" or "dark"
    * @param {string} opts.language - "en" or "it"
+   * @param {string|null} [opts.customTitle] - overrides the localized title
+   * @param {string|null} [opts.customPrimaryColor] - CSS color for accents
+   * @param {string|null} [opts.customIcon] - emoji or image URL for the button
+   * @param {string|null} [opts.welcomeMessage] - first assistant message on open
+   * @param {boolean} [opts.showPoweredBy=true] - show attribution footer
+   * @param {string|null} [opts.poweredByText] - custom footer text (plain text)
+   * @param {string|null} [opts.poweredByUrl] - custom footer link target
    * @param {function} opts.onSend - callback(question: string)
+   * @param {function} [opts.onNewChat] - callback invoked when "New chat" is clicked
    */
-  constructor({ theme = "light", language = "en", onSend }) {
+  constructor({
+    theme = "light",
+    language = "en",
+    customTitle = null,
+    customPrimaryColor = null,
+    customIcon = null,
+    welcomeMessage = null,
+    showPoweredBy = true,
+    poweredByText = null,
+    poweredByUrl = null,
+    onSend,
+    onNewChat = null,
+  }) {
     this._theme = theme;
     this._lang = I18N[language] || I18N.en;
     this._onSend = onSend;
+    this._onNewChat = onNewChat;
     this._isOpen = false;
     this._sending = false;
+    this._restoring = false; // true while a conversation history is being fetched
     this._status = null; // "unavailable" | "reconnecting" | "sessionExpired" | null
 
+    this._title = customTitle || this._lang.title;
+    this._icon = customIcon;
+    this._welcomeMessage = welcomeMessage;
+    this._showPoweredBy = showPoweredBy;
+    this._poweredByText = poweredByText;
+    this._poweredByUrl = poweredByUrl;
+    this._welcomeShown = false;
+    // Accept color only if it matches the conservative whitelist; anything
+    // else is silently ignored (falls back to theme default) to prevent CSS
+    // injection via data-primary-color.
+    this._primaryColor = _isSafeColor(customPrimaryColor)
+      ? customPrimaryColor.trim()
+      : null;
+
     this._injectStyles();
     this._createElements();
     this._bindEvents();
@@ -61,23 +137,51 @@ export class ChatUI {
     const style = document.createElement("style");
     style.textContent = buildStyles(this._theme);
     document.head.appendChild(style);
+
+    if (this._primaryColor) {
+      // Reuse a single override node — only the primary-color override is
+      // deduped, not the main style block above (DEBT-018 scope: avoid the
+      // override leaking to host page :root and clobbering unrelated
+      // --vektra-primary uses; main-style accumulation across hot reloads is
+      // not tackled here, see DEBT-022 for multi-instance support).
+      let override = document.getElementById("vektra-primary-override");
+      if (!override) {
+        override = document.createElement("style");
+        override.id = "vektra-primary-override";
+        document.head.appendChild(override);
+      }
+      override.textContent = `.vektra-chat-btn, .vektra-chat-panel { --vektra-primary: ${this._primaryColor}; }`;
+    }
   }
 
   _createElements() {
-    // Floating button
+    // Floating button (aria-label + icon set via safe APIs — no innerHTML of user input)
     this._btn = document.createElement("button");
     this._btn.className = "vektra-chat-btn";
-    this._btn.setAttribute("aria-label", this._lang.title);
-    this._btn.innerHTML = "&#128172;"; // speech bubble emoji
+    this._btn.setAttribute("aria-label", this._title);
+    if (this._icon && _iconIsUrl(this._icon)) {
+      const img = document.createElement("img");
+      img.src = this._icon;
+      img.alt = "";
+      img.className = "vektra-chat-btn-icon";
+      this._btn.appendChild(img);
+    } else if (this._icon) {
+      this._btn.textContent = this._icon;
+    } else {
+      this._btn.innerHTML = "&#128172;"; // speech bubble emoji
+    }
     document.body.appendChild(this._btn);
 
-    // Chat panel
+    // Chat panel — scaffold built with safe APIs; title uses textContent below.
     this._panel = document.createElement("div");
     this._panel.className = "vektra-chat-panel";
     this._panel.innerHTML = `
       <div class="vektra-chat-header">
-        <span class="vektra-chat-header-title">${this._lang.title}</span>
-        <button class="vektra-chat-close" aria-label="${this._lang.close}">&times;</button>
+        <span class="vektra-chat-header-title"></span>
+        <div class="vektra-chat-header-actions">
+          <button class="vektra-chat-new" aria-label="${this._lang.newChat}" title="${this._lang.newChat}">&#10227;</button>
+          <button class="vektra-chat-close" aria-label="${this._lang.close}">&times;</button>
+        </div>
       </div>
       <div class="vektra-chat-messages"></div>
       <div class="vektra-chat-input-area">
@@ -87,6 +191,35 @@ export class ChatUI {
         <button class="vektra-chat-send">${this._lang.send}</button>
       </div>
     `;
+    // Title: set via textContent so data-title cannot inject HTML
+    const titleEl = this._panel.querySelector(".vektra-chat-header-title");
+    titleEl.textContent = this._title;
+
+    if (this._showPoweredBy) {
+      const footer = document.createElement("div");
+      footer.className = "vektra-chat-powered-by";
+      // If poweredByText is set, the whole footer is a single link with that
+      // text. Otherwise the footer is "<i18n: Powered by> <link>VektraLabs</link>".
+      // A blank or invalid poweredByUrl falls back to the VektraLabs default URL.
+      const url = _isSafeLinkUrl(this._poweredByUrl)
+        ? this._poweredByUrl.trim()
+        : "https://vektralabs.github.io";
+      const link = document.createElement("a");
+      link.href = url;
+      link.target = "_blank";
+      link.rel = "noopener noreferrer";
+
+      if (this._poweredByText) {
+        link.textContent = this._poweredByText;
+        footer.appendChild(link);
+      } else {
+        link.textContent = "VektraLabs";
+        footer.textContent = `${this._lang.poweredBy} `;
+        footer.appendChild(link);
+      }
+      this._panel.appendChild(footer);
+    }
+
     document.body.appendChild(this._panel);
 
     // Cache references
@@ -94,6 +227,7 @@ export class ChatUI {
     this._inputEl = this._panel.querySelector(".vektra-chat-input");
     this._sendBtn = this._panel.querySelector(".vektra-chat-send");
     this._closeBtn = this._panel.querySelector(".vektra-chat-close");
+    this._newChatBtn = this._panel.querySelector(".vektra-chat-new");
   }
 
   _bindEvents() {
@@ -106,6 +240,55 @@ export class ChatUI {
         this._handleSend();
       }
     });
+    if (this._newChatBtn) {
+      this._newChatBtn.addEventListener("click", () => this._handleNewChat());
+    }
+  }
+
+  _handleNewChat() {
+    if (this._sending || this._restoring) return;
+    this.reset();
+    if (this._onNewChat) this._onNewChat();
+  }
+
+  /**
+   * Reset the chat panel: clear messages, re-arm welcome message, allow input.
+   * Does NOT call the onNewChat callback; use _handleNewChat for that.
+   */
+  reset() {
+    this._messagesEl.textContent = "";
+    this._welcomeShown = false;
+    if (this._isOpen && this._welcomeMessage) {
+      // Re-inject welcome message so the cleared panel isn't blank
+      this._welcomeShown = true;
+      const msg = document.createElement("div");
+      msg.className = "vektra-chat-msg assistant";
+      msg.textContent = this._welcomeMessage;
+      this._messagesEl.appendChild(msg);
+    }
+  }
+
+  /**
+   * Replay a list of stored turns as user/assistant message bubbles (WI-5).
+   * Call after restoring a conversation from sessionStorage but before
+   * enabling user input. Each turn is a plain object with
+   * { question, answer, sources }. Sources may be empty for now.
+   */
+  replayTurns(turns) {
+    if (!Array.isArray(turns)) return;
+    // Replaying takes ownership of the message list — clear any welcome msg
+    // so the history is the first thing the student sees.
+    this._messagesEl.textContent = "";
+    this._welcomeShown = true; // don't re-emit welcome on first open
+    for (const turn of turns) {
+      if (turn.question) this.addMessage("user", turn.question);
+      if (turn.answer) {
+        const msgEl = this.addMessage("assistant", turn.answer);
+        if (Array.isArray(turn.sources) && turn.sources.length > 0) {
+          this.addSources(msgEl, turn.sources);
+        }
+      }
+    }
   }
 
   toggle() {
@@ -115,6 +298,16 @@ export class ChatUI {
   open() {
     this._isOpen = true;
     this._panel.classList.add("open");
+    // Emit welcome message on first open (WI-4). Rendered as an assistant
+    // bubble so it flows naturally with subsequent conversation turns.
+    if (this._welcomeMessage && !this._welcomeShown) {
+      this._welcomeShown = true;
+      const msg = document.createElement("div");
+      msg.className = "vektra-chat-msg assistant";
+      msg.textContent = this._welcomeMessage;
+      this._messagesEl.appendChild(msg);
+      this._scrollToBottom();
+    }
     this._inputEl.focus();
   }
 
@@ -124,7 +317,7 @@ export class ChatUI {
   }
 
   _handleSend() {
-    if (this._sending) return;
+    if (this._sending || this._restoring) return;
     const question = this._inputEl.value.trim();
     if (!question) return;
 
@@ -142,9 +335,21 @@ export class ChatUI {
     this._updateControlsDisabled();
   }
 
+  /**
+   * Toggle the "restoring history" state (WI-5). While active, the input
+   * and send button are disabled so a fast user cannot preempt a pending
+   * replay — otherwise `replayTurns` would wipe a user message that was
+   * already rendered, and a new_chat click would race the restore.
+   */
+  setRestoring(restoring) {
+    this._restoring = restoring;
+    this._updateControlsDisabled();
+  }
+
   _updateControlsDisabled() {
     const blocked =
       this._sending ||
+      this._restoring ||
       this._status === "unavailable" ||
       this._status === "sessionExpired";
     this._sendBtn.disabled = blocked;
diff --git a/vektra-learn/widget/src/index.js b/vektra-learn/widget/src/index.js
index 9f0613b5..6f4ae561 100644
--- a/vektra-learn/widget/src/index.js
+++ b/vektra-learn/widget/src/index.js
@@ -12,12 +12,80 @@
  *     data-theme="light"
  *     data-language="en"
  *     data-token-refresh-url="/my-app/refresh-token"
+ *     data-title="My course helper"
+ *     data-primary-color="#9333ea"
+ *     data-icon="https://example.com/bot.png"
+ *     data-welcome-message="Hi! Ask me anything about the course."
+ *     data-powered-by="true"
+ *     data-powered-by-text="Supported by University of X"
+ *     data-powered-by-url="https://univ.example/help"
+ *     data-show-sources="true"
  *   ></script>
+ *
+ * White-label attributes (all optional):
+ *   data-title             - header title and button aria-label
+ *   data-primary-color     - hex/rgb/named color used for buttons and accents
+ *   data-icon              - emoji or image URL for the floating button
+ *   data-welcome-message   - assistant message shown on first open
+ *   data-powered-by        - "true" (default) shows the attribution footer,
+ *                            "false" hides it
+ *   data-powered-by-text   - overrides the footer text (plain text, no HTML).
+ *                            Default: "Powered by VektraLabs" as a link.
+ *   data-powered-by-url    - overrides the footer link target. Default:
+ *                            https://vektralabs.github.io
+ *   data-show-sources      - "true"/"false" client-side override for the
+ *                            source citations section. Absent = defer to the
+ *                            server-resolved value (namespace config > env
+ *                            default). (FEAT-014)
  */
 
 import { ApiClient } from "./api-client.js";
 import { ChatUI } from "./chat-ui.js";
 
+// Storage key for per-course conversation persistence (WI-5). Tab-scoped
+// via sessionStorage so that shared university computers don't leak a
+// student's conversation to the next user.
+const STORAGE_PREFIX = "vektra-conv:";
+// Tabs kept open for days shouldn't silently resurface yesterday's chat.
+const STALE_AFTER_MS = 24 * 60 * 60 * 1000;
+
+function _readStored(courseId) {
+  try {
+    const raw = window.sessionStorage.getItem(STORAGE_PREFIX + courseId);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    if (!parsed || !parsed.conversation_id) return null;
+    const age = Date.now() - (parsed.stored_at || 0);
+    if (age < 0 || age > STALE_AFTER_MS) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+function _writeStored(courseId, conversationId) {
+  try {
+    window.sessionStorage.setItem(
+      STORAGE_PREFIX + courseId,
+      JSON.stringify({
+        conversation_id: conversationId,
+        stored_at: Date.now(),
+      })
+    );
+  } catch {
+    // Storage full or unavailable — silently ignore; persistence is a
+    // convenience, not a correctness requirement.
+  }
+}
+
+function _clearStored(courseId) {
+  try {
+    window.sessionStorage.removeItem(STORAGE_PREFIX + courseId);
+  } catch {
+    // ignore
+  }
+}
+
 (function () {
   // Capture the script tag synchronously (before DOMContentLoaded)
   const scripts = document.querySelectorAll('script[src*="vektra-chat"]');
@@ -35,6 +103,33 @@ import { ChatUI } from "./chat-ui.js";
   const language = scriptTag.getAttribute("data-language") || "en";
   const tokenRefreshUrl = scriptTag.getAttribute("data-token-refresh-url") || null;
 
+  // White-label attributes (all optional). See file header for semantics.
+  const customTitle = scriptTag.getAttribute("data-title") || null;
+  const customPrimaryColor =
+    scriptTag.getAttribute("data-primary-color") || null;
+  const customIcon = scriptTag.getAttribute("data-icon") || null;
+  const welcomeMessage = scriptTag.getAttribute("data-welcome-message") || null;
+  const poweredByAttr = scriptTag.getAttribute("data-powered-by");
+  // Default ON; only "false" (case-insensitive) hides attribution.
+  const showPoweredBy = poweredByAttr === null
+    ? true
+    : poweredByAttr.toLowerCase() !== "false";
+  const poweredByText = scriptTag.getAttribute("data-powered-by-text") || null;
+  const poweredByUrl = scriptTag.getAttribute("data-powered-by-url") || null;
+
+  // FEAT-014: client-side override for source citation visibility. When the
+  // attribute is absent, we defer to the server-resolved value that arrives
+  // with each query response; when present, "false" hides citations and any
+  // other string re-enables them (including an explicit "true" that forces
+  // visibility even when the namespace config disables them).
+  const showSourcesAttr = scriptTag.getAttribute("data-show-sources");
+  // Trim before lowercasing so " false " (or surrounding whitespace from
+  // server-side templating) is honoured, not silently treated as truthy.
+  const clientShowSourcesOverride =
+    showSourcesAttr === null
+      ? null
+      : showSourcesAttr.trim().toLowerCase() !== "false";
+
   if (!apiUrl || !courseId || !token) {
     console.error(
       "[vektra-chat] Missing required attributes: data-api-url, data-course-id, data-token"
@@ -42,12 +137,19 @@ import { ChatUI } from "./chat-ui.js";
     return;
   }
 
-  function init() {
+  async function init() {
     const client = new ApiClient(apiUrl, token, courseId, { tokenRefreshUrl });
 
     const ui = new ChatUI({
       theme,
       language,
+      customTitle,
+      customPrimaryColor,
+      customIcon,
+      welcomeMessage,
+      showPoweredBy,
+      poweredByText,
+      poweredByUrl,
       onSend(question) {
         const stream = ui.createStreamMessage();
 
@@ -55,14 +157,28 @@ import { ChatUI } from "./chat-ui.js";
           onToken(tokenText) {
             ui.appendToken(stream, tokenText);
           },
-          onSources(sources) {
-            ui.addSources(stream, sources);
+          onSources(sources, serverShowSources) {
+            // Resolution: client data-show-sources override > server hint >
+            // default true (legacy behaviour when the server omits the field).
+            const effective =
+              clientShowSourcesOverride !== null
+                ? clientShowSourcesOverride
+                : typeof serverShowSources === "boolean"
+                  ? serverShowSources
+                  : true;
+            if (effective) {
+              ui.addSources(stream, sources);
+            }
           },
           onNoRelevantContext() {
             ui.appendToken(stream, ui.noRelevantContextMessage());
           },
           onDone() {
             ui.doneSending();
+            // Persist conversation ID for history restore on next load (WI-5).
+            if (client.conversationId) {
+              _writeStored(courseId, client.conversationId);
+            }
           },
           onError(errMsg) {
             // Show session expired message for auth failures
@@ -75,8 +191,46 @@ import { ChatUI } from "./chat-ui.js";
           },
         });
       },
+      onNewChat() {
+        // Reset both storage and client-side state so the next query
+        // creates a fresh conversation.
+        _clearStored(courseId);
+        client.setConversationId(null);
+      },
     });
 
+    // Restore a conversation from a prior load (WI-5 / FEAT-004). Awaited,
+    // with input+send disabled via ui.setRestoring(true) for the duration
+    // of the fetch. This closes a race the earlier "just await" fix did
+    // not fully handle: the UI is already mounted when the await starts,
+    // so without the input lock a fast user could type+send during the
+    // fetch — _handleSend would paint the user bubble into the DOM, then
+    // replayTurns would clear it when the restore resolved, losing the
+    // message. The fetch has an 8s timeout (api-client.js) so the input
+    // lock never persists indefinitely. Any failure keeps the stored id
+    // for the next load.
+    async function restoreConversation() {
+      const stored = _readStored(courseId);
+      if (!stored) return;
+      ui.setRestoring(true);
+      try {
+        const payload = await client.getConversationTurns(stored.conversation_id);
+        if (payload && Array.isArray(payload.turns) && payload.turns.length > 0) {
+          client.setConversationId(stored.conversation_id);
+          ui.replayTurns(payload.turns);
+        } else {
+          // Returned null (404/403) or empty turns — abandon stored id
+          _clearStored(courseId);
+        }
+      } catch {
+        // Network/transient error (incl. AbortError on timeout): keep
+        // stored id, try again next load.
+      } finally {
+        ui.setRestoring(false);
+      }
+    }
+    await restoreConversation();
+
     // Check API connectivity on startup and show status if unreachable
     let retryTimer = null;
 
@@ -110,10 +264,15 @@ import { ChatUI } from "./chat-ui.js";
     checkConnection();
   }
 
-  // Wait for DOM to be ready before creating UI elements
+  // Wait for DOM to be ready before creating UI elements. init is async
+  // (awaits restoreConversation); wrap with .catch so any unexpected
+  // rejection surfaces in the console rather than as an unhandled promise.
+  function runInit() {
+    init().catch((err) => console.error("[vektra-chat] init failed:", err));
+  }
   if (document.readyState === "loading") {
-    document.addEventListener("DOMContentLoaded", init);
+    document.addEventListener("DOMContentLoaded", runInit);
   } else {
-    init();
+    runInit();
   }
 })();
diff --git a/vektra-learn/widget/src/styles.js b/vektra-learn/widget/src/styles.js
index 22296cb0..944c7a3f 100644
--- a/vektra-learn/widget/src/styles.js
+++ b/vektra-learn/widget/src/styles.js
@@ -52,7 +52,7 @@ export function buildStyles(theme) {
   width: 56px;
   height: 56px;
   border-radius: 50%;
-  background: ${t.primary};
+  background: var(--vektra-primary, ${t.primary});
   color: #fff;
   border: none;
   cursor: pointer;
@@ -66,7 +66,8 @@ export function buildStyles(theme) {
   line-height: 1;
 }
 .vektra-chat-btn:hover {
-  background: ${t.primaryHover};
+  background: var(--vektra-primary, ${t.primaryHover});
+  filter: brightness(0.92);
   transform: scale(1.05);
 }
 
@@ -107,6 +108,12 @@ export function buildStyles(theme) {
   font-weight: 600;
   font-size: 15px;
 }
+.vektra-chat-header-actions {
+  display: flex;
+  align-items: center;
+  gap: 4px;
+}
+.vektra-chat-new,
 .vektra-chat-close {
   background: none;
   border: none;
@@ -116,6 +123,13 @@ export function buildStyles(theme) {
   padding: 4px;
   line-height: 1;
 }
+.vektra-chat-new {
+  font-size: 16px;
+}
+.vektra-chat-new:hover,
+.vektra-chat-close:hover {
+  color: ${t.text};
+}
 
 .vektra-chat-messages {
   flex: 1;
@@ -135,7 +149,7 @@ export function buildStyles(theme) {
 }
 .vektra-chat-msg.user {
   align-self: flex-end;
-  background: ${t.userBubble};
+  background: var(--vektra-primary, ${t.userBubble});
   color: ${t.userText};
   border-bottom-right-radius: 4px;
 }
@@ -188,7 +202,7 @@ export function buildStyles(theme) {
   font-size: 12px;
 }
 .vektra-chat-msg.assistant a {
-  color: ${t.primary};
+  color: var(--vektra-primary, ${t.primary});
   text-decoration: underline;
 }
 .vektra-chat-msg.assistant strong {
@@ -206,7 +220,7 @@ export function buildStyles(theme) {
   background: none;
   border: none;
   cursor: pointer;
-  color: ${t.primary};
+  color: var(--vektra-primary, ${t.primary});
   font-size: 12px;
   padding: 0;
   font-family: inherit;
@@ -215,7 +229,7 @@ export function buildStyles(theme) {
   text-decoration: underline;
 }
 .vektra-chat-sources-toggle:focus-visible {
-  outline: 2px solid ${t.primary};
+  outline: 2px solid var(--vektra-primary, ${t.primary});
   outline-offset: 2px;
   border-radius: 4px;
 }
@@ -235,7 +249,7 @@ export function buildStyles(theme) {
 }
 .vektra-chat-source-num {
   font-weight: 600;
-  color: ${t.primary};
+  color: var(--vektra-primary, ${t.primary});
   margin-right: 4px;
 }
 .vektra-chat-source-text {
@@ -280,14 +294,14 @@ export function buildStyles(theme) {
   font-family: inherit;
 }
 .vektra-chat-input:focus-visible {
-  outline: 2px solid ${t.primary};
+  outline: 2px solid var(--vektra-primary, ${t.primary});
   outline-offset: -1px;
 }
 .vektra-chat-input::placeholder {
   color: ${t.textSecondary};
 }
 .vektra-chat-send {
-  background: ${t.primary};
+  background: var(--vektra-primary, ${t.primary});
   color: #fff;
   border: none;
   border-radius: 8px;
@@ -298,13 +312,34 @@ export function buildStyles(theme) {
   transition: background 0.2s;
 }
 .vektra-chat-send:hover {
-  background: ${t.primaryHover};
+  background: var(--vektra-primary, ${t.primaryHover});
+  filter: brightness(0.92);
 }
 .vektra-chat-send:disabled {
   opacity: 0.5;
   cursor: not-allowed;
 }
 
+.vektra-chat-btn-icon {
+  width: 28px;
+  height: 28px;
+  display: block;
+}
+
+.vektra-chat-powered-by {
+  padding: 6px 12px;
+  text-align: center;
+  font-size: 11px;
+  color: ${t.textSecondary};
+  background: ${t.bgSecondary};
+  border-top: 1px solid ${t.border};
+  flex-shrink: 0;
+}
+.vektra-chat-powered-by a {
+  color: ${t.textSecondary};
+  text-decoration: underline;
+}
+
 @media (max-width: 480px) {
   .vektra-chat-panel {
     width: calc(100vw - 16px);
diff --git a/vektra-shared/README.md b/vektra-shared/README.md
index 6820cdce..fe5a454b 100644
--- a/vektra-shared/README.md
+++ b/vektra-shared/README.md
@@ -1,7 +1,25 @@
 # vektra-shared
 
-Shared protocol interfaces and types used by all Vektra components.
+Shared protocol interfaces, configuration, and helpers used by all Vektra components.
 
-This package defines the 9 Protocol interfaces (LLMProvider, EmbeddingProvider, SparseEmbeddingProvider, VectorStoreProvider, DocumentExtractor, ChunkingStrategy, QueryPipeline, SafeguardHook, EventEmitter) and the shared data models that form the Vektra platform contract.
+This package is the platform contract: every other component depends on it, and no component depends on another (enforced by `import-linter`).
 
-See [architecture.md](../.s2s/architecture.md) for the full protocol specifications.
+## What lives here
+
+- **9 Protocol interfaces**: `LLMProvider`, `EmbeddingProvider`, `SparseEmbeddingProvider`, `VectorStoreProvider`, `DocumentExtractor`, `ChunkingStrategy`, `QueryPipeline`, `SafeguardHook`, `EventEmitter`. Each is a `typing.Protocol` so any conforming class is a valid implementation, no inheritance required.
+- **Shared data models** (`types.py`): `QueryRequest`, `QueryResponse`, `SourceRef`, `QueryTrace`, `SearchResult`, `Chunk`, `Conversation`, etc.
+- **Configuration** (`config.py`): `VektraSettings` (the single Pydantic source of truth, ARCH-060) plus sub-configs (`RewriteConfig`, `RerankConfig`, `WebhookConfig`).
+- **Auth primitives** (`auth.py`): `require_scope` FastAPI dependency, `ApiKeyInfo` model, scope-checking logic. `admin` is a project-wide superscope: a key with `admin` satisfies any `require_scope("X")` check.
+- **Errors** (`errors.py`): the REQ-010 error envelope, error code constants (`ERR_AUTH_*`, `ERR_INGEST_*`, `ERR_QUERY_*`, `ERR_ADMIN_*`, `ERR_LEARN_*`, ...), category-to-HTTP mapping, and `http_status_for()`.
+- **Audit** (`audit.py`): `log_event()` helper that writes a row into the audit log; called from every component on sensitive content access (NFR-007).
+- **Namespace config resolvers** (`namespace.py`) — async helpers that read `namespaces.config` JSONB once per request and fall back to a caller-supplied default. Both use raw SQL (ADR-0005, no ORM imports across packages) and return the default on any error (missing namespace, DB error, invalid value):
+  - `resolve_grounding_mode(namespace: str, session_factory: Any, default_mode: str = "strict") -> str` — returns `"strict"` or `"hybrid"`. Called by `vektra-core` and `vektra-learn` per query. The caller pre-resolves the env-var fallback (`VEKTRA_PROMPT_GROUNDING_MODE`) and passes it as `default_mode`.
+  - `resolve_show_sources(namespace: str, session_factory: Any, default_value: bool = True) -> bool` — FEAT-014. Called by `vektra-learn` per query; the caller pre-resolves the env-var fallback (`VEKTRA_LEARN_SHOW_SOURCES`) into `default_value`. `vektra-admin` does not use this helper directly: it computes the equivalent `resolved` view inline in `GET /api/v1/admin/namespaces/{id}/config` so the response can carry both stored and resolved values.
+- **`ProviderRegistry`** (`registry.py`): the runtime registry where `vektra-app` registers Protocol implementations and other components resolve them by name.
+- **Startup validation** (`startup.py`): two helpers consumed by `vektra-app`'s lifespan (steps 2 and 3 of the 11-step ARCH-057 sequence): `check_database_connectivity` and `check_database_schema`, plus the `StartupValidationError` exception. The remaining nine steps live inline in `vektra-app/main.py:lifespan` (config validation, pgvector extension, provider registration, embedding warmup, LLM connectivity, prompt template loading, analytics check, learn check, qdrant check); see `docs/architecture/index.md > Startup validation` for the full list.
+
+## Why it's a separate package
+
+ADR-0005 (module boundary enforcement). Every other component imports `vektra_shared` for types, config, and protocols, but **never** imports another component. This keeps the modular monolith honest and gives us a clean Phase 3 extraction path: components can move to separate repos individually because they share no code outside `vektra-shared`.
+
+See [.s2s/architecture.md](../.s2s/architecture.md) for the full protocol specifications.
diff --git a/vektra-shared/pyproject.toml b/vektra-shared/pyproject.toml
index f8e2eb62..9e8b7498 100644
--- a/vektra-shared/pyproject.toml
+++ b/vektra-shared/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "vektra-shared"
-version = "0.4.0-dev"
+version = "0.5.0"
 description = "Shared protocols and types for the Vektra platform"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/vektra-shared/src/vektra_shared/config.py b/vektra-shared/src/vektra_shared/config.py
index e0642522..5b602fae 100644
--- a/vektra-shared/src/vektra_shared/config.py
+++ b/vektra-shared/src/vektra_shared/config.py
@@ -531,6 +531,11 @@ class VektraSettings(BaseSettings):
         alias="VEKTRA_LEARN_REQUIRE_ENROLLMENT",
         description="Require Vektra enrollment record for learn queries. Set to false when an external LMS manages enrollment and authorization.",
     )
+    learn_show_sources: bool = Field(
+        True,
+        alias="VEKTRA_LEARN_SHOW_SOURCES",
+        description="Default visibility of the source-citations section in the widget (FEAT-014). Per-namespace override via namespaces.config.show_sources.",
+    )
 
     # Observability / retention
     audit_retention_days: int = Field(90, alias="VEKTRA_AUDIT_RETENTION_DAYS")
diff --git a/vektra-shared/src/vektra_shared/errors.py b/vektra-shared/src/vektra_shared/errors.py
index 9eb648c3..f7510b06 100644
--- a/vektra-shared/src/vektra_shared/errors.py
+++ b/vektra-shared/src/vektra_shared/errors.py
@@ -110,6 +110,8 @@ def to_envelope(self) -> dict[str, Any]:
 ERR_LEARN_002 = "ERR-LEARN-002"  # Enrollment not found
 ERR_LEARN_003 = "ERR-LEARN-003"  # Invalid or expired dashboard token
 ERR_LEARN_004 = "ERR-LEARN-004"  # Duplicate enrollment
+ERR_LEARN_005 = "ERR-LEARN-005"  # Conversation not found (WI-1)
+ERR_LEARN_006 = "ERR-LEARN-006"  # Conversation belongs to another course (WI-1)
 
 
 # ---------------------------------------------------------------------------
@@ -135,6 +137,8 @@ def to_envelope(self) -> dict[str, Any]:
     ERR_LEARN_002: 404,
     ERR_LEARN_003: 401,
     ERR_LEARN_004: 409,
+    ERR_LEARN_005: 404,
+    ERR_LEARN_006: 403,
 }
 
 
diff --git a/vektra-shared/src/vektra_shared/namespace.py b/vektra-shared/src/vektra_shared/namespace.py
index 7212b269..5229be6e 100644
--- a/vektra-shared/src/vektra_shared/namespace.py
+++ b/vektra-shared/src/vektra_shared/namespace.py
@@ -1,4 +1,4 @@
-"""Namespace configuration utilities shared across packages (FEAT-020).
+"""Namespace configuration utilities shared across packages (FEAT-020, FEAT-014).
 
 Uses raw SQL to avoid importing ORM models from other packages (ADR-0005).
 Both vektra-core and vektra-learn can import from vektra-shared.
@@ -47,3 +47,36 @@ async def resolve_grounding_mode(
             error=str(exc),
         )
     return default_mode
+
+
+async def resolve_show_sources(
+    namespace: str,
+    session_factory: Any,
+    default_value: bool = True,
+) -> bool:
+    """Resolve show_sources: namespace JSONB config > default (FEAT-014).
+
+    The *default_value* parameter should incorporate the env var resolution
+    (``VEKTRA_LEARN_SHOW_SOURCES``) done by the caller.
+
+    Returns *default_value* on any error (namespace not found, DB error,
+    non-boolean value in config).
+    """
+    try:
+        async with session_factory() as session:
+            result = await session.execute(
+                text("SELECT config FROM namespaces WHERE id = :ns"),
+                {"ns": namespace},
+            )
+            row = result.scalar_one_or_none()
+            if row and isinstance(row, dict):
+                ns_value = row.get("show_sources")
+                if isinstance(ns_value, bool):
+                    return ns_value
+    except Exception as exc:
+        log.debug(
+            "show_sources_resolution_fallback",
+            namespace=namespace,
+            error=str(exc),
+        )
+    return default_value
diff --git a/vektra-shared/src/vektra_shared/types.py b/vektra-shared/src/vektra_shared/types.py
index 3f25d42a..d1d90342 100644
--- a/vektra-shared/src/vektra_shared/types.py
+++ b/vektra-shared/src/vektra_shared/types.py
@@ -283,6 +283,11 @@ class SourceRef:
     snippet: str
     citation_id: UUID
     document_version: int = 1  # from SearchResult (REQ-056)
+    # FEAT-012: filename of the source document so students can see citations
+    # like "[1] lecture-07.pdf (0.82)" instead of a chunk UUID. Soft-deleted
+    # documents (REQ-057) appear with an " (archived)" suffix; None only when
+    # the DB lookup failed (transient error, DB not initialised in tests).
+    document_name: str | None = None
 
 
 @dataclass