@vm0/cli 9.128.0 → 9.129.1

package/{chunk-ZBGP4ZRV.js → chunk-TO65SA2M.js}

@@ -73642,7 +73642,7 @@ if (DSN) {
   init2({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.128.0",
+    release: "9.129.1",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -73661,7 +73661,7 @@ if (DSN) {
     }
   });
   setContext("cli", {
-    version: "9.128.0",
+    version: "9.129.1",
     command: process.argv.slice(2).join(" ")
   });
   setContext("runtime", {
@@ -91178,6 +91178,11 @@ var openai = {
             placeholder: "sk-..."
           }
         }
+      },
+      platform: {
+        label: "Enable",
+        helpText: "No credentials needed. Usage is billed to your org credits.",
+        secrets: {}
       }
     },
     defaultAuthMethod: "api-token"
@@ -113459,55 +113464,7 @@ function matchFirewallPath(path3, pattern) {
   if (pi !== pathSegs.length) return null;
   return params;
 }
-function parseGraphQLRule(rest) {
-  const gqlIdx = rest.indexOf(" GraphQL");
-  if (gqlIdx === -1) return null;
-  const path3 = gqlIdx > 0 ? rest.slice(0, gqlIdx) : "/";
-  const suffixParts = rest.slice(gqlIdx + 1).split(/\s+/);
-  let typeFilter = null;
-  let opFilter = null;
-  let fieldFilters = null;
-  for (let i = 1; i < suffixParts.length; i++) {
-    const part = suffixParts[i];
-    if (part.startsWith("type:")) {
-      typeFilter = part.slice(5);
-    } else if (part.startsWith("operationName:")) {
-      opFilter = part.slice(14);
-    } else if (part.startsWith("field:")) {
-      fieldFilters = part.slice(6).split(",");
-    }
-  }
-  return { path: path3, typeFilter, opFilter, fieldFilters };
-}
-function matchWildcard(value, pattern) {
-  if (pattern.endsWith("*")) {
-    return value.startsWith(pattern.slice(0, -1));
-  }
-  return value === pattern;
-}
-function matchGraphQLBody(body, typeFilter, opFilter, fieldFilters) {
-  if (!body) return false;
-  if (typeFilter !== null && body.type !== typeFilter) {
-    return false;
-  }
-  if (opFilter !== null) {
-    const opName = body.operationName;
-    if (!opName) return false;
-    if (!matchWildcard(opName, opFilter)) return false;
-  }
-  if (fieldFilters !== null) {
-    const fields = body.fields;
-    if (!fields || fields.length === 0) return false;
-    if (!fieldFilters.some((pattern) => {
-      return fields.some((f) => {
-        return matchWildcard(f, pattern);
-      });
-    }))
-      return false;
-  }
-  return true;
-}
-function findMatchingPermissions(method, path3, config4, graphqlBody) {
+function findMatchingPermissions(method, path3, config4) {
   const upperMethod = method.toUpperCase();
   const matched = /* @__PURE__ */ new Set();
   for (const api of config4.apis) {
@@ -113520,17 +113477,7 @@ function findMatchingPermissions(method, path3, config4, graphqlBody) {
         const ruleMethod = rule.slice(0, spaceIdx).toUpperCase();
         const rest = rule.slice(spaceIdx + 1);
         if (ruleMethod !== "ANY" && ruleMethod !== upperMethod) continue;
-        const gql = parseGraphQLRule(rest);
-        const rulePath = gql ? gql.path : rest;
-        if (matchFirewallPath(path3, rulePath) !== null) {
-          if (gql && (gql.typeFilter !== null || gql.opFilter !== null || gql.fieldFilters !== null) && !matchGraphQLBody(
-            graphqlBody,
-            gql.typeFilter,
-            gql.opFilter,
-            gql.fieldFilters
-          )) {
-            continue;
-          }
+        if (matchFirewallPath(path3, rest) !== null) {
           matched.add(perm.name);
           break;
         }
@@ -115594,6 +115541,26 @@ var checkoutResponseSchema = external_exports.object({
 var portalResponseSchema = external_exports.object({
   url: external_exports.string()
 });
+var redeemResponseSchema = external_exports.discriminatedUnion("status", [
+  external_exports.object({
+    status: external_exports.literal("ready"),
+    checkoutUrl: external_exports.string().url()
+  }),
+  external_exports.object({
+    status: external_exports.literal("already_granted")
+  }),
+  external_exports.object({
+    status: external_exports.literal("processing")
+  }),
+  external_exports.object({
+    status: external_exports.literal("error"),
+    reason: external_exports.enum([
+      "campaign_misconfigured",
+      "admin_required",
+      "billing_unavailable"
+    ])
+  })
+]);
 var checkoutRequestSchema = external_exports.object({
   tier: external_exports.enum(["pro", "team"]),
   successUrl: external_exports.string().url(),
@@ -115607,6 +115574,10 @@ var autoRechargeUpdateRequestSchema = external_exports.object({
   threshold: external_exports.number().int().positive().optional(),
   amount: external_exports.number().int().min(1e3).optional()
 });
+var redeemRequestSchema = external_exports.object({
+  successUrl: external_exports.string().url(),
+  cancelUrl: external_exports.string().url()
+});
 var zeroBillingStatusContract = c34.router({
   get: {
     method: "GET",
@@ -115728,6 +115699,24 @@ var zeroBillingDowngradeContract = c34.router({
     summary: "Downgrade subscription to a lower tier"
   }
 });
+var zeroBillingRedeemContract = c34.router({
+  create: {
+    method: "POST",
+    path: "/api/zero/billing/redeem/:campaign",
+    pathParams: external_exports.object({
+      campaign: external_exports.string()
+    }),
+    headers: authHeadersSchema,
+    body: redeemRequestSchema,
+    responses: {
+      200: redeemResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Redeem a one-time campaign"
+  }
+});
 
 // ../../packages/core/src/contracts/zero-usage.ts
 init_esm_shims();
@@ -117441,6 +117430,12 @@ var FEATURE_SWITCHES = {
     maintainer: "ethan@vm0.ai",
     description: "Enable the DeepSeek-V3.2 (deepseek-chat) VM0 managed model",
     enabled: false
+  },
+  ["platformConnectors" /* PlatformConnectors */]: {
+    maintainer: "liangyou@vm0.ai",
+    description: "Gate the entire platform-managed connector UI (Enable button and POST /api/zero/platform-connectors/:type). When off, only api-token and OAuth methods surface in connectors list/search, and the enable endpoint 404s. Staff-only during rollout.",
+    enabled: false,
+    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
   }
 };
 function isFeatureEnabled(key, ctx) {
@@ -120089,4 +120084,4 @@ undici/lib/web/fetch/body.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-ZBGP4ZRV.js.map
+//# sourceMappingURL=chunk-TO65SA2M.js.map