@vm0/cli 9.145.2 → 9.145.4

package/{chunk-OXSVCIKP.js → chunk-2CIMPE42.js}

@@ -74083,7 +74083,7 @@ if (DSN) {
   init2({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.145.2",
+    release: "9.145.4",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -74102,7 +74102,7 @@ if (DSN) {
     }
   });
   setContext("cli", {
-    version: "9.145.2",
+    version: "9.145.4",
     command: process.argv.slice(2).join(" ")
   });
   setContext("runtime", {
@@ -93212,10 +93212,11 @@ var composesByIdContract = c.router({
     path: "/api/agent/composes/:id",
     headers: authHeadersSchema,
     pathParams: external_exports.object({
-      id: external_exports.string().min(1, "Compose ID is required")
+      id: external_exports.string().uuid("Compose ID must be a valid UUID")
     }),
     responses: {
       200: composeResponseSchema,
+      400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -93344,10 +93345,11 @@ var composesInstructionsContract = c.router({
     path: "/api/agent/composes/:id/instructions",
     headers: authHeadersSchema,
     pathParams: external_exports.object({
-      id: external_exports.string().min(1, "Compose ID is required")
+      id: external_exports.string().uuid("Compose ID must be a valid UUID")
     }),
     responses: {
       200: composeInstructionsResponseSchema,
+      400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -102340,6 +102342,22 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/model-providers.ts
 init_esm_shims();
+var SUPPORTED_RUN_MODELS = [
+  "claude-opus-4-7",
+  "claude-opus-4-6",
+  "claude-sonnet-4-6",
+  "gpt-5.5",
+  "gpt-5.4",
+  "deepseek-v4-pro",
+  "kimi-k2.6",
+  "kimi-k2.5",
+  "glm-5.1"
+];
+var supportedRunModelSchema = external_exports.enum(SUPPORTED_RUN_MODELS);
+var modelProviderCredentialScopeSchema = external_exports.enum(["org", "member"]);
+var SUPPORTED_RUN_MODEL_SET = new Set(
+  SUPPORTED_RUN_MODELS
+);
 var VM0_MODEL_TO_PROVIDER = {
   "claude-opus-4-7": {
     concreteType: "anthropic-api-key",
@@ -118149,6 +118167,15 @@ var resumeSessionSchema = external_exports.object({
   sessionId: external_exports.string(),
   sessionHistory: external_exports.string()
 });
+var secretConnectorMetadataSchema = external_exports.object({
+  sourceType: external_exports.enum(["connector", "model-provider"]),
+  sourceUserId: external_exports.string().optional(),
+  metadataKey: external_exports.string().optional()
+});
+var secretConnectorMetadataMapSchema = external_exports.record(
+  external_exports.string(),
+  secretConnectorMetadataSchema
+);
 var storedExecutionContextSchema = external_exports.object({
   workingDir: external_exports.string(),
   storageManifest: storageManifestSchema.nullable(),
@@ -118158,6 +118185,8 @@ var storedExecutionContextSchema = external_exports.object({
   // AES-256-GCM encrypted Record<string, string> (secret name → value)
   // Maps secret names to OAuth connector types for runtime token refresh (e.g. { "GMAIL_ACCESS_TOKEN": "gmail" })
   secretConnectorMap: external_exports.record(external_exports.string(), external_exports.string()).nullable().optional(),
+  // Per-secret refresh metadata, used when a handler needs owner-specific storage (e.g. personal model providers)
+  secretConnectorMetadataMap: secretConnectorMetadataMapSchema.nullable().optional(),
   cliAgentType: external_exports.string(),
   // Debug flag to force real Claude in mock environments (internal use only)
   debugNoMockClaude: external_exports.boolean().optional(),
@@ -118204,6 +118233,8 @@ var executionContextSchema = external_exports.object({
   encryptedSecrets: external_exports.string().nullable(),
   // Maps secret names to OAuth connector types for runtime token refresh
   secretConnectorMap: external_exports.record(external_exports.string(), external_exports.string()).nullable().optional(),
+  // Per-secret refresh metadata, used when a handler needs owner-specific storage (e.g. personal model providers)
+  secretConnectorMetadataMap: secretConnectorMetadataMapSchema.nullable().optional(),
   cliAgentType: external_exports.string(),
   // Debug flag to force real Claude in mock environments (internal use only)
   debugNoMockClaude: external_exports.boolean().optional(),
@@ -118623,10 +118654,11 @@ var zeroComposesByIdContract = c35.router({
     path: "/api/zero/composes/:id",
     headers: authHeadersSchema,
     pathParams: external_exports.object({
-      id: external_exports.string().min(1, "Compose ID is required")
+      id: external_exports.string().uuid("Compose ID must be a valid UUID")
     }),
     responses: {
       200: composeResponseSchema,
+      400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -119796,12 +119828,24 @@ var voiceChatTaskSchema = external_exports.object({
   startedAt: external_exports.string().nullable(),
   finishedAt: external_exports.string().nullable()
 });
-var tokenResponseSchema = external_exports.object({
+var legacyTokenResponseSchema = external_exports.object({
   client_secret: external_exports.object({
     value: external_exports.string(),
     expires_at: external_exports.number()
   })
 });
+var relayBootstrapResponseSchema = external_exports.object({
+  relayUrl: external_exports.url(),
+  relayToken: external_exports.string(),
+  expiresAt: external_exports.number(),
+  sessionId: external_exports.uuid(),
+  transport: external_exports.enum(["websocket"]),
+  minimumCreditsRequired: external_exports.number().int().nonnegative().optional()
+});
+var tokenResponseSchema = external_exports.union([
+  legacyTokenResponseSchema,
+  relayBootstrapResponseSchema
+]);
 var createSessionBodySchema = external_exports.object({ agentId: external_exports.uuid() });
 var appendItemBodySchema = external_exports.object({
   role: voiceChatItemRoleSchema,
@@ -119940,12 +119984,13 @@ var zeroVoiceChatContract = c54.router({
       200: tokenResponseSchema,
       400: apiErrorSchema,
       401: apiErrorSchema,
+      402: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema,
       503: apiErrorSchema
     },
-    summary: "Mint an ephemeral OpenAI realtime token for voice-chat"
+    summary: "Mint a voice-chat token. Returns either the legacy OpenAI client_secret or, when VoiceChatRealtimeBilling is ON, a VM0 relay bootstrap (relayUrl + HMAC relayToken)."
   }
 });
 
@@ -120607,6 +120652,18 @@ var FEATURE_SWITCHES = {
     description: "Enable per-user (BYOK) model providers in addition to org-level. When off: Personal tab in Preferences is hidden; personal-tier API endpoints return 404; the prefer_personal_provider checkbox on agents/schedules is hidden; the resolver ignores the flag (treats as false). Staff-only during rollout; per-user toggle via Lab.",
     enabled: false,
     enabledOrgIdHashes: STAFF_ORG_ID_HASHES
+  },
+  ["modelFirstModelProvider" /* ModelFirstModelProvider */]: {
+    maintainer: "lancy@vm0.ai",
+    description: "Gate the model-first model provider selection foundation. When off, all provider-first resolver, UI, CLI, and legacy model provider defaults remain unchanged. When on, follow-up work can use org model policies, canonical models, and member-scoped OAuth credentials.",
+    enabled: false,
+    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
+  },
+  ["voiceChatRealtimeBilling" /* VoiceChatRealtimeBilling */]: {
+    maintainer: "lancy@vm0.ai",
+    description: "Switch the voice-chat token endpoint to mint a VM0 relay-bootstrap instead of an OpenAI client_secret. When OFF, browsers receive the legacy ephemeral OpenAI token. When ON, the route runs credit + pricing admission and mints a short-lived HMAC relay token; the browser opens a WebSocket to /api/zero/voice-chat/relay (sub-issue #12139). Staff-only during rollout; operator flips per org via the feature-switch overrides API.",
+    enabled: false,
+    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
   }
 };
 function isFeatureEnabled(key, ctx) {
@@ -121987,4 +122044,4 @@ undici/lib/web/fetch/body.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-OXSVCIKP.js.map
+//# sourceMappingURL=chunk-2CIMPE42.js.map