@vm0/cli 9.155.0 → 9.156.0

package/{chunk-D3OXQKM5.js → chunk-EESCNG6H.js}

@@ -74083,7 +74083,7 @@ if (DSN) {
   init2({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.155.0",
+    release: "9.156.0",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -74102,7 +74102,7 @@ if (DSN) {
     }
   });
   setContext("cli", {
-    version: "9.155.0",
+    version: "9.156.0",
     command: process.argv.slice(2).join(" ")
   });
   setContext("runtime", {
@@ -88604,7 +88604,7 @@ var RUN_ERROR_GUIDANCE = {
   NO_MODEL_PROVIDER: {
     title: "No model provider configured",
     guidance: "Configure a model provider to start running agents.",
-    cliHint: "zero org model-provider setup"
+    cliHint: "zero model-provider set --help"
   },
   INSUFFICIENT_CREDITS: {
     title: "Credits depleted",
@@ -95561,11 +95561,32 @@ var SUPPORTED_RUN_MODELS = [
   "gpt-5.4",
   "gpt-5.4-mini"
 ];
+var VM0_MODEL_CREDIT_MULTIPLIER = Object.freeze({
+  "claude-opus-4-7": 1.7,
+  "claude-opus-4-6": 1.7,
+  "claude-sonnet-4-6": 1,
+  "claude-haiku-4-5": 0.3,
+  "deepseek-v4-pro": 0.06,
+  "deepseek-v4-flash": 0.02,
+  "kimi-k2.6": 0.3,
+  "kimi-k2.5": 0.2,
+  "MiniMax-M2.7": 0.1,
+  "glm-5.1": 0.4,
+  "gpt-5.5": 2,
+  "gpt-5.4": 1,
+  "gpt-5.4-mini": 0.3
+});
 var supportedRunModelSchema = external_exports.enum(SUPPORTED_RUN_MODELS);
 var modelProviderCredentialScopeSchema = external_exports.enum(["org", "member"]);
 var SUPPORTED_RUN_MODEL_SET = new Set(
   SUPPORTED_RUN_MODELS
 );
+function isSupportedRunModel(model) {
+  return typeof model === "string" && SUPPORTED_RUN_MODEL_SET.has(model);
+}
+function getVm0ModelMultiplier(model) {
+  return isSupportedRunModel(model) ? VM0_MODEL_CREDIT_MULTIPLIER[model] : void 0;
+}
 var VM0_MODEL_TO_PROVIDER = {
   "claude-opus-4-7": {
     concreteType: "anthropic-api-key",
@@ -96462,12 +96483,60 @@ async function deleteZeroOrgModelProvider(type) {
   handleError(result, `Org model provider "${type}" not found`);
 }
 
+// src/lib/api/domains/zero-model-policies.ts
+init_esm_shims();
+
+// ../../packages/api-contracts/src/contracts/zero-model-policies.ts
+init_esm_shims();
+var c14 = initContract();
+var zeroModelPoliciesMainContract = c14.router({
+  list: {
+    method: "GET",
+    path: "/api/zero/model-policies",
+    headers: authHeadersSchema,
+    responses: {
+      200: orgModelPoliciesResponseSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "List org model-first policies"
+  },
+  update: {
+    method: "PUT",
+    path: "/api/zero/model-policies",
+    headers: authHeadersSchema,
+    body: updateOrgModelPoliciesRequestSchema,
+    responses: {
+      200: orgModelPoliciesResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Update org model-first policies"
+  }
+});
+
+// src/lib/api/domains/zero-model-policies.ts
+async function listZeroModelPolicies() {
+  const config4 = await getClientConfig();
+  const client = initClient(zeroModelPoliciesMainContract, config4);
+  const result = await client.list({ headers: {} });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, "Failed to list model policies");
+}
+
 // src/lib/api/domains/zero-agents.ts
 init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-agents.ts
 init_esm_shims();
-var c14 = initContract();
+var c15 = initContract();
 var zeroAgentVisibilitySchema = external_exports.enum(["public", "private"]);
 var zeroAgentCustomSkillNameSchema = external_exports.string().min(2).max(64).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/);
 var zeroAgentResponseSchema = external_exports.object({
@@ -96506,7 +96575,7 @@ var zeroAgentInstructionsResponseSchema = external_exports.object({
 var zeroAgentInstructionsRequestSchema = external_exports.object({
   content: external_exports.string()
 });
-var zeroAgentsMainContract = c14.router({
+var zeroAgentsMainContract = c15.router({
   create: {
     method: "POST",
     path: "/api/zero/agents",
@@ -96534,7 +96603,7 @@ var zeroAgentsMainContract = c14.router({
     summary: "List zero agents"
   }
 });
-var zeroAgentsByIdContract = c14.router({
+var zeroAgentsByIdContract = c15.router({
   get: {
     method: "GET",
     path: "/api/zero/agents/:id",
@@ -96586,9 +96655,9 @@ var zeroAgentsByIdContract = c14.router({
     path: "/api/zero/agents/:id",
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
-    body: c14.noBody(),
+    body: c15.noBody(),
     responses: {
-      204: c14.noBody(),
+      204: c15.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -96601,7 +96670,7 @@ var zeroAgentPermissionPoliciesRequestSchema = external_exports.object({
   agentId: external_exports.string().uuid(),
   policies: firewallPoliciesSchema
 });
-var zeroAgentPermissionPoliciesContract = c14.router({
+var zeroAgentPermissionPoliciesContract = c15.router({
   update: {
     method: "PUT",
     path: "/api/zero/permission-policies",
@@ -96617,7 +96686,7 @@ var zeroAgentPermissionPoliciesContract = c14.router({
     summary: "Update zero agent permission policies (owner only)"
   }
 });
-var zeroAgentInstructionsContract = c14.router({
+var zeroAgentInstructionsContract = c15.router({
   get: {
     method: "GET",
     path: "/api/zero/agents/:id/instructions",
@@ -96707,7 +96776,7 @@ var zeroAgentSkillContentResponseSchema = external_exports.object({
 var zeroAgentSkillListResponseSchema = external_exports.array(
   zeroAgentCustomSkillSchema
 );
-var zeroSkillsCollectionContract = c14.router({
+var zeroSkillsCollectionContract = c15.router({
   list: {
     method: "GET",
     path: "/api/zero/skills",
@@ -96738,7 +96807,7 @@ var zeroSkillsCollectionContract = c14.router({
     summary: "Create a custom skill in the organization"
   }
 });
-var zeroSkillsDetailContract = c14.router({
+var zeroSkillsDetailContract = c15.router({
   get: {
     method: "GET",
     path: "/api/zero/skills/:name",
@@ -96772,9 +96841,9 @@ var zeroSkillsDetailContract = c14.router({
     path: "/api/zero/skills/:name",
     headers: authHeadersSchema,
     pathParams: external_exports.object({ name: zeroAgentCustomSkillNameSchema }),
-    body: c14.noBody(),
+    body: c15.noBody(),
     responses: {
-      204: c14.noBody(),
+      204: c15.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -96817,7 +96886,7 @@ var resolvePermissionAccessRequestSchema = external_exports.object({
   requestId: external_exports.string().uuid(),
   action: external_exports.enum(["approve", "reject"])
 });
-var permissionAccessRequestsCreateContract = c14.router({
+var permissionAccessRequestsCreateContract = c15.router({
   create: {
     method: "POST",
     path: "/api/zero/permission-access-requests",
@@ -96838,7 +96907,7 @@ var permissionAccessRequestsListQuerySchema = external_exports.object({
   requestId: external_exports.string().optional(),
   status: external_exports.string().optional()
 });
-var permissionAccessRequestsListContract = c14.router({
+var permissionAccessRequestsListContract = c15.router({
   list: {
     method: "GET",
     path: "/api/zero/permission-access-requests",
@@ -96853,7 +96922,7 @@ var permissionAccessRequestsListContract = c14.router({
     summary: "List permission access requests for an agent"
   }
 });
-var permissionAccessRequestsResolveContract = c14.router({
+var permissionAccessRequestsResolveContract = c15.router({
   resolve: {
     method: "PUT",
     path: "/api/zero/permission-access-requests",
@@ -96872,11 +96941,11 @@ var permissionAccessRequestsResolveContract = c14.router({
 
 // ../../packages/api-contracts/src/contracts/user-connectors.ts
 init_esm_shims();
-var c15 = initContract();
+var c16 = initContract();
 var userConnectorEnabledTypesSchema = external_exports.object({
   enabledTypes: external_exports.array(external_exports.string())
 });
-var zeroUserConnectorsContract = c15.router({
+var zeroUserConnectorsContract = c16.router({
   get: {
     method: "GET",
     path: "/api/zero/agents/:id/user-connectors",
@@ -100144,13 +100213,14 @@ var stripe = {
       },
       "cli-auth": {
         featureFlag: "cliAuthStripe" /* CliAuthStripe */,
-        label: "Stripe CLI",
-        helpText: "Sign in with the Stripe CLI to import an API key.",
+        label: "Sign in with Stripe",
+        helpText: "Approve access in Stripe to import an API key.",
         secrets: {}
       }
     },
     defaultAuthMethod: "oauth",
     cliAuth: {
+      flow: "browser-verification",
       modes: [
         {
           value: "test",
@@ -103662,8 +103732,8 @@ var computerConnectorCreateResponseSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/zero-connectors.ts
-var c16 = initContract();
-var zeroConnectorsMainContract = c16.router({
+var c17 = initContract();
+var zeroConnectorsMainContract = c17.router({
   list: {
     method: "GET",
     path: "/api/zero/connectors",
@@ -103677,7 +103747,7 @@ var zeroConnectorsMainContract = c16.router({
     summary: "List all connectors (zero proxy)"
   }
 });
-var zeroConnectorsByTypeContract = c16.router({
+var zeroConnectorsByTypeContract = c17.router({
   get: {
     method: "GET",
     path: "/api/zero/connectors/:type",
@@ -103697,14 +103767,14 @@ var zeroConnectorsByTypeContract = c16.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ type: connectorTypeSchema }),
     responses: {
-      204: c16.noBody(),
+      204: c17.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Disconnect a connector (zero proxy)"
   }
 });
-var zeroConnectorScopeDiffContract = c16.router({
+var zeroConnectorScopeDiffContract = c17.router({
   getScopeDiff: {
     method: "GET",
     path: "/api/zero/connectors/:type/scope-diff",
@@ -103719,7 +103789,7 @@ var zeroConnectorScopeDiffContract = c16.router({
     summary: "Get scope diff for a connector"
   }
 });
-var zeroConnectorAuthorizeContract = c16.router({
+var zeroConnectorAuthorizeContract = c17.router({
   authorize: {
     method: "GET",
     path: "/api/zero/connectors/:type/authorize",
@@ -103727,9 +103797,9 @@ var zeroConnectorAuthorizeContract = c16.router({
     pathParams: external_exports.object({ type: external_exports.string() }),
     query: external_exports.object({ session: external_exports.string().optional() }),
     responses: {
-      307: c16.noBody(),
+      307: c17.noBody(),
       400: external_exports.object({ error: external_exports.string() }),
-      401: c16.noBody(),
+      401: c17.noBody(),
       500: external_exports.object({ error: external_exports.string() })
     },
     summary: "Start connector OAuth authorization (zero proxy)"
@@ -103750,7 +103820,7 @@ var connectorSearchItemSchema = external_exports.object({
 var connectorSearchResponseSchema = external_exports.object({
   connectors: external_exports.array(connectorSearchItemSchema)
 });
-var zeroConnectorsSearchContract = c16.router({
+var zeroConnectorsSearchContract = c17.router({
   search: {
     method: "GET",
     path: "/api/zero/connectors/search",
@@ -103764,7 +103834,7 @@ var zeroConnectorsSearchContract = c16.router({
     summary: "Search available connector types"
   }
 });
-var zeroConnectorSessionsContract = c16.router({
+var zeroConnectorSessionsContract = c17.router({
   create: {
     method: "POST",
     path: "/api/zero/connectors/:type/sessions",
@@ -103779,7 +103849,7 @@ var zeroConnectorSessionsContract = c16.router({
     summary: "Create connector session for device flow (zero proxy)"
   }
 });
-var zeroConnectorSessionByIdContract = c16.router({
+var zeroConnectorSessionByIdContract = c17.router({
   get: {
     method: "GET",
     path: "/api/zero/connectors/:type/sessions/:sessionId",
@@ -103797,7 +103867,7 @@ var zeroConnectorSessionByIdContract = c16.router({
     summary: "Get connector session status (zero proxy)"
   }
 });
-var zeroComputerConnectorContract = c16.router({
+var zeroComputerConnectorContract = c17.router({
   create: {
     method: "POST",
     path: "/api/zero/connectors/computer",
@@ -103828,14 +103898,14 @@ var zeroComputerConnectorContract = c16.router({
     path: "/api/zero/connectors/computer",
     headers: authHeadersSchema,
     responses: {
-      204: c16.noBody(),
+      204: c17.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete computer connector (zero proxy)"
   }
 });
-var zeroLocalAgentConnectorContract = c16.router({
+var zeroLocalAgentConnectorContract = c17.router({
   create: {
     method: "POST",
     path: "/api/zero/connectors/local-agent",
@@ -103851,7 +103921,7 @@ var zeroLocalAgentConnectorContract = c16.router({
     summary: "Connect local-agent connector"
   }
 });
-var zeroLocalBrowserConnectorContract = c16.router({
+var zeroLocalBrowserConnectorContract = c17.router({
   create: {
     method: "POST",
     path: "/api/zero/connectors/local-browser",
@@ -103913,7 +103983,7 @@ import { pipeline } from "stream/promises";
 
 // ../../packages/api-contracts/src/contracts/integrations.ts
 init_esm_shims();
-var c17 = initContract();
+var c18 = initContract();
 var sendSlackMessageBodySchema = external_exports.object({
   channel: external_exports.string().min(1, "Channel ID is required").optional(),
   user: external_exports.string().min(1, "User ID is required").optional(),
@@ -103931,7 +104001,7 @@ var sendSlackMessageResponseSchema = external_exports.object({
   ts: external_exports.string().optional(),
   channel: external_exports.string().optional()
 });
-var integrationsSlackMessageContract = c17.router({
+var integrationsSlackMessageContract = c18.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/slack/message",
@@ -103959,7 +104029,7 @@ var sendTelegramMessageResponseSchema = external_exports.object({
   messageId: external_exports.number().int(),
   chatId: external_exports.string()
 });
-var integrationsTelegramMessageContract = c17.router({
+var integrationsTelegramMessageContract = c18.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/telegram/message",
@@ -103987,7 +104057,7 @@ var sendPhoneMessageResponseSchema = external_exports.object({
   channel: external_exports.string().nullable(),
   toNumber: external_exports.string()
 });
-var integrationsPhoneMessageContract = c17.router({
+var integrationsPhoneMessageContract = c18.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/phone/message",
@@ -104007,14 +104077,14 @@ var integrationsPhoneMessageContract = c17.router({
 var phoneDownloadFileQuerySchema = external_exports.object({
   file_id: external_exports.string().min(1, "file_id query parameter is required")
 });
-var integrationsPhoneDownloadFileContract = c17.router({
+var integrationsPhoneDownloadFileContract = c18.router({
   download: {
     method: "GET",
     path: "/api/zero/integrations/phone/download-file",
     headers: authHeadersSchema,
     query: phoneDownloadFileQuerySchema,
     responses: {
-      200: c17.type(),
+      200: c18.type(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -104049,7 +104119,7 @@ var telegramBotListItemSchema = external_exports.object({
 var listTelegramBotsResponseSchema = external_exports.object({
   bots: external_exports.array(telegramBotListItemSchema)
 });
-var integrationsTelegramBotListContract = c17.router({
+var integrationsTelegramBotListContract = c18.router({
   listBots: {
     method: "GET",
     path: "/api/zero/integrations/telegram/bots",
@@ -104070,7 +104140,7 @@ var slackUploadInitResponseSchema = external_exports.object({
   uploadUrl: external_exports.string(),
   fileId: external_exports.string()
 });
-var integrationsSlackUploadInitContract = c17.router({
+var integrationsSlackUploadInitContract = c18.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/init",
@@ -104099,7 +104169,7 @@ var telegramUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsTelegramUploadInitContract = c17.router({
+var integrationsTelegramUploadInitContract = c18.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/init",
@@ -104131,7 +104201,7 @@ var telegramUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsTelegramUploadCompleteContract = c17.router({
+var integrationsTelegramUploadCompleteContract = c18.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/complete",
@@ -104161,7 +104231,7 @@ var phoneUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsPhoneUploadInitContract = c17.router({
+var integrationsPhoneUploadInitContract = c18.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/init",
@@ -104192,7 +104262,7 @@ var phoneUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsPhoneUploadCompleteContract = c17.router({
+var integrationsPhoneUploadCompleteContract = c18.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/complete",
@@ -104236,7 +104306,7 @@ var sendChatMessageResponseSchema = external_exports.object({
   threadId: external_exports.string(),
   createdAt: external_exports.string()
 });
-var integrationsChatMessageContract = c17.router({
+var integrationsChatMessageContract = c18.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/chat/message",
@@ -104252,7 +104322,7 @@ var integrationsChatMessageContract = c17.router({
     summary: "Send a message to a web chat thread"
   }
 });
-var integrationsSlackUploadCompleteContract = c17.router({
+var integrationsSlackUploadCompleteContract = c18.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/complete",
@@ -104520,7 +104590,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-schedules.ts
 init_esm_shims();
-var c18 = initContract();
+var c19 = initContract();
 var scheduleResponseSchema = external_exports.object({
   id: external_exports.string().uuid(),
   agentId: external_exports.string().uuid(),
@@ -104583,7 +104653,7 @@ var zeroDeployScheduleRequestSchema = external_exports.object({
     message: "Exactly one of 'cronExpression', 'atTime', or 'intervalSeconds' must be specified"
   }
 );
-var zeroSchedulesMainContract = c18.router({
+var zeroSchedulesMainContract = c19.router({
   deploy: {
     method: "POST",
     path: "/api/zero/schedules",
@@ -104611,7 +104681,7 @@ var zeroSchedulesMainContract = c18.router({
     summary: "List all schedules (zero proxy)"
   }
 });
-var zeroSchedulesByNameContract = c18.router({
+var zeroSchedulesByNameContract = c19.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/schedules/:name",
@@ -104623,7 +104693,7 @@ var zeroSchedulesByNameContract = c18.router({
       agentId: external_exports.string().uuid("Invalid agent ID")
     }),
     responses: {
-      204: c18.noBody(),
+      204: c19.noBody(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -104632,7 +104702,7 @@ var zeroSchedulesByNameContract = c18.router({
     summary: "Delete schedule (zero proxy)"
   }
 });
-var zeroSchedulesEnableContract = c18.router({
+var zeroSchedulesEnableContract = c19.router({
   enable: {
     method: "POST",
     path: "/api/zero/schedules/:name/enable",
@@ -104672,7 +104742,7 @@ var zeroSchedulesEnableContract = c18.router({
     summary: "Disable schedule (zero proxy)"
   }
 });
-var zeroScheduleRunContract = c18.router({
+var zeroScheduleRunContract = c19.router({
   run: {
     method: "POST",
     path: "/api/zero/schedules/run",
@@ -104798,7 +104868,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/runners.ts
 init_esm_shims();
-var c19 = initContract();
+var c20 = initContract();
 var runnerGroupSchema = external_exports.string().regex(
   /^[a-z0-9-]+\/[a-z0-9-]+$/,
   "Runner group must be in vm0/<name> format (e.g., vm0/production)"
@@ -104812,7 +104882,7 @@ var jobSchema = external_exports.object({
   checkpointId: external_exports.uuid().nullable(),
   experimentalProfile: external_exports.string().optional()
 });
-var runnersPollContract = c19.router({
+var runnersPollContract = c20.router({
   poll: {
     method: "POST",
     path: "/api/runners/poll",
@@ -104953,7 +105023,7 @@ var executionContextSchema = external_exports.object({
   billableFirewalls: external_exports.array(external_exports.string()).optional(),
   modelUsageProvider: external_exports.string().optional()
 });
-var runnersJobClaimContract = c19.router({
+var runnersJobClaimContract = c20.router({
   claim: {
     method: "POST",
     path: "/api/runners/jobs/:id/claim",
@@ -104990,7 +105060,7 @@ var heartbeatBodySchema = external_exports.object({
   heldSessions: external_exports.array(external_exports.string()),
   mode: external_exports.enum(["running", "draining", "stopping"])
 });
-var runnersHeartbeatContract = c19.router({
+var runnersHeartbeatContract = c20.router({
   heartbeat: {
     method: "POST",
     path: "/api/runners/heartbeat",
@@ -105007,17 +105077,17 @@ var runnersHeartbeatContract = c19.router({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks.ts
-var c20 = initContract();
+var c21 = initContract();
 var thirdPartyWebhookErrorSchema = external_exports.object({ error: external_exports.string() });
 var thirdPartyWebhookOkSchema = external_exports.union([
   external_exports.string(),
   external_exports.object({ message: external_exports.literal("pong") })
 ]);
-var webhookClerkContract = c20.router({
+var webhookClerkContract = c21.router({
   post: {
     method: "POST",
     path: "/api/webhooks/clerk",
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema
@@ -105025,11 +105095,11 @@ var webhookClerkContract = c20.router({
     summary: "Handle Clerk organization and user webhooks"
   }
 });
-var webhookGithubContract = c20.router({
+var webhookGithubContract = c21.router({
   post: {
     method: "POST",
     path: "/api/webhooks/github",
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -105039,11 +105109,11 @@ var webhookGithubContract = c20.router({
     summary: "Handle GitHub App webhooks"
   }
 });
-var webhookStripeContract = c20.router({
+var webhookStripeContract = c21.router({
   post: {
     method: "POST",
     path: "/api/webhooks/stripe",
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema,
@@ -105093,7 +105163,7 @@ var firewallAuthResponseSchema = external_exports.object({
   refreshedConnectors: external_exports.array(external_exports.string()),
   refreshedSecrets: external_exports.array(external_exports.string())
 });
-var webhookFirewallAuthContract = c20.router({
+var webhookFirewallAuthContract = c21.router({
   /**
    * POST /api/webhooks/agent/firewall/auth
    * Resolve firewall auth templates and refresh OAuth tokens on demand.
@@ -105128,7 +105198,7 @@ var webhookFirewallAuthContract = c20.router({
     summary: "Resolve firewall auth templates"
   }
 });
-var webhookEventsContract = c20.router({
+var webhookEventsContract = c21.router({
   /**
    * POST /api/webhooks/agent/events
    * Receive agent events from sandbox
@@ -105155,7 +105225,7 @@ var webhookEventsContract = c20.router({
     summary: "Receive agent events from sandbox"
   }
 });
-var webhookCompleteContract = c20.router({
+var webhookCompleteContract = c21.router({
   /**
    * POST /api/webhooks/agent/complete
    * Handle agent run completion (success or failure)
@@ -105192,7 +105262,7 @@ var webhookCompleteContract = c20.router({
     summary: "Handle agent run completion"
   }
 });
-var webhookCheckpointsContract = c20.router({
+var webhookCheckpointsContract = c21.router({
   /**
    * POST /api/webhooks/agent/checkpoints
    * Create a recoverable checkpoint for an agent run.
@@ -105231,7 +105301,7 @@ var webhookCheckpointsContract = c20.router({
     summary: "Create checkpoint for agent run"
   }
 });
-var webhookCheckpointsPrepareHistoryContract = c20.router({
+var webhookCheckpointsPrepareHistoryContract = c21.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/checkpoints/prepare-history",
@@ -105254,7 +105324,7 @@ var webhookCheckpointsPrepareHistoryContract = c20.router({
     summary: "Get presigned URL for uploading session history to S3"
   }
 });
-var webhookHeartbeatContract = c20.router({
+var webhookHeartbeatContract = c21.router({
   /**
    * POST /api/webhooks/agent/heartbeat
    * Receive heartbeat signals from sandbox
@@ -105278,7 +105348,7 @@ var webhookHeartbeatContract = c20.router({
     summary: "Receive heartbeat from sandbox"
   }
 });
-var webhookStoragesContract = c20.router({
+var webhookStoragesContract = c21.router({
   /**
    * POST /api/webhooks/agent/storages
    * Create a new version of a storage from sandbox
@@ -105294,7 +105364,7 @@ var webhookStoragesContract = c20.router({
     path: "/api/webhooks/agent/storages",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -105310,7 +105380,7 @@ var webhookStoragesContract = c20.router({
     summary: "Upload storage version from sandbox"
   }
 });
-var webhookStoragesIncrementalContract = c20.router({
+var webhookStoragesIncrementalContract = c21.router({
   /**
    * POST /api/webhooks/agent/storages/incremental
    * Create a new version using incremental upload
@@ -105328,7 +105398,7 @@ var webhookStoragesIncrementalContract = c20.router({
     path: "/api/webhooks/agent/storages/incremental",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -105366,7 +105436,7 @@ var sandboxOperationSchema = external_exports.object({
   success: external_exports.boolean(),
   error: external_exports.string().optional()
 });
-var webhookTelemetryContract = c20.router({
+var webhookTelemetryContract = c21.router({
   /**
    * POST /api/webhooks/agent/telemetry
    * Receive telemetry data (system log, metrics, network logs, and sandbox operations) from sandbox
@@ -105395,7 +105465,7 @@ var webhookTelemetryContract = c20.router({
     summary: "Receive telemetry data from sandbox"
   }
 });
-var webhookStoragesPrepareContract = c20.router({
+var webhookStoragesPrepareContract = c21.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/storages/prepare",
@@ -105429,7 +105499,7 @@ var webhookStoragesPrepareContract = c20.router({
     summary: "Prepare for direct S3 upload from sandbox"
   }
 });
-var webhookStoragesCommitContract = c20.router({
+var webhookStoragesCommitContract = c21.router({
   commit: {
     method: "POST",
     path: "/api/webhooks/agent/storages/commit",
@@ -105471,7 +105541,7 @@ var webhookUsageEventItemSchema = external_exports.object({
   category: external_exports.string().min(1).max(100),
   quantity: external_exports.number().int().min(0)
 }).strict();
-var webhookUsageEventContract = c20.router({
+var webhookUsageEventContract = c21.router({
   send: {
     method: "POST",
     path: "/api/webhooks/agent/usage-event",
@@ -105507,8 +105577,8 @@ var zeroRunRequestSchema = unifiedRunRequestSchema.omit({
   agentId: external_exports.string().optional(),
   modelProvider: external_exports.string().optional()
 });
-var c21 = initContract();
-var zeroRunsMainContract = c21.router({
+var c22 = initContract();
+var zeroRunsMainContract = c22.router({
   create: {
     method: "POST",
     path: "/api/zero/runs",
@@ -105527,7 +105597,7 @@ var zeroRunsMainContract = c21.router({
     summary: "Create and execute agent run (zero proxy)"
   }
 });
-var zeroRunsByIdContract = c21.router({
+var zeroRunsByIdContract = c22.router({
   getById: {
     method: "GET",
     path: "/api/zero/runs/:id",
@@ -105545,7 +105615,7 @@ var zeroRunsByIdContract = c21.router({
     summary: "Get agent run by ID (zero proxy)"
   }
 });
-var zeroRunsCancelContract = c21.router({
+var zeroRunsCancelContract = c22.router({
   cancel: {
     method: "POST",
     path: "/api/zero/runs/:id/cancel",
@@ -105564,7 +105634,7 @@ var zeroRunsCancelContract = c21.router({
     summary: "Cancel a pending or running run (zero proxy)"
   }
 });
-var zeroRunsQueueContract = c21.router({
+var zeroRunsQueueContract = c22.router({
   getQueue: {
     method: "GET",
     path: "/api/zero/runs/queue",
@@ -105577,7 +105647,7 @@ var zeroRunsQueueContract = c21.router({
     summary: "Get org run queue status (zero proxy)"
   }
 });
-var zeroRunAgentEventsContract = c21.router({
+var zeroRunAgentEventsContract = c22.router({
   getAgentEvents: {
     method: "GET",
     path: "/api/zero/runs/:id/telemetry/agent",
@@ -105639,7 +105709,7 @@ var runContextResponseSchema = external_exports.object({
   artifact: runContextArtifactSchema.nullable(),
   featureFlags: external_exports.record(external_exports.string(), external_exports.boolean()).nullable()
 });
-var zeroRunContextContract = c21.router({
+var zeroRunContextContract = c22.router({
   getContext: {
     method: "GET",
     path: "/api/zero/runs/:id/context",
@@ -105657,7 +105727,7 @@ var zeroRunContextContract = c21.router({
     summary: "Get run execution context snapshot for debugging"
   }
 });
-var zeroRunNetworkLogsContract = c21.router({
+var zeroRunNetworkLogsContract = c22.router({
   getNetworkLogs: {
     method: "GET",
     path: "/api/zero/runs/:id/network",
@@ -105683,7 +105753,7 @@ var zeroRunNetworkLogsContract = c21.router({
 var runRunnerResponseSchema = external_exports.object({
   sandboxReuseResult: sandboxReuseResultSchema.nullable()
 });
-var zeroRunRunnerContract = c21.router({
+var zeroRunRunnerContract = c22.router({
   getRunner: {
     method: "GET",
     path: "/api/zero/runs/:id/runner",
@@ -105701,7 +105771,7 @@ var zeroRunRunnerContract = c21.router({
     summary: "Get runner-level metadata for a run"
   }
 });
-var zeroLogsSearchContract = c21.router({
+var zeroLogsSearchContract = c22.router({
   searchLogs: {
     method: "GET",
     path: "/api/zero/logs/search",
@@ -105801,7 +105871,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/chat-threads.ts
 init_esm_shims();
-var c22 = initContract();
+var c23 = initContract();
 var attachFileSchema = external_exports.object({
   id: external_exports.string(),
   filename: external_exports.string(),
@@ -105966,10 +106036,9 @@ var chatThreadDetailSchema = external_exports.object({
   draftContent: external_exports.string().nullable().optional(),
   draftAttachments: external_exports.array(persistedAttachmentSchema).nullable().optional(),
   /**
-   * Per-thread model pin. Provider-first threads store modelProviderId +
-   * selectedModel together; model-first threads can store selectedModel with
-   * route metadata and a null modelProviderId. When set, the send route uses
-   * this pin instead of drifting with current defaults.
+   * Per-thread selected model pin. Provider route fields are retained for
+   * backwards-compatible responses but model-first sends re-resolve provider
+   * routing from current org policy.
    */
   modelProviderId: external_exports.string().nullable().optional(),
   modelProviderType: modelProviderTypeSchema.nullable().optional(),
@@ -105986,7 +106055,7 @@ var modelSelectionRequestSchema = external_exports.object({
   modelProviderId: external_exports.string().uuid(),
   selectedModel: external_exports.string().min(1)
 });
-var chatThreadsContract = c22.router({
+var chatThreadsContract = c23.router({
   create: {
     method: "POST",
     path: "/api/zero/chat-threads",
@@ -106022,7 +106091,7 @@ var chatThreadsContract = c22.router({
     summary: "List chat threads. When agentId is omitted, returns every thread the caller owns scoped by orgId."
   }
 });
-var chatThreadByIdContract = c22.router({
+var chatThreadByIdContract = c23.router({
   get: {
     method: "GET",
     path: "/api/zero/chat-threads/:id",
@@ -106045,7 +106114,7 @@ var chatThreadByIdContract = c22.router({
       draftAttachments: external_exports.array(persistedAttachmentSchema).nullable().optional()
     }),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -106057,21 +106126,21 @@ var chatThreadByIdContract = c22.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string() }),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete a chat thread",
-    body: c22.noBody()
+    body: c23.noBody()
   }
 });
-var chatThreadMarkReadContract = c22.router({
+var chatThreadMarkReadContract = c23.router({
   markRead: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/mark-read",
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string() }),
-    body: c22.noBody(),
+    body: c23.noBody(),
     responses: {
       200: external_exports.object({
         lastReadMessageId: external_exports.string().nullable(),
@@ -106083,37 +106152,37 @@ var chatThreadMarkReadContract = c22.router({
     summary: "Mark a chat thread as read up to the latest message"
   }
 });
-var chatThreadPinContract = c22.router({
+var chatThreadPinContract = c23.router({
   pin: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/pin",
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string() }),
-    body: c22.noBody(),
+    body: c23.noBody(),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Pin a chat thread to the top of the sidebar"
   }
 });
-var chatThreadUnpinContract = c22.router({
+var chatThreadUnpinContract = c23.router({
   unpin: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/unpin",
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string() }),
-    body: c22.noBody(),
+    body: c23.noBody(),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Remove the pin from a chat thread"
   }
 });
-var chatThreadRenameContract = c22.router({
+var chatThreadRenameContract = c23.router({
   rename: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/rename",
@@ -106121,14 +106190,14 @@ var chatThreadRenameContract = c22.router({
     pathParams: external_exports.object({ id: external_exports.string() }),
     body: external_exports.object({ title: external_exports.string().min(1) }),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Rename a chat thread (suppresses automated title generation)"
   }
 });
-var chatMessagesContract = c22.router({
+var chatMessagesContract = c23.router({
   send: {
     method: "POST",
     path: "/api/zero/chat/messages",
@@ -106257,7 +106326,7 @@ var chatSearchResponseSchema = external_exports.object({
   results: external_exports.array(chatSearchResultSchema),
   hasMore: external_exports.boolean()
 });
-var chatSearchContract = c22.router({
+var chatSearchContract = c23.router({
   search: {
     method: "GET",
     path: "/api/zero/chat/search",
@@ -106279,7 +106348,7 @@ var chatSearchContract = c22.router({
     summary: "Search chat messages within caller's org (zero proxy)"
   }
 });
-var chatThreadMessagesContract = c22.router({
+var chatThreadMessagesContract = c23.router({
   list: {
     method: "GET",
     path: "/api/zero/chat-threads/:threadId/messages",
@@ -106301,7 +106370,7 @@ var chatThreadMessagesContract = c22.router({
     summary: "Get paginated chat messages for a thread"
   }
 });
-var chatThreadArtifactsContract = c22.router({
+var chatThreadArtifactsContract = c23.router({
   list: {
     method: "GET",
     path: "/api/zero/chat-threads/:threadId/artifacts",
@@ -106451,7 +106520,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-developer-support.ts
 init_esm_shims();
-var c23 = initContract();
+var c24 = initContract();
 var developerSupportBodySchema = external_exports.object({
   title: external_exports.string().min(1, "Title is required"),
   description: external_exports.string().min(1, "Description is required"),
@@ -106463,7 +106532,7 @@ var consentCodeResponseSchema = external_exports.object({
 var submitResponseSchema = external_exports.object({
   reference: external_exports.string()
 });
-var zeroDeveloperSupportContract = c23.router({
+var zeroDeveloperSupportContract = c24.router({
   submit: {
     method: "POST",
     path: "/api/zero/developer-support",
@@ -106500,7 +106569,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-computer-use.ts
 init_esm_shims();
-var c24 = initContract();
+var c25 = initContract();
 var registerResponseSchema = external_exports.object({
   id: external_exports.string(),
   domain: external_exports.string(),
@@ -106512,12 +106581,12 @@ var hostResponseSchema = external_exports.object({
   domain: external_exports.string(),
   token: external_exports.string()
 });
-var zeroComputerUseRegisterContract = c24.router({
+var zeroComputerUseRegisterContract = c25.router({
   register: {
     method: "POST",
     path: "/api/zero/computer-use/register",
     headers: authHeadersSchema,
-    body: c24.noBody(),
+    body: c25.noBody(),
     responses: {
       200: registerResponseSchema,
       401: apiErrorSchema,
@@ -106527,14 +106596,14 @@ var zeroComputerUseRegisterContract = c24.router({
     summary: "Register a computer-use host"
   }
 });
-var zeroComputerUseUnregisterContract = c24.router({
+var zeroComputerUseUnregisterContract = c25.router({
   unregister: {
     method: "DELETE",
     path: "/api/zero/computer-use/unregister",
     headers: authHeadersSchema,
-    body: c24.noBody(),
+    body: c25.noBody(),
     responses: {
-      204: c24.noBody(),
+      204: c25.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -106542,7 +106611,7 @@ var zeroComputerUseUnregisterContract = c24.router({
     summary: "Unregister a computer-use host"
   }
 });
-var zeroComputerUseHostContract = c24.router({
+var zeroComputerUseHostContract = c25.router({
   getHost: {
     method: "GET",
     path: "/api/zero/computer-use/host",
@@ -106597,7 +106666,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/realtime.ts
 init_esm_shims();
-var c25 = initContract();
+var c26 = initContract();
 var ablyTokenRequestSchema = external_exports.object({
   keyName: external_exports.string(),
   ttl: external_exports.number().optional(),
@@ -106607,7 +106676,7 @@ var ablyTokenRequestSchema = external_exports.object({
   nonce: external_exports.string(),
   mac: external_exports.string()
 });
-var runnerRealtimeTokenContract = c25.router({
+var runnerRealtimeTokenContract = c26.router({
   /**
    * POST /api/runners/realtime/token
    * Get an Ably token to subscribe to a runner group's job notification channel
@@ -106629,7 +106698,7 @@ var runnerRealtimeTokenContract = c25.router({
     summary: "Get Ably token for runner group job notifications"
   }
 });
-var platformRealtimeTokenContract = c25.router({
+var platformRealtimeTokenContract = c26.router({
   /**
    * POST /api/zero/realtime/token
    * Get an Ably token to subscribe to the authenticated user's push channel
@@ -106649,7 +106718,7 @@ var platformRealtimeTokenContract = c25.router({
 });
 
 // ../../packages/api-contracts/src/contracts/zero-local-agent.ts
-var c26 = initContract();
+var c27 = initContract();
 var localAgentBackendSchema = external_exports.enum(["codex", "claude-code"]);
 var localAgentJobStatusSchema = external_exports.enum([
   "queued",
@@ -106752,7 +106821,7 @@ var localAgentHostStartResponseSchema = external_exports.object({
 var localAgentHostDeleteResponseSchema = external_exports.object({
   ok: external_exports.literal(true)
 });
-var zeroLocalAgentDeviceStartContract = c26.router({
+var zeroLocalAgentDeviceStartContract = c27.router({
   start: {
     method: "POST",
     path: "/api/zero/local-agent/device/start",
@@ -106767,7 +106836,7 @@ var zeroLocalAgentDeviceStartContract = c26.router({
     summary: "Start a local-agent device pairing flow"
   }
 });
-var zeroLocalAgentDevicePollContract = c26.router({
+var zeroLocalAgentDevicePollContract = c27.router({
   poll: {
     method: "POST",
     path: "/api/zero/local-agent/device/poll",
@@ -106782,7 +106851,7 @@ var zeroLocalAgentDevicePollContract = c26.router({
     summary: "Poll a local-agent device pairing flow"
   }
 });
-var zeroLocalAgentDeviceClaimContract = c26.router({
+var zeroLocalAgentDeviceClaimContract = c27.router({
   claim: {
     method: "POST",
     path: "/api/zero/local-agent/device/claim",
@@ -106801,7 +106870,7 @@ var zeroLocalAgentDeviceClaimContract = c26.router({
     summary: "Approve a local-agent device pairing flow"
   }
 });
-var zeroLocalAgentHeartbeatContract = c26.router({
+var zeroLocalAgentHeartbeatContract = c27.router({
   heartbeat: {
     method: "POST",
     path: "/api/zero/local-agent/heartbeat",
@@ -106818,7 +106887,7 @@ var zeroLocalAgentHeartbeatContract = c26.router({
     summary: "Refresh a linked local-agent host heartbeat"
   }
 });
-var zeroLocalAgentHostRealtimeContract = c26.router({
+var zeroLocalAgentHostRealtimeContract = c27.router({
   create: {
     method: "POST",
     path: "/api/zero/local-agent/host/realtime-token",
@@ -106831,7 +106900,7 @@ var zeroLocalAgentHostRealtimeContract = c26.router({
     summary: "Get Ably token for local-agent host job notifications"
   }
 });
-var zeroLocalAgentRunContract = c26.router({
+var zeroLocalAgentRunContract = c27.router({
   list: {
     method: "GET",
     path: "/api/zero/local-agent/runs",
@@ -106883,7 +106952,7 @@ var zeroLocalAgentRunContract = c26.router({
     summary: "Get a local-agent job"
   }
 });
-var zeroLocalAgentHostsContract = c26.router({
+var zeroLocalAgentHostsContract = c27.router({
   start: {
     method: "POST",
     path: "/api/zero/local-agent/hosts/start",
@@ -106920,7 +106989,7 @@ var zeroLocalAgentHostsContract = c26.router({
       hostId: external_exports.string().min(1)
     }),
     headers: authHeadersSchema,
-    body: c26.noBody(),
+    body: c27.noBody(),
     responses: {
       200: localAgentHostDeleteResponseSchema,
       401: apiErrorSchema,
@@ -106930,7 +106999,7 @@ var zeroLocalAgentHostsContract = c26.router({
     summary: "Delete a local-agent host"
   }
 });
-var zeroLocalAgentHostJobsContract = c26.router({
+var zeroLocalAgentHostJobsContract = c27.router({
   next: {
     method: "POST",
     path: "/api/zero/local-agent/host/jobs/next",
@@ -107145,7 +107214,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-local-browser.ts
 init_esm_shims();
-var c27 = initContract();
+var c28 = initContract();
 var localBrowserHostStatusSchema = external_exports.enum(["online", "offline"]);
 var localBrowserReadCommandKindSchema = external_exports.enum([
   "tabs.list",
@@ -107442,7 +107511,7 @@ var localBrowserCommandApprovalResponseSchema = external_exports.object({
   commandId: external_exports.string(),
   status: external_exports.enum(["queued", "failed"])
 });
-var zeroLocalBrowserDeviceStartContract = c27.router({
+var zeroLocalBrowserDeviceStartContract = c28.router({
   start: {
     method: "POST",
     path: "/api/zero/local-browser/device/start",
@@ -107454,7 +107523,7 @@ var zeroLocalBrowserDeviceStartContract = c27.router({
     summary: "Start a local-browser device pairing flow"
   }
 });
-var zeroLocalBrowserDevicePollContract = c27.router({
+var zeroLocalBrowserDevicePollContract = c28.router({
   poll: {
     method: "POST",
     path: "/api/zero/local-browser/device/poll",
@@ -107469,7 +107538,7 @@ var zeroLocalBrowserDevicePollContract = c27.router({
     summary: "Poll a local-browser device pairing flow"
   }
 });
-var zeroLocalBrowserDeviceClaimContract = c27.router({
+var zeroLocalBrowserDeviceClaimContract = c28.router({
   claim: {
     method: "POST",
     path: "/api/zero/local-browser/device/claim",
@@ -107488,7 +107557,7 @@ var zeroLocalBrowserDeviceClaimContract = c27.router({
     summary: "Approve a local-browser device pairing flow"
   }
 });
-var zeroLocalBrowserHeartbeatContract = c27.router({
+var zeroLocalBrowserHeartbeatContract = c28.router({
   heartbeat: {
     method: "POST",
     path: "/api/zero/local-browser/heartbeat",
@@ -107502,7 +107571,7 @@ var zeroLocalBrowserHeartbeatContract = c27.router({
     summary: "Refresh a linked local-browser host heartbeat"
   }
 });
-var zeroLocalBrowserHostRealtimeContract = c27.router({
+var zeroLocalBrowserHostRealtimeContract = c28.router({
   create: {
     method: "POST",
     path: "/api/zero/local-browser/host/realtime-token",
@@ -107515,7 +107584,7 @@ var zeroLocalBrowserHostRealtimeContract = c27.router({
     summary: "Get Ably token for local-browser command wakeups"
   }
 });
-var zeroLocalBrowserHostsContract = c27.router({
+var zeroLocalBrowserHostsContract = c28.router({
   start: {
     method: "POST",
     path: "/api/zero/local-browser/hosts/start",
@@ -107550,7 +107619,7 @@ var zeroLocalBrowserHostsContract = c27.router({
       hostId: external_exports.string().min(1)
     }),
     headers: authHeadersSchema,
-    body: c27.noBody(),
+    body: c28.noBody(),
     responses: {
       200: localBrowserHostDeleteResponseSchema,
       401: apiErrorSchema,
@@ -107560,7 +107629,7 @@ var zeroLocalBrowserHostsContract = c27.router({
     summary: "Delete a local-browser host"
   }
 });
-var zeroLocalBrowserAuditEventsContract = c27.router({
+var zeroLocalBrowserAuditEventsContract = c28.router({
   list: {
     method: "GET",
     path: "/api/zero/local-browser/audit-events",
@@ -107579,12 +107648,12 @@ var zeroLocalBrowserAuditEventsContract = c27.router({
     summary: "List local-browser write command audit events"
   }
 });
-var zeroLocalBrowserHostSelfContract = c27.router({
+var zeroLocalBrowserHostSelfContract = c28.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/local-browser/host",
     headers: authHeadersSchema,
-    body: c27.noBody(),
+    body: c28.noBody(),
     responses: {
       200: localBrowserHostDeleteResponseSchema,
       401: apiErrorSchema
@@ -107592,7 +107661,7 @@ var zeroLocalBrowserHostSelfContract = c27.router({
     summary: "Revoke the current local-browser host token"
   }
 });
-var zeroLocalBrowserCommandContract = c27.router({
+var zeroLocalBrowserCommandContract = c28.router({
   create: {
     method: "POST",
     path: "/api/zero/local-browser/commands",
@@ -107624,7 +107693,7 @@ var zeroLocalBrowserCommandContract = c27.router({
     summary: "Get a local-browser command result"
   }
 });
-var zeroLocalBrowserWriteCommandContract = c27.router({
+var zeroLocalBrowserWriteCommandContract = c28.router({
   create: {
     method: "POST",
     path: "/api/zero/local-browser/write-commands",
@@ -107641,7 +107710,7 @@ var zeroLocalBrowserWriteCommandContract = c27.router({
     summary: "Create an approved-write local-browser command"
   }
 });
-var zeroLocalBrowserCommandApprovalContract = c27.router({
+var zeroLocalBrowserCommandApprovalContract = c28.router({
   decide: {
     method: "POST",
     path: "/api/zero/local-browser/commands/:commandId/approval",
@@ -107664,7 +107733,7 @@ var zeroLocalBrowserCommandApprovalContract = c27.router({
     summary: "Approve or deny a pending local-browser write command"
   }
 });
-var zeroLocalBrowserHostCommandsContract = c27.router({
+var zeroLocalBrowserHostCommandsContract = c28.router({
   next: {
     method: "POST",
     path: "/api/zero/local-browser/host/commands/next",
@@ -122288,11 +122357,11 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/health.ts
 init_esm_shims();
-var c28 = initContract();
+var c29 = initContract();
 var healthResponseSchema = external_exports.object({
   status: external_exports.literal("ok")
 });
-var healthContract = c28.router({
+var healthContract = c29.router({
   check: {
     method: "GET",
     path: "/health",
@@ -122302,7 +122371,7 @@ var healthContract = c28.router({
     summary: "Check API health"
   }
 });
-var healthAuthContract = c28.router({
+var healthAuthContract = c29.router({
   check: {
     method: "GET",
     path: "/health/auth",
@@ -122321,40 +122390,6 @@ var healthAuthContract = c28.router({
   }
 });
 
-// ../../packages/api-contracts/src/contracts/zero-model-policies.ts
-init_esm_shims();
-var c29 = initContract();
-var zeroModelPoliciesMainContract = c29.router({
-  list: {
-    method: "GET",
-    path: "/api/zero/model-policies",
-    headers: authHeadersSchema,
-    responses: {
-      200: orgModelPoliciesResponseSchema,
-      401: apiErrorSchema,
-      403: apiErrorSchema,
-      404: apiErrorSchema,
-      500: apiErrorSchema
-    },
-    summary: "List org model-first policies"
-  },
-  update: {
-    method: "PUT",
-    path: "/api/zero/model-policies",
-    headers: authHeadersSchema,
-    body: updateOrgModelPoliciesRequestSchema,
-    responses: {
-      200: orgModelPoliciesResponseSchema,
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      403: apiErrorSchema,
-      404: apiErrorSchema,
-      500: apiErrorSchema
-    },
-    summary: "Update org model-first policies"
-  }
-});
-
 // ../../packages/api-contracts/src/contracts/zero-user-model-preference.ts
 init_esm_shims();
 var c30 = initContract();
@@ -127156,7 +127191,8 @@ var FEATURE_SWITCHES = {
   ["cliAuthStripe" /* CliAuthStripe */]: {
     maintainer: "liangyou@vm0.ai",
     description: "Gate Stripe-specific CLI auth UI and API surfaces.",
-    enabled: false
+    enabled: false,
+    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
   },
   ["posthogConnector" /* PosthogConnector */]: {
     maintainer: "ethan@vm0.ai",
@@ -128738,6 +128774,7 @@ export {
   listZeroOrgVariables,
   setZeroOrgVariable,
   deleteZeroOrgVariable,
+  getVm0ModelMultiplier,
   MODEL_PROVIDER_TYPES,
   getSelectableProviderTypes,
   hasAuthMethods,
@@ -128747,6 +128784,7 @@ export {
   listZeroOrgModelProviders,
   upsertZeroOrgModelProvider,
   deleteZeroOrgModelProvider,
+  listZeroModelPolicies,
   zeroAgentCustomSkillNameSchema,
   createZeroAgent,
   listZeroAgents,
@@ -128865,4 +128903,4 @@ undici/lib/web/fetch/body.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-D3OXQKM5.js.map
+//# sourceMappingURL=chunk-EESCNG6H.js.map