@vm0/cli 9.156.6 → 9.156.7

package/{chunk-6YYCRDL4.js → chunk-KSOOAB7S.js}

@@ -74083,7 +74083,7 @@ if (DSN) {
   init2({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.156.6",
+    release: "9.156.7",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -74102,7 +74102,7 @@ if (DSN) {
     }
   });
   setContext("cli", {
-    version: "9.156.6",
+    version: "9.156.7",
     command: process.argv.slice(2).join(" ")
   });
   setContext("runtime", {
@@ -96608,6 +96608,7 @@ var zeroAgentsByIdContract = c15.router({
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     responses: {
       200: zeroAgentResponseSchema,
+      400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -96655,6 +96656,7 @@ var zeroAgentsByIdContract = c15.router({
     body: c15.noBody(),
     responses: {
       204: c15.noBody(),
+      400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -128459,7 +128461,12 @@ var FEATURE_SWITCHES = {
   },
   ["storedSecretKmsRead" /* StoredSecretKmsRead */]: {
     maintainer: "ethan@vm0.ai",
-    description: "Prefer AWS KMS material when reading stored-secret envelopes. Disabled keeps reading the legacy AES branch during rollout; writes still dual-write when SECRETS_KMS_KEY_ID is configured.",
+    description: "Prefer AWS KMS material when reading stored-secret envelopes. Disabled keeps reading the legacy AES branch during rollout. Read path is independent of StoredSecretKmsWrite \u2014 enable read only after dual-write has been on long enough to backfill existing rows.",
+    enabled: false
+  },
+  ["storedSecretKmsWrite" /* StoredSecretKmsWrite */]: {
+    maintainer: "ethan@vm0.ai",
+    description: "Dual-write stored-secret values to AWS KMS in addition to the legacy AES branch. When OFF, writes stay legacy-only even if SECRETS_KMS_KEY_ID is configured \u2014 this gates the KMS GenerateDataKey call so a missing IAM grant does not 500 every secret save.",
     enabled: false
   },
   ["trinity" /* Trinity */]: {
@@ -130032,4 +130039,4 @@ undici/lib/web/fetch/body.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-6YYCRDL4.js.map
+//# sourceMappingURL=chunk-KSOOAB7S.js.map