@vm0/cli 9.157.0 → 9.157.1

package/{chunk-D6CWF2IH.js → chunk-YWCHIHYE.js}

@@ -74083,7 +74083,7 @@ if (DSN) {
   init2({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.157.0",
+    release: "9.157.1",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -74102,7 +74102,7 @@ if (DSN) {
     }
   });
   setContext("cli", {
-    version: "9.157.0",
+    version: "9.157.1",
     command: process.argv.slice(2).join(" ")
   });
   setContext("runtime", {
@@ -74475,8 +74475,8 @@ var FEATURE_SWITCHES = {
   },
   ["storedSecretKmsRead" /* StoredSecretKmsRead */]: {
     maintainer: "ethan@vm0.ai",
-    description: "Prefer AWS KMS material when reading stored-secret envelopes. Disabled keeps reading the legacy AES branch during rollout. Read path is independent of StoredSecretKmsWrite \u2014 enable read only after dual-write has been on long enough to backfill existing rows.",
-    enabled: false
+    description: "Prefer AWS KMS material when reading stored-secret envelopes. Legacy AES remains as a fallback for old or explicitly legacy-only rows.",
+    enabled: true
   },
   ["storedSecretKmsWrite" /* StoredSecretKmsWrite */]: {
     maintainer: "ethan@vm0.ai",
@@ -97460,6 +97460,13 @@ var github = {
     oauth: {
       authorizationUrl: "https://github.com/login/oauth/authorize",
       tokenUrl: "https://github.com/login/oauth/access_token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "GH_OAUTH_CLIENT_ID",
+        clientSecretEnv: "GH_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["repo", "project", "workflow"]
     }
   }
@@ -97496,6 +97503,13 @@ var gmail = {
     oauth: {
       authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "GOOGLE_OAUTH_CLIENT_ID",
+        clientSecretEnv: "GOOGLE_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["https://www.googleapis.com/auth/gmail.modify"]
     }
   }
@@ -97532,6 +97546,13 @@ var notion = {
     oauth: {
       authorizationUrl: "https://api.notion.com/v1/oauth/authorize",
       tokenUrl: "https://api.notion.com/v1/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        clientIdEnv: "NOTION_OAUTH_CLIENT_ID",
+        clientSecretEnv: "NOTION_OAUTH_CLIENT_SECRET"
+      },
       scopes: []
     }
   }
@@ -97567,6 +97588,13 @@ var x = {
     oauth: {
       authorizationUrl: "https://twitter.com/i/oauth2/authorize",
       tokenUrl: "https://api.twitter.com/2/oauth2/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        clientIdEnv: "X_OAUTH_CLIENT_ID",
+        clientSecretEnv: "X_OAUTH_CLIENT_SECRET"
+      },
       // https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code
       scopes: [
         "tweet.read",
@@ -97648,6 +97676,13 @@ var googleDrive = {
     oauth: {
       authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "GOOGLE_OAUTH_CLIENT_ID",
+        clientSecretEnv: "GOOGLE_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "https://www.googleapis.com/auth/drive",
         "https://www.googleapis.com/auth/userinfo.email"
@@ -97683,6 +97718,13 @@ var slack = {
     oauth: {
       authorizationUrl: "https://slack.com/oauth/v2/authorize",
       tokenUrl: "https://slack.com/api/oauth.v2.access",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "SLACK_CLIENT_ID",
+        clientSecretEnv: "SLACK_CLIENT_SECRET"
+      },
       // Note: Slack does not approve `search:read` or user `*:history`
       // scopes outside of RTS / MCP applications. The personal connector
       // intentionally omits them. Bot-side history access is provided
@@ -97756,6 +97798,13 @@ var googleSheets = {
     oauth: {
       authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "GOOGLE_OAUTH_CLIENT_ID",
+        clientSecretEnv: "GOOGLE_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "https://www.googleapis.com/auth/spreadsheets",
         "https://www.googleapis.com/auth/userinfo.email"
@@ -97795,6 +97844,13 @@ var googleCalendar = {
     oauth: {
       authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "GOOGLE_OAUTH_CLIENT_ID",
+        clientSecretEnv: "GOOGLE_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "https://www.googleapis.com/auth/calendar",
         "https://www.googleapis.com/auth/userinfo.email"
@@ -97833,6 +97889,13 @@ var googleDocs = {
     oauth: {
       authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "GOOGLE_OAUTH_CLIENT_ID",
+        clientSecretEnv: "GOOGLE_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "https://www.googleapis.com/auth/documents",
         "https://www.googleapis.com/auth/userinfo.email"
@@ -97872,6 +97935,13 @@ var linear = {
     oauth: {
       authorizationUrl: "https://linear.app/oauth/authorize",
       tokenUrl: "https://api.linear.app/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "LINEAR_OAUTH_CLIENT_ID",
+        clientSecretEnv: "LINEAR_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "read",
         "write",
@@ -97909,6 +97979,13 @@ var intervalsIcu = {
     oauth: {
       authorizationUrl: "https://intervals.icu/oauth/authorize",
       tokenUrl: "https://intervals.icu/api/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "INTERVALS_ICU_OAUTH_CLIENT_ID",
+        clientSecretEnv: "INTERVALS_ICU_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["ACTIVITY", "WELLNESS", "CALENDAR", "SETTINGS", "LIBRARY"]
     }
   }
@@ -97939,6 +98016,13 @@ var vercel = {
     defaultAuthMethod: "oauth",
     oauth: {
       tokenUrl: "https://api.vercel.com/v2/oauth/access_token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "VERCEL_OAUTH_CLIENT_ID",
+        clientSecretEnv: "VERCEL_OAUTH_CLIENT_SECRET"
+      },
       scopes: []
     }
   }
@@ -97974,6 +98058,13 @@ var strava = {
     oauth: {
       authorizationUrl: "https://www.strava.com/oauth/authorize",
       tokenUrl: "https://www.strava.com/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "STRAVA_OAUTH_CLIENT_ID",
+        clientSecretEnv: "STRAVA_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "read",
         "profile:read_all",
@@ -98014,6 +98105,13 @@ var googleMeet = {
     oauth: {
       authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "GOOGLE_OAUTH_CLIENT_ID",
+        clientSecretEnv: "GOOGLE_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "https://www.googleapis.com/auth/meetings.space.created",
         // Use meetings.space.readonly (not meetings.conferencerecords.readonly) — confirmed
@@ -98057,6 +98155,13 @@ var hubspot = {
     oauth: {
       authorizationUrl: "https://app.hubspot.com/oauth/authorize",
       tokenUrl: "https://api.hubapi.com/oauth/v1/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "HUBSPOT_OAUTH_CLIENT_ID",
+        clientSecretEnv: "HUBSPOT_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "crm.objects.contacts.read",
         "crm.objects.contacts.write",
@@ -98125,6 +98230,13 @@ var sentry = {
     oauth: {
       authorizationUrl: "https://sentry.io/oauth/authorize/",
       tokenUrl: "https://sentry.io/oauth/token/",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "SENTRY_OAUTH_CLIENT_ID",
+        clientSecretEnv: "SENTRY_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "org:read",
         "project:read",
@@ -98163,6 +98275,13 @@ var todoist = {
     oauth: {
       authorizationUrl: "https://todoist.com/oauth/authorize",
       tokenUrl: "https://todoist.com/oauth/access_token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "TODOIST_OAUTH_CLIENT_ID",
+        clientSecretEnv: "TODOIST_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["data:read_write", "data:delete", "project:delete"]
     }
   }
@@ -98198,6 +98317,13 @@ var xero = {
     oauth: {
       authorizationUrl: "https://login.xero.com/identity/connect/authorize",
       tokenUrl: "https://identity.xero.com/connect/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "XERO_OAUTH_CLIENT_ID",
+        clientSecretEnv: "XERO_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "openid",
         "profile",
@@ -98256,6 +98382,13 @@ var airtable = {
     oauth: {
       authorizationUrl: "https://airtable.com/oauth2/v1/authorize",
       tokenUrl: "https://airtable.com/oauth2/v1/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        clientIdEnv: "AIRTABLE_OAUTH_CLIENT_ID",
+        clientSecretEnv: "AIRTABLE_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "data.records:read",
         "data.records:write",
@@ -98300,6 +98433,13 @@ var docusign = {
     oauth: {
       authorizationUrl: "https://account-d.docusign.com/oauth/auth",
       tokenUrl: "https://account-d.docusign.com/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        clientIdEnv: "DOCUSIGN_OAUTH_CLIENT_ID",
+        clientSecretEnv: "DOCUSIGN_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["signature", "extended", "openid"]
     }
   }
@@ -98337,6 +98477,13 @@ var googleAds = {
     oauth: {
       authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "GOOGLE_OAUTH_CLIENT_ID",
+        clientSecretEnv: "GOOGLE_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "https://www.googleapis.com/auth/adwords",
         "https://www.googleapis.com/auth/userinfo.email"
@@ -98410,6 +98557,13 @@ var gumroad = {
     oauth: {
       authorizationUrl: "https://gumroad.com/oauth/authorize",
       tokenUrl: "https://gumroad.com/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "GUMROAD_OAUTH_CLIENT_ID",
+        clientSecretEnv: "GUMROAD_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "view_profile",
         "edit_products",
@@ -98452,6 +98606,13 @@ var spotify = {
     oauth: {
       authorizationUrl: "https://accounts.spotify.com/authorize",
       tokenUrl: "https://accounts.spotify.com/api/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        clientIdEnv: "SPOTIFY_OAUTH_CLIENT_ID",
+        clientSecretEnv: "SPOTIFY_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "ugc-image-upload",
         "user-read-playback-state",
@@ -98593,6 +98754,13 @@ var ahrefs = {
     oauth: {
       authorizationUrl: "https://app.ahrefs.com/api/auth",
       tokenUrl: "https://app.ahrefs.com/api/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "AHREFS_OAUTH_CLIENT_ID",
+        clientSecretEnv: "AHREFS_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["api"]
     }
   }
@@ -98778,6 +98946,13 @@ var asana = {
     oauth: {
       authorizationUrl: "https://app.asana.com/-/oauth_authorize",
       tokenUrl: "https://app.asana.com/-/oauth_token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "ASANA_OAUTH_CLIENT_ID",
+        clientSecretEnv: "ASANA_OAUTH_CLIENT_SECRET"
+      },
       scopes: []
     }
   }
@@ -99363,6 +99538,13 @@ var canva = {
     oauth: {
       authorizationUrl: "https://www.canva.com/api/oauth/authorize",
       tokenUrl: "https://api.canva.com/rest/v1/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        clientIdEnv: "CANVA_OAUTH_CLIENT_ID",
+        clientSecretEnv: "CANVA_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "asset:read",
         "asset:write",
@@ -99551,6 +99733,13 @@ var close2 = {
     oauth: {
       authorizationUrl: "https://app.close.com/oauth2/authorize/",
       tokenUrl: "https://api.close.com/oauth2/token/",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "CLOSE_OAUTH_CLIENT_ID",
+        clientSecretEnv: "CLOSE_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["all.full_access", "offline_access"]
     }
   }
@@ -99809,6 +99998,13 @@ var deel = {
     oauth: {
       authorizationUrl: "https://app.deel.com/oauth2/authorize",
       tokenUrl: "https://app.deel.com/oauth2/tokens",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        clientIdEnv: "DEEL_OAUTH_CLIENT_ID",
+        clientSecretEnv: "DEEL_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "contracts:read",
         "people:read",
@@ -100111,6 +100307,13 @@ var dropbox = {
     oauth: {
       authorizationUrl: "https://www.dropbox.com/oauth2/authorize",
       tokenUrl: "https://api.dropboxapi.com/oauth2/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "DROPBOX_OAUTH_CLIENT_ID",
+        clientSecretEnv: "DROPBOX_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "account_info.read",
         "files.metadata.read",
@@ -100416,6 +100619,13 @@ var figma = {
     oauth: {
       authorizationUrl: "https://www.figma.com/oauth",
       tokenUrl: "https://api.figma.com/v1/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        clientIdEnv: "FIGMA_OAUTH_CLIENT_ID",
+        clientSecretEnv: "FIGMA_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "current_user:read",
         "file_content:read",
@@ -100577,6 +100787,13 @@ var garminConnect = {
     oauth: {
       authorizationUrl: "https://connect.garmin.com/oauth2Confirm",
       tokenUrl: "https://diauth.garmin.com/di-oauth2-service/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "GARMIN_CONNECT_OAUTH_CLIENT_ID",
+        clientSecretEnv: "GARMIN_CONNECT_OAUTH_CLIENT_SECRET"
+      },
       scopes: []
     }
   }
@@ -101525,6 +101742,13 @@ var mailchimp = {
     oauth: {
       authorizationUrl: "https://login.mailchimp.com/oauth2/authorize",
       tokenUrl: "https://login.mailchimp.com/oauth2/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "MAILCHIMP_OAUTH_CLIENT_ID",
+        clientSecretEnv: "MAILCHIMP_OAUTH_CLIENT_SECRET"
+      },
       scopes: []
     }
   }
@@ -101736,6 +101960,13 @@ var mercury = {
     oauth: {
       authorizationUrl: "https://oauth2.mercury.com/oauth2/auth",
       tokenUrl: "https://oauth2.mercury.com/oauth2/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "MERCURY_OAUTH_CLIENT_ID",
+        clientSecretEnv: "MERCURY_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["offline_access"]
     }
   }
@@ -101768,6 +101999,13 @@ var metaAds = {
     oauth: {
       authorizationUrl: "https://www.facebook.com/v22.0/dialog/oauth",
       tokenUrl: "https://graph.facebook.com/v22.0/oauth/access_token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "META_ADS_OAUTH_CLIENT_ID",
+        clientSecretEnv: "META_ADS_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["ads_management", "ads_read", "business_management"]
     }
   }
@@ -101971,6 +102209,13 @@ var monday = {
     oauth: {
       authorizationUrl: "https://auth.monday.com/oauth2/authorize",
       tokenUrl: "https://auth.monday.com/oauth2/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "MONDAY_OAUTH_CLIENT_ID",
+        clientSecretEnv: "MONDAY_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "me:read",
         "boards:read",
@@ -102128,6 +102373,13 @@ var neon = {
     oauth: {
       authorizationUrl: "https://oauth2.neon.tech/oauth2/auth",
       tokenUrl: "https://oauth2.neon.tech/oauth2/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "NEON_OAUTH_CLIENT_ID",
+        clientSecretEnv: "NEON_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "openid",
         "offline_access",
@@ -102312,6 +102564,13 @@ var outlookCalendar = {
     oauth: {
       authorizationUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
       tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "MICROSOFT_OAUTH_CLIENT_ID",
+        clientSecretEnv: "MICROSOFT_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["Calendars.ReadWrite", "User.Read", "offline_access"]
     }
   }
@@ -102348,6 +102607,13 @@ var outlookMail = {
     oauth: {
       authorizationUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
       tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "MICROSOFT_OAUTH_CLIENT_ID",
+        clientSecretEnv: "MICROSOFT_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["Mail.ReadWrite", "Mail.Send", "User.Read", "offline_access"]
     }
   }
@@ -102695,6 +102961,13 @@ var posthog = {
     oauth: {
       authorizationUrl: "https://us.posthog.com/oauth/authorize",
       tokenUrl: "https://us.posthog.com/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "POSTHOG_OAUTH_CLIENT_ID",
+        clientSecretEnv: "POSTHOG_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "openid",
         "profile",
@@ -102992,6 +103265,13 @@ var reddit = {
     oauth: {
       authorizationUrl: "https://www.reddit.com/api/v1/authorize",
       tokenUrl: "https://www.reddit.com/api/v1/access_token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        clientIdEnv: "REDDIT_OAUTH_CLIENT_ID",
+        clientSecretEnv: "REDDIT_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["identity", "read"]
     }
   }
@@ -103742,6 +104022,13 @@ var stripe = {
     oauth: {
       authorizationUrl: "https://connect.stripe.com/oauth/authorize",
       tokenUrl: "https://connect.stripe.com/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "STRIPE_OAUTH_CLIENT_ID",
+        clientSecretEnv: "STRIPE_OAUTH_CLIENT_SECRET"
+      },
       scopes: ["read_write"]
     }
   }
@@ -103789,6 +104076,13 @@ var supabase = {
     oauth: {
       authorizationUrl: "https://api.supabase.com/v1/oauth/authorize",
       tokenUrl: "https://api.supabase.com/v1/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        clientIdEnv: "SUPABASE_OAUTH_CLIENT_ID",
+        clientSecretEnv: "SUPABASE_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "organizations:read",
         "projects:read",
@@ -103920,6 +104214,13 @@ var testOauth = {
       // the preview-URL host changes per deploy.
       authorizationUrl: "/api/test/oauth-provider/authorize",
       tokenUrl: "/api/test/oauth-provider/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientId: "test-oauth-client",
+        clientSecret: "test-oauth-secret"
+      },
       scopes: ["read"]
     }
   }
@@ -104199,6 +104500,13 @@ var webflow = {
     oauth: {
       authorizationUrl: "https://webflow.com/oauth/authorize",
       tokenUrl: "https://api.webflow.com/oauth/access_token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_post",
+        clientIdEnv: "WEBFLOW_OAUTH_CLIENT_ID",
+        clientSecretEnv: "WEBFLOW_OAUTH_CLIENT_SECRET"
+      },
       scopes: [
         "authorized_user:read",
         "sites:read",
@@ -104504,6 +104812,13 @@ var zoom = {
     oauth: {
       authorizationUrl: "https://zoom.us/oauth/authorize",
       tokenUrl: "https://zoom.us/oauth/token",
+      client: {
+        clientRegistration: "static",
+        clientType: "confidential",
+        tokenEndpointAuthMethod: "client_secret_basic",
+        clientIdEnv: "ZOOM_OAUTH_CLIENT_ID",
+        clientSecretEnv: "ZOOM_OAUTH_CLIENT_SECRET"
+      },
       // Granular scopes (Zoom's "resource:action:target" format). Covers the
       // core read/write flows documented in the zoom skill: users, meetings,
       // past-meeting data, cloud recordings, and webinars.
@@ -105945,6 +106260,8 @@ init_esm_shims();
 // ../../packages/api-contracts/src/contracts/runners.ts
 init_esm_shims();
 var c20 = initContract();
+var MIN_EPOCH_MS_TIMESTAMP = 1e12;
+var apiStartTimeSchema = external_exports.number().int().min(MIN_EPOCH_MS_TIMESTAMP);
 var runnerGroupSchema = external_exports.string().regex(
   /^[a-z0-9-]+\/[a-z0-9-]+$/,
   "Runner group must be in vm0/<name> format (e.g., vm0/production)"
@@ -106030,8 +106347,8 @@ var storedExecutionContextSchema = external_exports.object({
   debugNoMockCodex: external_exports.boolean().optional(),
   // Capture HTTP request headers, request bodies, and response bodies in network logs
   captureNetworkBodies: external_exports.boolean().optional(),
-  // Dispatch timestamp for E2E timing metrics
-  apiStartTime: external_exports.number().optional(),
+  // Dispatch timestamp for E2E timing metrics, as Unix epoch milliseconds
+  apiStartTime: apiStartTimeSchema.optional(),
   // User's timezone preference (IANA format, e.g., "Asia/Shanghai")
   userTimezone: external_exports.string().optional(),
   // Firewall for proxy-side token replacement (complete config, all permissions)
@@ -106078,8 +106395,8 @@ var executionContextSchema = external_exports.object({
   debugNoMockCodex: external_exports.boolean().optional(),
   // Capture HTTP request headers, request bodies, and response bodies in network logs
   captureNetworkBodies: external_exports.boolean().optional(),
-  // Dispatch timestamp for E2E timing metrics
-  apiStartTime: external_exports.number().optional(),
+  // Dispatch timestamp for E2E timing metrics, as Unix epoch milliseconds
+  apiStartTime: apiStartTimeSchema.optional(),
   // User's timezone preference (IANA format, e.g., "Asia/Shanghai")
   userTimezone: external_exports.string().optional(),
   // Firewall for proxy-side token replacement (complete config, all permissions)
@@ -124915,16 +125232,27 @@ var healthAuthContract = c29.router({
 // ../../packages/api-contracts/src/contracts/desktop-auth.ts
 init_esm_shims();
 var c30 = initContract();
+var desktopAuthCallbackSchemes = [
+  "ai.vm0.zero.desktop",
+  "ai.vm0.zero.desktop.dev"
+];
+var defaultDesktopAuthCallbackScheme = desktopAuthCallbackSchemes[0];
+var desktopAuthCallbackSchemeSchema = external_exports.enum(
+  desktopAuthCallbackSchemes
+);
 var desktopAuthHandoffContract = c30.router({
   create: {
     method: "POST",
     path: "/api/desktop-auth/handoff",
     headers: authHeadersSchema,
-    body: external_exports.object({}).optional(),
+    body: external_exports.object({
+      callbackScheme: desktopAuthCallbackSchemeSchema.optional()
+    }).optional(),
     responses: {
       200: external_exports.object({
         callbackUrl: external_exports.string()
       }),
+      400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       500: apiErrorSchema
@@ -131279,4 +131607,4 @@ undici/lib/web/fetch/body.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-D6CWF2IH.js.map
+//# sourceMappingURL=chunk-YWCHIHYE.js.map