@vm0/cli 9.177.14 → 9.177.16

package/{chunk-FHVH4FYZ.js → chunk-BFQSUVXT.js}

@@ -74083,7 +74083,7 @@ if (DSN) {
   init2({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.177.14",
+    release: "9.177.16",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -74102,7 +74102,7 @@ if (DSN) {
     }
   });
   setContext("cli", {
-    version: "9.177.14",
+    version: "9.177.16",
     command: process.argv.slice(2).join(" ")
   });
   setContext("runtime", {
@@ -98439,8 +98439,10 @@ var googleAds = {
           tokenUrl: OAUTH_TOKEN_URL16,
           accessToken: "GOOGLE_ADS_ACCESS_TOKEN",
           refreshToken: "GOOGLE_ADS_REFRESH_TOKEN",
+          platformSecrets: ["GOOGLE_ADS_DEVELOPER_TOKEN"],
           envBindings: {
-            GOOGLE_ADS_TOKEN: "$secrets.GOOGLE_ADS_ACCESS_TOKEN"
+            GOOGLE_ADS_TOKEN: "$secrets.GOOGLE_ADS_ACCESS_TOKEN",
+            GOOGLE_ADS_DEVELOPER_TOKEN: "$secrets.GOOGLE_ADS_DEVELOPER_TOKEN"
           }
         },
         revoke: { kind: "none" }
@@ -107377,26 +107379,6 @@ var scopeDiffResponseSchema = external_exports.object({
   currentScopes: external_exports.array(external_exports.string()),
   storedScopes: external_exports.array(external_exports.string())
 });
-var connectorSessionStatusSchema = external_exports.enum([
-  "pending",
-  "complete",
-  "expired",
-  "error"
-]);
-var connectorSessionResponseSchema = external_exports.object({
-  id: external_exports.uuid(),
-  code: external_exports.string(),
-  type: connectorTypeSchema,
-  status: connectorSessionStatusSchema,
-  verificationUrl: external_exports.string(),
-  expiresIn: external_exports.number(),
-  interval: external_exports.number(),
-  errorMessage: external_exports.string().nullable().optional()
-});
-var connectorSessionStatusResponseSchema = external_exports.object({
-  status: connectorSessionStatusSchema,
-  errorMessage: external_exports.string().nullable().optional()
-});
 var connectorOauthStartResponseSchema = external_exports.object({
   authorizationUrl: external_exports.string()
 });
@@ -107498,23 +107480,6 @@ var zeroConnectorScopeDiffContract = c15.router({
     summary: "Get scope diff for a connector"
   }
 });
-var zeroConnectorAuthorizeContract = c15.router({
-  authorize: {
-    method: "GET",
-    path: "/api/zero/connectors/:type/authorize",
-    headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: external_exports.string() }),
-    query: external_exports.object({ session: external_exports.string().optional() }),
-    responses: {
-      307: c15.noBody(),
-      400: external_exports.object({ error: external_exports.string() }),
-      401: c15.noBody(),
-      403: external_exports.object({ error: external_exports.string() }),
-      500: external_exports.object({ error: external_exports.string() })
-    },
-    summary: "Start connector OAuth authorization (zero proxy)"
-  }
-});
 var zeroConnectorOauthStartContract = c15.router({
   start: {
     method: "POST",
@@ -107612,40 +107577,6 @@ var zeroConnectorsSearchContract = c15.router({
     summary: "Search available connector types"
   }
 });
-var zeroConnectorSessionsContract = c15.router({
-  create: {
-    method: "POST",
-    path: "/api/zero/connectors/:type/sessions",
-    headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorTypeSchema }),
-    body: external_exports.object({ authMethod: connectorAuthMethodIdSchema }),
-    responses: {
-      200: connectorSessionResponseSchema,
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      403: apiErrorSchema
-    },
-    summary: "Create connector session for auth-code handoff"
-  }
-});
-var zeroConnectorSessionByIdContract = c15.router({
-  get: {
-    method: "GET",
-    path: "/api/zero/connectors/:type/sessions/:sessionId",
-    headers: authHeadersSchema,
-    pathParams: external_exports.object({
-      type: connectorTypeSchema,
-      sessionId: external_exports.uuid()
-    }),
-    responses: {
-      200: connectorSessionStatusResponseSchema,
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      404: apiErrorSchema
-    },
-    summary: "Get connector session status (zero proxy)"
-  }
-});
 
 // src/lib/api/domains/zero-connectors.ts
 async function listZeroConnectors() {
@@ -109662,14 +109593,19 @@ var chatThreadsContract = c21.router({
     summary: "List chat threads. When agentId is omitted, returns every thread the caller owns scoped by orgId. Pinned threads are returned in full for the caller's org on the first page; non-pinned threads are cursor-paginated."
   }
 });
+var chatThreadIdPathParamsSchema = external_exports.object({ id: external_exports.string().uuid() });
+var chatThreadThreadIdPathParamsSchema = external_exports.object({
+  threadId: external_exports.string().uuid()
+});
 var chatThreadByIdContract = c21.router({
   get: {
     method: "GET",
     path: "/api/zero/chat-threads/:id",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ id: external_exports.string() }),
+    pathParams: chatThreadIdPathParamsSchema,
     responses: {
       200: chatThreadDetailSchema,
+      400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -109679,13 +109615,14 @@ var chatThreadByIdContract = c21.router({
     method: "PATCH",
     path: "/api/zero/chat-threads/:id",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ id: external_exports.string() }),
+    pathParams: chatThreadIdPathParamsSchema,
     body: external_exports.object({
       draftContent: external_exports.string().nullable().optional(),
       draftAttachments: external_exports.array(persistedAttachmentSchema).nullable().optional()
     }),
     responses: {
       204: c21.noBody(),
+      400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -109695,9 +109632,10 @@ var chatThreadByIdContract = c21.router({
     method: "DELETE",
     path: "/api/zero/chat-threads/:id",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ id: external_exports.string() }),
+    pathParams: chatThreadIdPathParamsSchema,
     responses: {
       204: c21.noBody(),
+      400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -109710,13 +109648,14 @@ var chatThreadMarkReadContract = c21.router({
     method: "POST",
     path: "/api/zero/chat-threads/:id/mark-read",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ id: external_exports.string() }),
+    pathParams: chatThreadIdPathParamsSchema,
     body: c21.noBody(),
     responses: {
       200: external_exports.object({
         lastReadMessageId: external_exports.string().nullable(),
         changed: external_exports.boolean()
       }),
+      400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -109728,10 +109667,11 @@ var chatThreadPinContract = c21.router({
     method: "POST",
     path: "/api/zero/chat-threads/:id/pin",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ id: external_exports.string() }),
+    pathParams: chatThreadIdPathParamsSchema,
     body: c21.noBody(),
     responses: {
       204: c21.noBody(),
+      400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -109743,10 +109683,11 @@ var chatThreadUnpinContract = c21.router({
     method: "POST",
     path: "/api/zero/chat-threads/:id/unpin",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ id: external_exports.string() }),
+    pathParams: chatThreadIdPathParamsSchema,
     body: c21.noBody(),
     responses: {
       204: c21.noBody(),
+      400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -109758,10 +109699,11 @@ var chatThreadRenameContract = c21.router({
     method: "POST",
     path: "/api/zero/chat-threads/:id/rename",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ id: external_exports.string() }),
+    pathParams: chatThreadIdPathParamsSchema,
     body: external_exports.object({ title: external_exports.string().min(1) }),
     responses: {
       204: c21.noBody(),
+      400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -109914,7 +109856,7 @@ var chatThreadMessagesContract = c21.router({
     method: "GET",
     path: "/api/zero/chat-threads/:threadId/messages",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ threadId: external_exports.string() }),
+    pathParams: chatThreadThreadIdPathParamsSchema,
     query: external_exports.object({
       sinceId: external_exports.string().uuid().optional(),
       beforeId: external_exports.string().uuid().optional(),
@@ -109925,6 +109867,7 @@ var chatThreadMessagesContract = c21.router({
         messages: external_exports.array(pagedChatMessageSchema),
         hasHistoryBefore: external_exports.boolean().optional()
       }),
+      400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -109936,11 +109879,12 @@ var chatThreadArtifactsContract = c21.router({
     method: "GET",
     path: "/api/zero/chat-threads/:threadId/artifacts",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ threadId: external_exports.string() }),
+    pathParams: chatThreadThreadIdPathParamsSchema,
     responses: {
       200: external_exports.object({
         runs: external_exports.array(chatThreadArtifactRunSchema)
       }),
+      400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -109951,7 +109895,7 @@ var chatThreadArtifactsContract = c21.router({
     method: "POST",
     path: "/api/zero/chat-threads/:threadId/artifacts",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ threadId: external_exports.string() }),
+    pathParams: chatThreadThreadIdPathParamsSchema,
     body: external_exports.object({
       runId: external_exports.string(),
       fileId: external_exports.string()
@@ -116086,26 +116030,12 @@ var vercelFirewall = {
 
 // ../../packages/connectors/src/connector-utils.ts
 init_esm_shims();
-
-// ../../packages/connectors/src/auth-providers/oauth/google-connectors.ts
-init_esm_shims();
-var GOOGLE_OAUTH_CONNECTOR_TYPES = [
-  "gmail",
-  "google-ads",
-  "google-calendar",
-  "google-docs",
-  "google-drive",
-  "google-meet",
-  "google-sheets"
-];
-var GOOGLE_OAUTH_CONNECTOR_TYPE_SET = new Set(GOOGLE_OAUTH_CONNECTOR_TYPES);
-
-// ../../packages/connectors/src/connector-utils.ts
 var CONNECTOR_AUTH_METHOD_PRIORITY = {
   oauth: 0,
   "api-token": 1,
   api: 2
 };
+var CONNECTOR_SECRET_REF_PREFIX = "$secrets.";
 function connectorAuthMethodPriority(authMethod) {
   return CONNECTOR_AUTH_METHOD_PRIORITY[authMethod];
 }
@@ -116142,6 +116072,32 @@ function connectorAccessEnvBindings(access) {
       return {};
   }
 }
+function connectorAccessPlatformSecrets(access) {
+  switch (access.kind) {
+    case "static":
+    case "refresh-token":
+      return access.platformSecrets ?? [];
+    case "none":
+      return [];
+  }
+}
+function connectorOwnedAccessSecretBindingEntries(args) {
+  const platformSecretNames = new Set(
+    args.platformSecrets
+  );
+  const entries = [];
+  for (const [envName, valueRef] of Object.entries(args.envBindings)) {
+    if (!valueRef.startsWith(CONNECTOR_SECRET_REF_PREFIX)) {
+      continue;
+    }
+    const secretName = valueRef.slice(CONNECTOR_SECRET_REF_PREFIX.length);
+    if (platformSecretNames.has(secretName)) {
+      continue;
+    }
+    entries.push({ envName, secretName });
+  }
+  return entries;
+}
 function connectorGrantScopes(grant) {
   switch (grant?.kind) {
     case "auth-code":
@@ -116162,7 +116118,7 @@ function getConnectorGenerationTypes(type) {
   const config4 = CONNECTOR_TYPES[type];
   return "generation" in config4 ? config4.generation ?? [] : [];
 }
-function connectorMethodSecretNames(method) {
+function connectorMethodOwnedSecretNames(method) {
   if (!method) {
     return [];
   }
@@ -116173,17 +116129,22 @@ function connectorMethodSecretNames(method) {
       names.add(name);
     }
   }
-  for (const valueRef of Object.values(
-    connectorAccessEnvBindings(method.access)
-  )) {
-    if (valueRef.startsWith("$secrets.")) {
-      names.add(valueRef.slice("$secrets.".length));
-    }
+  for (const { secretName } of connectorOwnedAccessSecretBindingEntries({
+    envBindings: connectorAccessEnvBindings(method.access),
+    platformSecrets: connectorAccessPlatformSecrets(method.access)
+  })) {
+    names.add(secretName);
   }
   if (method.access.kind === "refresh-token") {
     names.add(method.access.accessToken);
     names.add(method.access.refreshToken);
   }
+  const platformSecretNames = new Set(
+    connectorAccessPlatformSecrets(method.access)
+  );
+  for (const secretName of platformSecretNames) {
+    names.delete(secretName);
+  }
   return [...names];
 }
 function getConnectorAuthMethodEnvBindings(type, authMethod) {
@@ -116205,7 +116166,7 @@ function getConnectorEnvNamesForSecret(secretName) {
   for (const type of allTypes) {
     const config4 = CONNECTOR_TYPES[type];
     const found = Object.values(config4.authMethods).some((method) => {
-      return connectorMethodSecretNames(method).includes(secretName);
+      return connectorMethodOwnedSecretNames(method).includes(secretName);
     });
     if (!found) {
       continue;
@@ -116270,7 +116231,7 @@ function getConnectorTypeForSecretName(name) {
       }
     }
     for (const method of Object.values(config4.authMethods)) {
-      if (connectorMethodSecretNames(method).includes(name)) {
+      if (connectorMethodOwnedSecretNames(method).includes(name)) {
         return type;
       }
     }
@@ -128257,30 +128218,10 @@ var emailUnsubscribeContract = c40.router({
   }
 });
 
-// ../../packages/api-contracts/src/contracts/connectors-type-authorize.ts
-init_esm_shims();
-var c41 = initContract();
-var connectorsTypeAuthorizeContract = c41.router({
-  authorize: {
-    method: "GET",
-    path: "/api/connectors/:type/authorize",
-    headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: external_exports.string() }),
-    query: external_exports.object({ session: external_exports.string().optional() }),
-    responses: {
-      307: c41.noBody(),
-      400: external_exports.object({ error: external_exports.string() }),
-      403: external_exports.object({ error: external_exports.string() }),
-      500: external_exports.object({ error: external_exports.string() })
-    },
-    summary: "Start connector OAuth authorization"
-  }
-});
-
 // ../../packages/api-contracts/src/contracts/connectors-type-callback.ts
 init_esm_shims();
-var c42 = initContract();
-var connectorsTypeCallbackContract = c42.router({
+var c41 = initContract();
+var connectorsTypeCallbackContract = c41.router({
   callback: {
     method: "GET",
     path: "/api/connectors/:type/callback",
@@ -128293,7 +128234,7 @@ var connectorsTypeCallbackContract = c42.router({
       error_description: external_exports.string().optional()
     }),
     responses: {
-      307: c42.noBody()
+      307: c41.noBody()
     },
     summary: "Complete connector OAuth authorization"
   }
@@ -128301,7 +128242,7 @@ var connectorsTypeCallbackContract = c42.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-authorize.ts
 init_esm_shims();
-var c43 = initContract();
+var c42 = initContract();
 var testOAuthProviderAuthorizeErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -128313,13 +128254,13 @@ var testOAuthProviderAuthorizeQuerySchema = external_exports.object({
   scope: external_exports.string().optional(),
   state: external_exports.string().optional()
 });
-var testOAuthProviderAuthorizeContract = c43.router({
+var testOAuthProviderAuthorizeContract = c42.router({
   authorize: {
     method: "GET",
     path: "/api/test/oauth-provider/authorize",
     query: testOAuthProviderAuthorizeQuerySchema,
     responses: {
-      302: c43.noBody(),
+      302: c42.noBody(),
       400: testOAuthProviderAuthorizeErrorSchema,
       404: external_exports.string()
     },
@@ -128329,7 +128270,7 @@ var testOAuthProviderAuthorizeContract = c43.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-echo.ts
 init_esm_shims();
-var c44 = initContract();
+var c43 = initContract();
 var testOAuthProviderEchoErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -128337,7 +128278,7 @@ var testOAuthProviderEchoResponseSchema = external_exports.object({
   authorization: external_exports.string(),
   receivedAt: external_exports.string()
 });
-var testOAuthProviderEchoContract = c44.router({
+var testOAuthProviderEchoContract = c43.router({
   echo: {
     method: "GET",
     path: "/api/test/oauth-provider/echo",
@@ -128352,7 +128293,7 @@ var testOAuthProviderEchoContract = c44.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-token.ts
 init_esm_shims();
-var c45 = initContract();
+var c44 = initContract();
 var testOAuthProviderTokenErrorSchema = external_exports.object({
   error: external_exports.string(),
   error_description: external_exports.string().optional()
@@ -128364,11 +128305,11 @@ var testOAuthProviderTokenResponseSchema = external_exports.object({
   expires_in: external_exports.number(),
   scope: external_exports.string()
 });
-var testOAuthProviderTokenContract = c45.router({
+var testOAuthProviderTokenContract = c44.router({
   token: {
     method: "POST",
     path: "/api/test/oauth-provider/token",
-    body: c45.type(),
+    body: c44.type(),
     responses: {
       200: testOAuthProviderTokenResponseSchema,
       400: testOAuthProviderTokenErrorSchema,
@@ -128381,7 +128322,7 @@ var testOAuthProviderTokenContract = c45.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-device-auth.ts
 init_esm_shims();
-var c46 = initContract();
+var c45 = initContract();
 var testOAuthProviderDeviceAuthErrorSchema = external_exports.object({
   error: external_exports.string(),
   error_description: external_exports.string().optional()
@@ -128394,11 +128335,11 @@ var testOAuthProviderDeviceAuthResponseSchema = external_exports.object({
   expires_in: external_exports.number(),
   interval: external_exports.number()
 });
-var testOAuthProviderDeviceAuthContract = c46.router({
+var testOAuthProviderDeviceAuthContract = c45.router({
   deviceAuth: {
     method: "POST",
     path: "/api/test/oauth-provider/device/code",
-    body: c46.type(),
+    body: c45.type(),
     responses: {
       200: testOAuthProviderDeviceAuthResponseSchema,
       400: testOAuthProviderDeviceAuthErrorSchema,
@@ -128411,7 +128352,7 @@ var testOAuthProviderDeviceAuthContract = c46.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-userinfo.ts
 init_esm_shims();
-var c47 = initContract();
+var c46 = initContract();
 var testOAuthProviderUserinfoErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -128420,7 +128361,7 @@ var testOAuthProviderUserinfoResponseSchema = external_exports.object({
   id: external_exports.string(),
   username: external_exports.string()
 });
-var testOAuthProviderUserinfoContract = c47.router({
+var testOAuthProviderUserinfoContract = c46.router({
   userinfo: {
     method: "GET",
     path: "/api/test/oauth-provider/userinfo",
@@ -128435,7 +128376,7 @@ var testOAuthProviderUserinfoContract = c47.router({
 
 // ../../packages/api-contracts/src/contracts/test-slack-dispatch-probe.ts
 init_esm_shims();
-var c48 = initContract();
+var c47 = initContract();
 var testSlackDispatchProbeBodySchema = external_exports.object({
   team_id: external_exports.string(),
   channel_id: external_exports.string(),
@@ -128463,7 +128404,7 @@ var testSlackDispatchProbeResponseSchema = external_exports.union([
   testSlackDispatchProbeSuccessResponseSchema,
   testSlackDispatchProbeFailureResponseSchema
 ]);
-var testSlackDispatchProbeContract = c48.router({
+var testSlackDispatchProbeContract = c47.router({
   post: {
     method: "POST",
     path: "/api/test/slack-dispatch-probe",
@@ -128479,7 +128420,7 @@ var testSlackDispatchProbeContract = c48.router({
 
 // ../../packages/api-contracts/src/contracts/test-slack-state.ts
 init_esm_shims();
-var c49 = initContract();
+var c48 = initContract();
 var testSlackStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -128564,7 +128505,7 @@ var testSlackStateResponseSchema = external_exports.object({
     })
   )
 });
-var testSlackStateContract = c49.router({
+var testSlackStateContract = c48.router({
   get: {
     method: "GET",
     path: "/api/test/slack-state",
@@ -128606,7 +128547,7 @@ var testSlackStateContract = c49.router({
 
 // ../../packages/api-contracts/src/contracts/test-slack-mock.ts
 init_esm_shims();
-var c50 = initContract();
+var c49 = initContract();
 var slackMockRequestBodySchema = external_exports.unknown().optional();
 var slackMockNotFoundSchema = external_exports.string();
 var testSlackMockOkResponseSchema = external_exports.object({
@@ -128672,7 +128613,7 @@ var testSlackMockUsersInfoResponseSchema = testSlackMockOkResponseSchema.extend(
     })
   })
 });
-var testSlackMockContract = c50.router({
+var testSlackMockContract = c49.router({
   assistantThreadsSetStatus: {
     method: "POST",
     path: "/api/test/slack-mock/assistant.threads.setStatus",
@@ -128777,7 +128718,7 @@ var testSlackMockContract = c50.router({
 
 // ../../packages/api-contracts/src/contracts/test-telegram-mock.ts
 init_esm_shims();
-var c51 = initContract();
+var c50 = initContract();
 var testTelegramMockPathParamsSchema = external_exports.object({
   botToken: external_exports.string(),
   method: external_exports.string()
@@ -128790,7 +128731,7 @@ var testTelegramMockErrorResponseSchema = external_exports.object({
   ok: external_exports.literal(false),
   description: external_exports.string()
 });
-var testTelegramMockContract = c51.router({
+var testTelegramMockContract = c50.router({
   post: {
     method: "POST",
     path: "/api/test/telegram-mock/:botToken/:method",
@@ -128806,7 +128747,7 @@ var testTelegramMockContract = c51.router({
 
 // ../../packages/api-contracts/src/contracts/test-telegram-state.ts
 init_esm_shims();
-var c52 = initContract();
+var c51 = initContract();
 var testTelegramStateQuerySchema = external_exports.object({
   bot_id: external_exports.string().optional()
 });
@@ -128848,7 +128789,7 @@ var testTelegramStateSeedResponseSchema = external_exports.object({
   user_link_id: external_exports.string().nullable(),
   default_agent_id: external_exports.string()
 });
-var testTelegramStateContract = c52.router({
+var testTelegramStateContract = c51.router({
   get: {
     method: "GET",
     path: "/api/test/telegram-state",
@@ -128886,7 +128827,7 @@ var testTelegramStateContract = c52.router({
 
 // ../../packages/api-contracts/src/contracts/internal-event-consumers.ts
 init_esm_shims();
-var c53 = initContract();
+var c52 = initContract();
 var eventConsumerHeadersSchema = external_exports.object({
   "x-vm0-signature": external_exports.string().optional(),
   "x-vm0-timestamp": external_exports.string().optional()
@@ -128906,7 +128847,7 @@ var eventConsumerPayloadSchema = external_exports.object({
 var eventConsumerUnauthorizedSchema = external_exports.object({
   error: external_exports.string()
 });
-var internalEventConsumerTelegramTypingContract = c53.router({
+var internalEventConsumerTelegramTypingContract = c52.router({
   refresh: {
     method: "POST",
     path: "/api/internal/event-consumers/telegram-typing",
@@ -128919,7 +128860,7 @@ var internalEventConsumerTelegramTypingContract = c53.router({
     summary: "Refresh Telegram typing indicators for all pending callbacks of a run"
   }
 });
-var internalEventConsumerAgentPhoneTypingContract = c53.router({
+var internalEventConsumerAgentPhoneTypingContract = c52.router({
   refresh: {
     method: "POST",
     path: "/api/internal/event-consumers/agentphone-typing",
@@ -128932,7 +128873,7 @@ var internalEventConsumerAgentPhoneTypingContract = c53.router({
     summary: "Refresh AgentPhone typing indicators for all pending iMessage callbacks of a run"
   }
 });
-var internalEventConsumerAxiomContract = c53.router({
+var internalEventConsumerAxiomContract = c52.router({
   ingest: {
     method: "POST",
     path: "/api/internal/event-consumers/axiom",
@@ -128946,7 +128887,7 @@ var internalEventConsumerAxiomContract = c53.router({
     summary: "Ingest agent run events into Axiom"
   }
 });
-var internalEventConsumerChatAssistantContract = c53.router({
+var internalEventConsumerChatAssistantContract = c52.router({
   process: {
     method: "POST",
     path: "/api/internal/event-consumers/chat-assistant",
@@ -128962,7 +128903,7 @@ var internalEventConsumerChatAssistantContract = c53.router({
 
 // ../../packages/api-contracts/src/contracts/cron.ts
 init_esm_shims();
-var c54 = initContract();
+var c53 = initContract();
 var cleanupResultSchema = external_exports.object({
   runId: external_exports.string(),
   sandboxId: external_exports.string().nullable(),
@@ -128977,7 +128918,7 @@ var cleanupResponseSchema = external_exports.object({
   exportJobsCleaned: external_exports.number(),
   exportJobsStuck: external_exports.number()
 });
-var cronCleanupSandboxesContract = c54.router({
+var cronCleanupSandboxesContract = c53.router({
   /**
    * GET /api/cron/cleanup-sandboxes
    * Cron job to cleanup sandboxes that have stopped sending heartbeats
@@ -129044,7 +128985,7 @@ var cronAggregateInsightsResponseSchema = external_exports.union([
   cronAggregateInsightsSkippedResponseSchema,
   cronAggregateInsightsAggregatedResponseSchema
 ]);
-var cronAggregateUsageContract = c54.router({
+var cronAggregateUsageContract = c53.router({
   aggregate: {
     method: "GET",
     path: "/api/cron/aggregate-usage",
@@ -129056,7 +128997,7 @@ var cronAggregateUsageContract = c54.router({
     summary: "Aggregate daily usage cache"
   }
 });
-var cronProcessUsageEventsContract = c54.router({
+var cronProcessUsageEventsContract = c53.router({
   process: {
     method: "GET",
     path: "/api/cron/process-usage-events",
@@ -129068,7 +129009,7 @@ var cronProcessUsageEventsContract = c54.router({
     summary: "Process pending usage events"
   }
 });
-var cronReconcileBillingEntitlementsContract = c54.router({
+var cronReconcileBillingEntitlementsContract = c53.router({
   reconcile: {
     method: "GET",
     path: "/api/cron/reconcile-billing-entitlements",
@@ -129080,7 +129021,7 @@ var cronReconcileBillingEntitlementsContract = c54.router({
     summary: "Reconcile billing entitlements"
   }
 });
-var cronTelegramCleanupContract = c54.router({
+var cronTelegramCleanupContract = c53.router({
   cleanup: {
     method: "GET",
     path: "/api/cron/telegram-cleanup",
@@ -129092,7 +129033,7 @@ var cronTelegramCleanupContract = c54.router({
     summary: "Delete expired Telegram messages"
   }
 });
-var cronComputerUseScreenshotCleanupContract = c54.router({
+var cronComputerUseScreenshotCleanupContract = c53.router({
   cleanup: {
     method: "GET",
     path: "/api/cron/computer-use-screenshot-cleanup",
@@ -129104,7 +129045,7 @@ var cronComputerUseScreenshotCleanupContract = c54.router({
     summary: "Delete expired desktop computer-use screenshots"
   }
 });
-var cronDrainEmailOutboxContract = c54.router({
+var cronDrainEmailOutboxContract = c53.router({
   drain: {
     method: "GET",
     path: "/api/cron/drain-email-outbox",
@@ -129116,7 +129057,7 @@ var cronDrainEmailOutboxContract = c54.router({
     summary: "Drain pending email outbox messages"
   }
 });
-var cronSyncSkillsContract = c54.router({
+var cronSyncSkillsContract = c53.router({
   sync: {
     method: "GET",
     path: "/api/cron/sync-skills",
@@ -129128,7 +129069,7 @@ var cronSyncSkillsContract = c54.router({
     summary: "Sync official skills from the skills repository"
   }
 });
-var cronExecuteSchedulesContract = c54.router({
+var cronExecuteSchedulesContract = c53.router({
   execute: {
     method: "GET",
     path: "/api/cron/execute-schedules",
@@ -129140,7 +129081,7 @@ var cronExecuteSchedulesContract = c54.router({
     summary: "Execute due schedules"
   }
 });
-var cronAggregateInsightsContract = c54.router({
+var cronAggregateInsightsContract = c53.router({
   aggregate: {
     method: "GET",
     path: "/api/cron/aggregate-insights",
@@ -129155,7 +129096,7 @@ var cronAggregateInsightsContract = c54.router({
 
 // ../../packages/api-contracts/src/contracts/chat-threads-v1.ts
 init_esm_shims();
-var c55 = initContract();
+var c54 = initContract();
 var v1ThreadSchema = external_exports.object({
   id: external_exports.string(),
   title: external_exports.string().nullable(),
@@ -129169,7 +129110,7 @@ var v1MessageSchema = external_exports.object({
   error: external_exports.string().optional(),
   createdAt: external_exports.string()
 });
-var chatThreadV1GetContract = c55.router({
+var chatThreadV1GetContract = c54.router({
   get: {
     method: "GET",
     path: "/api/v1/chat-threads/:threadId",
@@ -129184,7 +129125,7 @@ var chatThreadV1GetContract = c55.router({
     summary: "Get a chat thread"
   }
 });
-var chatThreadV1MessagesContract = c55.router({
+var chatThreadV1MessagesContract = c54.router({
   list: {
     method: "GET",
     path: "/api/v1/chat-threads/:threadId/messages",
@@ -129204,7 +129145,7 @@ var chatThreadV1MessagesContract = c55.router({
     summary: "List messages in a chat thread"
   }
 });
-var chatThreadV1SendContract = c55.router({
+var chatThreadV1SendContract = c54.router({
   send: {
     method: "POST",
     path: "/api/v1/chat-threads/messages",
@@ -129235,7 +129176,7 @@ var chatThreadV1SendContract = c55.router({
 
 // ../../packages/api-contracts/src/contracts/device-token.ts
 init_esm_shims();
-var c56 = initContract();
+var c55 = initContract();
 var bb0DeviceCodeSchema = external_exports.string().regex(/^[A-Z2-9]{4}-[A-Z2-9]{4}$/);
 var bleSessionNonceSchema = external_exports.string().min(16).max(128).regex(/^[A-Za-z0-9._:-]+$/);
 var pollTokenSchema = external_exports.string().min(32).max(256).regex(/^[A-Za-z0-9._-]+$/);
@@ -129274,7 +129215,7 @@ var confirmBb0DeviceRequestSchema = external_exports.object({
 var confirmBb0DeviceResponseSchema = external_exports.object({
   status: external_exports.literal("approved")
 });
-var deviceTokenContract = c56.router({
+var deviceTokenContract = c55.router({
   create: {
     method: "POST",
     path: "/api/device-token",
@@ -129299,7 +129240,7 @@ var deviceTokenContract = c56.router({
     summary: "Poll a bb0 device code for approval and final credentials"
   }
 });
-var bb0DeviceConfirmContract = c56.router({
+var bb0DeviceConfirmContract = c55.router({
   confirm: {
     method: "POST",
     path: "/api/zero/devices/bb0/confirm",
@@ -129318,16 +129259,16 @@ var bb0DeviceConfirmContract = c56.router({
 
 // ../../packages/api-contracts/src/contracts/audio-transcriptions-v1.ts
 init_esm_shims();
-var c57 = initContract();
+var c56 = initContract();
 var audioTranscriptionV1Schema = external_exports.object({
   text: external_exports.string()
 });
-var audioTranscriptionsV1Contract = c57.router({
+var audioTranscriptionsV1Contract = c56.router({
   transcribe: {
     method: "POST",
     path: "/api/v1/audio/transcriptions",
     headers: authHeadersSchema,
-    body: c57.type(),
+    body: c56.type(),
     responses: {
       200: audioTranscriptionV1Schema,
       400: apiErrorSchema,
@@ -129344,7 +129285,7 @@ var audioTranscriptionsV1Contract = c57.router({
 
 // ../../packages/api-contracts/src/contracts/generate-image.ts
 init_esm_shims();
-var c58 = initContract();
+var c57 = initContract();
 var generateImageRequestSchema = external_exports.object({
   prompt: external_exports.unknown().optional()
 }).passthrough();
@@ -129355,7 +129296,7 @@ var generatedImageSchema = external_exports.object({
 var generateImageResponseSchema = external_exports.object({
   images: external_exports.array(generatedImageSchema)
 });
-var generateImageContract = c58.router({
+var generateImageContract = c57.router({
   post: {
     method: "POST",
     path: "/api/generate-image",
@@ -129375,7 +129316,7 @@ var generateImageContract = c58.router({
 
 // ../../packages/api-contracts/src/contracts/realtime.ts
 init_esm_shims();
-var c59 = initContract();
+var c58 = initContract();
 var ablyTokenRequestSchema = external_exports.object({
   keyName: external_exports.string(),
   ttl: external_exports.number().optional(),
@@ -129385,7 +129326,7 @@ var ablyTokenRequestSchema = external_exports.object({
   nonce: external_exports.string(),
   mac: external_exports.string()
 });
-var runnerRealtimeTokenContract = c59.router({
+var runnerRealtimeTokenContract = c58.router({
   /**
    * POST /api/runners/realtime/token
    * Get an Ably token to subscribe to a runner group's job notification channel
@@ -129407,7 +129348,7 @@ var runnerRealtimeTokenContract = c59.router({
     summary: "Get Ably token for runner group job notifications"
   }
 });
-var platformRealtimeTokenContract = c59.router({
+var platformRealtimeTokenContract = c58.router({
   /**
    * POST /api/zero/realtime/token
    * Get an Ably token to subscribe to the authenticated user's push channel
@@ -130035,14 +129976,14 @@ function findMatchingPermissions(method, path3, config4, options = {}) {
 
 // ../../packages/api-contracts/src/contracts/zero-feature-switches.ts
 init_esm_shims();
-var c60 = initContract();
+var c59 = initContract();
 var featureSwitchesResponseSchema = external_exports.object({
   switches: external_exports.record(external_exports.string(), external_exports.boolean())
 });
 var updateFeatureSwitchesRequestSchema = external_exports.object({
   switches: external_exports.record(external_exports.string(), external_exports.boolean())
 });
-var zeroFeatureSwitchesContract = c60.router({
+var zeroFeatureSwitchesContract = c59.router({
   get: {
     method: "GET",
     path: "/api/zero/feature-switches",
@@ -130071,7 +130012,7 @@ var zeroFeatureSwitchesContract = c60.router({
     method: "DELETE",
     path: "/api/zero/feature-switches",
     headers: authHeadersSchema,
-    body: c60.noBody(),
+    body: c59.noBody(),
     responses: {
       200: external_exports.object({ deleted: external_exports.literal(true) }),
       401: apiErrorSchema,
@@ -130083,7 +130024,7 @@ var zeroFeatureSwitchesContract = c60.router({
 
 // ../../packages/api-contracts/src/contracts/onboarding.ts
 init_esm_shims();
-var c61 = initContract();
+var c60 = initContract();
 var onboardingStatusResponseSchema = external_exports.object({
   needsOnboarding: external_exports.boolean(),
   isAdmin: external_exports.boolean(),
@@ -130096,7 +130037,7 @@ var onboardingStatusResponseSchema = external_exports.object({
     sound: external_exports.string().optional()
   }).nullable()
 });
-var onboardingStatusContract = c61.router({
+var onboardingStatusContract = c60.router({
   getStatus: {
     method: "GET",
     path: "/api/zero/onboarding/status",
@@ -130108,7 +130049,7 @@ var onboardingStatusContract = c61.router({
     summary: "Get onboarding status for current user"
   }
 });
-var onboardingSetupContract = c61.router({
+var onboardingSetupContract = c60.router({
   setup: {
     method: "POST",
     path: "/api/zero/onboarding/setup",
@@ -130140,6 +130081,69 @@ var skillFrontmatterSchema = external_exports.object({
   description: external_exports.string().optional()
 });
 
+// ../../packages/api-contracts/src/contracts/zero-user-permission-grants.ts
+init_esm_shims();
+var c61 = initContract();
+var agentIdSchema = external_exports.string().uuid();
+var connectorRefSchema = external_exports.string().min(1).max(64);
+var permissionSchema = external_exports.string().min(1).max(128);
+var userPermissionGrantActionSchema = external_exports.enum(["allow", "deny"]);
+var userPermissionGrantTtlSecondsSchema = external_exports.union([
+  external_exports.literal(300),
+  external_exports.literal(900),
+  external_exports.literal(3600),
+  external_exports.literal(86400)
+]);
+var userPermissionGrantResponseSchema = external_exports.object({
+  agentId: agentIdSchema,
+  connectorRef: connectorRefSchema,
+  permission: permissionSchema,
+  action: userPermissionGrantActionSchema,
+  expiresAt: external_exports.string().nullable(),
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string()
+});
+var listUserPermissionGrantsQuerySchema = external_exports.object({
+  agentId: agentIdSchema
+});
+var upsertUserPermissionGrantRequestSchema = external_exports.object({
+  agentId: agentIdSchema,
+  connectorRef: connectorRefSchema,
+  permission: permissionSchema,
+  action: userPermissionGrantActionSchema,
+  ttlSeconds: userPermissionGrantTtlSecondsSchema
+});
+var zeroUserPermissionGrantsContract = c61.router({
+  list: {
+    method: "GET",
+    path: "/api/zero/user-permission-grants",
+    headers: authHeadersSchema,
+    query: listUserPermissionGrantsQuerySchema,
+    responses: {
+      200: external_exports.array(userPermissionGrantResponseSchema),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "List current user's active permission grants for an agent"
+  },
+  upsert: {
+    method: "PUT",
+    path: "/api/zero/user-permission-grants",
+    headers: authHeadersSchema,
+    body: upsertUserPermissionGrantRequestSchema,
+    responses: {
+      200: userPermissionGrantResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Upsert current user's permission grant for an agent"
+  }
+});
+
 // ../../packages/api-contracts/src/contracts/zero-codex-device-auth.ts
 init_esm_shims();
 var c62 = initContract();
@@ -134356,4 +134360,4 @@ undici/lib/web/fetch/body.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-FHVH4FYZ.js.map
+//# sourceMappingURL=chunk-BFQSUVXT.js.map