@vm0/cli 9.180.5 → 9.180.6

package/{chunk-GBLGZMXM.js → chunk-Z5VRB237.js}

@@ -74083,7 +74083,7 @@ if (DSN) {
   init2({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.180.5",
+    release: "9.180.6",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -74102,7 +74102,7 @@ if (DSN) {
     }
   });
   setContext("cli", {
-    version: "9.180.5",
+    version: "9.180.6",
     command: process.argv.slice(2).join(" ")
   });
   setContext("runtime", {
@@ -93198,6 +93198,7 @@ var firewallSchema = external_exports.object({
   apis: external_exports.array(firewallApiSchema)
 });
 var firewallsSchema = external_exports.array(firewallSchema);
+var UNKNOWN_PERMISSION_GRANT = "__unknown__";
 var firewallConfigSchema = external_exports.object({
   name: external_exports.string().min(1, "Firewall name is required"),
   description: external_exports.string().optional(),
@@ -94285,13 +94286,18 @@ var storageEntrySchema = external_exports.object({
   instructionsTargetFilename: external_exports.string().optional(),
   archiveUrl: external_exports.string()
 });
+var artifactMissingRootPolicySchema = external_exports.enum([
+  "fail",
+  "preserveParentVersion"
+]);
 var artifactEntrySchema = external_exports.object({
   mountPath: external_exports.string(),
   vasStorageName: external_exports.string(),
   vasStorageId: external_exports.string(),
   vasVersionId: external_exports.string(),
   archiveUrl: external_exports.string(),
-  manifestUrl: external_exports.string().optional()
+  manifestUrl: external_exports.string().optional(),
+  missingRootPolicy: artifactMissingRootPolicySchema.optional()
 });
 var storageManifestSchema = external_exports.object({
   storages: external_exports.array(storageEntrySchema),
@@ -95797,7 +95803,6 @@ var orgMessageResponseSchema = external_exports.object({
 // ../../packages/api-contracts/src/contracts/orgs.ts
 var c4 = initContract();
 var orgTierSchema = external_exports.enum(["free", "pro-suspend", "pro", "team"]);
-var permissionGrantModeSchema = external_exports.enum(["legacy", "user-grants"]);
 var orgSlugSchema = external_exports.string().min(3, "Org slug must be at least 3 characters").max(64, "Org slug must be at most 64 characters").regex(
   /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]{1,2}$/,
   "Org slug must contain only lowercase letters, numbers, and hyphens, and must start and end with an alphanumeric character"
@@ -95810,7 +95815,6 @@ var orgResponseSchema = external_exports.object({
   name: external_exports.string(),
   tier: external_exports.string().optional(),
   role: orgRoleSchema.optional(),
-  permissionGrantMode: permissionGrantModeSchema.optional(),
   createdBy: external_exports.string().optional()
 });
 var updateOrgRequestSchema = external_exports.object({
@@ -96915,7 +96919,6 @@ var zeroAgentResponseSchema = external_exports.object({
   displayName: external_exports.string().nullable(),
   sound: external_exports.string().nullable(),
   avatarUrl: external_exports.string().nullable(),
-  permissionPolicies: firewallPoliciesSchema.nullable(),
   customSkills: external_exports.array(external_exports.string()).default([]),
   modelProviderId: external_exports.string().uuid().nullable().default(null),
   selectedModel: external_exports.string().nullable().default(null),
@@ -97037,26 +97040,6 @@ var zeroAgentsByIdContract = c13.router({
     summary: "Delete zero agent by id"
   }
 });
-var zeroAgentPermissionPoliciesRequestSchema = external_exports.object({
-  agentId: external_exports.string().uuid(),
-  policies: firewallPoliciesSchema
-});
-var zeroAgentPermissionPoliciesContract = c13.router({
-  update: {
-    method: "PUT",
-    path: "/api/zero/permission-policies",
-    headers: authHeadersSchema,
-    body: zeroAgentPermissionPoliciesRequestSchema,
-    responses: {
-      200: zeroAgentResponseSchema,
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      403: apiErrorSchema,
-      404: apiErrorSchema
-    },
-    summary: "Update zero agent permission policies (owner only)"
-  }
-});
 var zeroAgentInstructionsContract = c13.router({
   get: {
     method: "GET",
@@ -97227,101 +97210,70 @@ var zeroSkillsDetailContract = c13.router({
     summary: "Delete custom skill from the organization"
   }
 });
-var permissionAccessRequestStatusSchema = external_exports.enum([
-  "pending",
-  "approved",
-  "rejected"
-]);
-var permissionAccessRequestActionSchema = external_exports.enum(["allow", "deny"]);
-var permissionAccessRequestResponseSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  agentId: external_exports.string().uuid(),
-  connectorRef: external_exports.string(),
-  permission: external_exports.string(),
-  action: permissionAccessRequestActionSchema,
-  method: external_exports.string().nullable(),
-  path: external_exports.string().nullable(),
-  reason: external_exports.string().nullable(),
-  status: permissionAccessRequestStatusSchema,
-  requesterUserId: external_exports.string(),
-  requesterName: external_exports.string().nullable(),
-  resolvedBy: external_exports.string().nullable(),
-  resolvedAt: external_exports.string().nullable(),
-  createdAt: external_exports.string()
-});
-var createPermissionAccessRequestSchema = external_exports.object({
-  agentId: external_exports.string().uuid(),
-  connectorRef: external_exports.string(),
-  permission: external_exports.string(),
-  action: permissionAccessRequestActionSchema.optional().default("allow"),
-  method: external_exports.string().optional(),
-  path: external_exports.string().optional(),
-  reason: external_exports.string().optional()
-});
-var resolvePermissionAccessRequestSchema = external_exports.object({
-  requestId: external_exports.string().uuid(),
-  action: external_exports.enum(["approve", "reject"])
+
+// ../../packages/api-contracts/src/contracts/zero-user-permission-grants.ts
+init_esm_shims();
+var c14 = initContract();
+var agentIdSchema = external_exports.string().uuid();
+var connectorRefSchema = external_exports.string().min(1).max(64);
+var permissionSchema = external_exports.string().min(1).max(128);
+var userPermissionGrantActionSchema = external_exports.enum(["allow", "deny"]);
+var userPermissionGrantResponseSchema = external_exports.object({
+  agentId: agentIdSchema,
+  connectorRef: connectorRefSchema,
+  permission: permissionSchema,
+  action: userPermissionGrantActionSchema,
+  expiresAt: external_exports.string().nullable(),
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string()
 });
-var permissionAccessRequestsCreateContract = c13.router({
-  create: {
-    method: "POST",
-    path: "/api/zero/permission-access-requests",
-    headers: authHeadersSchema,
-    body: createPermissionAccessRequestSchema,
-    responses: {
-      201: permissionAccessRequestResponseSchema,
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      403: apiErrorSchema,
-      404: apiErrorSchema
-    },
-    summary: "Create permission access request"
-  }
+var listUserPermissionGrantsQuerySchema = external_exports.object({
+  agentId: agentIdSchema
 });
-var permissionAccessRequestsListQuerySchema = external_exports.object({
-  agentId: external_exports.string().optional(),
-  requestId: external_exports.string().optional(),
-  status: external_exports.string().optional()
+var upsertUserPermissionGrantRequestSchema = external_exports.object({
+  agentId: agentIdSchema,
+  connectorRef: connectorRefSchema,
+  permission: permissionSchema,
+  action: userPermissionGrantActionSchema
 });
-var permissionAccessRequestsListContract = c13.router({
+var zeroUserPermissionGrantsContract = c14.router({
   list: {
     method: "GET",
-    path: "/api/zero/permission-access-requests",
+    path: "/api/zero/user-permission-grants",
     headers: authHeadersSchema,
-    query: permissionAccessRequestsListQuerySchema,
+    query: listUserPermissionGrantsQuerySchema,
     responses: {
-      200: external_exports.array(permissionAccessRequestResponseSchema),
+      200: external_exports.array(userPermissionGrantResponseSchema),
       400: apiErrorSchema,
       401: apiErrorSchema,
-      403: apiErrorSchema
+      403: apiErrorSchema,
+      404: apiErrorSchema
     },
-    summary: "List permission access requests for an agent"
-  }
-});
-var permissionAccessRequestsResolveContract = c13.router({
-  resolve: {
+    summary: "List current user's active permission grants for an agent"
+  },
+  upsert: {
     method: "PUT",
-    path: "/api/zero/permission-access-requests",
+    path: "/api/zero/user-permission-grants",
     headers: authHeadersSchema,
-    body: resolvePermissionAccessRequestSchema,
+    body: upsertUserPermissionGrantRequestSchema,
     responses: {
-      200: permissionAccessRequestResponseSchema,
+      200: userPermissionGrantResponseSchema,
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
     },
-    summary: "Resolve (approve/reject) a permission access request (owner only)"
+    summary: "Upsert current user's permission grant for an agent"
   }
 });
 
 // ../../packages/api-contracts/src/contracts/user-connectors.ts
 init_esm_shims();
-var c14 = initContract();
+var c15 = initContract();
 var userConnectorEnabledTypesSchema = external_exports.object({
   enabledTypes: external_exports.array(external_exports.string())
 });
-var zeroUserConnectorsContract = c14.router({
+var zeroUserConnectorsContract = c15.router({
   get: {
     method: "GET",
     path: "/api/zero/agents/:id/user-connectors",
@@ -97405,6 +97357,16 @@ async function getZeroAgentUserConnectors(id) {
     `Failed to get connector permissions for zero agent "${id}"`
   );
 }
+async function listZeroUserPermissionGrants(agentId) {
+  const config4 = await getClientConfig();
+  const client = initClient(zeroUserPermissionGrantsContract, config4);
+  const result = await client.list({ query: { agentId } });
+  if (result.status === 200) return result.body;
+  handleError(
+    result,
+    `Failed to get permission grants for zero agent "${agentId}"`
+  );
+}
 async function updateZeroAgentInstructions(id, content) {
   const config4 = await getClientConfig();
   const client = initClient(zeroAgentInstructionsContract, config4);
@@ -108540,8 +108502,8 @@ var connectorOauthDeviceAuthSessionPollResponseSchema = external_exports.discrim
 ]);
 
 // ../../packages/api-contracts/src/contracts/zero-connectors.ts
-var c15 = initContract();
-var zeroConnectorsMainContract = c15.router({
+var c16 = initContract();
+var zeroConnectorsMainContract = c16.router({
   list: {
     method: "GET",
     path: "/api/zero/connectors",
@@ -108555,7 +108517,7 @@ var zeroConnectorsMainContract = c15.router({
     summary: "List all connectors (zero proxy)"
   }
 });
-var zeroConnectorsByTypeContract = c15.router({
+var zeroConnectorsByTypeContract = c16.router({
   get: {
     method: "GET",
     path: "/api/zero/connectors/:type",
@@ -108575,14 +108537,14 @@ var zeroConnectorsByTypeContract = c15.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ type: connectorTypeSchema }),
     responses: {
-      204: c15.noBody(),
+      204: c16.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Disconnect a connector (zero proxy)"
   }
 });
-var zeroConnectorScopeDiffContract = c15.router({
+var zeroConnectorScopeDiffContract = c16.router({
   getScopeDiff: {
     method: "GET",
     path: "/api/zero/connectors/:type/scope-diff",
@@ -108597,7 +108559,7 @@ var zeroConnectorScopeDiffContract = c15.router({
     summary: "Get scope diff for a connector"
   }
 });
-var zeroConnectorOauthStartContract = c15.router({
+var zeroConnectorOauthStartContract = c16.router({
   start: {
     method: "POST",
     path: "/api/zero/connectors/:type/oauth/start",
@@ -108614,7 +108576,7 @@ var zeroConnectorOauthStartContract = c15.router({
     summary: "Create connector OAuth handoff and authorization URL"
   }
 });
-var zeroConnectorManualGrantContract = c15.router({
+var zeroConnectorManualGrantContract = c16.router({
   connect: {
     method: "POST",
     path: "/api/zero/connectors/:type/manual-grant",
@@ -108635,7 +108597,7 @@ var zeroConnectorManualGrantContract = c15.router({
     summary: "Connect a connector with a manual grant"
   }
 });
-var zeroConnectorOauthDeviceAuthSessionContract = c15.router({
+var zeroConnectorOauthDeviceAuthSessionContract = c16.router({
   create: {
     method: "POST",
     path: "/api/zero/connectors/:type/oauth/device/sessions",
@@ -108680,7 +108642,7 @@ var connectorSearchItemSchema = external_exports.object({
 var connectorSearchResponseSchema = external_exports.object({
   connectors: external_exports.array(connectorSearchItemSchema)
 });
-var zeroConnectorsSearchContract = c15.router({
+var zeroConnectorsSearchContract = c16.router({
   search: {
     method: "GET",
     path: "/api/zero/connectors/search",
@@ -108764,7 +108726,7 @@ var listQuerySchema = external_exports.object({
   cursor: external_exports.string().optional(),
   limit: external_exports.coerce.number().min(1).max(100).default(20)
 });
-var c16 = initContract();
+var c17 = initContract();
 var logStatusSchema = external_exports.enum([
   "queued",
   "pending",
@@ -108835,7 +108797,7 @@ var logDetailSchema = external_exports.object({
   completedAt: external_exports.string().nullable(),
   artifact: artifactSchema
 });
-var logsListContract = c16.router({
+var logsListContract = c17.router({
   list: {
     method: "GET",
     path: "/api/zero/logs",
@@ -108857,7 +108819,7 @@ var logsListContract = c16.router({
     summary: "List agent run logs with pagination"
   }
 });
-var logsByIdContract = c16.router({
+var logsByIdContract = c17.router({
   getById: {
     method: "GET",
     path: "/api/zero/logs/:id",
@@ -108876,7 +108838,7 @@ var logsByIdContract = c16.router({
 });
 
 // ../../packages/api-contracts/src/contracts/runs.ts
-var c17 = initContract();
+var c18 = initContract();
 var directRunModelProviderTypeSchema = modelProviderTypeSchema.refine(
   (type) => {
     return type !== "vm0";
@@ -109041,7 +109003,7 @@ var runListItemSchema = external_exports.object({
 var runsListResponseSchema = external_exports.object({
   runs: external_exports.array(runListItemSchema)
 });
-var runsMainContract = c17.router({
+var runsMainContract = c18.router({
   /**
    * GET /api/agent/runs
    * List agent runs (pending and running by default)
@@ -109092,7 +109054,7 @@ var runsMainContract = c17.router({
     summary: "Create and execute agent run"
   }
 });
-var runsByIdContract = c17.router({
+var runsByIdContract = c18.router({
   /**
    * GET /api/agent/runs/:id
    * Get agent run status and results
@@ -109118,7 +109080,7 @@ var cancelRunResponseSchema = external_exports.object({
   status: external_exports.literal("cancelled"),
   message: external_exports.string()
 });
-var runsCancelContract = c17.router({
+var runsCancelContract = c18.router({
   /**
    * POST /api/agent/runs/:id/cancel
    * Cancel a pending or running run
@@ -109141,7 +109103,7 @@ var runsCancelContract = c17.router({
     summary: "Cancel a pending or running run"
   }
 });
-var runEventsContract = c17.router({
+var runEventsContract = c18.router({
   /**
    * GET /api/agent/runs/:id/events
    * Poll for agent run events with pagination
@@ -109235,7 +109197,7 @@ var telemetryResponseSchema = external_exports.object({
   systemLog: external_exports.string(),
   metrics: external_exports.array(telemetryMetricSchema)
 });
-var runTelemetryContract = c17.router({
+var runTelemetryContract = c18.router({
   /**
    * GET /api/agent/runs/:id/telemetry
    * Get aggregated telemetry data for a run (legacy combined format)
@@ -109255,7 +109217,7 @@ var runTelemetryContract = c17.router({
     summary: "Get run telemetry data"
   }
 });
-var runSystemLogContract = c17.router({
+var runSystemLogContract = c18.router({
   /**
    * GET /api/agent/runs/:id/telemetry/system-log
    * Get system log with pagination
@@ -109280,7 +109242,7 @@ var runSystemLogContract = c17.router({
     summary: "Get system log with pagination"
   }
 });
-var runMetricsContract = c17.router({
+var runMetricsContract = c18.router({
   /**
    * GET /api/agent/runs/:id/telemetry/metrics
    * Get metrics with pagination
@@ -109305,7 +109267,7 @@ var runMetricsContract = c17.router({
     summary: "Get metrics with pagination"
   }
 });
-var runAgentEventsContract = c17.router({
+var runAgentEventsContract = c18.router({
   /**
    * GET /api/agent/runs/:id/telemetry/agent
    * Get agent events with pagination (for vm0 logs default)
@@ -109330,7 +109292,7 @@ var runAgentEventsContract = c17.router({
     summary: "Get agent events with pagination"
   }
 });
-var runNetworkLogsContract = c17.router({
+var runNetworkLogsContract = c18.router({
   /**
    * GET /api/agent/runs/:id/telemetry/network
    * Get network logs with pagination (for vm0 logs --network)
@@ -109366,7 +109328,7 @@ var logsSearchResponseSchema = external_exports.object({
   results: external_exports.array(searchResultSchema),
   hasMore: external_exports.boolean()
 });
-var logsSearchContract = c17.router({
+var logsSearchContract = c18.router({
   /**
    * GET /api/logs/search
    * Search agent events across runs using keyword matching
@@ -109423,7 +109385,7 @@ var queueResponseSchema = external_exports.object({
   runningTasks: external_exports.array(runningTaskSchema),
   estimatedTimePerRun: external_exports.number().nullable()
 });
-var runsQueueContract = c17.router({
+var runsQueueContract = c18.router({
   /**
    * GET /api/agent/runs/queue
    * Get org run queue status including concurrency context and queued entries
@@ -109446,7 +109408,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/storages.ts
 init_esm_shims();
-var c18 = initContract();
+var c19 = initContract();
 var storageTypeSchema = external_exports.enum(["volume", "artifact"]);
 var versionQuerySchema = external_exports.string().regex(/^[a-f0-9]{8,64}$/i, "Version must be 8-64 hex characters").optional();
 var uploadStorageResponseSchema = external_exports.object({
@@ -109457,7 +109419,7 @@ var uploadStorageResponseSchema = external_exports.object({
   type: storageTypeSchema,
   deduplicated: external_exports.boolean()
 });
-var storagesContract = c18.router({
+var storagesContract = c19.router({
   /**
    * POST /api/storages
    * Upload a storage (tar.gz file)
@@ -109474,7 +109436,7 @@ var storagesContract = c18.router({
     path: "/api/storages",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c18.type(),
+    body: c19.type(),
     responses: {
       200: uploadStorageResponseSchema,
       400: apiErrorSchema,
@@ -109503,9 +109465,9 @@ var storagesContract = c18.router({
     }),
     responses: {
       // Binary response - actual handling done at route level
-      200: c18.otherResponse({
+      200: c19.otherResponse({
         contentType: "application/gzip",
-        body: c18.type()
+        body: c19.type()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -109530,7 +109492,7 @@ var presignedUploadSchema = external_exports.object({
   key: external_exports.string(),
   presignedUrl: external_exports.url()
 });
-var storagesPrepareContract = c18.router({
+var storagesPrepareContract = c19.router({
   prepare: {
     method: "POST",
     path: "/api/storages/prepare",
@@ -109565,7 +109527,7 @@ var storagesPrepareContract = c18.router({
     summary: "Prepare for direct S3 upload"
   }
 });
-var storagesCommitContract = c18.router({
+var storagesCommitContract = c19.router({
   commit: {
     method: "POST",
     path: "/api/storages/commit",
@@ -109599,7 +109561,7 @@ var storagesCommitContract = c18.router({
     summary: "Commit uploaded storage"
   }
 });
-var storagesDownloadContract = c18.router({
+var storagesDownloadContract = c19.router({
   download: {
     method: "GET",
     path: "/api/storages/download",
@@ -109635,7 +109597,7 @@ var storagesDownloadContract = c18.router({
     summary: "Get presigned download URL"
   }
 });
-var storagesListContract = c18.router({
+var storagesListContract = c19.router({
   list: {
     method: "GET",
     path: "/api/storages/list",
@@ -109663,17 +109625,17 @@ var storagesListContract = c18.router({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks.ts
-var c19 = initContract();
+var c20 = initContract();
 var thirdPartyWebhookErrorSchema = external_exports.object({ error: external_exports.string() });
 var thirdPartyWebhookOkSchema = external_exports.union([
   external_exports.string(),
   external_exports.object({ message: external_exports.literal("pong") })
 ]);
-var webhookClerkContract = c19.router({
+var webhookClerkContract = c20.router({
   post: {
     method: "POST",
     path: "/api/webhooks/clerk",
-    body: c19.type(),
+    body: c20.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema
@@ -109681,11 +109643,11 @@ var webhookClerkContract = c19.router({
     summary: "Handle Clerk organization and user webhooks"
   }
 });
-var webhookGithubContract = c19.router({
+var webhookGithubContract = c20.router({
   post: {
     method: "POST",
     path: "/api/webhooks/github",
-    body: c19.type(),
+    body: c20.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -109695,11 +109657,11 @@ var webhookGithubContract = c19.router({
     summary: "Handle GitHub App webhooks"
   }
 });
-var webhookStripeContract = c19.router({
+var webhookStripeContract = c20.router({
   post: {
     method: "POST",
     path: "/api/webhooks/stripe",
-    body: c19.type(),
+    body: c20.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema,
@@ -109708,7 +109670,7 @@ var webhookStripeContract = c19.router({
     summary: "Handle Stripe billing webhooks"
   }
 });
-var webhookBuiltInGenerationFalContract = c19.router({
+var webhookBuiltInGenerationFalContract = c20.router({
   post: {
     method: "POST",
     path: "/api/webhooks/built-in-generations/fal/:generationId",
@@ -109719,7 +109681,7 @@ var webhookBuiltInGenerationFalContract = c19.router({
       token: external_exports.string().min(1),
       visualKey: external_exports.string().min(1).optional()
     }),
-    body: c19.type(),
+    body: c20.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -109729,7 +109691,7 @@ var webhookBuiltInGenerationFalContract = c19.router({
     summary: "Handle fal built-in generation webhooks"
   }
 });
-var webhookBuiltInGenerationBytePlusContract = c19.router({
+var webhookBuiltInGenerationBytePlusContract = c20.router({
   post: {
     method: "POST",
     path: "/api/webhooks/built-in-generations/byteplus/:generationId",
@@ -109740,7 +109702,7 @@ var webhookBuiltInGenerationBytePlusContract = c19.router({
       token: external_exports.string().min(1),
       visualKey: external_exports.string().min(1).optional()
     }),
-    body: c19.type(),
+    body: c20.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -109767,7 +109729,10 @@ var artifactSnapshotsSchema = external_exports.array(
   external_exports.object({
     name: external_exports.string(),
     version: external_exports.string(),
-    mountPath: external_exports.string()
+    mountPath: external_exports.string(),
+    // Internal provenance used by run creation to decide checkpoint-time
+    // behavior on a later resume. It is not exposed by public checkpoint APIs.
+    generatedBy: external_exports.literal("apiAutoMemory").optional()
   })
 );
 var volumeVersionsSnapshotSchema = external_exports.object({
@@ -109793,7 +109758,7 @@ var firewallAuthResponseSchema = external_exports.object({
   refreshedConnectors: external_exports.array(external_exports.string()),
   refreshedSecrets: external_exports.array(external_exports.string())
 });
-var webhookFirewallAuthContract = c19.router({
+var webhookFirewallAuthContract = c20.router({
   /**
    * POST /api/webhooks/agent/firewall/auth
    * Resolve firewall auth templates and refresh access tokens on demand.
@@ -109834,7 +109799,7 @@ var webhookFirewallAuthContract = c19.router({
     summary: "Resolve firewall auth templates"
   }
 });
-var webhookEventsContract = c19.router({
+var webhookEventsContract = c20.router({
   /**
    * POST /api/webhooks/agent/events
    * Receive agent events from sandbox
@@ -109861,7 +109826,7 @@ var webhookEventsContract = c19.router({
     summary: "Receive agent events from sandbox"
   }
 });
-var webhookCompleteContract = c19.router({
+var webhookCompleteContract = c20.router({
   /**
    * POST /api/webhooks/agent/complete
    * Handle agent run completion (success or failure)
@@ -109898,7 +109863,7 @@ var webhookCompleteContract = c19.router({
     summary: "Handle agent run completion"
   }
 });
-var webhookCheckpointsContract = c19.router({
+var webhookCheckpointsContract = c20.router({
   /**
    * POST /api/webhooks/agent/checkpoints
    * Create a recoverable checkpoint for an agent run.
@@ -109937,7 +109902,7 @@ var webhookCheckpointsContract = c19.router({
     summary: "Create checkpoint for agent run"
   }
 });
-var webhookCheckpointsPrepareHistoryContract = c19.router({
+var webhookCheckpointsPrepareHistoryContract = c20.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/checkpoints/prepare-history",
@@ -109960,7 +109925,7 @@ var webhookCheckpointsPrepareHistoryContract = c19.router({
     summary: "Get presigned URL for uploading session history to S3"
   }
 });
-var webhookHeartbeatContract = c19.router({
+var webhookHeartbeatContract = c20.router({
   /**
    * POST /api/webhooks/agent/heartbeat
    * Receive heartbeat signals from sandbox
@@ -109984,7 +109949,7 @@ var webhookHeartbeatContract = c19.router({
     summary: "Receive heartbeat from sandbox"
   }
 });
-var webhookStoragesContract = c19.router({
+var webhookStoragesContract = c20.router({
   /**
    * POST /api/webhooks/agent/storages
    * Create a new version of a storage from sandbox
@@ -110000,7 +109965,7 @@ var webhookStoragesContract = c19.router({
     path: "/api/webhooks/agent/storages",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c19.type(),
+    body: c20.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -110016,7 +109981,7 @@ var webhookStoragesContract = c19.router({
     summary: "Upload storage version from sandbox"
   }
 });
-var webhookStoragesIncrementalContract = c19.router({
+var webhookStoragesIncrementalContract = c20.router({
   /**
    * POST /api/webhooks/agent/storages/incremental
    * Create a new version using incremental upload
@@ -110034,7 +109999,7 @@ var webhookStoragesIncrementalContract = c19.router({
     path: "/api/webhooks/agent/storages/incremental",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c19.type(),
+    body: c20.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -110072,7 +110037,7 @@ var sandboxOperationSchema = external_exports.object({
   success: external_exports.boolean(),
   error: external_exports.string().optional()
 });
-var webhookTelemetryContract = c19.router({
+var webhookTelemetryContract = c20.router({
   /**
    * POST /api/webhooks/agent/telemetry
    * Receive telemetry data (system log, metrics, network logs, and sandbox operations) from sandbox
@@ -110101,7 +110066,7 @@ var webhookTelemetryContract = c19.router({
     summary: "Receive telemetry data from sandbox"
   }
 });
-var webhookStoragesPrepareContract = c19.router({
+var webhookStoragesPrepareContract = c20.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/storages/prepare",
@@ -110135,7 +110100,7 @@ var webhookStoragesPrepareContract = c19.router({
     summary: "Prepare for direct S3 upload from sandbox"
   }
 });
-var webhookStoragesCommitContract = c19.router({
+var webhookStoragesCommitContract = c20.router({
   commit: {
     method: "POST",
     path: "/api/webhooks/agent/storages/commit",
@@ -110177,7 +110142,7 @@ var webhookUsageEventItemSchema = external_exports.object({
   category: external_exports.string().min(1).max(100),
   quantity: external_exports.number().int().min(0)
 }).strict();
-var webhookUsageEventContract = c19.router({
+var webhookUsageEventContract = c20.router({
   send: {
     method: "POST",
     path: "/api/webhooks/agent/usage-event",
@@ -110215,8 +110180,8 @@ var zeroRunRequestSchema = unifiedRunRequestSchema.omit({
   agentId: external_exports.string().optional(),
   modelProvider: external_exports.string().optional()
 });
-var c20 = initContract();
-var zeroRunsMainContract = c20.router({
+var c21 = initContract();
+var zeroRunsMainContract = c21.router({
   create: {
     method: "POST",
     path: "/api/zero/runs",
@@ -110235,7 +110200,7 @@ var zeroRunsMainContract = c20.router({
     summary: "Create and execute agent run (zero proxy)"
   }
 });
-var zeroRunsByIdContract = c20.router({
+var zeroRunsByIdContract = c21.router({
   getById: {
     method: "GET",
     path: "/api/zero/runs/:id",
@@ -110253,7 +110218,7 @@ var zeroRunsByIdContract = c20.router({
     summary: "Get agent run by ID (zero proxy)"
   }
 });
-var zeroRunsCancelContract = c20.router({
+var zeroRunsCancelContract = c21.router({
   cancel: {
     method: "POST",
     path: "/api/zero/runs/:id/cancel",
@@ -110272,7 +110237,7 @@ var zeroRunsCancelContract = c20.router({
     summary: "Cancel a pending or running run (zero proxy)"
   }
 });
-var zeroRunsQueueContract = c20.router({
+var zeroRunsQueueContract = c21.router({
   getQueue: {
     method: "GET",
     path: "/api/zero/runs/queue",
@@ -110285,7 +110250,7 @@ var zeroRunsQueueContract = c20.router({
     summary: "Get org run queue status (zero proxy)"
   }
 });
-var zeroRunAgentEventsContract = c20.router({
+var zeroRunAgentEventsContract = c21.router({
   getAgentEvents: {
     method: "GET",
     path: "/api/zero/runs/:id/telemetry/agent",
@@ -110347,7 +110312,7 @@ var runContextResponseSchema = external_exports.object({
   artifact: runContextArtifactSchema.nullable(),
   featureFlags: external_exports.record(external_exports.string(), external_exports.boolean()).nullable()
 });
-var zeroRunContextContract = c20.router({
+var zeroRunContextContract = c21.router({
   getContext: {
     method: "GET",
     path: "/api/zero/runs/:id/context",
@@ -110365,7 +110330,7 @@ var zeroRunContextContract = c20.router({
     summary: "Get run execution context snapshot for debugging"
   }
 });
-var zeroRunNetworkLogsContract = c20.router({
+var zeroRunNetworkLogsContract = c21.router({
   getNetworkLogs: {
     method: "GET",
     path: "/api/zero/runs/:id/network",
@@ -110391,7 +110356,7 @@ var zeroRunNetworkLogsContract = c20.router({
 var runRunnerResponseSchema = external_exports.object({
   sandboxReuseResult: sandboxReuseResultSchema.nullable()
 });
-var zeroRunRunnerContract = c20.router({
+var zeroRunRunnerContract = c21.router({
   getRunner: {
     method: "GET",
     path: "/api/zero/runs/:id/runner",
@@ -110409,7 +110374,7 @@ var zeroRunRunnerContract = c20.router({
     summary: "Get runner-level metadata for a run"
   }
 });
-var zeroLogsSearchContract = c20.router({
+var zeroLogsSearchContract = c21.router({
   searchLogs: {
     method: "GET",
     path: "/api/zero/logs/search",
@@ -110474,7 +110439,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/chat-threads.ts
 init_esm_shims();
-var c21 = initContract();
+var c22 = initContract();
 var MODEL_FIRST_SELECTION_PROVIDER_ID = "00000000-0000-4000-8000-000000000000";
 var attachFileSchema = external_exports.object({
   id: external_exports.string(),
@@ -110680,7 +110645,7 @@ var modelSelectionRequestSchema = external_exports.object({
     });
   }
 });
-var chatThreadsContract = c21.router({
+var chatThreadsContract = c22.router({
   create: {
     method: "POST",
     path: "/api/zero/chat-threads",
@@ -110757,7 +110722,7 @@ var chatThreadIdPathParamsSchema = external_exports.object({ id: external_export
 var chatThreadThreadIdPathParamsSchema = external_exports.object({
   threadId: external_exports.string().uuid()
 });
-var chatThreadByIdContract = c21.router({
+var chatThreadByIdContract = c22.router({
   get: {
     method: "GET",
     path: "/api/zero/chat-threads/:id",
@@ -110781,7 +110746,7 @@ var chatThreadByIdContract = c21.router({
       draftAttachments: external_exports.array(persistedAttachmentSchema).nullable().optional()
     }),
     responses: {
-      204: c21.noBody(),
+      204: c22.noBody(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
@@ -110794,22 +110759,22 @@ var chatThreadByIdContract = c21.router({
     headers: authHeadersSchema,
     pathParams: chatThreadIdPathParamsSchema,
     responses: {
-      204: c21.noBody(),
+      204: c22.noBody(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
     },
     summary: "Delete a chat thread",
-    body: c21.noBody()
+    body: c22.noBody()
   }
 });
-var chatThreadMarkReadContract = c21.router({
+var chatThreadMarkReadContract = c22.router({
   markRead: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/mark-read",
     headers: authHeadersSchema,
     pathParams: chatThreadIdPathParamsSchema,
-    body: c21.noBody(),
+    body: c22.noBody(),
     responses: {
       200: external_exports.object({
         lastReadMessageId: external_exports.string().nullable(),
@@ -110822,15 +110787,15 @@ var chatThreadMarkReadContract = c21.router({
     summary: "Mark a chat thread as read up to the latest message"
   }
 });
-var chatThreadPinContract = c21.router({
+var chatThreadPinContract = c22.router({
   pin: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/pin",
     headers: authHeadersSchema,
     pathParams: chatThreadIdPathParamsSchema,
-    body: c21.noBody(),
+    body: c22.noBody(),
     responses: {
-      204: c21.noBody(),
+      204: c22.noBody(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
@@ -110838,15 +110803,15 @@ var chatThreadPinContract = c21.router({
     summary: "Pin a chat thread to the top of the sidebar"
   }
 });
-var chatThreadUnpinContract = c21.router({
+var chatThreadUnpinContract = c22.router({
   unpin: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/unpin",
     headers: authHeadersSchema,
     pathParams: chatThreadIdPathParamsSchema,
-    body: c21.noBody(),
+    body: c22.noBody(),
     responses: {
-      204: c21.noBody(),
+      204: c22.noBody(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
@@ -110854,7 +110819,7 @@ var chatThreadUnpinContract = c21.router({
     summary: "Remove the pin from a chat thread"
   }
 });
-var chatThreadRenameContract = c21.router({
+var chatThreadRenameContract = c22.router({
   rename: {
     method: "POST",
     path: "/api/zero/chat-threads/:id/rename",
@@ -110862,7 +110827,7 @@ var chatThreadRenameContract = c21.router({
     pathParams: chatThreadIdPathParamsSchema,
     body: external_exports.object({ title: external_exports.string().min(1) }),
     responses: {
-      204: c21.noBody(),
+      204: c22.noBody(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
@@ -110870,7 +110835,7 @@ var chatThreadRenameContract = c21.router({
     summary: "Rename a chat thread (suppresses automated title generation)"
   }
 });
-var chatMessagesContract = c21.router({
+var chatMessagesContract = c22.router({
   send: {
     method: "POST",
     path: "/api/zero/chat/messages",
@@ -110989,7 +110954,7 @@ var chatSearchResponseSchema = external_exports.object({
   results: external_exports.array(chatSearchResultSchema),
   hasMore: external_exports.boolean()
 });
-var chatSearchContract = c21.router({
+var chatSearchContract = c22.router({
   search: {
     method: "GET",
     path: "/api/zero/chat/search",
@@ -111011,7 +110976,7 @@ var chatSearchContract = c21.router({
     summary: "Search chat messages within caller's org (zero proxy)"
   }
 });
-var chatThreadMessagesContract = c21.router({
+var chatThreadMessagesContract = c22.router({
   list: {
     method: "GET",
     path: "/api/zero/chat-threads/:threadId/messages",
@@ -111034,7 +110999,7 @@ var chatThreadMessagesContract = c21.router({
     summary: "Get paginated chat messages for a thread"
   }
 });
-var chatThreadArtifactsContract = c21.router({
+var chatThreadArtifactsContract = c22.router({
   list: {
     method: "GET",
     path: "/api/zero/chat-threads/:threadId/artifacts",
@@ -111075,7 +111040,7 @@ var chatThreadArtifactsContract = c21.router({
     summary: "Sync a chat artifact file to the user's connected Google Drive"
   }
 });
-var chatThreadGithubPrsContract = c21.router({
+var chatThreadGithubPrsContract = c22.router({
   list: {
     method: "GET",
     path: "/api/zero/chat-threads/:threadId/github-prs",
@@ -111203,7 +111168,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-developer-support.ts
 init_esm_shims();
-var c22 = initContract();
+var c23 = initContract();
 var developerSupportBodySchema = external_exports.object({
   title: external_exports.string().min(1, "Title is required"),
   description: external_exports.string().min(1, "Description is required"),
@@ -111215,7 +111180,7 @@ var consentCodeResponseSchema = external_exports.object({
 var submitResponseSchema = external_exports.object({
   reference: external_exports.string()
 });
-var zeroDeveloperSupportContract = c22.router({
+var zeroDeveloperSupportContract = c23.router({
   submit: {
     method: "POST",
     path: "/api/zero/developer-support",
@@ -111252,7 +111217,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-computer-use.ts
 init_esm_shims();
-var c23 = initContract();
+var c24 = initContract();
 var computerUseHostStatusSchema = external_exports.enum(["online", "offline"]);
 var computerUseReadCommandKindSchema = external_exports.enum([
   "apps.list",
@@ -111560,7 +111525,7 @@ var computerUseAuditEventSchema = external_exports.object({
 var computerUseAuditEventListResponseSchema = external_exports.object({
   auditEvents: external_exports.array(computerUseAuditEventSchema)
 });
-var zeroComputerUseHostsContract = c23.router({
+var zeroComputerUseHostsContract = c24.router({
   start: {
     method: "POST",
     path: "/api/zero/computer-use/hosts/start",
@@ -111599,7 +111564,7 @@ var zeroComputerUseHostsContract = c23.router({
     summary: "Delete a desktop computer-use host"
   }
 });
-var zeroComputerUseHeartbeatContract = c23.router({
+var zeroComputerUseHeartbeatContract = c24.router({
   heartbeat: {
     method: "POST",
     path: "/api/zero/computer-use/heartbeat",
@@ -111624,7 +111589,7 @@ var zeroComputerUseHeartbeatContract = c23.router({
     summary: "Stop a desktop computer-use host"
   }
 });
-var zeroComputerUseCommandContract = c23.router({
+var zeroComputerUseCommandContract = c24.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/commands",
@@ -111659,7 +111624,7 @@ var zeroComputerUseCommandContract = c23.router({
     headers: authHeadersSchema,
     pathParams: commandIdPathParamsSchema,
     responses: {
-      200: c23.noBody(),
+      200: c24.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -111667,7 +111632,7 @@ var zeroComputerUseCommandContract = c23.router({
     summary: "Download a desktop computer-use command screenshot"
   }
 });
-var zeroComputerUseWriteCommandContract = c23.router({
+var zeroComputerUseWriteCommandContract = c24.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/write-commands",
@@ -111684,7 +111649,7 @@ var zeroComputerUseWriteCommandContract = c23.router({
     summary: "Create a desktop computer-use write command"
   }
 });
-var zeroComputerUseCommandApprovalContract = c23.router({
+var zeroComputerUseCommandApprovalContract = c24.router({
   decide: {
     method: "POST",
     path: "/api/zero/computer-use/commands/:commandId/approval",
@@ -111701,7 +111666,7 @@ var zeroComputerUseCommandApprovalContract = c23.router({
     summary: "Approve or deny a pending desktop computer-use write command"
   }
 });
-var zeroComputerUseHostCommandsContract = c23.router({
+var zeroComputerUseHostCommandsContract = c24.router({
   next: {
     method: "POST",
     path: "/api/zero/computer-use/host/commands/next",
@@ -111729,7 +111694,7 @@ var zeroComputerUseHostCommandsContract = c23.router({
     summary: "Complete a desktop computer-use command"
   }
 });
-var zeroComputerUseAuditEventsContract = c23.router({
+var zeroComputerUseAuditEventsContract = c24.router({
   list: {
     method: "GET",
     path: "/api/zero/computer-use/audit-events",
@@ -112040,7 +112005,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/sessions.ts
 init_esm_shims();
-var c24 = initContract();
+var c25 = initContract();
 var sessionResponseSchema = external_exports.object({
   id: external_exports.string(),
   agentComposeId: external_exports.string(),
@@ -112081,7 +112046,7 @@ var checkpointResponseSchema = external_exports.object({
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
   createdAt: external_exports.string()
 });
-var sessionsByIdContract = c24.router({
+var sessionsByIdContract = c25.router({
   /**
    * GET /api/agent/sessions/:id
    * Get session by ID
@@ -112102,7 +112067,7 @@ var sessionsByIdContract = c24.router({
     summary: "Get session by ID"
   }
 });
-var checkpointsByIdContract = c24.router({
+var checkpointsByIdContract = c25.router({
   /**
    * GET /api/agent/checkpoints/:id
    * Get checkpoint by ID
@@ -112264,9 +112229,9 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-model-providers.ts
 init_esm_shims();
-var c25 = initContract();
+var c26 = initContract();
 var orgUpsertModelProviderRequestSchema = upsertModelProviderRequestSchema.omit({ selectedModel: true });
-var zeroModelProvidersMainContract = c25.router({
+var zeroModelProvidersMainContract = c26.router({
   list: {
     method: "GET",
     path: "/api/zero/model-providers",
@@ -112295,7 +112260,7 @@ var zeroModelProvidersMainContract = c25.router({
     summary: "Create or update an org-level model provider (admin only)"
   }
 });
-var zeroModelProvidersByTypeContract = c25.router({
+var zeroModelProvidersByTypeContract = c26.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/model-providers/:type",
@@ -112304,7 +112269,7 @@ var zeroModelProvidersByTypeContract = c25.router({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c25.noBody(),
+      204: c26.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -112391,7 +112356,7 @@ import { pipeline } from "stream/promises";
 
 // ../../packages/api-contracts/src/contracts/integrations.ts
 init_esm_shims();
-var c26 = initContract();
+var c27 = initContract();
 var sendSlackMessageBodySchema = external_exports.object({
   channel: external_exports.string().min(1, "Channel ID is required").optional(),
   user: external_exports.string().min(1, "User ID is required").optional(),
@@ -112409,7 +112374,7 @@ var sendSlackMessageResponseSchema = external_exports.object({
   ts: external_exports.string().optional(),
   channel: external_exports.string().optional()
 });
-var integrationsSlackMessageContract = c26.router({
+var integrationsSlackMessageContract = c27.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/slack/message",
@@ -112437,7 +112402,7 @@ var sendTelegramMessageResponseSchema = external_exports.object({
   messageId: external_exports.number().int(),
   chatId: external_exports.string()
 });
-var integrationsTelegramMessageContract = c26.router({
+var integrationsTelegramMessageContract = c27.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/telegram/message",
@@ -112465,7 +112430,7 @@ var sendPhoneMessageResponseSchema = external_exports.object({
   channel: external_exports.string().nullable(),
   toNumber: external_exports.string()
 });
-var integrationsPhoneMessageContract = c26.router({
+var integrationsPhoneMessageContract = c27.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/phone/message",
@@ -112485,14 +112450,14 @@ var integrationsPhoneMessageContract = c26.router({
 var phoneDownloadFileQuerySchema = external_exports.object({
   file_id: external_exports.string().min(1, "file_id query parameter is required")
 });
-var integrationsPhoneDownloadFileContract = c26.router({
+var integrationsPhoneDownloadFileContract = c27.router({
   download: {
     method: "GET",
     path: "/api/zero/integrations/phone/download-file",
     headers: authHeadersSchema,
     query: phoneDownloadFileQuerySchema,
     responses: {
-      200: c26.type(),
+      200: c27.type(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -112527,7 +112492,7 @@ var telegramBotListItemSchema = external_exports.object({
 var listTelegramBotsResponseSchema = external_exports.object({
   bots: external_exports.array(telegramBotListItemSchema)
 });
-var integrationsTelegramBotListContract = c26.router({
+var integrationsTelegramBotListContract = c27.router({
   listBots: {
     method: "GET",
     path: "/api/zero/integrations/telegram/bots",
@@ -112548,7 +112513,7 @@ var slackUploadInitResponseSchema = external_exports.object({
   uploadUrl: external_exports.string(),
   fileId: external_exports.string()
 });
-var integrationsSlackUploadInitContract = c26.router({
+var integrationsSlackUploadInitContract = c27.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/init",
@@ -112577,7 +112542,7 @@ var telegramUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsTelegramUploadInitContract = c26.router({
+var integrationsTelegramUploadInitContract = c27.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/init",
@@ -112609,7 +112574,7 @@ var telegramUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsTelegramUploadCompleteContract = c26.router({
+var integrationsTelegramUploadCompleteContract = c27.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/complete",
@@ -112639,7 +112604,7 @@ var githubUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsGithubUploadInitContract = c26.router({
+var integrationsGithubUploadInitContract = c27.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/github/upload-file/init",
@@ -112670,7 +112635,7 @@ var githubUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsGithubUploadCompleteContract = c26.router({
+var integrationsGithubUploadCompleteContract = c27.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/github/upload-file/complete",
@@ -112701,7 +112666,7 @@ var phoneUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsPhoneUploadInitContract = c26.router({
+var integrationsPhoneUploadInitContract = c27.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/init",
@@ -112732,7 +112697,7 @@ var phoneUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsPhoneUploadCompleteContract = c26.router({
+var integrationsPhoneUploadCompleteContract = c27.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/complete",
@@ -112776,7 +112741,7 @@ var sendChatMessageResponseSchema = external_exports.object({
   threadId: external_exports.string(),
   createdAt: external_exports.string()
 });
-var integrationsChatMessageContract = c26.router({
+var integrationsChatMessageContract = c27.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/chat/message",
@@ -112792,7 +112757,7 @@ var integrationsChatMessageContract = c26.router({
     summary: "Send a message to a web chat thread"
   }
 });
-var integrationsSlackUploadCompleteContract = c26.router({
+var integrationsSlackUploadCompleteContract = c27.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/complete",
@@ -112975,7 +112940,7 @@ import { pipeline as pipeline3 } from "stream/promises";
 
 // ../../packages/api-contracts/src/contracts/integrations-github.ts
 init_esm_shims();
-var c27 = initContract();
+var c28 = initContract();
 var githubInstallationEnvironmentSchema = external_exports.object({
   requiredSecrets: external_exports.array(external_exports.string()),
   requiredVars: external_exports.array(external_exports.string()),
@@ -113063,7 +113028,7 @@ var createGithubLabelListenerResponseSchema = external_exports.object({
 var updateGithubLabelListenerResponseSchema = external_exports.object({
   listener: githubLabelListenerSchema
 });
-var integrationsGithubContract = c27.router({
+var integrationsGithubContract = c28.router({
   getInstallation: {
     method: "GET",
     path: "/api/integrations/github",
@@ -113097,7 +113062,7 @@ var integrationsGithubContract = c27.router({
     method: "DELETE",
     path: "/api/integrations/github/link",
     headers: authHeadersSchema,
-    body: c27.noBody(),
+    body: c28.noBody(),
     responses: {
       200: githubIntegrationActionResponseSchema,
       401: apiErrorSchema,
@@ -113110,7 +113075,7 @@ var integrationsGithubContract = c27.router({
     method: "DELETE",
     path: "/api/integrations/github",
     headers: authHeadersSchema,
-    body: c27.noBody(),
+    body: c28.noBody(),
     responses: {
       200: deleteGithubInstallationResponseSchema,
       401: apiErrorSchema,
@@ -113173,7 +113138,7 @@ var integrationsGithubContract = c27.router({
     path: "/api/integrations/github/label-listeners/:listenerId",
     pathParams: external_exports.object({ listenerId: external_exports.string().uuid() }),
     headers: authHeadersSchema,
-    body: c27.noBody(),
+    body: c28.noBody(),
     responses: {
       200: githubIntegrationActionResponseSchema,
       401: apiErrorSchema,
@@ -113387,7 +113352,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-schedules.ts
 init_esm_shims();
-var c28 = initContract();
+var c29 = initContract();
 var scheduleResponseSchema = external_exports.object({
   id: external_exports.string().uuid(),
   agentId: external_exports.string().uuid(),
@@ -113447,7 +113412,7 @@ var zeroDeployScheduleRequestSchema = external_exports.object({
     message: "Exactly one of 'cronExpression', 'atTime', or 'intervalSeconds' must be specified"
   }
 );
-var zeroSchedulesMainContract = c28.router({
+var zeroSchedulesMainContract = c29.router({
   deploy: {
     method: "POST",
     path: "/api/zero/schedules",
@@ -113475,7 +113440,7 @@ var zeroSchedulesMainContract = c28.router({
     summary: "List all schedules (zero proxy)"
   }
 });
-var zeroSchedulesByNameContract = c28.router({
+var zeroSchedulesByNameContract = c29.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/schedules/:name",
@@ -113487,7 +113452,7 @@ var zeroSchedulesByNameContract = c28.router({
       agentId: external_exports.string().uuid("Invalid agent ID")
     }),
     responses: {
-      204: c28.noBody(),
+      204: c29.noBody(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -113496,7 +113461,7 @@ var zeroSchedulesByNameContract = c28.router({
     summary: "Delete schedule (zero proxy)"
   }
 });
-var zeroSchedulesEnableContract = c28.router({
+var zeroSchedulesEnableContract = c29.router({
   enable: {
     method: "POST",
     path: "/api/zero/schedules/:name/enable",
@@ -113536,7 +113501,7 @@ var zeroSchedulesEnableContract = c28.router({
     summary: "Disable schedule (zero proxy)"
   }
 });
-var zeroScheduleRunContract = c28.router({
+var zeroScheduleRunContract = c29.router({
   run: {
     method: "POST",
     path: "/api/zero/schedules/run",
@@ -128886,6 +128851,22 @@ function resolveFirewallPolicies(stored, connectors) {
   }
   return resolved;
 }
+function permissionGrantsToFirewallPolicies(grants) {
+  const policies = {};
+  for (const grant of grants) {
+    const current = policies[grant.connectorRef] ?? { policies: {} };
+    if (grant.permission === UNKNOWN_PERMISSION_GRANT) {
+      policies[grant.connectorRef] = {
+        ...current,
+        unknownPolicy: grant.action
+      };
+      continue;
+    }
+    current.policies[grant.permission] = grant.action;
+    policies[grant.connectorRef] = current;
+  }
+  return Object.keys(policies).length > 0 ? policies : null;
+}
 
 // src/lib/events/event-stream-normalizer.ts
 init_esm_shims();
@@ -128899,6 +128880,9 @@ init_esm_shims();
 // ../../packages/core/src/usage-source-bucket.ts
 init_esm_shims();
 
+// ../../packages/core/src/presentation-template-items.ts
+init_esm_shims();
+
 // ../../packages/core/src/contracts/index.ts
 init_esm_shims();
 
@@ -128907,11 +128891,11 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/health.ts
 init_esm_shims();
-var c29 = initContract();
+var c30 = initContract();
 var healthResponseSchema = external_exports.object({
   status: external_exports.literal("ok")
 });
-var healthContract = c29.router({
+var healthContract = c30.router({
   check: {
     method: "GET",
     path: "/health",
@@ -128921,7 +128905,7 @@ var healthContract = c29.router({
     summary: "Check API health"
   }
 });
-var healthAuthContract = c29.router({
+var healthAuthContract = c30.router({
   check: {
     method: "GET",
     path: "/health/auth",
@@ -128942,7 +128926,7 @@ var healthAuthContract = c29.router({
 
 // ../../packages/api-contracts/src/contracts/desktop-auth.ts
 init_esm_shims();
-var c30 = initContract();
+var c31 = initContract();
 var desktopAuthCallbackSchemes = [
   "ai.vm0.zero.desktop",
   "ai.vm0.zero.desktop.dev"
@@ -128951,7 +128935,7 @@ var defaultDesktopAuthCallbackScheme = desktopAuthCallbackSchemes[0];
 var desktopAuthCallbackSchemeSchema = external_exports.enum(
   desktopAuthCallbackSchemes
 );
-var desktopAuthHandoffContract = c30.router({
+var desktopAuthHandoffContract = c31.router({
   create: {
     method: "POST",
     path: "/api/desktop-auth/handoff",
@@ -128971,7 +128955,7 @@ var desktopAuthHandoffContract = c30.router({
     summary: "Create a desktop auth handoff code"
   }
 });
-var desktopAuthConsumeContract = c30.router({
+var desktopAuthConsumeContract = c31.router({
   consume: {
     method: "POST",
     path: "/api/desktop-auth/consume",
@@ -128991,7 +128975,7 @@ var desktopAuthConsumeContract = c30.router({
 
 // ../../packages/api-contracts/src/contracts/zero-user-model-preference.ts
 init_esm_shims();
-var c31 = initContract();
+var c32 = initContract();
 var userModelPreferenceResponseSchema = external_exports.object({
   selectedModel: supportedRunModelSchema.nullable(),
   updatedAt: external_exports.string().nullable()
@@ -128999,7 +128983,7 @@ var userModelPreferenceResponseSchema = external_exports.object({
 var updateUserModelPreferenceRequestSchema = external_exports.object({
   selectedModel: supportedRunModelSchema.nullable()
 });
-var zeroUserModelPreferenceContract = c31.router({
+var zeroUserModelPreferenceContract = c32.router({
   get: {
     method: "GET",
     path: "/api/zero/user-model-preference",
@@ -129058,12 +129042,12 @@ var internalCallbackErrorSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/internal-callbacks-chat.ts
-var c32 = initContract();
+var c33 = initContract();
 var chatCallbackPayloadSchema = external_exports.object({
   threadId: external_exports.string(),
   agentId: external_exports.string()
 }).passthrough();
-var internalCallbacksChatContract = c32.router({
+var internalCallbacksChatContract = c33.router({
   post: {
     method: "POST",
     path: "/api/internal/callbacks/chat",
@@ -129084,7 +129068,7 @@ var internalCallbacksChatContract = c32.router({
 
 // ../../packages/api-contracts/src/contracts/internal-callbacks-telegram.ts
 init_esm_shims();
-var c33 = initContract();
+var c34 = initContract();
 var telegramCallbackPayloadSchema = external_exports.object({
   installationId: external_exports.string(),
   chatId: external_exports.string(),
@@ -129096,7 +129080,7 @@ var telegramCallbackPayloadSchema = external_exports.object({
   isDM: external_exports.boolean(),
   thinkingMessageId: external_exports.string().nullable().optional()
 }).passthrough();
-var internalCallbacksTelegramContract = c33.router({
+var internalCallbacksTelegramContract = c34.router({
   post: {
     method: "POST",
     path: "/api/internal/callbacks/telegram",
@@ -129118,7 +129102,7 @@ var internalCallbacksTelegramContract = c33.router({
 
 // ../../packages/api-contracts/src/contracts/internal-callbacks-agentphone.ts
 init_esm_shims();
-var c34 = initContract();
+var c35 = initContract();
 var agentPhoneCallbackPayloadSchema = external_exports.object({
   messageId: external_exports.string(),
   conversationId: external_exports.string().nullable(),
@@ -129133,7 +129117,7 @@ var agentPhoneCallbackPayloadSchema = external_exports.object({
   agentphoneAgentId: external_exports.string(),
   existingSessionId: external_exports.string().nullable().optional()
 }).passthrough();
-var internalCallbacksAgentPhoneContract = c34.router({
+var internalCallbacksAgentPhoneContract = c35.router({
   post: {
     method: "POST",
     path: "/api/internal/callbacks/agentphone",
@@ -129154,7 +129138,7 @@ var internalCallbacksAgentPhoneContract = c34.router({
 
 // ../../packages/api-contracts/src/contracts/test-telegram-dispatch-probe.ts
 init_esm_shims();
-var c35 = initContract();
+var c36 = initContract();
 var testTelegramDispatchProbeBodySchema = external_exports.unknown().optional();
 var testTelegramDispatchProbeSuccessSchema = external_exports.object({
   ok: external_exports.literal(true)
@@ -129171,7 +129155,7 @@ var testTelegramDispatchProbeHandlerErrorSchema = external_exports.object({
     stack: external_exports.string().optional()
   })
 });
-var testTelegramDispatchProbeContract = c35.router({
+var testTelegramDispatchProbeContract = c36.router({
   post: {
     method: "POST",
     path: "/api/test/telegram-dispatch-probe",
@@ -129190,7 +129174,7 @@ var testTelegramDispatchProbeContract = c35.router({
 
 // ../../packages/api-contracts/src/contracts/internal-callbacks-slack-org.ts
 init_esm_shims();
-var c36 = initContract();
+var c37 = initContract();
 var slackOrgCallbackPayloadSchema = external_exports.object({
   workspaceId: external_exports.string(),
   channelId: external_exports.string(),
@@ -129200,7 +129184,7 @@ var slackOrgCallbackPayloadSchema = external_exports.object({
   agentId: external_exports.string(),
   existingSessionId: external_exports.string().optional()
 }).passthrough();
-var internalCallbacksSlackOrgContract = c36.router({
+var internalCallbacksSlackOrgContract = c37.router({
   post: {
     method: "POST",
     path: "/api/internal/callbacks/slack/org",
@@ -129222,7 +129206,7 @@ var internalCallbacksSlackOrgContract = c36.router({
 
 // ../../packages/api-contracts/src/contracts/zero-email.ts
 init_esm_shims();
-var c37 = initContract();
+var c38 = initContract();
 var emailRecipientsSchema = external_exports.array(external_exports.string()).optional();
 var zeroEmailReplyCallbackPayloadSchema = external_exports.object({
   emailThreadSessionId: external_exports.string(),
@@ -129245,7 +129229,7 @@ var zeroEmailTriggerCallbackPayloadSchema = external_exports.object({
   replyRecipientTo: emailRecipientsSchema,
   replyRecipientCc: emailRecipientsSchema
 }).passthrough();
-var zeroEmailReplyCallbackContract = c37.router({
+var zeroEmailReplyCallbackContract = c38.router({
   post: {
     method: "POST",
     path: "/api/zero/email/callbacks/reply",
@@ -129262,7 +129246,7 @@ var zeroEmailReplyCallbackContract = c37.router({
     summary: "Handle Zero email reply completion callbacks"
   }
 });
-var zeroEmailTriggerCallbackContract = c37.router({
+var zeroEmailTriggerCallbackContract = c38.router({
   post: {
     method: "POST",
     path: "/api/zero/email/callbacks/trigger",
@@ -129279,7 +129263,7 @@ var zeroEmailTriggerCallbackContract = c37.router({
     summary: "Handle Zero email trigger completion callbacks"
   }
 });
-var zeroEmailInboundContract = c37.router({
+var zeroEmailInboundContract = c38.router({
   post: {
     method: "POST",
     path: "/api/zero/email/inbound",
@@ -129299,8 +129283,8 @@ var zeroEmailInboundContract = c37.router({
 
 // ../../packages/api-contracts/src/contracts/auth.ts
 init_esm_shims();
-var c38 = initContract();
-var authContract = c38.router({
+var c39 = initContract();
+var authContract = c39.router({
   /**
    * GET /api/auth/me
    * Get current user information
@@ -129325,7 +129309,7 @@ var authContract = c38.router({
 
 // ../../packages/api-contracts/src/contracts/user-export.ts
 init_esm_shims();
-var c39 = initContract();
+var c40 = initContract();
 var exportJobStatusSchema = external_exports.enum([
   "pending",
   "running",
@@ -129350,7 +129334,7 @@ var userExportStartResponseSchema = external_exports.object({
   jobId: external_exports.string().uuid(),
   status: external_exports.enum(["pending", "running"])
 });
-var userExportContract = c39.router({
+var userExportContract = c40.router({
   get: {
     method: "GET",
     path: "/api/user/export",
@@ -129381,7 +129365,7 @@ var userExportContract = c39.router({
 
 // ../../packages/api-contracts/src/contracts/email-unsubscribe.ts
 init_esm_shims();
-var c40 = initContract();
+var c41 = initContract();
 var emailUnsubscribeQuerySchema = external_exports.object({
   token: external_exports.string().optional()
 });
@@ -129391,13 +129375,13 @@ var emailUnsubscribeResponseSchema = external_exports.object({
 var emailUnsubscribeErrorSchema = external_exports.object({
   error: external_exports.string()
 });
-var emailUnsubscribeContract = c40.router({
+var emailUnsubscribeContract = c41.router({
   get: {
     method: "GET",
     path: "/api/email/unsubscribe",
     query: emailUnsubscribeQuerySchema,
     responses: {
-      200: c40.otherResponse({
+      200: c41.otherResponse({
         contentType: "text/html",
         body: external_exports.unknown()
       }),
@@ -129420,8 +129404,8 @@ var emailUnsubscribeContract = c40.router({
 
 // ../../packages/api-contracts/src/contracts/connectors-type-callback.ts
 init_esm_shims();
-var c41 = initContract();
-var connectorsTypeCallbackContract = c41.router({
+var c42 = initContract();
+var connectorsTypeCallbackContract = c42.router({
   callback: {
     method: "GET",
     path: "/api/connectors/:type/callback",
@@ -129434,7 +129418,7 @@ var connectorsTypeCallbackContract = c41.router({
       error_description: external_exports.string().optional()
     }),
     responses: {
-      307: c41.noBody()
+      307: c42.noBody()
     },
     summary: "Complete connector OAuth authorization"
   }
@@ -129442,7 +129426,7 @@ var connectorsTypeCallbackContract = c41.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-authorize.ts
 init_esm_shims();
-var c42 = initContract();
+var c43 = initContract();
 var testOAuthProviderAuthorizeErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -129454,13 +129438,13 @@ var testOAuthProviderAuthorizeQuerySchema = external_exports.object({
   scope: external_exports.string().optional(),
   state: external_exports.string().optional()
 });
-var testOAuthProviderAuthorizeContract = c42.router({
+var testOAuthProviderAuthorizeContract = c43.router({
   authorize: {
     method: "GET",
     path: "/api/test/oauth-provider/authorize",
     query: testOAuthProviderAuthorizeQuerySchema,
     responses: {
-      302: c42.noBody(),
+      302: c43.noBody(),
       400: testOAuthProviderAuthorizeErrorSchema,
       404: external_exports.string()
     },
@@ -129470,7 +129454,7 @@ var testOAuthProviderAuthorizeContract = c42.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-echo.ts
 init_esm_shims();
-var c43 = initContract();
+var c44 = initContract();
 var testOAuthProviderEchoErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -129478,7 +129462,7 @@ var testOAuthProviderEchoResponseSchema = external_exports.object({
   authorization: external_exports.string(),
   receivedAt: external_exports.string()
 });
-var testOAuthProviderEchoContract = c43.router({
+var testOAuthProviderEchoContract = c44.router({
   echo: {
     method: "GET",
     path: "/api/test/oauth-provider/echo",
@@ -129493,7 +129477,7 @@ var testOAuthProviderEchoContract = c43.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-token.ts
 init_esm_shims();
-var c44 = initContract();
+var c45 = initContract();
 var testOAuthProviderTokenErrorSchema = external_exports.object({
   error: external_exports.string(),
   error_description: external_exports.string().optional()
@@ -129505,11 +129489,11 @@ var testOAuthProviderTokenResponseSchema = external_exports.object({
   expires_in: external_exports.number(),
   scope: external_exports.string()
 });
-var testOAuthProviderTokenContract = c44.router({
+var testOAuthProviderTokenContract = c45.router({
   token: {
     method: "POST",
     path: "/api/test/oauth-provider/token",
-    body: c44.type(),
+    body: c45.type(),
     responses: {
       200: testOAuthProviderTokenResponseSchema,
       400: testOAuthProviderTokenErrorSchema,
@@ -129522,7 +129506,7 @@ var testOAuthProviderTokenContract = c44.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-device-auth.ts
 init_esm_shims();
-var c45 = initContract();
+var c46 = initContract();
 var testOAuthProviderDeviceAuthErrorSchema = external_exports.object({
   error: external_exports.string(),
   error_description: external_exports.string().optional()
@@ -129535,11 +129519,11 @@ var testOAuthProviderDeviceAuthResponseSchema = external_exports.object({
   expires_in: external_exports.number(),
   interval: external_exports.number()
 });
-var testOAuthProviderDeviceAuthContract = c45.router({
+var testOAuthProviderDeviceAuthContract = c46.router({
   deviceAuth: {
     method: "POST",
     path: "/api/test/oauth-provider/device/code",
-    body: c45.type(),
+    body: c46.type(),
     responses: {
       200: testOAuthProviderDeviceAuthResponseSchema,
       400: testOAuthProviderDeviceAuthErrorSchema,
@@ -129552,7 +129536,7 @@ var testOAuthProviderDeviceAuthContract = c45.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-userinfo.ts
 init_esm_shims();
-var c46 = initContract();
+var c47 = initContract();
 var testOAuthProviderUserinfoErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -129561,7 +129545,7 @@ var testOAuthProviderUserinfoResponseSchema = external_exports.object({
   id: external_exports.string(),
   username: external_exports.string()
 });
-var testOAuthProviderUserinfoContract = c46.router({
+var testOAuthProviderUserinfoContract = c47.router({
   userinfo: {
     method: "GET",
     path: "/api/test/oauth-provider/userinfo",
@@ -129576,7 +129560,7 @@ var testOAuthProviderUserinfoContract = c46.router({
 
 // ../../packages/api-contracts/src/contracts/test-slack-dispatch-probe.ts
 init_esm_shims();
-var c47 = initContract();
+var c48 = initContract();
 var testSlackDispatchProbeBodySchema = external_exports.object({
   team_id: external_exports.string(),
   channel_id: external_exports.string(),
@@ -129604,7 +129588,7 @@ var testSlackDispatchProbeResponseSchema = external_exports.union([
   testSlackDispatchProbeSuccessResponseSchema,
   testSlackDispatchProbeFailureResponseSchema
 ]);
-var testSlackDispatchProbeContract = c47.router({
+var testSlackDispatchProbeContract = c48.router({
   post: {
     method: "POST",
     path: "/api/test/slack-dispatch-probe",
@@ -129620,7 +129604,7 @@ var testSlackDispatchProbeContract = c47.router({
 
 // ../../packages/api-contracts/src/contracts/test-slack-state.ts
 init_esm_shims();
-var c48 = initContract();
+var c49 = initContract();
 var testSlackStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -129705,7 +129689,7 @@ var testSlackStateResponseSchema = external_exports.object({
     })
   )
 });
-var testSlackStateContract = c48.router({
+var testSlackStateContract = c49.router({
   get: {
     method: "GET",
     path: "/api/test/slack-state",
@@ -129747,7 +129731,7 @@ var testSlackStateContract = c48.router({
 
 // ../../packages/api-contracts/src/contracts/test-slack-mock.ts
 init_esm_shims();
-var c49 = initContract();
+var c50 = initContract();
 var slackMockRequestBodySchema = external_exports.unknown().optional();
 var slackMockNotFoundSchema = external_exports.string();
 var testSlackMockOkResponseSchema = external_exports.object({
@@ -129813,7 +129797,7 @@ var testSlackMockUsersInfoResponseSchema = testSlackMockOkResponseSchema.extend(
     })
   })
 });
-var testSlackMockContract = c49.router({
+var testSlackMockContract = c50.router({
   assistantThreadsSetStatus: {
     method: "POST",
     path: "/api/test/slack-mock/assistant.threads.setStatus",
@@ -129918,7 +129902,7 @@ var testSlackMockContract = c49.router({
 
 // ../../packages/api-contracts/src/contracts/test-telegram-mock.ts
 init_esm_shims();
-var c50 = initContract();
+var c51 = initContract();
 var testTelegramMockPathParamsSchema = external_exports.object({
   botToken: external_exports.string(),
   method: external_exports.string()
@@ -129931,7 +129915,7 @@ var testTelegramMockErrorResponseSchema = external_exports.object({
   ok: external_exports.literal(false),
   description: external_exports.string()
 });
-var testTelegramMockContract = c50.router({
+var testTelegramMockContract = c51.router({
   post: {
     method: "POST",
     path: "/api/test/telegram-mock/:botToken/:method",
@@ -129947,7 +129931,7 @@ var testTelegramMockContract = c50.router({
 
 // ../../packages/api-contracts/src/contracts/test-telegram-state.ts
 init_esm_shims();
-var c51 = initContract();
+var c52 = initContract();
 var testTelegramStateQuerySchema = external_exports.object({
   bot_id: external_exports.string().optional()
 });
@@ -129989,7 +129973,7 @@ var testTelegramStateSeedResponseSchema = external_exports.object({
   user_link_id: external_exports.string().nullable(),
   default_agent_id: external_exports.string()
 });
-var testTelegramStateContract = c51.router({
+var testTelegramStateContract = c52.router({
   get: {
     method: "GET",
     path: "/api/test/telegram-state",
@@ -130027,7 +130011,7 @@ var testTelegramStateContract = c51.router({
 
 // ../../packages/api-contracts/src/contracts/internal-event-consumers.ts
 init_esm_shims();
-var c52 = initContract();
+var c53 = initContract();
 var eventConsumerHeadersSchema = external_exports.object({
   "x-vm0-signature": external_exports.string().optional(),
   "x-vm0-timestamp": external_exports.string().optional()
@@ -130047,7 +130031,7 @@ var eventConsumerPayloadSchema = external_exports.object({
 var eventConsumerUnauthorizedSchema = external_exports.object({
   error: external_exports.string()
 });
-var internalEventConsumerTelegramTypingContract = c52.router({
+var internalEventConsumerTelegramTypingContract = c53.router({
   refresh: {
     method: "POST",
     path: "/api/internal/event-consumers/telegram-typing",
@@ -130060,7 +130044,7 @@ var internalEventConsumerTelegramTypingContract = c52.router({
     summary: "Refresh Telegram typing indicators for all pending callbacks of a run"
   }
 });
-var internalEventConsumerAgentPhoneTypingContract = c52.router({
+var internalEventConsumerAgentPhoneTypingContract = c53.router({
   refresh: {
     method: "POST",
     path: "/api/internal/event-consumers/agentphone-typing",
@@ -130073,7 +130057,7 @@ var internalEventConsumerAgentPhoneTypingContract = c52.router({
     summary: "Refresh AgentPhone typing indicators for all pending iMessage callbacks of a run"
   }
 });
-var internalEventConsumerAxiomContract = c52.router({
+var internalEventConsumerAxiomContract = c53.router({
   ingest: {
     method: "POST",
     path: "/api/internal/event-consumers/axiom",
@@ -130087,7 +130071,7 @@ var internalEventConsumerAxiomContract = c52.router({
     summary: "Ingest agent run events into Axiom"
   }
 });
-var internalEventConsumerChatAssistantContract = c52.router({
+var internalEventConsumerChatAssistantContract = c53.router({
   process: {
     method: "POST",
     path: "/api/internal/event-consumers/chat-assistant",
@@ -130103,7 +130087,7 @@ var internalEventConsumerChatAssistantContract = c52.router({
 
 // ../../packages/api-contracts/src/contracts/cron.ts
 init_esm_shims();
-var c53 = initContract();
+var c54 = initContract();
 var cleanupResultSchema = external_exports.object({
   runId: external_exports.string(),
   sandboxId: external_exports.string().nullable(),
@@ -130118,7 +130102,7 @@ var cleanupResponseSchema = external_exports.object({
   exportJobsCleaned: external_exports.number(),
   exportJobsStuck: external_exports.number()
 });
-var cronCleanupSandboxesContract = c53.router({
+var cronCleanupSandboxesContract = c54.router({
   /**
    * GET /api/cron/cleanup-sandboxes
    * Cron job to cleanup sandboxes that have stopped sending heartbeats
@@ -130185,7 +130169,7 @@ var cronAggregateInsightsResponseSchema = external_exports.union([
   cronAggregateInsightsSkippedResponseSchema,
   cronAggregateInsightsAggregatedResponseSchema
 ]);
-var cronAggregateUsageContract = c53.router({
+var cronAggregateUsageContract = c54.router({
   aggregate: {
     method: "GET",
     path: "/api/cron/aggregate-usage",
@@ -130197,7 +130181,7 @@ var cronAggregateUsageContract = c53.router({
     summary: "Aggregate daily usage cache"
   }
 });
-var cronProcessUsageEventsContract = c53.router({
+var cronProcessUsageEventsContract = c54.router({
   process: {
     method: "GET",
     path: "/api/cron/process-usage-events",
@@ -130209,7 +130193,7 @@ var cronProcessUsageEventsContract = c53.router({
     summary: "Process pending usage events"
   }
 });
-var cronReconcileBillingEntitlementsContract = c53.router({
+var cronReconcileBillingEntitlementsContract = c54.router({
   reconcile: {
     method: "GET",
     path: "/api/cron/reconcile-billing-entitlements",
@@ -130221,7 +130205,7 @@ var cronReconcileBillingEntitlementsContract = c53.router({
     summary: "Reconcile billing entitlements"
   }
 });
-var cronTelegramCleanupContract = c53.router({
+var cronTelegramCleanupContract = c54.router({
   cleanup: {
     method: "GET",
     path: "/api/cron/telegram-cleanup",
@@ -130233,7 +130217,7 @@ var cronTelegramCleanupContract = c53.router({
     summary: "Delete expired Telegram messages"
   }
 });
-var cronComputerUseScreenshotCleanupContract = c53.router({
+var cronComputerUseScreenshotCleanupContract = c54.router({
   cleanup: {
     method: "GET",
     path: "/api/cron/computer-use-screenshot-cleanup",
@@ -130245,7 +130229,7 @@ var cronComputerUseScreenshotCleanupContract = c53.router({
     summary: "Delete expired desktop computer-use screenshots"
   }
 });
-var cronDrainEmailOutboxContract = c53.router({
+var cronDrainEmailOutboxContract = c54.router({
   drain: {
     method: "GET",
     path: "/api/cron/drain-email-outbox",
@@ -130257,7 +130241,7 @@ var cronDrainEmailOutboxContract = c53.router({
     summary: "Drain pending email outbox messages"
   }
 });
-var cronSyncSkillsContract = c53.router({
+var cronSyncSkillsContract = c54.router({
   sync: {
     method: "GET",
     path: "/api/cron/sync-skills",
@@ -130269,7 +130253,7 @@ var cronSyncSkillsContract = c53.router({
     summary: "Sync official skills from the skills repository"
   }
 });
-var cronExecuteSchedulesContract = c53.router({
+var cronExecuteSchedulesContract = c54.router({
   execute: {
     method: "GET",
     path: "/api/cron/execute-schedules",
@@ -130281,7 +130265,7 @@ var cronExecuteSchedulesContract = c53.router({
     summary: "Execute due schedules"
   }
 });
-var cronAggregateInsightsContract = c53.router({
+var cronAggregateInsightsContract = c54.router({
   aggregate: {
     method: "GET",
     path: "/api/cron/aggregate-insights",
@@ -130296,7 +130280,7 @@ var cronAggregateInsightsContract = c53.router({
 
 // ../../packages/api-contracts/src/contracts/chat-threads-v1.ts
 init_esm_shims();
-var c54 = initContract();
+var c55 = initContract();
 var v1ThreadSchema = external_exports.object({
   id: external_exports.string(),
   title: external_exports.string().nullable(),
@@ -130310,7 +130294,7 @@ var v1MessageSchema = external_exports.object({
   error: external_exports.string().optional(),
   createdAt: external_exports.string()
 });
-var chatThreadV1GetContract = c54.router({
+var chatThreadV1GetContract = c55.router({
   get: {
     method: "GET",
     path: "/api/v1/chat-threads/:threadId",
@@ -130325,7 +130309,7 @@ var chatThreadV1GetContract = c54.router({
     summary: "Get a chat thread"
   }
 });
-var chatThreadV1MessagesContract = c54.router({
+var chatThreadV1MessagesContract = c55.router({
   list: {
     method: "GET",
     path: "/api/v1/chat-threads/:threadId/messages",
@@ -130345,7 +130329,7 @@ var chatThreadV1MessagesContract = c54.router({
     summary: "List messages in a chat thread"
   }
 });
-var chatThreadV1SendContract = c54.router({
+var chatThreadV1SendContract = c55.router({
   send: {
     method: "POST",
     path: "/api/v1/chat-threads/messages",
@@ -130376,7 +130360,7 @@ var chatThreadV1SendContract = c54.router({
 
 // ../../packages/api-contracts/src/contracts/device-token.ts
 init_esm_shims();
-var c55 = initContract();
+var c56 = initContract();
 var bb0DeviceCodeSchema = external_exports.string().regex(/^[A-Z2-9]{4}-[A-Z2-9]{4}$/);
 var bleSessionNonceSchema = external_exports.string().min(16).max(128).regex(/^[A-Za-z0-9._:-]+$/);
 var pollTokenSchema = external_exports.string().min(32).max(256).regex(/^[A-Za-z0-9._-]+$/);
@@ -130415,7 +130399,7 @@ var confirmBb0DeviceRequestSchema = external_exports.object({
 var confirmBb0DeviceResponseSchema = external_exports.object({
   status: external_exports.literal("approved")
 });
-var deviceTokenContract = c55.router({
+var deviceTokenContract = c56.router({
   create: {
     method: "POST",
     path: "/api/device-token",
@@ -130440,7 +130424,7 @@ var deviceTokenContract = c55.router({
     summary: "Poll a bb0 device code for approval and final credentials"
   }
 });
-var bb0DeviceConfirmContract = c55.router({
+var bb0DeviceConfirmContract = c56.router({
   confirm: {
     method: "POST",
     path: "/api/zero/devices/bb0/confirm",
@@ -130459,16 +130443,16 @@ var bb0DeviceConfirmContract = c55.router({
 
 // ../../packages/api-contracts/src/contracts/audio-transcriptions-v1.ts
 init_esm_shims();
-var c56 = initContract();
+var c57 = initContract();
 var audioTranscriptionV1Schema = external_exports.object({
   text: external_exports.string()
 });
-var audioTranscriptionsV1Contract = c56.router({
+var audioTranscriptionsV1Contract = c57.router({
   transcribe: {
     method: "POST",
     path: "/api/v1/audio/transcriptions",
     headers: authHeadersSchema,
-    body: c56.type(),
+    body: c57.type(),
     responses: {
       200: audioTranscriptionV1Schema,
       400: apiErrorSchema,
@@ -130485,7 +130469,7 @@ var audioTranscriptionsV1Contract = c56.router({
 
 // ../../packages/api-contracts/src/contracts/generate-image.ts
 init_esm_shims();
-var c57 = initContract();
+var c58 = initContract();
 var generateImageRequestSchema = external_exports.object({
   prompt: external_exports.unknown().optional()
 }).passthrough();
@@ -130496,7 +130480,7 @@ var generatedImageSchema = external_exports.object({
 var generateImageResponseSchema = external_exports.object({
   images: external_exports.array(generatedImageSchema)
 });
-var generateImageContract = c57.router({
+var generateImageContract = c58.router({
   post: {
     method: "POST",
     path: "/api/generate-image",
@@ -130516,7 +130500,7 @@ var generateImageContract = c57.router({
 
 // ../../packages/api-contracts/src/contracts/realtime.ts
 init_esm_shims();
-var c58 = initContract();
+var c59 = initContract();
 var ablyTokenRequestSchema = external_exports.object({
   keyName: external_exports.string(),
   ttl: external_exports.number().optional(),
@@ -130526,7 +130510,7 @@ var ablyTokenRequestSchema = external_exports.object({
   nonce: external_exports.string(),
   mac: external_exports.string()
 });
-var runnerRealtimeTokenContract = c58.router({
+var runnerRealtimeTokenContract = c59.router({
   /**
    * POST /api/runners/realtime/token
    * Get an Ably token to subscribe to a runner group's job notification channel
@@ -130548,7 +130532,7 @@ var runnerRealtimeTokenContract = c58.router({
     summary: "Get Ably token for runner group job notifications"
   }
 });
-var platformRealtimeTokenContract = c58.router({
+var platformRealtimeTokenContract = c59.router({
   /**
    * POST /api/zero/realtime/token
    * Get an Ably token to subscribe to the authenticated user's push channel
@@ -131176,14 +131160,14 @@ function findMatchingPermissions(method, path3, config4, options = {}) {
 
 // ../../packages/api-contracts/src/contracts/zero-feature-switches.ts
 init_esm_shims();
-var c59 = initContract();
+var c60 = initContract();
 var featureSwitchesResponseSchema = external_exports.object({
   switches: external_exports.record(external_exports.string(), external_exports.boolean())
 });
 var updateFeatureSwitchesRequestSchema = external_exports.object({
   switches: external_exports.record(external_exports.string(), external_exports.boolean())
 });
-var zeroFeatureSwitchesContract = c59.router({
+var zeroFeatureSwitchesContract = c60.router({
   get: {
     method: "GET",
     path: "/api/zero/feature-switches",
@@ -131212,7 +131196,7 @@ var zeroFeatureSwitchesContract = c59.router({
     method: "DELETE",
     path: "/api/zero/feature-switches",
     headers: authHeadersSchema,
-    body: c59.noBody(),
+    body: c60.noBody(),
     responses: {
       200: external_exports.object({ deleted: external_exports.literal(true) }),
       401: apiErrorSchema,
@@ -131224,7 +131208,7 @@ var zeroFeatureSwitchesContract = c59.router({
 
 // ../../packages/api-contracts/src/contracts/zero-memory.ts
 init_esm_shims();
-var c60 = initContract();
+var c61 = initContract();
 var memoryFileSchema = external_exports.object({
   path: external_exports.string(),
   size: external_exports.number()
@@ -131242,7 +131226,7 @@ var memoryDetailResponseSchema = external_exports.object({
   files: external_exports.array(memoryFileSchema),
   fileContents: external_exports.array(memoryFileContentSchema)
 });
-var zeroMemoryContract = c60.router({
+var zeroMemoryContract = c61.router({
   get: {
     method: "GET",
     path: "/api/zero/memory",
@@ -131258,7 +131242,7 @@ var zeroMemoryContract = c60.router({
 
 // ../../packages/api-contracts/src/contracts/onboarding.ts
 init_esm_shims();
-var c61 = initContract();
+var c62 = initContract();
 var onboardingStatusResponseSchema = external_exports.object({
   needsOnboarding: external_exports.boolean(),
   isAdmin: external_exports.boolean(),
@@ -131271,7 +131255,7 @@ var onboardingStatusResponseSchema = external_exports.object({
     sound: external_exports.string().optional()
   }).nullable()
 });
-var onboardingStatusContract = c61.router({
+var onboardingStatusContract = c62.router({
   getStatus: {
     method: "GET",
     path: "/api/zero/onboarding/status",
@@ -131283,7 +131267,7 @@ var onboardingStatusContract = c61.router({
     summary: "Get onboarding status for current user"
   }
 });
-var onboardingSetupContract = c61.router({
+var onboardingSetupContract = c62.router({
   setup: {
     method: "POST",
     path: "/api/zero/onboarding/setup",
@@ -131315,62 +131299,6 @@ var skillFrontmatterSchema = external_exports.object({
   description: external_exports.string().optional()
 });
 
-// ../../packages/api-contracts/src/contracts/zero-user-permission-grants.ts
-init_esm_shims();
-var c62 = initContract();
-var agentIdSchema = external_exports.string().uuid();
-var connectorRefSchema = external_exports.string().min(1).max(64);
-var permissionSchema = external_exports.string().min(1).max(128);
-var userPermissionGrantActionSchema = external_exports.enum(["allow", "deny"]);
-var userPermissionGrantResponseSchema = external_exports.object({
-  agentId: agentIdSchema,
-  connectorRef: connectorRefSchema,
-  permission: permissionSchema,
-  action: userPermissionGrantActionSchema,
-  expiresAt: external_exports.string().nullable(),
-  createdAt: external_exports.string(),
-  updatedAt: external_exports.string()
-});
-var listUserPermissionGrantsQuerySchema = external_exports.object({
-  agentId: agentIdSchema
-});
-var upsertUserPermissionGrantRequestSchema = external_exports.object({
-  agentId: agentIdSchema,
-  connectorRef: connectorRefSchema,
-  permission: permissionSchema,
-  action: userPermissionGrantActionSchema
-});
-var zeroUserPermissionGrantsContract = c62.router({
-  list: {
-    method: "GET",
-    path: "/api/zero/user-permission-grants",
-    headers: authHeadersSchema,
-    query: listUserPermissionGrantsQuerySchema,
-    responses: {
-      200: external_exports.array(userPermissionGrantResponseSchema),
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      403: apiErrorSchema,
-      404: apiErrorSchema
-    },
-    summary: "List current user's active permission grants for an agent"
-  },
-  upsert: {
-    method: "PUT",
-    path: "/api/zero/user-permission-grants",
-    headers: authHeadersSchema,
-    body: upsertUserPermissionGrantRequestSchema,
-    responses: {
-      200: userPermissionGrantResponseSchema,
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      403: apiErrorSchema,
-      404: apiErrorSchema
-    },
-    summary: "Upsert current user's permission grant for an agent"
-  }
-});
-
 // ../../packages/api-contracts/src/contracts/zero-codex-device-auth.ts
 init_esm_shims();
 var c63 = initContract();
@@ -134056,12 +133984,6 @@ var FEATURE_SWITCHES = {
     description: "Reveal activity debug surfaces, activity log navigation, appended system prompts, and Debug preferences",
     enabled: false
   },
-  ["userPermissionGrants" /* UserPermissionGrants */]: {
-    maintainer: "liangyou@vm0.ai",
-    description: "Gate the per-user Zero firewall permission grant rollout. Staff-only while the grant backfill and rollout verification complete.",
-    enabled: false,
-    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
-  },
   ["computerUse" /* ComputerUse */]: {
     maintainer: "ethan@vm0.ai",
     description: "Enable remote desktop host registration",
@@ -135553,7 +135475,6 @@ export {
   Option,
   configureGlobalProxyFromEnv,
   source_default,
-  decodeCliTokenPayload,
   decodeZeroTokenPayload,
   loadConfig,
   saveConfig,
@@ -135630,6 +135551,7 @@ export {
   deleteZeroAgent,
   getZeroAgentInstructions,
   getZeroAgentUserConnectors,
+  listZeroUserPermissionGrants,
   updateZeroAgentInstructions,
   listSkills,
   createSkill,
@@ -135717,6 +135639,7 @@ export {
   isFirewallConnectorType,
   getConnectorFirewall,
   resolveFirewallPolicies,
+  permissionGrantsToFirewallPolicies,
   matchFirewallBaseUrl,
   findMatchingPermissions,
   parseEvent,
@@ -135746,4 +135669,4 @@ undici/lib/web/fetch/body.js:
 undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
-//# sourceMappingURL=chunk-GBLGZMXM.js.map
+//# sourceMappingURL=chunk-Z5VRB237.js.map