@vm0/cli 9.216.0 → 9.217.1

package/{agent-BOESNJTO.js → agent-XRGESF2G.js}

@@ -4,14 +4,15 @@ const require = __createRequire(import.meta.url);
 import {
   loadConnectorPermissionInfos,
   policyIcon
-} from "./chunk-GPPNNNQY.js";
+} from "./chunk-4MIRUOTC.js";
 import {
   permissionGrantsToFirewallPolicies
-} from "./chunk-2K3VV6M7.js";
+} from "./chunk-FDEC2TSK.js";
 import {
   isInteractive,
   promptConfirm
 } from "./chunk-JFY6GK7Y.js";
+import "./chunk-LTDQISD7.js";
 import {
   createZeroAgent,
   deleteZeroAgent,
@@ -23,8 +24,7 @@ import {
   listZeroUserPermissionGrants,
   updateZeroAgent,
   updateZeroAgentInstructions
-} from "./chunk-BXXT44X3.js";
-import "./chunk-LTDQISD7.js";
+} from "./chunk-5NIWPEYU.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -595,4 +595,4 @@ Notes:
 export {
   zeroAgentCommand
 };
-//# sourceMappingURL=agent-BOESNJTO.js.map
+//# sourceMappingURL=agent-XRGESF2G.js.map

package/{automation-PY6RNYCZ.js → automation-GDW672NH.js}

@@ -12,6 +12,7 @@ import {
   isInteractive,
   promptConfirm
 } from "./chunk-JFY6GK7Y.js";
+import "./chunk-LTDQISD7.js";
 import {
   createAutomation,
   deleteAutomation,
@@ -23,8 +24,7 @@ import {
   showAutomation,
   updateAutomation,
   updateAutomationTrigger
-} from "./chunk-BXXT44X3.js";
-import "./chunk-LTDQISD7.js";
+} from "./chunk-5NIWPEYU.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -490,4 +490,4 @@ Examples:
 export {
   zeroAutomationCommand
 };
-//# sourceMappingURL=automation-PY6RNYCZ.js.map
+//# sourceMappingURL=automation-GDW672NH.js.map

package/{banking-AXGFOQER.js → banking-6ARXS2Z6.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
+import "./chunk-LTDQISD7.js";
 import {
   callZeroBanking
-} from "./chunk-BXXT44X3.js";
-import "./chunk-LTDQISD7.js";
+} from "./chunk-5NIWPEYU.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -115,4 +115,4 @@ Notes:
 export {
   zeroBankingCommand
 };
-//# sourceMappingURL=banking-AXGFOQER.js.map
+//# sourceMappingURL=banking-6ARXS2Z6.js.map

package/{chat-6HX4S2ZF.js → chat-DFWQBUP5.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
+import "./chunk-LTDQISD7.js";
 import {
+  getZeroChatThread,
   renameZeroChatThread
-} from "./chunk-BXXT44X3.js";
-import "./chunk-LTDQISD7.js";
+} from "./chunk-5NIWPEYU.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -22,7 +23,7 @@ import {
 // src/commands/zero/chat/index.ts
 init_esm_shims();
 
-// src/commands/zero/chat/rename.ts
+// src/commands/zero/chat/get.ts
 init_esm_shims();
 function getCurrentChatThreadId() {
   return process.env.ZERO_CHAT_THREAD_ID?.trim() || void 0;
@@ -32,6 +33,46 @@ function printUsageError(message, hint) {
   console.error(source_default.dim(`  ${hint}`));
   process.exit(1);
 }
+var getCommand = new Command().name("get").description("Show the current web chat thread").option("--json", "Print machine-readable JSON").addHelpText(
+  "after",
+  `
+Examples:
+  Show this chat:    zero chat get
+  Print JSON:        zero chat get --json
+
+Notes:
+  - Uses ZERO_CHAT_THREAD_ID from the current web chat thread
+  - Authenticates via ZERO_TOKEN (requires chat-thread:read capability)`
+).action(
+  withErrorHandler(async (options) => {
+    const threadId = getCurrentChatThreadId();
+    if (!threadId) {
+      printUsageError(
+        "ZERO_CHAT_THREAD_ID is not set",
+        "Run this command from a Zero web chat thread."
+      );
+    }
+    const thread = await getZeroChatThread({ threadId });
+    if (options.json) {
+      console.log(JSON.stringify(thread));
+      return;
+    }
+    console.log(source_default.green("\u2713 Chat thread loaded"));
+    console.log(source_default.dim(`  Thread: ${thread.id}`));
+    console.log(source_default.dim(`  Title:  ${thread.title ?? "(untitled)"}`));
+  })
+);
+
+// src/commands/zero/chat/rename.ts
+init_esm_shims();
+function getCurrentChatThreadId2() {
+  return process.env.ZERO_CHAT_THREAD_ID?.trim() || void 0;
+}
+function printUsageError2(message, hint) {
+  console.error(source_default.red(`\u2717 ${message}`));
+  console.error(source_default.dim(`  ${hint}`));
+  process.exit(1);
+}
 var renameCommand = new Command().name("rename").description("Rename the current web chat thread").argument("<title...>", "New chat title").option("--json", "Print machine-readable JSON").addHelpText(
   "after",
   `
@@ -45,14 +86,14 @@ Notes:
   withErrorHandler(async (titleParts, options) => {
     const title = titleParts.join(" ").trim();
     if (!title) {
-      printUsageError(
+      printUsageError2(
         "Title is required",
         'Run: zero chat rename "New title"'
       );
     }
-    const threadId = getCurrentChatThreadId();
+    const threadId = getCurrentChatThreadId2();
     if (!threadId) {
-      printUsageError(
+      printUsageError2(
         "ZERO_CHAT_THREAD_ID is not set",
         "Run this command from a Zero web chat thread."
       );
@@ -69,13 +110,14 @@ Notes:
 );
 
 // src/commands/zero/chat/index.ts
-var zeroChatCommand = new Command().name("chat").description("Manage the current web chat thread").addCommand(renameCommand).addHelpText(
+var zeroChatCommand = new Command().name("chat").description("Manage the current web chat thread").addCommand(getCommand).addCommand(renameCommand).addHelpText(
   "after",
   `
 Examples:
+  Show this chat:    zero chat get
   Rename this chat:  zero chat rename "Launch plan"`
 );
 export {
   zeroChatCommand
 };
-//# sourceMappingURL=chat-6HX4S2ZF.js.map
+//# sourceMappingURL=chat-DFWQBUP5.js.map

package/chat-DFWQBUP5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/zero/chat/index.ts","../src/commands/zero/chat/get.ts","../src/commands/zero/chat/rename.ts"],"sourcesContent":["import { Command } from \"commander\";\n\nimport { getCommand } from \"./get\";\nimport { renameCommand } from \"./rename\";\n\nexport const zeroChatCommand = new Command()\n  .name(\"chat\")\n  .description(\"Manage the current web chat thread\")\n  .addCommand(getCommand)\n  .addCommand(renameCommand)\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  Show this chat:    zero chat get\n  Rename this chat:  zero chat rename \"Launch plan\"`,\n  );\n","import chalk from \"chalk\";\nimport { Command } from \"commander\";\n\nimport { getZeroChatThread } from \"../../../lib/api\";\nimport { withErrorHandler } from \"../../../lib/command\";\n\ninterface GetOptions {\n  readonly json?: boolean;\n}\n\nfunction getCurrentChatThreadId(): string | undefined {\n  return process.env.ZERO_CHAT_THREAD_ID?.trim() || undefined;\n}\n\nfunction printUsageError(message: string, hint: string): never {\n  console.error(chalk.red(`✗ ${message}`));\n  console.error(chalk.dim(`  ${hint}`));\n  process.exit(1);\n}\n\nexport const getCommand = new Command()\n  .name(\"get\")\n  .description(\"Show the current web chat thread\")\n  .option(\"--json\", \"Print machine-readable JSON\")\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  Show this chat:    zero chat get\n  Print JSON:        zero chat get --json\n\nNotes:\n  - Uses ZERO_CHAT_THREAD_ID from the current web chat thread\n  - Authenticates via ZERO_TOKEN (requires chat-thread:read capability)`,\n  )\n  .action(\n    withErrorHandler(async (options: GetOptions) => {\n      const threadId = getCurrentChatThreadId();\n      if (!threadId) {\n        printUsageError(\n          \"ZERO_CHAT_THREAD_ID is not set\",\n          \"Run this command from a Zero web chat thread.\",\n        );\n      }\n\n      const thread = await getZeroChatThread({ threadId });\n      if (options.json) {\n        console.log(JSON.stringify(thread));\n        return;\n      }\n\n      console.log(chalk.green(\"✓ Chat thread loaded\"));\n      console.log(chalk.dim(`  Thread: ${thread.id}`));\n      console.log(chalk.dim(`  Title:  ${thread.title ?? \"(untitled)\"}`));\n    }),\n  );\n","import chalk from \"chalk\";\nimport { Command } from \"commander\";\n\nimport { renameZeroChatThread } from \"../../../lib/api\";\nimport { withErrorHandler } from \"../../../lib/command\";\n\ninterface RenameOptions {\n  readonly json?: boolean;\n}\n\nfunction getCurrentChatThreadId(): string | undefined {\n  return process.env.ZERO_CHAT_THREAD_ID?.trim() || undefined;\n}\n\nfunction printUsageError(message: string, hint: string): never {\n  console.error(chalk.red(`✗ ${message}`));\n  console.error(chalk.dim(`  ${hint}`));\n  process.exit(1);\n}\n\nexport const renameCommand = new Command()\n  .name(\"rename\")\n  .description(\"Rename the current web chat thread\")\n  .argument(\"<title...>\", \"New chat title\")\n  .option(\"--json\", \"Print machine-readable JSON\")\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  Rename this chat:  zero chat rename \"Launch plan\"\n\nNotes:\n  - Uses ZERO_CHAT_THREAD_ID from the current web chat thread\n  - Authenticates via ZERO_TOKEN (requires chat-thread:write capability)`,\n  )\n  .action(\n    withErrorHandler(async (titleParts: string[], options: RenameOptions) => {\n      const title = titleParts.join(\" \").trim();\n      if (!title) {\n        printUsageError(\n          \"Title is required\",\n          'Run: zero chat rename \"New title\"',\n        );\n      }\n\n      const threadId = getCurrentChatThreadId();\n      if (!threadId) {\n        printUsageError(\n          \"ZERO_CHAT_THREAD_ID is not set\",\n          \"Run this command from a Zero web chat thread.\",\n        );\n      }\n\n      const result = await renameZeroChatThread({ threadId, title });\n      if (options.json) {\n        console.log(JSON.stringify(result));\n        return;\n      }\n\n      console.log(chalk.green(\"✓ Chat title updated\"));\n      console.log(chalk.dim(`  Thread: ${result.threadId}`));\n      console.log(chalk.dim(`  Title:  ${result.title}`));\n    }),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA;;;ACAA;AAUA,SAAS,yBAA6C;AACpD,SAAO,QAAQ,IAAI,qBAAqB,KAAK,KAAK;AACpD;AAEA,SAAS,gBAAgB,SAAiB,MAAqB;AAC7D,UAAQ,MAAM,eAAM,IAAI,UAAK,OAAO,EAAE,CAAC;AACvC,UAAQ,MAAM,eAAM,IAAI,KAAK,IAAI,EAAE,CAAC;AACpC,UAAQ,KAAK,CAAC;AAChB;AAEO,IAAM,aAAa,IAAI,QAAQ,EACnC,KAAK,KAAK,EACV,YAAY,kCAAkC,EAC9C,OAAO,UAAU,6BAA6B,EAC9C;AAAA,EACC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQF,EACC;AAAA,EACC,iBAAiB,OAAO,YAAwB;AAC9C,UAAM,WAAW,uBAAuB;AACxC,QAAI,CAAC,UAAU;AACb;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,kBAAkB,EAAE,SAAS,CAAC;AACnD,QAAI,QAAQ,MAAM;AAChB,cAAQ,IAAI,KAAK,UAAU,MAAM,CAAC;AAClC;AAAA,IACF;AAEA,YAAQ,IAAI,eAAM,MAAM,2BAAsB,CAAC;AAC/C,YAAQ,IAAI,eAAM,IAAI,aAAa,OAAO,EAAE,EAAE,CAAC;AAC/C,YAAQ,IAAI,eAAM,IAAI,aAAa,OAAO,SAAS,YAAY,EAAE,CAAC;AAAA,EACpE,CAAC;AACH;;;ACvDF;AAUA,SAASA,0BAA6C;AACpD,SAAO,QAAQ,IAAI,qBAAqB,KAAK,KAAK;AACpD;AAEA,SAASC,iBAAgB,SAAiB,MAAqB;AAC7D,UAAQ,MAAM,eAAM,IAAI,UAAK,OAAO,EAAE,CAAC;AACvC,UAAQ,MAAM,eAAM,IAAI,KAAK,IAAI,EAAE,CAAC;AACpC,UAAQ,KAAK,CAAC;AAChB;AAEO,IAAM,gBAAgB,IAAI,QAAQ,EACtC,KAAK,QAAQ,EACb,YAAY,oCAAoC,EAChD,SAAS,cAAc,gBAAgB,EACvC,OAAO,UAAU,6BAA6B,EAC9C;AAAA,EACC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOF,EACC;AAAA,EACC,iBAAiB,OAAO,YAAsB,YAA2B;AACvE,UAAM,QAAQ,WAAW,KAAK,GAAG,EAAE,KAAK;AACxC,QAAI,CAAC,OAAO;AACV,MAAAA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAWD,wBAAuB;AACxC,QAAI,CAAC,UAAU;AACb,MAAAC;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,qBAAqB,EAAE,UAAU,MAAM,CAAC;AAC7D,QAAI,QAAQ,MAAM;AAChB,cAAQ,IAAI,KAAK,UAAU,MAAM,CAAC;AAClC;AAAA,IACF;AAEA,YAAQ,IAAI,eAAM,MAAM,2BAAsB,CAAC;AAC/C,YAAQ,IAAI,eAAM,IAAI,aAAa,OAAO,QAAQ,EAAE,CAAC;AACrD,YAAQ,IAAI,eAAM,IAAI,aAAa,OAAO,KAAK,EAAE,CAAC;AAAA,EACpD,CAAC;AACH;;;AF1DK,IAAM,kBAAkB,IAAI,QAAQ,EACxC,KAAK,MAAM,EACX,YAAY,oCAAoC,EAChD,WAAW,UAAU,EACrB,WAAW,aAAa,EACxB;AAAA,EACC;AAAA,EACA;AAAA;AAAA;AAAA;AAIF;","names":["getCurrentChatThreadId","printUsageError"]}

package/{chunk-5EBRKXYZ.js → chunk-4HNQ562Q.js}

@@ -5,7 +5,7 @@ import {
   CONNECTOR_TYPES,
   CONNECTOR_TYPE_KEYS,
   connectorAuthMethodIdSchema
-} from "./chunk-BXXT44X3.js";
+} from "./chunk-5NIWPEYU.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -181,4 +181,4 @@ export {
   hasRequiredConnectorAuthMethodScopes,
   getConnectorAuthMethodScopeDiff
 };
-//# sourceMappingURL=chunk-5EBRKXYZ.js.map
+//# sourceMappingURL=chunk-4HNQ562Q.js.map

package/{chunk-GPPNNNQY.js → chunk-4MIRUOTC.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   loadFirewallPermissionMetadata,
   resolveFirewallMetadataPolicies
-} from "./chunk-2K3VV6M7.js";
+} from "./chunk-FDEC2TSK.js";
 import {
   source_default
 } from "./chunk-JUTUEPIR.js";
@@ -87,4 +87,4 @@ export {
   policyIcon,
   loadConnectorPermissionInfos
 };
-//# sourceMappingURL=chunk-GPPNNNQY.js.map
+//# sourceMappingURL=chunk-4MIRUOTC.js.map

package/{chunk-BXXT44X3.js → chunk-5NIWPEYU.js}

@@ -253,7 +253,7 @@ var MODEL_PROVIDER_FIREWALL_CONFIGS = {
     { name: "Authorization", valuePrefix: "Bearer" },
     MODEL_PROVIDER_ENV_PLACEHOLDERS.OPENAI_API_KEY
   ),
-  // ChatGPT OAuth provider: multi-header injection plus auth.openai.com deny.
+  // ChatGPT OAuth provider: multi-header injection plus unknown-policy auth.openai.com deny.
   "codex-oauth-token": {
     name: "model-provider:codex-oauth-token",
     apis: [
@@ -268,6 +268,7 @@ var MODEL_PROVIDER_FIREWALL_CONFIGS = {
         permissions: [
           {
             name: "codex:api",
+            description: "Access the ChatGPT Codex backend with GET and POST requests.",
             rules: ["GET /{path*}", "POST /{path*}"]
           }
         ]
@@ -275,11 +276,10 @@ var MODEL_PROVIDER_FIREWALL_CONFIGS = {
       {
         base: "https://auth.openai.com",
         auth: { headers: {} },
-        permissions: [{ name: "denied", rules: ["ANY /*"] }]
+        permissions: []
       }
     ],
     defaultPolicies: {
-      deny: ["denied"],
       unknownPolicy: "deny"
     },
     placeholders: {
@@ -3651,7 +3651,8 @@ var IPV4_NON_PUBLIC_RANGES = [
   [2130706432, 2147483647],
   [2851995648, 2852061183],
   [2886729728, 2887778303],
-  [3221225472, 3221225727],
+  [3221225472, 3221225480],
+  [3221225483, 3221225727],
   [3221225984, 3221226239],
   [3227017984, 3227018239],
   [3232235520, 3232301055],
@@ -4202,7 +4203,7 @@ function parseIpv6Address(value) {
 }
 function isPublicIpv6SpecialRegistryException(words) {
   const second = words[1];
-  if (second === 1 && words[2] === 0 && words[3] === 0 && words[4] === 0 && words[5] === 0 && words[6] === 0 && (words[7] === 1 || words[7] === 2)) {
+  if (second === 1 && words[2] === 0 && words[3] === 0 && words[4] === 0 && words[5] === 0 && words[6] === 0 && words[7] >= 1 && words[7] <= 3) {
     return true;
   }
   if (second === 3) {
@@ -4231,6 +4232,9 @@ function isPublicIpv6Address(words) {
   if (first === 8193 && second === 3512) {
     return false;
   }
+  if (first === 16383 && second <= 4095) {
+    return false;
+  }
   if (first === 8194) {
     return false;
   }
@@ -4242,13 +4246,22 @@ function hostPolicyIpLiteralIsPublic(hostname) {
     return words ? isPublicIpv6Address(words) : false;
   }
   const ipv4Parts = parseCanonicalIpv4Address(hostname);
-  return ipv4Parts ? isPublicIpv4Address(ipv4Parts) : null;
+  if (ipv4Parts) {
+    return isPublicIpv4Address(ipv4Parts);
+  }
+  const normalizedIpv4Host = normalizeHostForIpv4LiteralSyntax(hostname);
+  if (isIpv4LiteralLike(normalizedIpv4Host)) {
+    return false;
+  }
+  return null;
 }
-function providerOwnedHostMatches(hostname, hostPolicy) {
-  const exactHosts = hostPolicy.exactHosts ?? [];
-  for (const exactHost of exactHosts) {
-    if (hostname === normalizeHostPolicyHostname(exactHost)) {
-      return true;
+function providerOwnedHostMatches(hostname, hostPolicy, options = {}) {
+  if (options.allowExactHosts !== false) {
+    const exactHosts = hostPolicy.exactHosts ?? [];
+    for (const exactHost of exactHosts) {
+      if (hostname === normalizeHostPolicyHostname(exactHost)) {
+        return true;
+      }
     }
   }
   const suffixes = hostPolicy.suffixes ?? [];
@@ -4260,22 +4273,61 @@ function providerOwnedHostMatches(hostname, hostPolicy) {
   }
   return false;
 }
-function validateResolvedBaseUrlHostPolicy({
-  templateBase,
-  resolvedBase,
+function baseUrlAuthorityHasParams(base) {
+  const authority = rawAuthorityFromBaseUrl(base);
+  return authority !== null && hasBaseUrlParams(authority);
+}
+function validateHostPolicyShape(base, serviceName, hostPolicy) {
+  const result = firewallBaseHostPolicySchema.safeParse(hostPolicy);
+  if (result.success) return;
+  const message = result.error.issues.map((issue) => {
+    return issue.message;
+  }).join("; ");
+  throw new Error(
+    errMsg(base, serviceName, `hostPolicy is invalid: ${message}`)
+  );
+}
+function urlForHostPolicyValidation(base, serviceName) {
+  if (!baseUrlAuthorityHasParams(base)) return new URL(base);
+  const schemeEnd = base.indexOf("://");
+  const authority = rawAuthorityFromBaseUrl(base);
+  if (schemeEnd === -1 || authority === null) return new URL(base);
+  const authorityParts = splitParameterizedAuthority(
+    authority,
+    base,
+    serviceName
+  );
+  const host = splitAuthorityHostSegments(authorityParts.normalizedHost).map((segment2) => {
+    return hostSegmentForSyntaxValidation(segment2, base, serviceName);
+  }).join(".");
+  return new URL(
+    `${base.slice(0, schemeEnd)}://${host}${authorityParts.portSuffix}`
+  );
+}
+function validateBaseUrlHostPolicy({
+  base,
+  diagnosticBase = base,
   serviceName,
   hostPolicy
 }) {
   if (!hostPolicy) {
     return;
   }
-  const url = new URL(resolvedBase);
+  validateHostPolicyShape(diagnosticBase, serviceName, hostPolicy);
+  if (hasBaseUrlVars(base)) {
+    return;
+  }
+  const authorityHasParams = baseUrlAuthorityHasParams(base);
+  const url = urlForHostPolicyValidation(base, serviceName);
+  const rawAuthority = rawAuthorityFromBaseUrl(base);
   const hostname = normalizeHostPolicyHostname(url.hostname);
   if (hostPolicy.kind === "providerOwned") {
-    if (!providerOwnedHostMatches(hostname, hostPolicy)) {
+    if (!providerOwnedHostMatches(hostname, hostPolicy, {
+      allowExactHosts: !authorityHasParams
+    })) {
       throw new Error(
         errMsg(
-          templateBase,
+          diagnosticBase,
           serviceName,
           `host policy does not allow resolved host "${hostname}"`
         )
@@ -4284,7 +4336,7 @@ function validateResolvedBaseUrlHostPolicy({
     if (!hostPolicy.allowNonDefaultPort && url.port !== "") {
       throw new Error(
         errMsg(
-          templateBase,
+          diagnosticBase,
           serviceName,
           "host policy does not allow non-default ports"
         )
@@ -4292,11 +4344,12 @@ function validateResolvedBaseUrlHostPolicy({
     }
     return;
   }
-  const publicIpLiteral = hostPolicyIpLiteralIsPublic(hostname);
+  const publicDestinationHost = rawAuthority === null ? url.hostname : rawHostFromAuthority(rawAuthority);
+  const publicIpLiteral = hostPolicyIpLiteralIsPublic(publicDestinationHost);
   if (publicIpLiteral === false) {
     throw new Error(
       errMsg(
-        templateBase,
+        diagnosticBase,
         serviceName,
         `host policy does not allow non-public IP literal "${hostname}"`
       )
@@ -4343,9 +4396,9 @@ function resolveFirewallBaseUrlTemplate({
       serviceName,
       credentialed
     );
-    validateResolvedBaseUrlHostPolicy({
-      templateBase: base,
-      resolvedBase: resolved,
+    validateBaseUrlHostPolicy({
+      base: resolved,
+      diagnosticBase: base,
       serviceName,
       hostPolicy
     });
@@ -4380,6 +4433,7 @@ var ALLOWED_BASE_URL_SCHEMES = /* @__PURE__ */ new Set(["http", "https"]);
 var REQUIRED_AUTH_BASE_URL_SCHEME = "https";
 var WHITESPACE_PATTERN = /\s/u;
 var UNICODE_CONTROL_PATTERN = /\p{C}/u;
+var UNICODE_DECIMAL_NUMBER_PATTERN = /^\p{Decimal_Number}+$/u;
 var UNICODE_MARK_PATTERN = /\p{M}/u;
 var UNICODE_LETTER_PATTERN = /\p{L}/u;
 var GREEK_COMBINING_YPOGEGRAMMENI = "\u0345";
@@ -4464,9 +4518,7 @@ function isIpv4NumberComponent(value) {
       return isHexDigit(char);
     });
   }
-  return [...value].every((char) => {
-    return char >= "0" && char <= "9";
-  });
+  return UNICODE_DECIMAL_NUMBER_PATTERN.test(value);
 }
 function isIpv4LiteralLike(value) {
   const parts = value.split(".");
@@ -4632,6 +4684,15 @@ function validateHostPercentEncoding(host, base, serviceName) {
           errMsg(base, serviceName, "host must not contain commas")
         );
       }
+      if (char === "*") {
+        throw new Error(
+          errMsg(
+            base,
+            serviceName,
+            "host must not contain wildcard characters"
+          )
+        );
+      }
     }
     i = end - 1;
   }
@@ -4661,6 +4722,16 @@ function rawAuthorityFromBaseUrl(base) {
   const authorityEnd = delimiterIndexes.length === 0 ? -1 : Math.min(...delimiterIndexes);
   return authorityEnd === -1 ? rest : rest.slice(0, authorityEnd);
 }
+function authorityHasEmptyPort(authority) {
+  if (authority.startsWith("[")) {
+    const closeBracket = authority.indexOf("]");
+    if (closeBracket === -1) return false;
+    return authority.slice(closeBracket + 1) === ":";
+  }
+  const portSeparator = authority.lastIndexOf(":");
+  if (portSeparator === -1) return false;
+  return authority.indexOf(":") === portSeparator && portSeparator === authority.length - 1;
+}
 function validateNoUserinfo(authority, base, serviceName) {
   if (authority.includes("@")) {
     throw new Error(errMsg(base, serviceName, "must not contain userinfo"));
@@ -4790,6 +4861,25 @@ function splitParameterizedAuthority(authority, base, serviceName) {
 function validateStaticHostLabels(hostname, base, serviceName) {
   if (hostname.startsWith("[") && hostname.endsWith("]")) return;
   validateHostHasNoEmptyLabels(hostname, base, serviceName);
+  validateHostHasNoRawWildcards(hostname, base, serviceName);
+}
+function hostSegmentHasRawWildcard(segment2) {
+  const parsed = parseSegment(segment2);
+  if (parsed.kind === "literal") return parsed.value.includes("*");
+  if (parsed.kind === "param") {
+    return parsed.prefix.includes("*") || parsed.suffix.includes("*");
+  }
+  return false;
+}
+function validateHostHasNoRawWildcards(host, base, serviceName) {
+  if (host.startsWith("[") && host.endsWith("]")) return;
+  for (const segment2 of host.replace(HOST_DOT_EQUIVALENT_PATTERN, ".").split(".")) {
+    if (hostSegmentHasRawWildcard(segment2)) {
+      throw new Error(
+        errMsg(base, serviceName, "host must not contain wildcard characters")
+      );
+    }
+  }
 }
 function hostSegmentForSyntaxValidation(seg, base, svc) {
   const parsed = parseSegment(seg);
@@ -4908,6 +4998,9 @@ function validateBaseUrlParams(base, serviceName) {
   const slashIdx = rest.indexOf("/");
   const host = slashIdx === -1 ? rest : rest.slice(0, slashIdx);
   const path = slashIdx === -1 ? "" : rest.slice(slashIdx);
+  if (authorityHasEmptyPort(host)) {
+    throw new Error(errMsg(base, serviceName, "not a valid URL authority"));
+  }
   validateNoUserinfo(host, base, serviceName);
   validateHostPercentEncoding(host, base, serviceName);
   const authority = splitParameterizedAuthority(host, base, serviceName);
@@ -4921,6 +5014,7 @@ function validateBaseUrlParams(base, serviceName) {
     base,
     serviceName
   );
+  validateHostHasNoRawWildcards(authority.normalizedHost, base, serviceName);
   validateParameterizedHostUrlSyntax(
     base.slice(0, schemeEnd),
     authority,
@@ -4992,6 +5086,11 @@ function validateBaseUrl(base, serviceName) {
         `Invalid base URL "${base}" in firewall "${serviceName}": not a valid URL authority`
       );
     }
+    if (authorityHasEmptyPort(authority)) {
+      throw new Error(
+        `Invalid base URL "${base}" in firewall "${serviceName}": not a valid URL authority`
+      );
+    }
     validateNoUserinfo(authority, base, serviceName);
     validateHostPercentEncoding(authority, base, serviceName);
     validateHostHasCanonicalIpv4Syntax(authority, base, serviceName);
@@ -6280,6 +6379,12 @@ var chatThreadDetailSchema = external_exports.object({
   activeRunIds: external_exports.array(external_exports.string()),
   createdAt: external_exports.string(),
   updatedAt: external_exports.string(),
+  /**
+   * ISO timestamp at which the user pinned this thread. Exposed on detail so
+   * the current thread can be placed in the correct sidebar segment even when
+   * it is omitted from the paged list response.
+   */
+  pinnedAt: external_exports.string().nullable().optional(),
   draftContent: external_exports.string().nullable().optional(),
   draftAttachments: external_exports.array(persistedAttachmentSchema).nullable().optional(),
   computerUseHostId: external_exports.string().uuid().nullable().optional(),
@@ -6299,6 +6404,10 @@ var chatThreadDetailSchema = external_exports.object({
    */
   renamedAt: external_exports.string().nullable().optional()
 });
+var chatThreadMetadataSchema = external_exports.object({
+  id: external_exports.string(),
+  title: external_exports.string().nullable()
+});
 var modelSelectionRequestSchema = external_exports.object({
   modelProviderId: external_exports.string().uuid(),
   selectedModel: external_exports.string().min(1)
@@ -6343,7 +6452,12 @@ var chatThreadsContract = c15.router({
        * `pinned` is empty (pinned threads are only included on the first
        * page) and `threads` continues from the position after the cursor.
        */
-      cursor: external_exports.string().optional()
+      cursor: external_exports.string().optional(),
+      /**
+       * Optional server-side list filter. `unread` returns only threads whose
+       * latest visible message is newer than the caller's read cursor.
+       */
+      filter: external_exports.enum(["unread"]).optional()
     }),
     responses: {
       200: external_exports.object({
@@ -6546,6 +6660,22 @@ var chatThreadRenameContract = c15.router({
     summary: "Rename a chat thread (suppresses automated title generation)"
   }
 });
+var chatThreadMetadataContract = c15.router({
+  get: {
+    method: "GET",
+    path: "/api/zero/chat-threads/:id/metadata",
+    headers: authHeadersSchema,
+    pathParams: chatThreadIdPathParamsSchema,
+    responses: {
+      200: chatThreadMetadataSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get chat thread metadata"
+  }
+});
 var chatThreadModelSelectionContract = c15.router({
   update: {
     method: "POST",
@@ -17238,6 +17368,45 @@ var perplexity = {
   }
 };
 
+// ../../packages/connectors/src/connectors/pexels.ts
+init_esm_shims();
+var pexels = {
+  pexels: {
+    label: "Pexels",
+    category: "marketing-content-growth",
+    helpText: "Connect Pexels to search, download, and insert stock photos and videos into artifacts. Keep Pexels and photographer attribution with generated artifacts, and avoid bulk downloading or rebuilding a stock photo or wallpaper library.",
+    tags: ["stock-photos", "stock-videos", "images", "media"],
+    authMethods: {
+      "api-token": {
+        label: "API Key",
+        featureFlag: "pexelsConnector" /* PexelsConnector */,
+        helpText: "1. Sign in to [Pexels](https://www.pexels.com)\n2. Open the [Pexels API page](https://www.pexels.com/api/) and request or copy your API key\n3. Paste the key here\n\nvm0 stores the key as a secret and automatically attaches it when calling the Pexels API. Pexels asks API users to include a prominent Pexels link and, where possible, photographer credit when displaying content.",
+        storage: {
+          secrets: ["PEXELS_API_KEY"],
+          variables: []
+        },
+        grant: {
+          kind: "manual",
+          fields: {
+            PEXELS_API_KEY: {
+              label: "API Key",
+              required: true,
+              placeholder: "your-pexels-api-key"
+            }
+          }
+        },
+        access: {
+          kind: "static",
+          envBindings: {
+            PEXELS_API_KEY: "$secrets.PEXELS_API_KEY"
+          }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/pika.ts
 init_esm_shims();
 var pika = {
@@ -21020,6 +21189,7 @@ var CONNECTOR_TYPES_DEF = defineConnectors({
   ...pdforge,
   ...peopleDataLabs,
   ...perplexity,
+  ...pexels,
   ...pika,
   ...pinecone,
   ...pipedream,
@@ -23228,6 +23398,17 @@ async function renameZeroChatThread(options) {
   }
   handleError(result, "Failed to rename chat thread");
 }
+async function getZeroChatThread(options) {
+  const config = await getClientConfig();
+  const client = initClient(chatThreadMetadataContract, config);
+  const result = await client.get({
+    params: { id: options.threadId }
+  });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, "Failed to get chat thread");
+}
 
 // src/lib/api/domains/zero-developer-support.ts
 init_esm_shims();
@@ -27443,6 +27624,7 @@ export {
   deleteZeroOrgModelProvider,
   listZeroModelPolicies,
   hostedArtifactKindSchema,
+  persistedAttachmentSchema,
   zeroAgentVisibilitySchema,
   createZeroAgent,
   listZeroAgents,
@@ -27518,6 +27700,7 @@ export {
   searchZeroLogs,
   searchZeroChat,
   renameZeroChatThread,
+  getZeroChatThread,
   getSystemLog,
   getMetrics,
   getAgentEvents,
@@ -27536,4 +27719,4 @@ export {
   completeHostedSite,
   getHostedSiteFiles
 };
-//# sourceMappingURL=chunk-BXXT44X3.js.map
+//# sourceMappingURL=chunk-5NIWPEYU.js.map