@vm0/cli 9.217.0 → 9.217.2

package/{chunk-TKAJDWGT.js → chunk-BEGJBHUZ.js}

@@ -3651,7 +3651,8 @@ var IPV4_NON_PUBLIC_RANGES = [
   [2130706432, 2147483647],
   [2851995648, 2852061183],
   [2886729728, 2887778303],
-  [3221225472, 3221225727],
+  [3221225472, 3221225480],
+  [3221225483, 3221225727],
   [3221225984, 3221226239],
   [3227017984, 3227018239],
   [3232235520, 3232301055],
@@ -4202,7 +4203,7 @@ function parseIpv6Address(value) {
 }
 function isPublicIpv6SpecialRegistryException(words) {
   const second = words[1];
-  if (second === 1 && words[2] === 0 && words[3] === 0 && words[4] === 0 && words[5] === 0 && words[6] === 0 && (words[7] === 1 || words[7] === 2)) {
+  if (second === 1 && words[2] === 0 && words[3] === 0 && words[4] === 0 && words[5] === 0 && words[6] === 0 && words[7] >= 1 && words[7] <= 3) {
     return true;
   }
   if (second === 3) {
@@ -4231,6 +4232,9 @@ function isPublicIpv6Address(words) {
   if (first === 8193 && second === 3512) {
     return false;
   }
+  if (first === 16383 && second <= 4095) {
+    return false;
+  }
   if (first === 8194) {
     return false;
   }
@@ -4242,13 +4246,22 @@ function hostPolicyIpLiteralIsPublic(hostname) {
     return words ? isPublicIpv6Address(words) : false;
   }
   const ipv4Parts = parseCanonicalIpv4Address(hostname);
-  return ipv4Parts ? isPublicIpv4Address(ipv4Parts) : null;
+  if (ipv4Parts) {
+    return isPublicIpv4Address(ipv4Parts);
+  }
+  const normalizedIpv4Host = normalizeHostForIpv4LiteralSyntax(hostname);
+  if (isIpv4LiteralLike(normalizedIpv4Host)) {
+    return false;
+  }
+  return null;
 }
-function providerOwnedHostMatches(hostname, hostPolicy) {
-  const exactHosts = hostPolicy.exactHosts ?? [];
-  for (const exactHost of exactHosts) {
-    if (hostname === normalizeHostPolicyHostname(exactHost)) {
-      return true;
+function providerOwnedHostMatches(hostname, hostPolicy, options = {}) {
+  if (options.allowExactHosts !== false) {
+    const exactHosts = hostPolicy.exactHosts ?? [];
+    for (const exactHost of exactHosts) {
+      if (hostname === normalizeHostPolicyHostname(exactHost)) {
+        return true;
+      }
     }
   }
   const suffixes = hostPolicy.suffixes ?? [];
@@ -4260,22 +4273,61 @@ function providerOwnedHostMatches(hostname, hostPolicy) {
   }
   return false;
 }
-function validateResolvedBaseUrlHostPolicy({
-  templateBase,
-  resolvedBase,
+function baseUrlAuthorityHasParams(base) {
+  const authority = rawAuthorityFromBaseUrl(base);
+  return authority !== null && hasBaseUrlParams(authority);
+}
+function validateHostPolicyShape(base, serviceName, hostPolicy) {
+  const result = firewallBaseHostPolicySchema.safeParse(hostPolicy);
+  if (result.success) return;
+  const message = result.error.issues.map((issue) => {
+    return issue.message;
+  }).join("; ");
+  throw new Error(
+    errMsg(base, serviceName, `hostPolicy is invalid: ${message}`)
+  );
+}
+function urlForHostPolicyValidation(base, serviceName) {
+  if (!baseUrlAuthorityHasParams(base)) return new URL(base);
+  const schemeEnd = base.indexOf("://");
+  const authority = rawAuthorityFromBaseUrl(base);
+  if (schemeEnd === -1 || authority === null) return new URL(base);
+  const authorityParts = splitParameterizedAuthority(
+    authority,
+    base,
+    serviceName
+  );
+  const host = splitAuthorityHostSegments(authorityParts.normalizedHost).map((segment2) => {
+    return hostSegmentForSyntaxValidation(segment2, base, serviceName);
+  }).join(".");
+  return new URL(
+    `${base.slice(0, schemeEnd)}://${host}${authorityParts.portSuffix}`
+  );
+}
+function validateBaseUrlHostPolicy({
+  base,
+  diagnosticBase = base,
   serviceName,
   hostPolicy
 }) {
   if (!hostPolicy) {
     return;
   }
-  const url = new URL(resolvedBase);
+  validateHostPolicyShape(diagnosticBase, serviceName, hostPolicy);
+  if (hasBaseUrlVars(base)) {
+    return;
+  }
+  const authorityHasParams = baseUrlAuthorityHasParams(base);
+  const url = urlForHostPolicyValidation(base, serviceName);
+  const rawAuthority = rawAuthorityFromBaseUrl(base);
   const hostname = normalizeHostPolicyHostname(url.hostname);
   if (hostPolicy.kind === "providerOwned") {
-    if (!providerOwnedHostMatches(hostname, hostPolicy)) {
+    if (!providerOwnedHostMatches(hostname, hostPolicy, {
+      allowExactHosts: !authorityHasParams
+    })) {
       throw new Error(
         errMsg(
-          templateBase,
+          diagnosticBase,
           serviceName,
           `host policy does not allow resolved host "${hostname}"`
         )
@@ -4284,7 +4336,7 @@ function validateResolvedBaseUrlHostPolicy({
     if (!hostPolicy.allowNonDefaultPort && url.port !== "") {
       throw new Error(
         errMsg(
-          templateBase,
+          diagnosticBase,
           serviceName,
           "host policy does not allow non-default ports"
         )
@@ -4292,11 +4344,12 @@ function validateResolvedBaseUrlHostPolicy({
     }
     return;
   }
-  const publicIpLiteral = hostPolicyIpLiteralIsPublic(hostname);
+  const publicDestinationHost = rawAuthority === null ? url.hostname : rawHostFromAuthority(rawAuthority);
+  const publicIpLiteral = hostPolicyIpLiteralIsPublic(publicDestinationHost);
   if (publicIpLiteral === false) {
     throw new Error(
       errMsg(
-        templateBase,
+        diagnosticBase,
         serviceName,
         `host policy does not allow non-public IP literal "${hostname}"`
       )
@@ -4343,9 +4396,9 @@ function resolveFirewallBaseUrlTemplate({
       serviceName,
       credentialed
     );
-    validateResolvedBaseUrlHostPolicy({
-      templateBase: base,
-      resolvedBase: resolved,
+    validateBaseUrlHostPolicy({
+      base: resolved,
+      diagnosticBase: base,
       serviceName,
       hostPolicy
     });
@@ -4380,6 +4433,7 @@ var ALLOWED_BASE_URL_SCHEMES = /* @__PURE__ */ new Set(["http", "https"]);
 var REQUIRED_AUTH_BASE_URL_SCHEME = "https";
 var WHITESPACE_PATTERN = /\s/u;
 var UNICODE_CONTROL_PATTERN = /\p{C}/u;
+var UNICODE_DECIMAL_NUMBER_PATTERN = /^\p{Decimal_Number}+$/u;
 var UNICODE_MARK_PATTERN = /\p{M}/u;
 var UNICODE_LETTER_PATTERN = /\p{L}/u;
 var GREEK_COMBINING_YPOGEGRAMMENI = "\u0345";
@@ -4464,9 +4518,7 @@ function isIpv4NumberComponent(value) {
       return isHexDigit(char);
     });
   }
-  return [...value].every((char) => {
-    return char >= "0" && char <= "9";
-  });
+  return UNICODE_DECIMAL_NUMBER_PATTERN.test(value);
 }
 function isIpv4LiteralLike(value) {
   const parts = value.split(".");
@@ -4632,6 +4684,15 @@ function validateHostPercentEncoding(host, base, serviceName) {
           errMsg(base, serviceName, "host must not contain commas")
         );
       }
+      if (char === "*") {
+        throw new Error(
+          errMsg(
+            base,
+            serviceName,
+            "host must not contain wildcard characters"
+          )
+        );
+      }
     }
     i = end - 1;
   }
@@ -4661,6 +4722,16 @@ function rawAuthorityFromBaseUrl(base) {
   const authorityEnd = delimiterIndexes.length === 0 ? -1 : Math.min(...delimiterIndexes);
   return authorityEnd === -1 ? rest : rest.slice(0, authorityEnd);
 }
+function authorityHasEmptyPort(authority) {
+  if (authority.startsWith("[")) {
+    const closeBracket = authority.indexOf("]");
+    if (closeBracket === -1) return false;
+    return authority.slice(closeBracket + 1) === ":";
+  }
+  const portSeparator = authority.lastIndexOf(":");
+  if (portSeparator === -1) return false;
+  return authority.indexOf(":") === portSeparator && portSeparator === authority.length - 1;
+}
 function validateNoUserinfo(authority, base, serviceName) {
   if (authority.includes("@")) {
     throw new Error(errMsg(base, serviceName, "must not contain userinfo"));
@@ -4790,6 +4861,25 @@ function splitParameterizedAuthority(authority, base, serviceName) {
 function validateStaticHostLabels(hostname, base, serviceName) {
   if (hostname.startsWith("[") && hostname.endsWith("]")) return;
   validateHostHasNoEmptyLabels(hostname, base, serviceName);
+  validateHostHasNoRawWildcards(hostname, base, serviceName);
+}
+function hostSegmentHasRawWildcard(segment2) {
+  const parsed = parseSegment(segment2);
+  if (parsed.kind === "literal") return parsed.value.includes("*");
+  if (parsed.kind === "param") {
+    return parsed.prefix.includes("*") || parsed.suffix.includes("*");
+  }
+  return false;
+}
+function validateHostHasNoRawWildcards(host, base, serviceName) {
+  if (host.startsWith("[") && host.endsWith("]")) return;
+  for (const segment2 of host.replace(HOST_DOT_EQUIVALENT_PATTERN, ".").split(".")) {
+    if (hostSegmentHasRawWildcard(segment2)) {
+      throw new Error(
+        errMsg(base, serviceName, "host must not contain wildcard characters")
+      );
+    }
+  }
 }
 function hostSegmentForSyntaxValidation(seg, base, svc) {
   const parsed = parseSegment(seg);
@@ -4908,6 +4998,9 @@ function validateBaseUrlParams(base, serviceName) {
   const slashIdx = rest.indexOf("/");
   const host = slashIdx === -1 ? rest : rest.slice(0, slashIdx);
   const path = slashIdx === -1 ? "" : rest.slice(slashIdx);
+  if (authorityHasEmptyPort(host)) {
+    throw new Error(errMsg(base, serviceName, "not a valid URL authority"));
+  }
   validateNoUserinfo(host, base, serviceName);
   validateHostPercentEncoding(host, base, serviceName);
   const authority = splitParameterizedAuthority(host, base, serviceName);
@@ -4921,6 +5014,7 @@ function validateBaseUrlParams(base, serviceName) {
     base,
     serviceName
   );
+  validateHostHasNoRawWildcards(authority.normalizedHost, base, serviceName);
   validateParameterizedHostUrlSyntax(
     base.slice(0, schemeEnd),
     authority,
@@ -4992,6 +5086,11 @@ function validateBaseUrl(base, serviceName) {
         `Invalid base URL "${base}" in firewall "${serviceName}": not a valid URL authority`
       );
     }
+    if (authorityHasEmptyPort(authority)) {
+      throw new Error(
+        `Invalid base URL "${base}" in firewall "${serviceName}": not a valid URL authority`
+      );
+    }
     validateNoUserinfo(authority, base, serviceName);
     validateHostPercentEncoding(authority, base, serviceName);
     validateHostHasCanonicalIpv4Syntax(authority, base, serviceName);
@@ -6512,6 +6611,23 @@ var chatThreadMarkReadContract = c15.router({
     summary: "Mark a chat thread as read up to the latest message"
   }
 });
+var chatThreadMarkAgentReadContract = c15.router({
+  markAgentRead: {
+    method: "POST",
+    path: "/api/zero/chat-thread-unreads/mark-read",
+    headers: authHeadersSchema,
+    body: external_exports.object({
+      agentId: external_exports.string().min(1)
+    }),
+    responses: {
+      204: c15.noBody(),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema
+    },
+    summary: "Mark all unread chat threads under an agent as read"
+  }
+});
 var chatThreadPinContract = c15.router({
   pin: {
     method: "POST",
@@ -17269,6 +17385,45 @@ var perplexity = {
   }
 };
 
+// ../../packages/connectors/src/connectors/pexels.ts
+init_esm_shims();
+var pexels = {
+  pexels: {
+    label: "Pexels",
+    category: "marketing-content-growth",
+    helpText: "Connect Pexels to search, download, and insert stock photos and videos into artifacts. Responses and artifacts should include photographer attribution and the original Pexels URL. Avoid bulk downloading or rebuilding a stock photo or wallpaper library.",
+    tags: ["stock-photos", "stock-videos", "images", "media"],
+    authMethods: {
+      "api-token": {
+        label: "API Key",
+        featureFlag: "pexelsConnector" /* PexelsConnector */,
+        helpText: "1. Sign in to [Pexels](https://www.pexels.com)\n2. Open the [Pexels API page](https://www.pexels.com/api/) and request or copy your API key\n3. Paste the key here\n\nvm0 stores the key as a secret and automatically attaches it when calling the Pexels API. Pexels asks API users to include a prominent Pexels link and, where possible, photographer credit when displaying content. Responses and artifacts should include photographer attribution and the original Pexels URL.",
+        storage: {
+          secrets: ["PEXELS_API_KEY"],
+          variables: []
+        },
+        grant: {
+          kind: "manual",
+          fields: {
+            PEXELS_API_KEY: {
+              label: "API Key",
+              required: true,
+              placeholder: "your-pexels-api-key"
+            }
+          }
+        },
+        access: {
+          kind: "static",
+          envBindings: {
+            PEXELS_API_KEY: "$secrets.PEXELS_API_KEY"
+          }
+        },
+        revoke: { kind: "none" }
+      }
+    }
+  }
+};
+
 // ../../packages/connectors/src/connectors/pika.ts
 init_esm_shims();
 var pika = {
@@ -21051,6 +21206,7 @@ var CONNECTOR_TYPES_DEF = defineConnectors({
   ...pdforge,
   ...peopleDataLabs,
   ...perplexity,
+  ...pexels,
   ...pika,
   ...pinecone,
   ...pipedream,
@@ -25778,13 +25934,6 @@ async function copyWorkflow(workflowId, toAgentId) {
   if (result.status === 201) return result.body;
   handleError(result, `Failed to copy workflow "${workflowId}"`);
 }
-async function runWorkflow(workflowId) {
-  const config = await getClientConfig();
-  const client = initClient(zeroWorkflowsDetailContract, config);
-  const result = await client.run({ params: { workflowId } });
-  if (result.status === 200) return result.body;
-  handleError(result, `Failed to run workflow "${workflowId}"`);
-}
 async function listWorkflowTriggers(workflowId) {
   const config = await getClientConfig();
   const client = initClient(zeroWorkflowTriggersContract, config);
@@ -27485,6 +27634,7 @@ export {
   deleteZeroOrgModelProvider,
   listZeroModelPolicies,
   hostedArtifactKindSchema,
+  persistedAttachmentSchema,
   zeroAgentVisibilitySchema,
   createZeroAgent,
   listZeroAgents,
@@ -27502,7 +27652,6 @@ export {
   updateWorkflow,
   deleteWorkflow,
   copyWorkflow,
-  runWorkflow,
   listWorkflowTriggers,
   createWorkflowTrigger,
   getWorkflowTrigger,
@@ -27579,4 +27728,4 @@ export {
   completeHostedSite,
   getHostedSiteFiles
 };
-//# sourceMappingURL=chunk-TKAJDWGT.js.map
+//# sourceMappingURL=chunk-BEGJBHUZ.js.map