@vm0/cli 9.222.2 → 9.222.3

package/{agent-MAPPQJ6T.js → agent-LPPBYNS2.js}

@@ -4,10 +4,10 @@ const require = __createRequire(import.meta.url);
 import {
   loadConnectorPermissionInfos,
   policyIcon
-} from "./chunk-UX5MX23W.js";
+} from "./chunk-V2NS7MND.js";
 import {
   permissionGrantsToFirewallPolicies
-} from "./chunk-KA6H24H6.js";
+} from "./chunk-K7F6VF2Z.js";
 import {
   isInteractive,
   promptConfirm
@@ -24,7 +24,7 @@ import {
   listZeroUserPermissionGrants,
   updateZeroAgent,
   updateZeroAgentInstructions
-} from "./chunk-E2O7MDL7.js";
+} from "./chunk-3QZMZ46V.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -595,4 +595,4 @@ Notes:
 export {
   zeroAgentCommand
 };
-//# sourceMappingURL=agent-MAPPQJ6T.js.map
+//# sourceMappingURL=agent-LPPBYNS2.js.map

package/{automation-Z4A56FZU.js → automation-BB4N3JL7.js}

@@ -8,10 +8,10 @@ import {
 } from "./chunk-HQFETCZ6.js";
 import {
   isUUID
-} from "./chunk-TTPLNGWS.js";
+} from "./chunk-OFENJD2Q.js";
 import "./chunk-YRZ6VZJR.js";
-import "./chunk-ODQBZESC.js";
-import "./chunk-IH5XFOOD.js";
+import "./chunk-72DXWQL4.js";
+import "./chunk-A5RF3VZM.js";
 import {
   isInteractive,
   promptConfirm
@@ -28,7 +28,7 @@ import {
   showAutomation,
   updateAutomation,
   updateAutomationTrigger
-} from "./chunk-E2O7MDL7.js";
+} from "./chunk-3QZMZ46V.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -498,4 +498,4 @@ Examples:
 export {
   zeroAutomationCommand
 };
-//# sourceMappingURL=automation-Z4A56FZU.js.map
+//# sourceMappingURL=automation-BB4N3JL7.js.map

package/{banking-EI7CVZ5K.js → banking-WAVEYEQR.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import "./chunk-LTDQISD7.js";
 import {
   callZeroBanking
-} from "./chunk-E2O7MDL7.js";
+} from "./chunk-3QZMZ46V.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -115,4 +115,4 @@ Notes:
 export {
   zeroBankingCommand
 };
-//# sourceMappingURL=banking-EI7CVZ5K.js.map
+//# sourceMappingURL=banking-WAVEYEQR.js.map

package/{chat-2C6KFXSA.js → chat-WLUTTBQU.js}

@@ -5,7 +5,7 @@ import "./chunk-LTDQISD7.js";
 import {
   getZeroChatThread,
   renameZeroChatThread
-} from "./chunk-E2O7MDL7.js";
+} from "./chunk-3QZMZ46V.js";
 import {
   withErrorHandler
 } from "./chunk-3F4RFLPX.js";
@@ -120,4 +120,4 @@ Examples:
 export {
   zeroChatCommand
 };
-//# sourceMappingURL=chat-2C6KFXSA.js.map
+//# sourceMappingURL=chat-WLUTTBQU.js.map

package/{chunk-E2O7MDL7.js → chunk-3QZMZ46V.js}

@@ -3712,6 +3712,7 @@ var AUTH_REFERENCE_PATTERN_G = new RegExp(AUTH_REFERENCE_PATTERN.source, "g");
 var AUTH_REFERENCE_PREFIX_PATTERN = new RegExp(
   `^${AUTH_REFERENCE_PATTERN.source}`
 );
+var AUTH_TEMPLATE_START = "${{";
 var AUTH_TEMPLATE_URL_PLACEHOLDER = "placeholder";
 var IPV4_MAX_OCTET = 255;
 var IPV4_OCTET_BASE = IPV4_MAX_OCTET + 1;
@@ -5174,6 +5175,129 @@ function validateBaseUrl(base, serviceName) {
     );
   }
 }
+function authBaseForStaticUrlValidation(authBase) {
+  if (!authBase.includes(AUTH_TEMPLATE_START)) {
+    return { url: authBase, dynamicPrefixSuffix: "" };
+  }
+  const replaced = authBase.replace(
+    AUTH_REFERENCE_PATTERN_G,
+    AUTH_TEMPLATE_URL_PLACEHOLDER
+  );
+  if (replaced.includes(AUTH_TEMPLATE_START)) {
+    return { url: authBase, dynamicPrefixSuffix: "" };
+  }
+  const prefixMatch = AUTH_REFERENCE_PREFIX_PATTERN.exec(authBase);
+  if (prefixMatch) {
+    return {
+      url: null,
+      dynamicPrefixSuffix: authBase.slice(prefixMatch[0].length).replace(AUTH_REFERENCE_PATTERN_G, AUTH_TEMPLATE_URL_PLACEHOLDER)
+    };
+  }
+  return { url: replaced, dynamicPrefixSuffix: "" };
+}
+function validateDynamicAuthBaseSuffix(authBase, suffix, serviceName) {
+  if (suffix.includes(AUTH_TEMPLATE_START)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": contains unsupported template reference`
+    );
+  }
+  if (hasRawWhitespace(suffix)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain whitespace`
+    );
+  }
+  if (hasUnsafeUrlCodepoint(suffix)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain control characters or invalid Unicode`
+    );
+  }
+  if (suffix.includes("#")) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain fragment`
+    );
+  }
+  if (suffix !== "" && !suffix.startsWith("/") && !suffix.startsWith("?")) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": dynamic URL suffix must start with "/" or "?"`
+    );
+  }
+}
+function validateAuthBaseUrl(authBase, serviceName) {
+  if (authBase.includes("\\")) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain backslash`
+    );
+  }
+  const target = authBaseForStaticUrlValidation(authBase);
+  validateDynamicAuthBaseSuffix(
+    authBase,
+    target.dynamicPrefixSuffix,
+    serviceName
+  );
+  const validationUrl = target.url;
+  if (validationUrl === null) return;
+  if (validationUrl.includes(AUTH_TEMPLATE_START)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": contains unsupported template reference`
+    );
+  }
+  if (hasRawWhitespace(validationUrl)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain whitespace`
+    );
+  }
+  if (hasUnsafeUrlCodepoint(validationUrl)) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain control characters or invalid Unicode`
+    );
+  }
+  validateUrlSchemeDelimiter(
+    validationUrl,
+    serviceName,
+    "auth.base URL",
+    authBase
+  );
+  let url;
+  try {
+    url = new URL(validationUrl);
+  } catch {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": not a valid URL`
+    );
+  }
+  if (url.protocol.slice(0, -1).toLowerCase() !== REQUIRED_AUTH_BASE_URL_SCHEME) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": scheme must be https`
+    );
+  }
+  if (url.hash) {
+    throw new Error(
+      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain fragment`
+    );
+  }
+  const authority = rawAuthorityFromBaseUrl(validationUrl);
+  if (authority !== null) {
+    if (authority === "") {
+      throw new Error(
+        `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": not a valid URL authority`
+      );
+    }
+    if (authorityHasEmptyPort(authority)) {
+      throw new Error(
+        `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": not a valid URL authority`
+      );
+    }
+    if (authority.includes("@")) {
+      throw new Error(
+        `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain userinfo`
+      );
+    }
+    validateHostPercentEncoding(authority, validationUrl, serviceName);
+    validateHostHasCanonicalIpv4Syntax(authority, validationUrl, serviceName);
+    validateHostHasNoUnsafeIdnaMappings(authority, validationUrl, serviceName);
+  }
+  validateStaticHostLabels(url.hostname, validationUrl, serviceName);
+}
 
 // ../../packages/api-contracts/src/contracts/logs.ts
 init_esm_shims();
@@ -28370,6 +28494,7 @@ export {
   resolveFirewallBaseUrlTemplate,
   hasBaseUrlParams,
   validateBaseUrl,
+  validateAuthBaseUrl,
   runnerGroupSchema,
   volumeConfigSchema,
   agentDefinitionSchema,
@@ -28531,4 +28656,4 @@ export {
   completeHostedSite,
   getHostedSiteFiles
 };
-//# sourceMappingURL=chunk-E2O7MDL7.js.map
+//# sourceMappingURL=chunk-3QZMZ46V.js.map