@vm0/cli 9.238.2 → 9.238.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (114) hide show
  1. package/{agent-232YB3UW.js → agent-DY657IHK.js} +6 -8
  2. package/{agent-232YB3UW.js.map → agent-DY657IHK.js.map} +1 -1
  3. package/{banking-W4YOUOGR.js → banking-WZ5ZXNHW.js} +4 -6
  4. package/{banking-W4YOUOGR.js.map → banking-WZ5ZXNHW.js.map} +1 -1
  5. package/{chat-U7IY4EFM.js → chat-ORHRUMSC.js} +5 -7
  6. package/{chat-U7IY4EFM.js.map → chat-ORHRUMSC.js.map} +1 -1
  7. package/{chunk-TDHY3N5U.js → chunk-6TXV6T6G.js} +2 -2
  8. package/{chunk-QRWCZFSW.js → chunk-APIZB5CD.js} +5 -7
  9. package/{chunk-QRWCZFSW.js.map → chunk-APIZB5CD.js.map} +1 -1
  10. package/{chunk-LSV2VNTU.js → chunk-CYF7PHDS.js} +2832 -1327
  11. package/chunk-CYF7PHDS.js.map +1 -0
  12. package/{chunk-63SY7N6Y.js → chunk-EH4MVCB3.js} +2 -2
  13. package/{chunk-5IL2HDF6.js → chunk-GA7UX3FL.js} +1408 -32
  14. package/chunk-GA7UX3FL.js.map +1 -0
  15. package/{chunk-OJDPK7NK.js → chunk-GU4IPLKQ.js} +2 -2
  16. package/{chunk-OJDPK7NK.js.map → chunk-GU4IPLKQ.js.map} +1 -1
  17. package/{chunk-LKJRJF2G.js → chunk-JH5O3APS.js} +3 -3
  18. package/{chunk-PT3JWQPE.js → chunk-MZTSDUUX.js} +2 -2
  19. package/{chunk-HVKP7UPZ.js → chunk-XVW5RA46.js} +23 -1051
  20. package/chunk-XVW5RA46.js.map +1 -0
  21. package/{chunk-V2OYP5BZ.js → chunk-Z4SU5SW5.js} +227 -200
  22. package/chunk-Z4SU5SW5.js.map +1 -0
  23. package/{chunk-H3PJLBYQ.js → chunk-ZRG2A3OV.js} +4 -4
  24. package/{computer-use-FMWOZUIP.js → computer-use-NKBLGFEQ.js} +3 -4
  25. package/{computer-use-FMWOZUIP.js.map → computer-use-NKBLGFEQ.js.map} +1 -1
  26. package/{connector-YOH3JOKV.js → connector-7AIQZYTK.js} +5 -7
  27. package/{connector-YOH3JOKV.js.map → connector-7AIQZYTK.js.map} +1 -1
  28. package/{credit-BSKBYVKJ.js → credit-TIOONK33.js} +5 -7
  29. package/{credit-BSKBYVKJ.js.map → credit-TIOONK33.js.map} +1 -1
  30. package/{developer-support-MLHK3AS5.js → developer-support-IM7P3PNY.js} +3 -4
  31. package/{developer-support-MLHK3AS5.js.map → developer-support-IM7P3PNY.js.map} +1 -1
  32. package/{doctor-AXSIJ2XY.js → doctor-UG5O6IF2.js} +32 -18
  33. package/doctor-UG5O6IF2.js.map +1 -0
  34. package/{generate-IX7Y7HZH.js → generate-FFZOGVVZ.js} +6 -8
  35. package/{generate-IX7Y7HZH.js.map → generate-FFZOGVVZ.js.map} +1 -1
  36. package/{github-DLJEXA4P.js → github-B4A2NYZE.js} +3 -4
  37. package/{github-DLJEXA4P.js.map → github-B4A2NYZE.js.map} +1 -1
  38. package/{goal-R6NDTIHJ.js → goal-MQVOVTDO.js} +3 -4
  39. package/{goal-R6NDTIHJ.js.map → goal-MQVOVTDO.js.map} +1 -1
  40. package/google-contacts.generated-FL6Z7MTD.js +16 -0
  41. package/google-contacts.generated-FL6Z7MTD.js.map +1 -0
  42. package/google-contacts.generated-Q67YBTPW.js +16 -0
  43. package/google-contacts.generated-Q67YBTPW.js.map +1 -0
  44. package/google-forms.generated-AOKO24AB.js +16 -0
  45. package/google-forms.generated-AOKO24AB.js.map +1 -0
  46. package/google-forms.generated-KDCHIV43.js +16 -0
  47. package/google-forms.generated-KDCHIV43.js.map +1 -0
  48. package/{host-VD5GWO4T.js → host-OP2HJH6Y.js} +4 -6
  49. package/{host-VD5GWO4T.js.map → host-OP2HJH6Y.js.map} +1 -1
  50. package/index.js +17 -20
  51. package/index.js.map +1 -1
  52. package/{logs-NQI3ITVT.js → logs-CA6HKKD7.js} +8 -11
  53. package/{logs-NQI3ITVT.js.map → logs-CA6HKKD7.js.map} +1 -1
  54. package/{maps-XLAARX76.js → maps-IR4XLNKS.js} +4 -6
  55. package/{maps-XLAARX76.js.map → maps-IR4XLNKS.js.map} +1 -1
  56. package/{memory-UUNI5B2C.js → memory-KRW4WNNT.js} +4 -6
  57. package/{memory-UUNI5B2C.js.map → memory-KRW4WNNT.js.map} +1 -1
  58. package/{model-LMW4L5P6.js → model-N4ZX7CTX.js} +6 -8
  59. package/{model-LMW4L5P6.js.map → model-N4ZX7CTX.js.map} +1 -1
  60. package/{model-provider-2FCSBI3H.js → model-provider-U4P563EL.js} +5 -7
  61. package/{model-provider-2FCSBI3H.js.map → model-provider-U4P563EL.js.map} +1 -1
  62. package/{org-N6CEZGPY.js → org-IESFCHFN.js} +10 -12
  63. package/{org-N6CEZGPY.js.map → org-IESFCHFN.js.map} +1 -1
  64. package/package.json +1 -1
  65. package/{phone-LZ5VKEA5.js → phone-EBV43OF4.js} +4 -6
  66. package/{phone-LZ5VKEA5.js.map → phone-EBV43OF4.js.map} +1 -1
  67. package/{preference-F2IDGWK3.js → preference-ZBNLMRLI.js} +4 -6
  68. package/{preference-F2IDGWK3.js.map → preference-ZBNLMRLI.js.map} +1 -1
  69. package/{relationship-7EV3WLB3.js → relationship-TP2F7LLQ.js} +4 -6
  70. package/{relationship-7EV3WLB3.js.map → relationship-TP2F7LLQ.js.map} +1 -1
  71. package/{resource-MJISJ52Q.js → resource-OTHN2AGX.js} +5 -7
  72. package/{resource-MJISJ52Q.js.map → resource-OTHN2AGX.js.map} +1 -1
  73. package/{search-SEXZVPOC.js → search-4JZ5XQIQ.js} +8 -11
  74. package/{search-SEXZVPOC.js.map → search-4JZ5XQIQ.js.map} +1 -1
  75. package/{secret-Z3CACK36.js → secret-73Y3IETU.js} +12 -26
  76. package/secret-73Y3IETU.js.map +1 -0
  77. package/{slack-QDZZZ2AV.js → slack-5NXJ5HF5.js} +4 -6
  78. package/{slack-QDZZZ2AV.js.map → slack-5NXJ5HF5.js.map} +1 -1
  79. package/{teams-LG4URJER.js → teams-DXT4NI2S.js} +4 -6
  80. package/{teams-LG4URJER.js.map → teams-DXT4NI2S.js.map} +1 -1
  81. package/{telegram-GLGHTNGM.js → telegram-DRWWXQNJ.js} +4 -6
  82. package/{telegram-GLGHTNGM.js.map → telegram-DRWWXQNJ.js.map} +1 -1
  83. package/{variable-TXYIWD3G.js → variable-LP5GN2VJ.js} +4 -6
  84. package/{variable-TXYIWD3G.js.map → variable-LP5GN2VJ.js.map} +1 -1
  85. package/{video-E56LX44R.js → video-TNA6D37U.js} +2 -3
  86. package/{video-E56LX44R.js.map → video-TNA6D37U.js.map} +1 -1
  87. package/{web-Q3NRMNK3.js → web-KNGVOG6B.js} +3 -4
  88. package/{web-Q3NRMNK3.js.map → web-KNGVOG6B.js.map} +1 -1
  89. package/{whoami-HRHU43T7.js → whoami-O7ZRGGC7.js} +6 -8
  90. package/{whoami-HRHU43T7.js.map → whoami-O7ZRGGC7.js.map} +1 -1
  91. package/{workflow-S46MZV7Z.js → workflow-FYC7N3RU.js} +5 -7
  92. package/workflow-FYC7N3RU.js.map +1 -0
  93. package/zero.js +34 -51
  94. package/zero.js.map +1 -1
  95. package/automation-7MAK66QT.js +0 -31
  96. package/automation-7MAK66QT.js.map +0 -1
  97. package/chunk-5BTPFZG2.js +0 -1301
  98. package/chunk-5BTPFZG2.js.map +0 -1
  99. package/chunk-5IL2HDF6.js.map +0 -1
  100. package/chunk-HVKP7UPZ.js.map +0 -1
  101. package/chunk-JUTUEPIR.js +0 -512
  102. package/chunk-JUTUEPIR.js.map +0 -1
  103. package/chunk-LSV2VNTU.js.map +0 -1
  104. package/chunk-V2OYP5BZ.js.map +0 -1
  105. package/doctor-AXSIJ2XY.js.map +0 -1
  106. package/schedule-OSHL7HWT.js +0 -33
  107. package/schedule-OSHL7HWT.js.map +0 -1
  108. package/secret-Z3CACK36.js.map +0 -1
  109. package/workflow-S46MZV7Z.js.map +0 -1
  110. /package/{chunk-TDHY3N5U.js.map → chunk-6TXV6T6G.js.map} +0 -0
  111. /package/{chunk-63SY7N6Y.js.map → chunk-EH4MVCB3.js.map} +0 -0
  112. /package/{chunk-LKJRJF2G.js.map → chunk-JH5O3APS.js.map} +0 -0
  113. /package/{chunk-PT3JWQPE.js.map → chunk-MZTSDUUX.js.map} +0 -0
  114. /package/{chunk-H3PJLBYQ.js.map → chunk-ZRG2A3OV.js.map} +0 -0
@@ -13,1001 +13,20 @@ import {
13
13
  handleError,
14
14
  headersWithCliClientHeaders,
15
15
  initClient,
16
- initContract
17
- } from "./chunk-LSV2VNTU.js";
16
+ initContract,
17
+ isSupportedRunModel,
18
+ modelProviderCodexRuntimeConfigSchema,
19
+ modelProviderListResponseSchema,
20
+ modelProviderTypeSchema,
21
+ orgModelPoliciesResponseSchema,
22
+ updateOrgModelPoliciesRequestSchema,
23
+ upsertModelProviderRequestSchema,
24
+ upsertModelProviderResponseSchema
25
+ } from "./chunk-CYF7PHDS.js";
18
26
  import {
19
27
  init_esm_shims
20
28
  } from "./chunk-DIRAZ3YX.js";
21
29
 
22
- // ../../packages/api-contracts/src/contracts/model-providers.ts
23
- init_esm_shims();
24
-
25
- // ../../packages/connectors/src/feature-switch-key.ts
26
- init_esm_shims();
27
-
28
- // ../../packages/api-contracts/src/contracts/model-price-tiers.ts
29
- init_esm_shims();
30
- var SUPPORTED_RUN_MODELS = [
31
- "claude-fable-5",
32
- "gpt-5.6-sol",
33
- "gpt-5.6-terra",
34
- "gpt-5.6-luna",
35
- "gpt-5.5",
36
- "claude-opus-4-8",
37
- "claude-opus-4-7",
38
- "claude-opus-4-6",
39
- "claude-sonnet-5",
40
- "claude-sonnet-4-6",
41
- "deepseek-v4-pro",
42
- "kimi-k2.7-code",
43
- "MiniMax-M3",
44
- "glm-5.2",
45
- "glm-5.1",
46
- "mimo-v2.5",
47
- "hy3-preview",
48
- "gpt-5.4",
49
- "gpt-5.4-mini"
50
- ];
51
- var VM0_MODEL_PRICE_TIER = Object.freeze({
52
- "claude-fable-5": "$$$$",
53
- "gpt-5.6-sol": "$$$",
54
- "gpt-5.6-terra": "$$",
55
- "gpt-5.6-luna": "$",
56
- "gpt-5.5": "$$$",
57
- "claude-opus-4-8": "$$$",
58
- "claude-opus-4-7": "$$$",
59
- "claude-opus-4-6": "$$$",
60
- "claude-sonnet-5": "$$",
61
- "claude-sonnet-4-6": "$$",
62
- "deepseek-v4-pro": "$",
63
- "kimi-k2.7-code": "$",
64
- "MiniMax-M3": "$",
65
- "glm-5.2": "$",
66
- "glm-5.1": "$",
67
- "mimo-v2.5": "$",
68
- "hy3-preview": "$",
69
- "gpt-5.4": "$$",
70
- "gpt-5.4-mini": "$"
71
- });
72
- var VM0_MODEL_PRICE_TIER_LABEL = Object.freeze({
73
- $: "Economy tier for everyday simple tasks",
74
- $$: "Balanced cost and performance",
75
- $$$: "Frontier flagship model",
76
- $$$$: "Premium frontier model for the hardest tasks"
77
- });
78
-
79
- // ../../packages/api-contracts/src/contracts/model-provider-types.ts
80
- init_esm_shims();
81
- var MODEL_PROVIDER_TYPE_IDS = [
82
- "claude-code-oauth-token",
83
- "anthropic-api-key",
84
- "openrouter-api-key",
85
- "moonshot-api-key",
86
- "minimax-api-key",
87
- "deepseek-api-key",
88
- "zai-api-key",
89
- "vercel-ai-gateway",
90
- "openrouter-codex",
91
- "vercel-ai-gateway-codex",
92
- "openai-api-key",
93
- "codex-oauth-token",
94
- "azure-foundry",
95
- "aws-bedrock",
96
- "vm0"
97
- ];
98
-
99
- // ../../packages/api-contracts/src/contracts/model-provider-firewalls.ts
100
- init_esm_shims();
101
- var MODEL_PROVIDER_ENV_PLACEHOLDERS = {
102
- // Placeholder: sk-ant-api03-{93 word/hyphen chars}AA (108 chars total)
103
- // Source: Semgrep regex \Bsk-ant-api03-[\w\-]{93}AA\B
104
- // https://semgrep.dev/blog/2025/secrets-story-and-prefixed-secrets/
105
- ANTHROPIC_API_KEY: "sk-ant-api03-CoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCofAA",
106
- // Placeholder: sk-ant-oat01-{93 word/hyphen chars}AA (108 chars total)
107
- // Source: same structure as API key; prefix from claude setup-token output
108
- // https://github.com/anthropics/claude-code/issues/18340
109
- // Example: sk-ant-oat01-xxxxx...xxxxx (1-year OAuth token)
110
- CLAUDE_CODE_OAUTH_TOKEN: "sk-ant-oat01-CoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCofAA",
111
- // Generic bearer-token marker for Claude-compatible gateways that map
112
- // provider-specific secrets into ANTHROPIC_AUTH_TOKEN.
113
- ANTHROPIC_AUTH_TOKEN: "sk-CoffeeSafeLocalCoffeeSafeLocalCo",
114
- // Placeholder: sk-proj-{chars}T3BlbkFJ{chars} (typical project key shape)
115
- // Source: mirrors the OpenAI connector firewall placeholder shape.
116
- OPENAI_API_KEY: "sk-proj-CoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocaT3BlbkFJCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLoca",
117
- // Opaque fake marker, not a JWT. Codex ChatGPT mode reads auth.json, while
118
- // firewall auth substitutes this marker at egress.
119
- CHATGPT_ACCESS_TOKEN: "chatgpt-token-CoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocal",
120
- CHATGPT_ACCOUNT_ID: "ws_VM0_PLACEHOLDER_DO_NOT_TRUST",
121
- CHATGPT_REFRESH_TOKEN: "rt_VM0_PLACEHOLDER_DO_NOT_TRUST"
122
- };
123
- var MODEL_PROVIDER_FIREWALL_PROVIDER_CONFIGS = {
124
- "anthropic-api-key": {
125
- framework: "claude-code",
126
- secretName: "ANTHROPIC_API_KEY"
127
- },
128
- "claude-code-oauth-token": {
129
- framework: "claude-code",
130
- secretName: "CLAUDE_CODE_OAUTH_TOKEN"
131
- },
132
- "openrouter-api-key": {
133
- framework: "claude-code",
134
- secretName: "OPENROUTER_API_KEY",
135
- anthropicBaseUrl: "https://openrouter.ai/api"
136
- },
137
- "moonshot-api-key": {
138
- framework: "claude-code",
139
- secretName: "MOONSHOT_API_KEY",
140
- anthropicBaseUrl: "https://api.moonshot.ai/anthropic"
141
- },
142
- "minimax-api-key": {
143
- framework: "claude-code",
144
- secretName: "MINIMAX_API_KEY",
145
- anthropicBaseUrl: "https://api.minimax.io/anthropic"
146
- },
147
- "deepseek-api-key": {
148
- framework: "claude-code",
149
- secretName: "DEEPSEEK_API_KEY",
150
- anthropicBaseUrl: "https://api.deepseek.com/anthropic"
151
- },
152
- "zai-api-key": {
153
- framework: "claude-code",
154
- secretName: "ZAI_API_KEY",
155
- anthropicBaseUrl: "https://api.z.ai/api/anthropic"
156
- },
157
- "vercel-ai-gateway": {
158
- framework: "claude-code",
159
- secretName: "VERCEL_AI_GATEWAY_API_KEY",
160
- anthropicBaseUrl: "https://ai-gateway.vercel.sh"
161
- },
162
- "openrouter-codex": {
163
- framework: "codex",
164
- secretName: "OPENROUTER_API_KEY",
165
- openaiBaseUrl: "https://openrouter.ai/api/v1"
166
- },
167
- "vercel-ai-gateway-codex": {
168
- framework: "codex",
169
- secretName: "VERCEL_AI_GATEWAY_API_KEY",
170
- openaiBaseUrl: "https://ai-gateway.vercel.sh/v1"
171
- },
172
- "openai-api-key": {
173
- framework: "codex",
174
- secretName: "OPENAI_API_KEY"
175
- }
176
- };
177
- var ANTHROPIC_API_BASE = "https://api.anthropic.com";
178
- function isLegacySingleSecretProvider(type) {
179
- return type !== "codex-oauth-token";
180
- }
181
- function getFirewallBaseUrl(type) {
182
- if (!isLegacySingleSecretProvider(type)) {
183
- return "https://chatgpt.com/backend-api/codex";
184
- }
185
- const config = MODEL_PROVIDER_FIREWALL_PROVIDER_CONFIGS[type];
186
- if (config.framework === "codex") {
187
- return config.openaiBaseUrl?.replace(/\/+$/, "") ?? "https://api.openai.com/v1/responses";
188
- }
189
- const base = (config.anthropicBaseUrl ?? ANTHROPIC_API_BASE).replace(
190
- /\/+$/,
191
- ""
192
- );
193
- return `${base}/v1/messages`;
194
- }
195
- function mpFirewall(type, authHeader, placeholderValue) {
196
- const secretName = MODEL_PROVIDER_FIREWALL_PROVIDER_CONFIGS[type].secretName;
197
- const secretRef = `\${{ secrets.${secretName} }}`;
198
- const headerValue = authHeader.valuePrefix ? `${authHeader.valuePrefix} ${secretRef}` : secretRef;
199
- return {
200
- name: `model-provider:${type}`,
201
- apis: [
202
- {
203
- base: getFirewallBaseUrl(type),
204
- auth: { headers: { [authHeader.name]: headerValue } },
205
- permissions: []
206
- }
207
- ],
208
- placeholders: { [secretName]: placeholderValue }
209
- };
210
- }
211
- var MODEL_PROVIDER_FIREWALL_CONFIGS = {
212
- "anthropic-api-key": mpFirewall(
213
- "anthropic-api-key",
214
- { name: "x-api-key" },
215
- MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_API_KEY
216
- ),
217
- "claude-code-oauth-token": mpFirewall(
218
- "claude-code-oauth-token",
219
- { name: "Authorization", valuePrefix: "Bearer" },
220
- MODEL_PROVIDER_ENV_PLACEHOLDERS.CLAUDE_CODE_OAUTH_TOKEN
221
- ),
222
- "openrouter-api-key": mpFirewall(
223
- "openrouter-api-key",
224
- { name: "Authorization", valuePrefix: "Bearer" },
225
- MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
226
- ),
227
- "moonshot-api-key": mpFirewall(
228
- "moonshot-api-key",
229
- { name: "Authorization", valuePrefix: "Bearer" },
230
- MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
231
- ),
232
- "minimax-api-key": mpFirewall(
233
- "minimax-api-key",
234
- { name: "Authorization", valuePrefix: "Bearer" },
235
- MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
236
- ),
237
- "deepseek-api-key": mpFirewall(
238
- "deepseek-api-key",
239
- { name: "Authorization", valuePrefix: "Bearer" },
240
- MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
241
- ),
242
- "zai-api-key": mpFirewall(
243
- "zai-api-key",
244
- { name: "Authorization", valuePrefix: "Bearer" },
245
- MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
246
- ),
247
- "vercel-ai-gateway": mpFirewall(
248
- "vercel-ai-gateway",
249
- { name: "Authorization", valuePrefix: "Bearer" },
250
- MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
251
- ),
252
- // Codex-framework twin of openrouter-api-key. It reuses the same stored
253
- // OpenRouter secret, but the sandbox env name is OPENAI_API_KEY because codex
254
- // SDK hits OpenAI-compatible paths (/chat/completions, /responses) under
255
- // https://openrouter.ai/api/v1.
256
- "openrouter-codex": mpFirewall(
257
- "openrouter-codex",
258
- { name: "Authorization", valuePrefix: "Bearer" },
259
- MODEL_PROVIDER_ENV_PLACEHOLDERS.OPENAI_API_KEY
260
- ),
261
- // Codex-framework twin of vercel-ai-gateway. It reuses the same stored Vercel
262
- // secret, but the sandbox env name is OPENAI_API_KEY. Base URL is scoped to
263
- // the /v1 prefix so codex can use either /chat/completions or /responses.
264
- "vercel-ai-gateway-codex": mpFirewall(
265
- "vercel-ai-gateway-codex",
266
- { name: "Authorization", valuePrefix: "Bearer" },
267
- MODEL_PROVIDER_ENV_PLACEHOLDERS.OPENAI_API_KEY
268
- ),
269
- "openai-api-key": mpFirewall(
270
- "openai-api-key",
271
- { name: "Authorization", valuePrefix: "Bearer" },
272
- MODEL_PROVIDER_ENV_PLACEHOLDERS.OPENAI_API_KEY
273
- ),
274
- // ChatGPT OAuth provider: multi-header injection plus unknown-policy auth.openai.com deny.
275
- "codex-oauth-token": {
276
- name: "model-provider:codex-oauth-token",
277
- apis: [
278
- {
279
- base: "https://chatgpt.com/backend-api/codex",
280
- auth: {
281
- headers: {
282
- Authorization: "Bearer ${{ secrets.CHATGPT_ACCESS_TOKEN }}",
283
- "ChatGPT-Account-ID": "${{ secrets.CHATGPT_ACCOUNT_ID }}"
284
- }
285
- },
286
- permissions: [
287
- {
288
- name: "codex:api",
289
- description: "Access the ChatGPT Codex backend with GET and POST requests.",
290
- rules: ["GET /{path*}", "POST /{path*}"]
291
- }
292
- ]
293
- },
294
- {
295
- base: "https://auth.openai.com",
296
- auth: { headers: {} },
297
- permissions: []
298
- }
299
- ],
300
- defaultPolicies: {
301
- unknownPolicy: "deny"
302
- },
303
- placeholders: {
304
- CHATGPT_ACCESS_TOKEN: MODEL_PROVIDER_ENV_PLACEHOLDERS.CHATGPT_ACCESS_TOKEN,
305
- CHATGPT_ACCOUNT_ID: MODEL_PROVIDER_ENV_PLACEHOLDERS.CHATGPT_ACCOUNT_ID,
306
- CHATGPT_REFRESH_TOKEN: MODEL_PROVIDER_ENV_PLACEHOLDERS.CHATGPT_REFRESH_TOKEN
307
- }
308
- }
309
- };
310
- var MINIMAX_CODEX_FIREWALL_CONFIG = {
311
- name: "model-provider:minimax-api-key",
312
- apis: [
313
- {
314
- base: "https://api.minimax.io/v1",
315
- auth: {
316
- headers: {
317
- Authorization: "Bearer ${{ secrets.MINIMAX_API_KEY }}"
318
- }
319
- },
320
- permissions: []
321
- }
322
- ],
323
- placeholders: {
324
- MINIMAX_API_KEY: MODEL_PROVIDER_ENV_PLACEHOLDERS.OPENAI_API_KEY
325
- }
326
- };
327
-
328
- // ../../packages/api-contracts/src/contracts/model-providers.ts
329
- var modelProviderCodexRuntimeConfigSchema = external_exports.object({
330
- providerId: external_exports.string().regex(/^[A-Za-z0-9_-]+$/),
331
- name: external_exports.string().min(1),
332
- baseUrl: external_exports.url(),
333
- envKey: external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/),
334
- wireApi: external_exports.literal("responses"),
335
- supportsWebsockets: external_exports.boolean(),
336
- modelCatalog: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
337
- });
338
- var GATED_MODEL_PROVIDER_FEATURE_SWITCHES = {};
339
- var FRAMEWORK_SWITCHED_MODEL_PROVIDER_FEATURE_SWITCHES = {
340
- "minimax-api-key": "codexFrameworkForMinimax" /* CodexFrameworkForMinimax */
341
- };
342
- function isModelProviderTypeEnabled(type, featureStates) {
343
- const switchKey = GATED_MODEL_PROVIDER_FEATURE_SWITCHES[type];
344
- return switchKey ? featureStates?.[switchKey] === true : true;
345
- }
346
- var DEFAULT_ORG_MODEL_POLICY_DEFAULT_MODEL = "gpt-5.6-terra";
347
- var supportedRunModelSchema = external_exports.enum(SUPPORTED_RUN_MODELS);
348
- var modelProviderCredentialScopeSchema = external_exports.enum(["org", "member"]);
349
- var SUPPORTED_RUN_MODEL_SET = new Set(
350
- SUPPORTED_RUN_MODELS
351
- );
352
- function isSupportedRunModel(model) {
353
- return typeof model === "string" && SUPPORTED_RUN_MODEL_SET.has(model);
354
- }
355
- function getVm0ModelPriceTier(model) {
356
- return isSupportedRunModel(model) ? VM0_MODEL_PRICE_TIER[model] : void 0;
357
- }
358
- var VM0_MODEL_TO_PROVIDER = {
359
- "claude-fable-5": {
360
- concreteType: "anthropic-api-key",
361
- vendor: "anthropic"
362
- },
363
- "claude-opus-4-8": {
364
- concreteType: "anthropic-api-key",
365
- vendor: "anthropic"
366
- },
367
- "claude-opus-4-7": {
368
- concreteType: "anthropic-api-key",
369
- vendor: "anthropic"
370
- },
371
- "claude-opus-4-6": {
372
- concreteType: "anthropic-api-key",
373
- vendor: "anthropic"
374
- },
375
- "claude-sonnet-5": {
376
- concreteType: "anthropic-api-key",
377
- vendor: "anthropic"
378
- },
379
- "claude-sonnet-4-6": {
380
- concreteType: "anthropic-api-key",
381
- vendor: "anthropic"
382
- },
383
- "glm-5.2": {
384
- concreteType: "zai-api-key",
385
- vendor: "zai"
386
- },
387
- "glm-5.1": {
388
- concreteType: "zai-api-key",
389
- vendor: "zai"
390
- },
391
- "mimo-v2.5": {
392
- concreteType: "openrouter-api-key",
393
- vendor: "openrouter",
394
- apiModel: "xiaomi/mimo-v2.5"
395
- },
396
- "hy3-preview": {
397
- concreteType: "openrouter-api-key",
398
- vendor: "openrouter",
399
- apiModel: "tencent/hy3-preview"
400
- },
401
- "kimi-k2.7-code": {
402
- concreteType: "moonshot-api-key",
403
- vendor: "moonshot"
404
- },
405
- "MiniMax-M3": {
406
- concreteType: "minimax-api-key",
407
- vendor: "minimax"
408
- },
409
- "deepseek-v4-pro": {
410
- concreteType: "deepseek-api-key",
411
- vendor: "deepseek"
412
- },
413
- "gpt-5.6-sol": {
414
- concreteType: "openai-api-key",
415
- vendor: "openai"
416
- },
417
- "gpt-5.6-terra": {
418
- concreteType: "openai-api-key",
419
- vendor: "openai"
420
- },
421
- "gpt-5.6-luna": {
422
- concreteType: "openai-api-key",
423
- vendor: "openai"
424
- },
425
- "gpt-5.5": {
426
- concreteType: "openai-api-key",
427
- vendor: "openai"
428
- },
429
- "gpt-5.4": {
430
- concreteType: "openai-api-key",
431
- vendor: "openai"
432
- },
433
- "gpt-5.4-mini": {
434
- concreteType: "openai-api-key",
435
- vendor: "openai"
436
- }
437
- };
438
- var MODEL_PROVIDER_TYPES = {
439
- "claude-code-oauth-token": {
440
- framework: "claude-code",
441
- secretName: "CLAUDE_CODE_OAUTH_TOKEN",
442
- label: "Claude Code (OAuth Token)",
443
- secretLabel: "OAuth token",
444
- helpText: "To get your OAuth token, run: claude setup-token\n(Requires Claude Pro or Max subscription)",
445
- envBindings: {
446
- CLAUDE_CODE_OAUTH_TOKEN: "$secret",
447
- ANTHROPIC_MODEL: "$model"
448
- },
449
- models: [
450
- "claude-fable-5",
451
- "claude-sonnet-5",
452
- "claude-sonnet-4-6",
453
- "claude-opus-4-8",
454
- "claude-opus-4-7",
455
- "claude-opus-4-6"
456
- ],
457
- defaultModel: "claude-sonnet-4-6"
458
- },
459
- "anthropic-api-key": {
460
- framework: "claude-code",
461
- secretName: "ANTHROPIC_API_KEY",
462
- label: "Anthropic",
463
- secretLabel: "API key",
464
- helpText: "Get your API key at: https://console.anthropic.com/settings/keys",
465
- envBindings: {
466
- ANTHROPIC_API_KEY: "$secret",
467
- ANTHROPIC_MODEL: "$model"
468
- },
469
- models: [
470
- "claude-fable-5",
471
- "claude-sonnet-5",
472
- "claude-sonnet-4-6",
473
- "claude-opus-4-8",
474
- "claude-opus-4-7",
475
- "claude-opus-4-6"
476
- ],
477
- defaultModel: "claude-sonnet-4-6"
478
- },
479
- "openrouter-api-key": {
480
- framework: "claude-code",
481
- secretName: "OPENROUTER_API_KEY",
482
- label: "OpenRouter",
483
- secretLabel: "API key",
484
- helpText: "Get your API key at: https://openrouter.ai/settings/keys",
485
- envBindings: {
486
- ANTHROPIC_AUTH_TOKEN: "$secret",
487
- ANTHROPIC_BASE_URL: "https://openrouter.ai/api",
488
- ANTHROPIC_API_KEY: "",
489
- ANTHROPIC_MODEL: "$model",
490
- ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
491
- ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
492
- ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
493
- CLAUDE_CODE_SUBAGENT_MODEL: "$model"
494
- },
495
- models: [
496
- "anthropic/claude-fable-5",
497
- "anthropic/claude-opus-4.8",
498
- "anthropic/claude-opus-4.7",
499
- "anthropic/claude-sonnet-5",
500
- "anthropic/claude-sonnet-4.6",
501
- "anthropic/claude-opus-4.6",
502
- "anthropic/claude-opus-4.5",
503
- "anthropic/claude-sonnet-4.5",
504
- "z-ai/glm-5.2",
505
- "z-ai/glm-5.1",
506
- "xiaomi/mimo-v2.5",
507
- "tencent/hy3-preview",
508
- "deepseek/deepseek-v4-pro"
509
- ],
510
- defaultModel: ""
511
- },
512
- "moonshot-api-key": {
513
- framework: "claude-code",
514
- secretName: "MOONSHOT_API_KEY",
515
- label: "Moonshot (Kimi)",
516
- secretLabel: "API key",
517
- helpText: "Get your API key at: https://platform.moonshot.ai/console/api-keys",
518
- envBindings: {
519
- ANTHROPIC_AUTH_TOKEN: "$secret",
520
- ANTHROPIC_BASE_URL: "https://api.moonshot.ai/anthropic",
521
- ANTHROPIC_MODEL: "$model",
522
- ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
523
- ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
524
- ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
525
- CLAUDE_CODE_SUBAGENT_MODEL: "$model",
526
- // Moonshot rejects Anthropic document blocks; keep attachments as text.
527
- CLAUDE_CODE_DISABLE_ATTACHMENTS: "1"
528
- },
529
- models: [
530
- "kimi-k2.7-code",
531
- "kimi-k2-thinking-turbo",
532
- "kimi-k2-thinking"
533
- ],
534
- defaultModel: "kimi-k2.7-code"
535
- },
536
- "minimax-api-key": {
537
- framework: "claude-code",
538
- secretName: "MINIMAX_API_KEY",
539
- label: "MiniMax",
540
- secretLabel: "API key",
541
- helpText: "Get your API key at: https://platform.minimax.io/user-center/basic-information/interface-key",
542
- envBindings: {
543
- ANTHROPIC_AUTH_TOKEN: "$secret",
544
- ANTHROPIC_BASE_URL: "https://api.minimax.io/anthropic",
545
- ANTHROPIC_MODEL: "$model",
546
- ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
547
- ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
548
- ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
549
- CLAUDE_CODE_SUBAGENT_MODEL: "$model",
550
- API_TIMEOUT_MS: "3000000",
551
- CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
552
- // MiniMax does not document support for Anthropic document blocks.
553
- CLAUDE_CODE_DISABLE_ATTACHMENTS: "1"
554
- },
555
- models: ["MiniMax-M3", "MiniMax-M2.1"],
556
- defaultModel: "MiniMax-M3"
557
- },
558
- "deepseek-api-key": {
559
- framework: "claude-code",
560
- secretName: "DEEPSEEK_API_KEY",
561
- label: "DeepSeek",
562
- secretLabel: "API key",
563
- helpText: "Get your API key at: https://platform.deepseek.com/api_keys",
564
- envBindings: {
565
- ANTHROPIC_AUTH_TOKEN: "$secret",
566
- ANTHROPIC_BASE_URL: "https://api.deepseek.com/anthropic",
567
- ANTHROPIC_MODEL: "$model",
568
- ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
569
- ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
570
- ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
571
- CLAUDE_CODE_SUBAGENT_MODEL: "$model",
572
- API_TIMEOUT_MS: "600000",
573
- CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
574
- // DeepSeek explicitly rejects Anthropic document blocks.
575
- CLAUDE_CODE_DISABLE_ATTACHMENTS: "1"
576
- },
577
- models: ["deepseek-v4-pro"],
578
- defaultModel: "deepseek-v4-pro"
579
- },
580
- "zai-api-key": {
581
- framework: "claude-code",
582
- secretName: "ZAI_API_KEY",
583
- label: "Z.AI (GLM)",
584
- secretLabel: "API key",
585
- helpText: "Get your API key at: https://z.ai/model-api",
586
- envBindings: {
587
- ANTHROPIC_AUTH_TOKEN: "$secret",
588
- ANTHROPIC_BASE_URL: "https://api.z.ai/api/anthropic",
589
- ANTHROPIC_MODEL: "$model",
590
- ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
591
- ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
592
- ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
593
- CLAUDE_CODE_SUBAGENT_MODEL: "$model",
594
- API_TIMEOUT_MS: "3000000"
595
- },
596
- models: [
597
- "glm-5.2",
598
- "glm-5.1",
599
- "glm-5",
600
- "glm-4.7",
601
- "glm-4.5-air"
602
- ],
603
- defaultModel: "glm-5.2"
604
- },
605
- "vercel-ai-gateway": {
606
- framework: "claude-code",
607
- secretName: "VERCEL_AI_GATEWAY_API_KEY",
608
- label: "Vercel AI Gateway",
609
- secretLabel: "API key",
610
- helpText: "Get your API key from the Vercel AI Gateway dashboard",
611
- envBindings: {
612
- ANTHROPIC_AUTH_TOKEN: "$secret",
613
- ANTHROPIC_BASE_URL: "https://ai-gateway.vercel.sh",
614
- ANTHROPIC_API_KEY: "",
615
- ANTHROPIC_MODEL: "$model",
616
- ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
617
- ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
618
- ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
619
- CLAUDE_CODE_SUBAGENT_MODEL: "$model"
620
- },
621
- models: [
622
- "anthropic/claude-fable-5",
623
- "anthropic/claude-opus-4.8",
624
- "anthropic/claude-opus-4.7",
625
- "anthropic/claude-opus-4.6",
626
- "anthropic/claude-sonnet-5",
627
- "anthropic/claude-opus-4.5",
628
- "anthropic/claude-sonnet-4.6",
629
- "anthropic/claude-sonnet-4.5",
630
- "minimax/minimax-m2.5",
631
- "zai/glm-5-turbo"
632
- ],
633
- defaultModel: "anthropic/claude-sonnet-4.6"
634
- },
635
- // Codex-framework twin of openrouter-api-key. Same upstream gateway (OpenRouter)
636
- // and same API key (shared secretName), but routes through OpenRouter's
637
- // OpenAI-compatible endpoint surface for GPT models that codex CLI requires.
638
- // Pairing rule: the claude-code entry serves Anthropic Messages API
639
- // (/v1/messages); this codex entry serves OpenAI Chat Completions / Responses
640
- // (/v1/chat/completions, /v1/responses) under the same /api/v1 prefix.
641
- "openrouter-codex": {
642
- framework: "codex",
643
- secretName: "OPENROUTER_API_KEY",
644
- label: "OpenRouter (Codex)",
645
- secretLabel: "API key",
646
- helpText: "Get your API key at: https://openrouter.ai/settings/keys",
647
- envBindings: {
648
- OPENAI_API_KEY: "$secret",
649
- OPENAI_BASE_URL: "https://openrouter.ai/api/v1",
650
- OPENAI_MODEL: "$model"
651
- },
652
- models: [
653
- "openai/gpt-5.5",
654
- "openai/gpt-5.4",
655
- "openai/gpt-5.4-mini"
656
- ],
657
- defaultModel: "openai/gpt-5.5"
658
- },
659
- // Codex-framework twin of vercel-ai-gateway. Vercel exposes both
660
- // Anthropic Messages and OpenAI Chat Completions / Responses on the same
661
- // base URL, distinguished by path. The claude-code entry uses /v1/messages;
662
- // this codex entry uses /v1/chat/completions or /v1/responses (codex CLI
663
- // picks the path it needs).
664
- "vercel-ai-gateway-codex": {
665
- framework: "codex",
666
- secretName: "VERCEL_AI_GATEWAY_API_KEY",
667
- label: "Vercel AI Gateway (Codex)",
668
- secretLabel: "API key",
669
- helpText: "Get your API key from the Vercel AI Gateway dashboard",
670
- envBindings: {
671
- OPENAI_API_KEY: "$secret",
672
- OPENAI_BASE_URL: "https://ai-gateway.vercel.sh/v1",
673
- OPENAI_MODEL: "$model"
674
- },
675
- models: [
676
- "openai/gpt-5.5",
677
- "openai/gpt-5.4",
678
- "openai/gpt-5.4-mini"
679
- ],
680
- defaultModel: "openai/gpt-5.5"
681
- },
682
- "openai-api-key": {
683
- framework: "codex",
684
- secretName: "OPENAI_API_KEY",
685
- label: "OpenAI",
686
- secretLabel: "API key",
687
- helpText: "Get your API key at: https://platform.openai.com/api-keys",
688
- envBindings: {
689
- OPENAI_API_KEY: "$secret",
690
- OPENAI_MODEL: "$model"
691
- },
692
- models: [
693
- "gpt-5.6-sol",
694
- "gpt-5.6-terra",
695
- "gpt-5.6-luna",
696
- "gpt-5.5",
697
- "gpt-5.4",
698
- "gpt-5.4-mini"
699
- ],
700
- defaultModel: "gpt-5.5"
701
- },
702
- "codex-oauth-token": {
703
- framework: "codex",
704
- label: "ChatGPT (Codex)",
705
- helpText: "Run `codex login` on your machine, then paste the resulting ~/.codex/auth.json contents to authorize ChatGPT (Plus / Pro / Business / Edu / Enterprise) for Codex.",
706
- authMethods: {
707
- // Paste-based auth: client posts CODEX_AUTH_JSON, server parses it via
708
- // codex-auth-json-parser.ts and persists the four derived CHATGPT_*
709
- // fields. The raw blob is NEVER stored. The wire-shape secret
710
- // (CODEX_AUTH_JSON) is declared optional+serverOnly so the contract
711
- // accepts it on POST without persisting; the four CHATGPT_* fields are
712
- // the canonical stored secrets and the firewall layer reads from those.
713
- auth_json: {
714
- label: "Codex auth.json",
715
- helpText: "Run `codex login` locally, then paste the contents of ~/.codex/auth.json below.",
716
- secrets: {
717
- CODEX_AUTH_JSON: {
718
- label: "auth.json contents",
719
- required: false,
720
- serverOnly: true,
721
- placeholder: '{"OPENAI_API_KEY":null,"tokens":{...}}',
722
- helpText: "Paste the entire contents of ~/.codex/auth.json"
723
- },
724
- // CHATGPT_ACCESS_TOKEN and CHATGPT_ACCOUNT_ID reach the sandbox env
725
- // as placeholder values (substituted by the firewall token-replacement
726
- // layer at egress) — keeping them non-serverOnly preserves the
727
- // placeholder injection path. CHATGPT_REFRESH_TOKEN and
728
- // CHATGPT_ID_TOKEN stay serverOnly per the #7365 invariant.
729
- //
730
- // All four are `derived: true` — the server-side parser populates
731
- // them from the user-pasted CODEX_AUTH_JSON. The UI MUST NOT render
732
- // them as input fields (per #12024).
733
- CHATGPT_ACCESS_TOKEN: {
734
- label: "CHATGPT_ACCESS_TOKEN",
735
- required: true,
736
- derived: true
737
- },
738
- CHATGPT_REFRESH_TOKEN: {
739
- label: "CHATGPT_REFRESH_TOKEN",
740
- required: true,
741
- serverOnly: true,
742
- derived: true
743
- },
744
- CHATGPT_ACCOUNT_ID: {
745
- label: "CHATGPT_ACCOUNT_ID",
746
- required: true,
747
- derived: true
748
- },
749
- CHATGPT_ID_TOKEN: {
750
- label: "CHATGPT_ID_TOKEN",
751
- required: true,
752
- serverOnly: true,
753
- derived: true
754
- }
755
- }
756
- }
757
- },
758
- defaultAuthMethod: "auth_json",
759
- envBindings: {
760
- CHATGPT_ACCESS_TOKEN: "$secrets.CHATGPT_ACCESS_TOKEN",
761
- CHATGPT_ACCOUNT_ID: "$secrets.CHATGPT_ACCOUNT_ID",
762
- OPENAI_MODEL: "$model"
763
- },
764
- models: [
765
- "gpt-5.6-sol",
766
- "gpt-5.6-terra",
767
- "gpt-5.6-luna",
768
- "gpt-5.5",
769
- "gpt-5.4",
770
- "gpt-5.4-mini"
771
- ],
772
- defaultModel: "gpt-5.5"
773
- },
774
- "azure-foundry": {
775
- framework: "claude-code",
776
- label: "Azure Foundry",
777
- helpText: "Run Claude on Microsoft Azure Foundry.\nSetup guide: https://code.claude.com/docs/en/microsoft-foundry",
778
- authMethods: {
779
- "api-key": {
780
- label: "API Key",
781
- helpText: "Use an Azure Foundry API key for authentication",
782
- secrets: {
783
- ANTHROPIC_FOUNDRY_API_KEY: {
784
- label: "ANTHROPIC_FOUNDRY_API_KEY",
785
- required: true,
786
- helpText: "API key from Azure Foundry portal (Endpoints and keys)"
787
- },
788
- ANTHROPIC_FOUNDRY_RESOURCE: {
789
- label: "ANTHROPIC_FOUNDRY_RESOURCE",
790
- required: true,
791
- placeholder: "my-resource",
792
- helpText: "Azure resource name (from portal URL)"
793
- }
794
- }
795
- }
796
- },
797
- defaultAuthMethod: "api-key",
798
- envBindings: {
799
- CLAUDE_CODE_USE_FOUNDRY: "1",
800
- ANTHROPIC_FOUNDRY_API_KEY: "$secrets.ANTHROPIC_FOUNDRY_API_KEY",
801
- ANTHROPIC_FOUNDRY_RESOURCE: "$secrets.ANTHROPIC_FOUNDRY_RESOURCE",
802
- ANTHROPIC_MODEL: "$model"
803
- },
804
- models: [],
805
- defaultModel: "",
806
- allowCustomModel: true,
807
- customModelPlaceholder: "claude-sonnet-4-5"
808
- },
809
- "aws-bedrock": {
810
- framework: "claude-code",
811
- label: "AWS Bedrock",
812
- helpText: "Run Claude on AWS Bedrock.\nSetup guide: https://code.claude.com/docs/en/amazon-bedrock",
813
- authMethods: {
814
- "api-key": {
815
- label: "Bedrock API Key",
816
- helpText: "Use a Bedrock API key for authentication",
817
- secrets: {
818
- AWS_BEARER_TOKEN_BEDROCK: {
819
- label: "AWS_BEARER_TOKEN_BEDROCK",
820
- required: true,
821
- helpText: "Bedrock API key from AWS console"
822
- },
823
- AWS_REGION: {
824
- label: "AWS_REGION",
825
- required: true,
826
- placeholder: "us-east-1",
827
- helpText: "e.g., us-east-1, us-west-2"
828
- }
829
- }
830
- },
831
- "access-keys": {
832
- label: "IAM Access Keys",
833
- helpText: "Use IAM access key secrets",
834
- secrets: {
835
- AWS_ACCESS_KEY_ID: {
836
- label: "AWS_ACCESS_KEY_ID",
837
- required: true,
838
- helpText: "IAM access key ID"
839
- },
840
- AWS_SECRET_ACCESS_KEY: {
841
- label: "AWS_SECRET_ACCESS_KEY",
842
- required: true,
843
- helpText: "IAM secret access key"
844
- },
845
- AWS_SESSION_TOKEN: {
846
- label: "AWS_SESSION_TOKEN",
847
- required: false,
848
- helpText: "Optional, for temporary secrets"
849
- },
850
- AWS_REGION: {
851
- label: "AWS_REGION",
852
- required: true,
853
- placeholder: "us-east-1",
854
- helpText: "e.g., us-east-1, us-west-2"
855
- }
856
- }
857
- }
858
- },
859
- defaultAuthMethod: "api-key",
860
- envBindings: {
861
- CLAUDE_CODE_USE_BEDROCK: "1",
862
- AWS_REGION: "$secrets.AWS_REGION",
863
- AWS_BEARER_TOKEN_BEDROCK: "$secrets.AWS_BEARER_TOKEN_BEDROCK",
864
- AWS_ACCESS_KEY_ID: "$secrets.AWS_ACCESS_KEY_ID",
865
- AWS_SECRET_ACCESS_KEY: "$secrets.AWS_SECRET_ACCESS_KEY",
866
- AWS_SESSION_TOKEN: "$secrets.AWS_SESSION_TOKEN",
867
- ANTHROPIC_MODEL: "$model"
868
- },
869
- models: [],
870
- defaultModel: "",
871
- allowCustomModel: true,
872
- customModelPlaceholder: "anthropic.claude-sonnet-4-20250514-v1:0"
873
- },
874
- vm0: {
875
- framework: "claude-code",
876
- label: "VM0 Managed",
877
- models: Object.keys(VM0_MODEL_TO_PROVIDER),
878
- defaultModel: DEFAULT_ORG_MODEL_POLICY_DEFAULT_MODEL
879
- }
880
- };
881
- var HIDDEN_PROVIDER_LIST = ["aws-bedrock", "azure-foundry"];
882
- var HIDDEN_PROVIDER_TYPES = new Set(
883
- HIDDEN_PROVIDER_LIST
884
- );
885
- function getSelectableProviderTypes(featureStates) {
886
- return Object.keys(MODEL_PROVIDER_TYPES).filter(
887
- (type) => {
888
- return !HIDDEN_PROVIDER_TYPES.has(type) && isModelProviderTypeEnabled(type, featureStates);
889
- }
890
- );
891
- }
892
- var modelProviderTypeSchema = external_exports.enum(MODEL_PROVIDER_TYPE_IDS);
893
- var modelProviderFrameworkSchema = external_exports.enum(["claude-code", "codex"]);
894
- function hasAuthMethods(type) {
895
- const config = MODEL_PROVIDER_TYPES[type];
896
- if (!config) return false;
897
- return "authMethods" in config;
898
- }
899
- function getAuthMethodsForType(type) {
900
- const config = MODEL_PROVIDER_TYPES[type];
901
- if (!config) return void 0;
902
- return "authMethods" in config ? config.authMethods : void 0;
903
- }
904
- function getDefaultAuthMethod(type) {
905
- const config = MODEL_PROVIDER_TYPES[type];
906
- return "defaultAuthMethod" in config ? config.defaultAuthMethod : void 0;
907
- }
908
- function getSecretsForAuthMethod(type, authMethod) {
909
- const authMethods = getAuthMethodsForType(type);
910
- if (!authMethods || !(authMethod in authMethods)) {
911
- return void 0;
912
- }
913
- const method = authMethods[authMethod];
914
- return method?.secrets;
915
- }
916
- var modelProviderSubscriptionUsageWindowSchema = external_exports.object({
917
- usedPercent: external_exports.number().nullable(),
918
- remainingPercent: external_exports.number().nullable(),
919
- resetAt: external_exports.string().nullable(),
920
- windowSeconds: external_exports.number().nullable()
921
- });
922
- var modelProviderSubscriptionUsageSchema = external_exports.object({
923
- fiveHour: modelProviderSubscriptionUsageWindowSchema.nullable(),
924
- weekly: modelProviderSubscriptionUsageWindowSchema.nullable()
925
- });
926
- var modelProviderResponseSchema = external_exports.object({
927
- id: external_exports.uuid(),
928
- type: modelProviderTypeSchema,
929
- framework: modelProviderFrameworkSchema,
930
- secretName: external_exports.string().nullable(),
931
- // Legacy single-secret (deprecated for multi-auth)
932
- authMethod: external_exports.string().nullable(),
933
- // For multi-auth providers
934
- secretNames: external_exports.array(external_exports.string()).nullable(),
935
- // For multi-auth providers
936
- isDefault: external_exports.boolean(),
937
- selectedModel: external_exports.string().nullable(),
938
- createdAt: external_exports.string(),
939
- updatedAt: external_exports.string(),
940
- // OAuth account metadata populated by provider-specific connect flows. Other
941
- // provider types omit these.
942
- accountEmail: external_exports.string().nullable().optional(),
943
- workspaceName: external_exports.string().nullable().optional(),
944
- planType: external_exports.string().nullable().optional(),
945
- // Subscription quota metadata. Providers omit these until an upstream source
946
- // exposes the reset cadence or next reset timestamp.
947
- subscriptionResetPeriod: external_exports.string().nullable().optional(),
948
- subscriptionNextResetAt: external_exports.string().nullable().optional(),
949
- subscriptionUsage: modelProviderSubscriptionUsageSchema.nullable().optional(),
950
- subscriptionResetCredits: external_exports.number().int().nonnegative().nullable().optional(),
951
- // OAuth refresh state. `needsReconnect` flips to true when the firewall's
952
- // refresh attempt fails (#11921 writes this on the model_providers row).
953
- // `lastRefreshErrorCode` carries the typed code from `ChatgptRefreshError`
954
- // (e.g. `refresh_token_expired`) so the UI can render an actionable
955
- // re-connect message. Both fields are always emitted for OAuth-typed
956
- // providers; non-OAuth types default to false / null.
957
- needsReconnect: external_exports.boolean(),
958
- lastRefreshErrorCode: external_exports.string().nullable()
959
- });
960
- var modelProviderListResponseSchema = external_exports.object({
961
- modelProviders: external_exports.array(modelProviderResponseSchema)
962
- });
963
- var upsertModelProviderRequestSchema = external_exports.object({
964
- type: modelProviderTypeSchema,
965
- secret: external_exports.string().min(1).optional(),
966
- // Legacy single secret
967
- authMethod: external_exports.string().optional(),
968
- // For multi-auth providers
969
- secrets: external_exports.record(external_exports.string(), external_exports.string()).optional(),
970
- // For multi-auth providers
971
- selectedModel: external_exports.string().optional()
972
- });
973
- var upsertModelProviderResponseSchema = external_exports.object({
974
- provider: modelProviderResponseSchema,
975
- created: external_exports.boolean()
976
- });
977
- var orgModelPolicyRouteStatusSchema = external_exports.enum([
978
- "valid",
979
- "missing_provider",
980
- "invalid"
981
- ]);
982
- var orgModelPolicySchema = external_exports.object({
983
- id: external_exports.uuid(),
984
- model: supportedRunModelSchema,
985
- modelLabel: external_exports.string(),
986
- isDefault: external_exports.boolean(),
987
- defaultProviderType: modelProviderTypeSchema,
988
- credentialScope: modelProviderCredentialScopeSchema,
989
- modelProviderId: external_exports.uuid().nullable(),
990
- routeStatus: orgModelPolicyRouteStatusSchema,
991
- routeStatusReason: external_exports.string().nullable(),
992
- createdAt: external_exports.string(),
993
- updatedAt: external_exports.string()
994
- });
995
- var updateOrgModelPolicySchema = external_exports.object({
996
- model: supportedRunModelSchema,
997
- isDefault: external_exports.boolean(),
998
- defaultProviderType: modelProviderTypeSchema,
999
- credentialScope: modelProviderCredentialScopeSchema,
1000
- modelProviderId: external_exports.uuid().nullable()
1001
- });
1002
- var orgModelPoliciesResponseSchema = external_exports.object({
1003
- policies: external_exports.array(orgModelPolicySchema),
1004
- workspaceDefaultModel: supportedRunModelSchema.nullable(),
1005
- workspaceDefaultPolicyId: external_exports.uuid().nullable()
1006
- });
1007
- var updateOrgModelPoliciesRequestSchema = external_exports.object({
1008
- policies: external_exports.array(updateOrgModelPolicySchema)
1009
- });
1010
-
1011
30
  // src/lib/api/domains/registry-resources.ts
1012
31
  init_esm_shims();
1013
32
 
@@ -2524,6 +1543,7 @@ var zeroHostContract = c11.router({
2524
1543
  401: apiErrorSchema,
2525
1544
  402: apiErrorSchema,
2526
1545
  403: apiErrorSchema,
1546
+ 503: apiErrorSchema,
2527
1547
  500: apiErrorSchema
2528
1548
  },
2529
1549
  summary: "Create an edited HTML draft from DOM comments"
@@ -5549,38 +4569,6 @@ var chatThreadUnreadAgentsSchema = external_exports.object({
5549
4569
  });
5550
4570
  var chatThreadEventIdSchema = external_exports.string().uuid();
5551
4571
  var codexServiceTierSchema = external_exports.enum(["fast"]);
5552
- var chatThreadListItemSchema = external_exports.object({
5553
- id: external_exports.string(),
5554
- title: external_exports.string().nullable(),
5555
- /**
5556
- * Owning agent snapshot emitted by the server for every list row.
5557
- */
5558
- agent: external_exports.object({
5559
- id: external_exports.string(),
5560
- avatarUrl: external_exports.string().nullable()
5561
- }),
5562
- createdAt: external_exports.string(),
5563
- updatedAt: external_exports.string(),
5564
- /**
5565
- * True when the thread has at least one non-terminal run
5566
- * (queued / pending / running). Drives the sidebar running indicator,
5567
- * which is mutually exclusive with the unread dot.
5568
- */
5569
- running: external_exports.boolean(),
5570
- /**
5571
- * ISO timestamp at which the user pinned this thread. Null/undefined means
5572
- * unpinned. Pinned threads sort above unpinned in the sidebar; both groups
5573
- * keep recency order. Optional for back-compat with fixtures that predate
5574
- * the field.
5575
- */
5576
- pinnedAt: external_exports.string().nullable().optional(),
5577
- /**
5578
- * ISO timestamp at which the user manually renamed this thread. Null/undefined
5579
- * means never renamed. When set, automated title generation is suppressed.
5580
- * Optional for back-compat with fixtures that predate the field.
5581
- */
5582
- renamedAt: external_exports.string().nullable().optional()
5583
- });
5584
4572
  var chatThreadSnapshotProjectionSchema = external_exports.object({
5585
4573
  id: external_exports.string().uuid(),
5586
4574
  agentId: external_exports.string().uuid(),
@@ -5696,15 +4684,6 @@ var pagedChatMessageBaseSchema = external_exports.object({
5696
4684
  attachFiles: external_exports.array(resolvedAttachFileSchema).optional(),
5697
4685
  generationTemplate: generationTemplateRequestSchema.optional(),
5698
4686
  sequenceNumber: external_exports.number().nullable().optional(),
5699
- // Deprecated legacy schedule automation metadata. Migration 0545 clears
5700
- // existing values; new message writes no longer populate these fields.
5701
- automationId: external_exports.string().optional(),
5702
- automationTitle: external_exports.string().optional(),
5703
- automationSnapshot: external_exports.object({
5704
- id: external_exports.string(),
5705
- title: external_exports.string(),
5706
- description: external_exports.string().nullable()
5707
- }).optional(),
5708
4687
  workflowSnapshot: external_exports.object({
5709
4688
  id: external_exports.string().uuid().optional(),
5710
4689
  agentId: external_exports.string().uuid().optional(),
@@ -11255,8 +10234,14 @@ var secretResponseSchema = external_exports.object({
11255
10234
  createdAt: external_exports.string(),
11256
10235
  updatedAt: external_exports.string()
11257
10236
  });
10237
+ var secretListItemResponseSchema = secretResponseSchema.extend({
10238
+ connectorDisplay: external_exports.object({
10239
+ label: external_exports.string(),
10240
+ environmentNames: external_exports.array(external_exports.string())
10241
+ }).nullable()
10242
+ });
11258
10243
  var secretListResponseSchema = external_exports.object({
11259
- secrets: external_exports.array(secretResponseSchema)
10244
+ secrets: external_exports.array(secretListItemResponseSchema)
11260
10245
  });
11261
10246
  var setSecretRequestSchema = external_exports.object({
11262
10247
  name: secretNameSchema,
@@ -12182,12 +11167,12 @@ var zeroWorkflowDetailResponseSchema = zeroWorkflowSummarySchema.extend({
12182
11167
  var zeroWorkflowListResponseSchema = external_exports.array(
12183
11168
  zeroWorkflowSummarySchema
12184
11169
  );
12185
- var zeroWorkflowTriggerAutomationEntrySchema = external_exports.object({
11170
+ var zeroWorkflowAutomationEntrySchema = external_exports.object({
12186
11171
  workflow: zeroWorkflowSummarySchema,
12187
11172
  trigger: zeroWorkflowTriggerSummarySchema
12188
11173
  });
12189
- var zeroWorkflowTriggerAutomationListResponseSchema = external_exports.array(
12190
- zeroWorkflowTriggerAutomationEntrySchema
11174
+ var zeroWorkflowAutomationListResponseSchema = external_exports.array(
11175
+ zeroWorkflowAutomationEntrySchema
12191
11176
  );
12192
11177
  var zeroWorkflowCreateRequestSchema = external_exports.object({
12193
11178
  agentId: external_exports.string().uuid(),
@@ -12423,7 +11408,7 @@ var zeroWorkflowTriggersContract = c33.router({
12423
11408
  path: "/api/zero/workflow-triggers",
12424
11409
  headers: authHeadersSchema,
12425
11410
  responses: {
12426
- 200: zeroWorkflowTriggerAutomationListResponseSchema,
11411
+ 200: zeroWorkflowAutomationListResponseSchema,
12427
11412
  401: apiErrorSchema,
12428
11413
  403: apiErrorSchema
12429
11414
  },
@@ -15212,19 +14197,6 @@ export {
15212
14197
  validateBaseUrl,
15213
14198
  validateAuthBaseUrl,
15214
14199
  authHeadersSchema,
15215
- supportedRunModelSchema,
15216
- getVm0ModelPriceTier,
15217
- MODEL_PROVIDER_TYPES,
15218
- getSelectableProviderTypes,
15219
- modelProviderTypeSchema,
15220
- hasAuthMethods,
15221
- getAuthMethodsForType,
15222
- getDefaultAuthMethod,
15223
- getSecretsForAuthMethod,
15224
- modelProviderResponseSchema,
15225
- modelProviderListResponseSchema,
15226
- upsertModelProviderRequestSchema,
15227
- upsertModelProviderResponseSchema,
15228
14200
  runnerGroupSchema,
15229
14201
  volumeConfigSchema,
15230
14202
  agentDefinitionSchema,
@@ -15384,4 +14356,4 @@ export {
15384
14356
  completeHostedSite,
15385
14357
  getHostedSiteFiles
15386
14358
  };
15387
- //# sourceMappingURL=chunk-HVKP7UPZ.js.map
14359
+ //# sourceMappingURL=chunk-XVW5RA46.js.map