@vm0/cli 9.238.3 → 9.238.5

package/{chunk-XX3HVOWG.js → chunk-GIACTMOF.js}

@@ -13,1001 +13,20 @@ import {
   handleError,
   headersWithCliClientHeaders,
   initClient,
-  initContract
-} from "./chunk-22VWTDX6.js";
+  initContract,
+  isSupportedRunModel,
+  modelProviderCodexRuntimeConfigSchema,
+  modelProviderListResponseSchema,
+  modelProviderTypeSchema,
+  orgModelPoliciesResponseSchema,
+  updateOrgModelPoliciesRequestSchema,
+  upsertModelProviderRequestSchema,
+  upsertModelProviderResponseSchema
+} from "./chunk-VC7E6IA7.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
 
-// ../../packages/api-contracts/src/contracts/model-providers.ts
-init_esm_shims();
-
-// ../../packages/connectors/src/feature-switch-key.ts
-init_esm_shims();
-
-// ../../packages/api-contracts/src/contracts/model-price-tiers.ts
-init_esm_shims();
-var SUPPORTED_RUN_MODELS = [
-  "claude-fable-5",
-  "gpt-5.6-sol",
-  "gpt-5.6-terra",
-  "gpt-5.6-luna",
-  "gpt-5.5",
-  "claude-opus-4-8",
-  "claude-opus-4-7",
-  "claude-opus-4-6",
-  "claude-sonnet-5",
-  "claude-sonnet-4-6",
-  "deepseek-v4-pro",
-  "kimi-k2.7-code",
-  "MiniMax-M3",
-  "glm-5.2",
-  "glm-5.1",
-  "mimo-v2.5",
-  "hy3-preview",
-  "gpt-5.4",
-  "gpt-5.4-mini"
-];
-var VM0_MODEL_PRICE_TIER = Object.freeze({
-  "claude-fable-5": "$$$$",
-  "gpt-5.6-sol": "$$$",
-  "gpt-5.6-terra": "$$",
-  "gpt-5.6-luna": "$",
-  "gpt-5.5": "$$$",
-  "claude-opus-4-8": "$$$",
-  "claude-opus-4-7": "$$$",
-  "claude-opus-4-6": "$$$",
-  "claude-sonnet-5": "$$",
-  "claude-sonnet-4-6": "$$",
-  "deepseek-v4-pro": "$",
-  "kimi-k2.7-code": "$",
-  "MiniMax-M3": "$",
-  "glm-5.2": "$",
-  "glm-5.1": "$",
-  "mimo-v2.5": "$",
-  "hy3-preview": "$",
-  "gpt-5.4": "$$",
-  "gpt-5.4-mini": "$"
-});
-var VM0_MODEL_PRICE_TIER_LABEL = Object.freeze({
-  $: "Economy tier for everyday simple tasks",
-  $$: "Balanced cost and performance",
-  $$$: "Frontier flagship model",
-  $$$$: "Premium frontier model for the hardest tasks"
-});
-
-// ../../packages/api-contracts/src/contracts/model-provider-types.ts
-init_esm_shims();
-var MODEL_PROVIDER_TYPE_IDS = [
-  "claude-code-oauth-token",
-  "anthropic-api-key",
-  "openrouter-api-key",
-  "moonshot-api-key",
-  "minimax-api-key",
-  "deepseek-api-key",
-  "zai-api-key",
-  "vercel-ai-gateway",
-  "openrouter-codex",
-  "vercel-ai-gateway-codex",
-  "openai-api-key",
-  "codex-oauth-token",
-  "azure-foundry",
-  "aws-bedrock",
-  "vm0"
-];
-
-// ../../packages/api-contracts/src/contracts/model-provider-firewalls.ts
-init_esm_shims();
-var MODEL_PROVIDER_ENV_PLACEHOLDERS = {
-  // Placeholder: sk-ant-api03-{93 word/hyphen chars}AA (108 chars total)
-  // Source: Semgrep regex \Bsk-ant-api03-[\w\-]{93}AA\B
-  //   https://semgrep.dev/blog/2025/secrets-story-and-prefixed-secrets/
-  ANTHROPIC_API_KEY: "sk-ant-api03-CoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCofAA",
-  // Placeholder: sk-ant-oat01-{93 word/hyphen chars}AA (108 chars total)
-  // Source: same structure as API key; prefix from claude setup-token output
-  //   https://github.com/anthropics/claude-code/issues/18340
-  //   Example: sk-ant-oat01-xxxxx...xxxxx (1-year OAuth token)
-  CLAUDE_CODE_OAUTH_TOKEN: "sk-ant-oat01-CoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCofAA",
-  // Generic bearer-token marker for Claude-compatible gateways that map
-  // provider-specific secrets into ANTHROPIC_AUTH_TOKEN.
-  ANTHROPIC_AUTH_TOKEN: "sk-CoffeeSafeLocalCoffeeSafeLocalCo",
-  // Placeholder: sk-proj-{chars}T3BlbkFJ{chars} (typical project key shape)
-  // Source: mirrors the OpenAI connector firewall placeholder shape.
-  OPENAI_API_KEY: "sk-proj-CoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocaT3BlbkFJCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLoca",
-  // Opaque fake marker, not a JWT. Codex ChatGPT mode reads auth.json, while
-  // firewall auth substitutes this marker at egress.
-  CHATGPT_ACCESS_TOKEN: "chatgpt-token-CoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocalCoffeeSafeLocal",
-  CHATGPT_ACCOUNT_ID: "ws_VM0_PLACEHOLDER_DO_NOT_TRUST",
-  CHATGPT_REFRESH_TOKEN: "rt_VM0_PLACEHOLDER_DO_NOT_TRUST"
-};
-var MODEL_PROVIDER_FIREWALL_PROVIDER_CONFIGS = {
-  "anthropic-api-key": {
-    framework: "claude-code",
-    secretName: "ANTHROPIC_API_KEY"
-  },
-  "claude-code-oauth-token": {
-    framework: "claude-code",
-    secretName: "CLAUDE_CODE_OAUTH_TOKEN"
-  },
-  "openrouter-api-key": {
-    framework: "claude-code",
-    secretName: "OPENROUTER_API_KEY",
-    anthropicBaseUrl: "https://openrouter.ai/api"
-  },
-  "moonshot-api-key": {
-    framework: "claude-code",
-    secretName: "MOONSHOT_API_KEY",
-    anthropicBaseUrl: "https://api.moonshot.ai/anthropic"
-  },
-  "minimax-api-key": {
-    framework: "claude-code",
-    secretName: "MINIMAX_API_KEY",
-    anthropicBaseUrl: "https://api.minimax.io/anthropic"
-  },
-  "deepseek-api-key": {
-    framework: "claude-code",
-    secretName: "DEEPSEEK_API_KEY",
-    anthropicBaseUrl: "https://api.deepseek.com/anthropic"
-  },
-  "zai-api-key": {
-    framework: "claude-code",
-    secretName: "ZAI_API_KEY",
-    anthropicBaseUrl: "https://api.z.ai/api/anthropic"
-  },
-  "vercel-ai-gateway": {
-    framework: "claude-code",
-    secretName: "VERCEL_AI_GATEWAY_API_KEY",
-    anthropicBaseUrl: "https://ai-gateway.vercel.sh"
-  },
-  "openrouter-codex": {
-    framework: "codex",
-    secretName: "OPENROUTER_API_KEY",
-    openaiBaseUrl: "https://openrouter.ai/api/v1"
-  },
-  "vercel-ai-gateway-codex": {
-    framework: "codex",
-    secretName: "VERCEL_AI_GATEWAY_API_KEY",
-    openaiBaseUrl: "https://ai-gateway.vercel.sh/v1"
-  },
-  "openai-api-key": {
-    framework: "codex",
-    secretName: "OPENAI_API_KEY"
-  }
-};
-var ANTHROPIC_API_BASE = "https://api.anthropic.com";
-function isLegacySingleSecretProvider(type) {
-  return type !== "codex-oauth-token";
-}
-function getFirewallBaseUrl(type) {
-  if (!isLegacySingleSecretProvider(type)) {
-    return "https://chatgpt.com/backend-api/codex";
-  }
-  const config = MODEL_PROVIDER_FIREWALL_PROVIDER_CONFIGS[type];
-  if (config.framework === "codex") {
-    return config.openaiBaseUrl?.replace(/\/+$/, "") ?? "https://api.openai.com/v1/responses";
-  }
-  const base = (config.anthropicBaseUrl ?? ANTHROPIC_API_BASE).replace(
-    /\/+$/,
-    ""
-  );
-  return `${base}/v1/messages`;
-}
-function mpFirewall(type, authHeader, placeholderValue) {
-  const secretName = MODEL_PROVIDER_FIREWALL_PROVIDER_CONFIGS[type].secretName;
-  const secretRef = `\${{ secrets.${secretName} }}`;
-  const headerValue = authHeader.valuePrefix ? `${authHeader.valuePrefix} ${secretRef}` : secretRef;
-  return {
-    name: `model-provider:${type}`,
-    apis: [
-      {
-        base: getFirewallBaseUrl(type),
-        auth: { headers: { [authHeader.name]: headerValue } },
-        permissions: []
-      }
-    ],
-    placeholders: { [secretName]: placeholderValue }
-  };
-}
-var MODEL_PROVIDER_FIREWALL_CONFIGS = {
-  "anthropic-api-key": mpFirewall(
-    "anthropic-api-key",
-    { name: "x-api-key" },
-    MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_API_KEY
-  ),
-  "claude-code-oauth-token": mpFirewall(
-    "claude-code-oauth-token",
-    { name: "Authorization", valuePrefix: "Bearer" },
-    MODEL_PROVIDER_ENV_PLACEHOLDERS.CLAUDE_CODE_OAUTH_TOKEN
-  ),
-  "openrouter-api-key": mpFirewall(
-    "openrouter-api-key",
-    { name: "Authorization", valuePrefix: "Bearer" },
-    MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
-  ),
-  "moonshot-api-key": mpFirewall(
-    "moonshot-api-key",
-    { name: "Authorization", valuePrefix: "Bearer" },
-    MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
-  ),
-  "minimax-api-key": mpFirewall(
-    "minimax-api-key",
-    { name: "Authorization", valuePrefix: "Bearer" },
-    MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
-  ),
-  "deepseek-api-key": mpFirewall(
-    "deepseek-api-key",
-    { name: "Authorization", valuePrefix: "Bearer" },
-    MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
-  ),
-  "zai-api-key": mpFirewall(
-    "zai-api-key",
-    { name: "Authorization", valuePrefix: "Bearer" },
-    MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
-  ),
-  "vercel-ai-gateway": mpFirewall(
-    "vercel-ai-gateway",
-    { name: "Authorization", valuePrefix: "Bearer" },
-    MODEL_PROVIDER_ENV_PLACEHOLDERS.ANTHROPIC_AUTH_TOKEN
-  ),
-  // Codex-framework twin of openrouter-api-key. It reuses the same stored
-  // OpenRouter secret, but the sandbox env name is OPENAI_API_KEY because codex
-  // SDK hits OpenAI-compatible paths (/chat/completions, /responses) under
-  // https://openrouter.ai/api/v1.
-  "openrouter-codex": mpFirewall(
-    "openrouter-codex",
-    { name: "Authorization", valuePrefix: "Bearer" },
-    MODEL_PROVIDER_ENV_PLACEHOLDERS.OPENAI_API_KEY
-  ),
-  // Codex-framework twin of vercel-ai-gateway. It reuses the same stored Vercel
-  // secret, but the sandbox env name is OPENAI_API_KEY. Base URL is scoped to
-  // the /v1 prefix so codex can use either /chat/completions or /responses.
-  "vercel-ai-gateway-codex": mpFirewall(
-    "vercel-ai-gateway-codex",
-    { name: "Authorization", valuePrefix: "Bearer" },
-    MODEL_PROVIDER_ENV_PLACEHOLDERS.OPENAI_API_KEY
-  ),
-  "openai-api-key": mpFirewall(
-    "openai-api-key",
-    { name: "Authorization", valuePrefix: "Bearer" },
-    MODEL_PROVIDER_ENV_PLACEHOLDERS.OPENAI_API_KEY
-  ),
-  // ChatGPT OAuth provider: multi-header injection plus unknown-policy auth.openai.com deny.
-  "codex-oauth-token": {
-    name: "model-provider:codex-oauth-token",
-    apis: [
-      {
-        base: "https://chatgpt.com/backend-api/codex",
-        auth: {
-          headers: {
-            Authorization: "Bearer ${{ secrets.CHATGPT_ACCESS_TOKEN }}",
-            "ChatGPT-Account-ID": "${{ secrets.CHATGPT_ACCOUNT_ID }}"
-          }
-        },
-        permissions: [
-          {
-            name: "codex:api",
-            description: "Access the ChatGPT Codex backend with GET and POST requests.",
-            rules: ["GET /{path*}", "POST /{path*}"]
-          }
-        ]
-      },
-      {
-        base: "https://auth.openai.com",
-        auth: { headers: {} },
-        permissions: []
-      }
-    ],
-    defaultPolicies: {
-      unknownPolicy: "deny"
-    },
-    placeholders: {
-      CHATGPT_ACCESS_TOKEN: MODEL_PROVIDER_ENV_PLACEHOLDERS.CHATGPT_ACCESS_TOKEN,
-      CHATGPT_ACCOUNT_ID: MODEL_PROVIDER_ENV_PLACEHOLDERS.CHATGPT_ACCOUNT_ID,
-      CHATGPT_REFRESH_TOKEN: MODEL_PROVIDER_ENV_PLACEHOLDERS.CHATGPT_REFRESH_TOKEN
-    }
-  }
-};
-var MINIMAX_CODEX_FIREWALL_CONFIG = {
-  name: "model-provider:minimax-api-key",
-  apis: [
-    {
-      base: "https://api.minimax.io/v1",
-      auth: {
-        headers: {
-          Authorization: "Bearer ${{ secrets.MINIMAX_API_KEY }}"
-        }
-      },
-      permissions: []
-    }
-  ],
-  placeholders: {
-    MINIMAX_API_KEY: MODEL_PROVIDER_ENV_PLACEHOLDERS.OPENAI_API_KEY
-  }
-};
-
-// ../../packages/api-contracts/src/contracts/model-providers.ts
-var modelProviderCodexRuntimeConfigSchema = external_exports.object({
-  providerId: external_exports.string().regex(/^[A-Za-z0-9_-]+$/),
-  name: external_exports.string().min(1),
-  baseUrl: external_exports.url(),
-  envKey: external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/),
-  wireApi: external_exports.literal("responses"),
-  supportsWebsockets: external_exports.boolean(),
-  modelCatalog: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-});
-var GATED_MODEL_PROVIDER_FEATURE_SWITCHES = {};
-var FRAMEWORK_SWITCHED_MODEL_PROVIDER_FEATURE_SWITCHES = {
-  "minimax-api-key": "codexFrameworkForMinimax" /* CodexFrameworkForMinimax */
-};
-function isModelProviderTypeEnabled(type, featureStates) {
-  const switchKey = GATED_MODEL_PROVIDER_FEATURE_SWITCHES[type];
-  return switchKey ? featureStates?.[switchKey] === true : true;
-}
-var DEFAULT_ORG_MODEL_POLICY_DEFAULT_MODEL = "gpt-5.6-terra";
-var supportedRunModelSchema = external_exports.enum(SUPPORTED_RUN_MODELS);
-var modelProviderCredentialScopeSchema = external_exports.enum(["org", "member"]);
-var SUPPORTED_RUN_MODEL_SET = new Set(
-  SUPPORTED_RUN_MODELS
-);
-function isSupportedRunModel(model) {
-  return typeof model === "string" && SUPPORTED_RUN_MODEL_SET.has(model);
-}
-function getVm0ModelPriceTier(model) {
-  return isSupportedRunModel(model) ? VM0_MODEL_PRICE_TIER[model] : void 0;
-}
-var VM0_MODEL_TO_PROVIDER = {
-  "claude-fable-5": {
-    concreteType: "anthropic-api-key",
-    vendor: "anthropic"
-  },
-  "claude-opus-4-8": {
-    concreteType: "anthropic-api-key",
-    vendor: "anthropic"
-  },
-  "claude-opus-4-7": {
-    concreteType: "anthropic-api-key",
-    vendor: "anthropic"
-  },
-  "claude-opus-4-6": {
-    concreteType: "anthropic-api-key",
-    vendor: "anthropic"
-  },
-  "claude-sonnet-5": {
-    concreteType: "anthropic-api-key",
-    vendor: "anthropic"
-  },
-  "claude-sonnet-4-6": {
-    concreteType: "anthropic-api-key",
-    vendor: "anthropic"
-  },
-  "glm-5.2": {
-    concreteType: "zai-api-key",
-    vendor: "zai"
-  },
-  "glm-5.1": {
-    concreteType: "zai-api-key",
-    vendor: "zai"
-  },
-  "mimo-v2.5": {
-    concreteType: "openrouter-api-key",
-    vendor: "openrouter",
-    apiModel: "xiaomi/mimo-v2.5"
-  },
-  "hy3-preview": {
-    concreteType: "openrouter-api-key",
-    vendor: "openrouter",
-    apiModel: "tencent/hy3-preview"
-  },
-  "kimi-k2.7-code": {
-    concreteType: "moonshot-api-key",
-    vendor: "moonshot"
-  },
-  "MiniMax-M3": {
-    concreteType: "minimax-api-key",
-    vendor: "minimax"
-  },
-  "deepseek-v4-pro": {
-    concreteType: "deepseek-api-key",
-    vendor: "deepseek"
-  },
-  "gpt-5.6-sol": {
-    concreteType: "openai-api-key",
-    vendor: "openai"
-  },
-  "gpt-5.6-terra": {
-    concreteType: "openai-api-key",
-    vendor: "openai"
-  },
-  "gpt-5.6-luna": {
-    concreteType: "openai-api-key",
-    vendor: "openai"
-  },
-  "gpt-5.5": {
-    concreteType: "openai-api-key",
-    vendor: "openai"
-  },
-  "gpt-5.4": {
-    concreteType: "openai-api-key",
-    vendor: "openai"
-  },
-  "gpt-5.4-mini": {
-    concreteType: "openai-api-key",
-    vendor: "openai"
-  }
-};
-var MODEL_PROVIDER_TYPES = {
-  "claude-code-oauth-token": {
-    framework: "claude-code",
-    secretName: "CLAUDE_CODE_OAUTH_TOKEN",
-    label: "Claude Code (OAuth Token)",
-    secretLabel: "OAuth token",
-    helpText: "To get your OAuth token, run: claude setup-token\n(Requires Claude Pro or Max subscription)",
-    envBindings: {
-      CLAUDE_CODE_OAUTH_TOKEN: "$secret",
-      ANTHROPIC_MODEL: "$model"
-    },
-    models: [
-      "claude-fable-5",
-      "claude-sonnet-5",
-      "claude-sonnet-4-6",
-      "claude-opus-4-8",
-      "claude-opus-4-7",
-      "claude-opus-4-6"
-    ],
-    defaultModel: "claude-sonnet-4-6"
-  },
-  "anthropic-api-key": {
-    framework: "claude-code",
-    secretName: "ANTHROPIC_API_KEY",
-    label: "Anthropic",
-    secretLabel: "API key",
-    helpText: "Get your API key at: https://console.anthropic.com/settings/keys",
-    envBindings: {
-      ANTHROPIC_API_KEY: "$secret",
-      ANTHROPIC_MODEL: "$model"
-    },
-    models: [
-      "claude-fable-5",
-      "claude-sonnet-5",
-      "claude-sonnet-4-6",
-      "claude-opus-4-8",
-      "claude-opus-4-7",
-      "claude-opus-4-6"
-    ],
-    defaultModel: "claude-sonnet-4-6"
-  },
-  "openrouter-api-key": {
-    framework: "claude-code",
-    secretName: "OPENROUTER_API_KEY",
-    label: "OpenRouter",
-    secretLabel: "API key",
-    helpText: "Get your API key at: https://openrouter.ai/settings/keys",
-    envBindings: {
-      ANTHROPIC_AUTH_TOKEN: "$secret",
-      ANTHROPIC_BASE_URL: "https://openrouter.ai/api",
-      ANTHROPIC_API_KEY: "",
-      ANTHROPIC_MODEL: "$model",
-      ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
-      ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
-      CLAUDE_CODE_SUBAGENT_MODEL: "$model"
-    },
-    models: [
-      "anthropic/claude-fable-5",
-      "anthropic/claude-opus-4.8",
-      "anthropic/claude-opus-4.7",
-      "anthropic/claude-sonnet-5",
-      "anthropic/claude-sonnet-4.6",
-      "anthropic/claude-opus-4.6",
-      "anthropic/claude-opus-4.5",
-      "anthropic/claude-sonnet-4.5",
-      "z-ai/glm-5.2",
-      "z-ai/glm-5.1",
-      "xiaomi/mimo-v2.5",
-      "tencent/hy3-preview",
-      "deepseek/deepseek-v4-pro"
-    ],
-    defaultModel: ""
-  },
-  "moonshot-api-key": {
-    framework: "claude-code",
-    secretName: "MOONSHOT_API_KEY",
-    label: "Moonshot (Kimi)",
-    secretLabel: "API key",
-    helpText: "Get your API key at: https://platform.moonshot.ai/console/api-keys",
-    envBindings: {
-      ANTHROPIC_AUTH_TOKEN: "$secret",
-      ANTHROPIC_BASE_URL: "https://api.moonshot.ai/anthropic",
-      ANTHROPIC_MODEL: "$model",
-      ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
-      ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
-      CLAUDE_CODE_SUBAGENT_MODEL: "$model",
-      // Moonshot rejects Anthropic document blocks; keep attachments as text.
-      CLAUDE_CODE_DISABLE_ATTACHMENTS: "1"
-    },
-    models: [
-      "kimi-k2.7-code",
-      "kimi-k2-thinking-turbo",
-      "kimi-k2-thinking"
-    ],
-    defaultModel: "kimi-k2.7-code"
-  },
-  "minimax-api-key": {
-    framework: "claude-code",
-    secretName: "MINIMAX_API_KEY",
-    label: "MiniMax",
-    secretLabel: "API key",
-    helpText: "Get your API key at: https://platform.minimax.io/user-center/basic-information/interface-key",
-    envBindings: {
-      ANTHROPIC_AUTH_TOKEN: "$secret",
-      ANTHROPIC_BASE_URL: "https://api.minimax.io/anthropic",
-      ANTHROPIC_MODEL: "$model",
-      ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
-      ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
-      CLAUDE_CODE_SUBAGENT_MODEL: "$model",
-      API_TIMEOUT_MS: "3000000",
-      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
-      // MiniMax does not document support for Anthropic document blocks.
-      CLAUDE_CODE_DISABLE_ATTACHMENTS: "1"
-    },
-    models: ["MiniMax-M3", "MiniMax-M2.1"],
-    defaultModel: "MiniMax-M3"
-  },
-  "deepseek-api-key": {
-    framework: "claude-code",
-    secretName: "DEEPSEEK_API_KEY",
-    label: "DeepSeek",
-    secretLabel: "API key",
-    helpText: "Get your API key at: https://platform.deepseek.com/api_keys",
-    envBindings: {
-      ANTHROPIC_AUTH_TOKEN: "$secret",
-      ANTHROPIC_BASE_URL: "https://api.deepseek.com/anthropic",
-      ANTHROPIC_MODEL: "$model",
-      ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
-      ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
-      CLAUDE_CODE_SUBAGENT_MODEL: "$model",
-      API_TIMEOUT_MS: "600000",
-      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
-      // DeepSeek explicitly rejects Anthropic document blocks.
-      CLAUDE_CODE_DISABLE_ATTACHMENTS: "1"
-    },
-    models: ["deepseek-v4-pro"],
-    defaultModel: "deepseek-v4-pro"
-  },
-  "zai-api-key": {
-    framework: "claude-code",
-    secretName: "ZAI_API_KEY",
-    label: "Z.AI (GLM)",
-    secretLabel: "API key",
-    helpText: "Get your API key at: https://z.ai/model-api",
-    envBindings: {
-      ANTHROPIC_AUTH_TOKEN: "$secret",
-      ANTHROPIC_BASE_URL: "https://api.z.ai/api/anthropic",
-      ANTHROPIC_MODEL: "$model",
-      ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
-      ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
-      CLAUDE_CODE_SUBAGENT_MODEL: "$model",
-      API_TIMEOUT_MS: "3000000"
-    },
-    models: [
-      "glm-5.2",
-      "glm-5.1",
-      "glm-5",
-      "glm-4.7",
-      "glm-4.5-air"
-    ],
-    defaultModel: "glm-5.2"
-  },
-  "vercel-ai-gateway": {
-    framework: "claude-code",
-    secretName: "VERCEL_AI_GATEWAY_API_KEY",
-    label: "Vercel AI Gateway",
-    secretLabel: "API key",
-    helpText: "Get your API key from the Vercel AI Gateway dashboard",
-    envBindings: {
-      ANTHROPIC_AUTH_TOKEN: "$secret",
-      ANTHROPIC_BASE_URL: "https://ai-gateway.vercel.sh",
-      ANTHROPIC_API_KEY: "",
-      ANTHROPIC_MODEL: "$model",
-      ANTHROPIC_DEFAULT_OPUS_MODEL: "$model",
-      ANTHROPIC_DEFAULT_SONNET_MODEL: "$model",
-      ANTHROPIC_DEFAULT_HAIKU_MODEL: "$model",
-      CLAUDE_CODE_SUBAGENT_MODEL: "$model"
-    },
-    models: [
-      "anthropic/claude-fable-5",
-      "anthropic/claude-opus-4.8",
-      "anthropic/claude-opus-4.7",
-      "anthropic/claude-opus-4.6",
-      "anthropic/claude-sonnet-5",
-      "anthropic/claude-opus-4.5",
-      "anthropic/claude-sonnet-4.6",
-      "anthropic/claude-sonnet-4.5",
-      "minimax/minimax-m2.5",
-      "zai/glm-5-turbo"
-    ],
-    defaultModel: "anthropic/claude-sonnet-4.6"
-  },
-  // Codex-framework twin of openrouter-api-key. Same upstream gateway (OpenRouter)
-  // and same API key (shared secretName), but routes through OpenRouter's
-  // OpenAI-compatible endpoint surface for GPT models that codex CLI requires.
-  // Pairing rule: the claude-code entry serves Anthropic Messages API
-  // (/v1/messages); this codex entry serves OpenAI Chat Completions / Responses
-  // (/v1/chat/completions, /v1/responses) under the same /api/v1 prefix.
-  "openrouter-codex": {
-    framework: "codex",
-    secretName: "OPENROUTER_API_KEY",
-    label: "OpenRouter (Codex)",
-    secretLabel: "API key",
-    helpText: "Get your API key at: https://openrouter.ai/settings/keys",
-    envBindings: {
-      OPENAI_API_KEY: "$secret",
-      OPENAI_BASE_URL: "https://openrouter.ai/api/v1",
-      OPENAI_MODEL: "$model"
-    },
-    models: [
-      "openai/gpt-5.5",
-      "openai/gpt-5.4",
-      "openai/gpt-5.4-mini"
-    ],
-    defaultModel: "openai/gpt-5.5"
-  },
-  // Codex-framework twin of vercel-ai-gateway. Vercel exposes both
-  // Anthropic Messages and OpenAI Chat Completions / Responses on the same
-  // base URL, distinguished by path. The claude-code entry uses /v1/messages;
-  // this codex entry uses /v1/chat/completions or /v1/responses (codex CLI
-  // picks the path it needs).
-  "vercel-ai-gateway-codex": {
-    framework: "codex",
-    secretName: "VERCEL_AI_GATEWAY_API_KEY",
-    label: "Vercel AI Gateway (Codex)",
-    secretLabel: "API key",
-    helpText: "Get your API key from the Vercel AI Gateway dashboard",
-    envBindings: {
-      OPENAI_API_KEY: "$secret",
-      OPENAI_BASE_URL: "https://ai-gateway.vercel.sh/v1",
-      OPENAI_MODEL: "$model"
-    },
-    models: [
-      "openai/gpt-5.5",
-      "openai/gpt-5.4",
-      "openai/gpt-5.4-mini"
-    ],
-    defaultModel: "openai/gpt-5.5"
-  },
-  "openai-api-key": {
-    framework: "codex",
-    secretName: "OPENAI_API_KEY",
-    label: "OpenAI",
-    secretLabel: "API key",
-    helpText: "Get your API key at: https://platform.openai.com/api-keys",
-    envBindings: {
-      OPENAI_API_KEY: "$secret",
-      OPENAI_MODEL: "$model"
-    },
-    models: [
-      "gpt-5.6-sol",
-      "gpt-5.6-terra",
-      "gpt-5.6-luna",
-      "gpt-5.5",
-      "gpt-5.4",
-      "gpt-5.4-mini"
-    ],
-    defaultModel: "gpt-5.5"
-  },
-  "codex-oauth-token": {
-    framework: "codex",
-    label: "ChatGPT (Codex)",
-    helpText: "Run `codex login` on your machine, then paste the resulting ~/.codex/auth.json contents to authorize ChatGPT (Plus / Pro / Business / Edu / Enterprise) for Codex.",
-    authMethods: {
-      // Paste-based auth: client posts CODEX_AUTH_JSON, server parses it via
-      // codex-auth-json-parser.ts and persists the four derived CHATGPT_*
-      // fields. The raw blob is NEVER stored. The wire-shape secret
-      // (CODEX_AUTH_JSON) is declared optional+serverOnly so the contract
-      // accepts it on POST without persisting; the four CHATGPT_* fields are
-      // the canonical stored secrets and the firewall layer reads from those.
-      auth_json: {
-        label: "Codex auth.json",
-        helpText: "Run `codex login` locally, then paste the contents of ~/.codex/auth.json below.",
-        secrets: {
-          CODEX_AUTH_JSON: {
-            label: "auth.json contents",
-            required: false,
-            serverOnly: true,
-            placeholder: '{"OPENAI_API_KEY":null,"tokens":{...}}',
-            helpText: "Paste the entire contents of ~/.codex/auth.json"
-          },
-          // CHATGPT_ACCESS_TOKEN and CHATGPT_ACCOUNT_ID reach the sandbox env
-          // as placeholder values (substituted by the firewall token-replacement
-          // layer at egress) — keeping them non-serverOnly preserves the
-          // placeholder injection path. CHATGPT_REFRESH_TOKEN and
-          // CHATGPT_ID_TOKEN stay serverOnly per the #7365 invariant.
-          //
-          // All four are `derived: true` — the server-side parser populates
-          // them from the user-pasted CODEX_AUTH_JSON. The UI MUST NOT render
-          // them as input fields (per #12024).
-          CHATGPT_ACCESS_TOKEN: {
-            label: "CHATGPT_ACCESS_TOKEN",
-            required: true,
-            derived: true
-          },
-          CHATGPT_REFRESH_TOKEN: {
-            label: "CHATGPT_REFRESH_TOKEN",
-            required: true,
-            serverOnly: true,
-            derived: true
-          },
-          CHATGPT_ACCOUNT_ID: {
-            label: "CHATGPT_ACCOUNT_ID",
-            required: true,
-            derived: true
-          },
-          CHATGPT_ID_TOKEN: {
-            label: "CHATGPT_ID_TOKEN",
-            required: true,
-            serverOnly: true,
-            derived: true
-          }
-        }
-      }
-    },
-    defaultAuthMethod: "auth_json",
-    envBindings: {
-      CHATGPT_ACCESS_TOKEN: "$secrets.CHATGPT_ACCESS_TOKEN",
-      CHATGPT_ACCOUNT_ID: "$secrets.CHATGPT_ACCOUNT_ID",
-      OPENAI_MODEL: "$model"
-    },
-    models: [
-      "gpt-5.6-sol",
-      "gpt-5.6-terra",
-      "gpt-5.6-luna",
-      "gpt-5.5",
-      "gpt-5.4",
-      "gpt-5.4-mini"
-    ],
-    defaultModel: "gpt-5.5"
-  },
-  "azure-foundry": {
-    framework: "claude-code",
-    label: "Azure Foundry",
-    helpText: "Run Claude on Microsoft Azure Foundry.\nSetup guide: https://code.claude.com/docs/en/microsoft-foundry",
-    authMethods: {
-      "api-key": {
-        label: "API Key",
-        helpText: "Use an Azure Foundry API key for authentication",
-        secrets: {
-          ANTHROPIC_FOUNDRY_API_KEY: {
-            label: "ANTHROPIC_FOUNDRY_API_KEY",
-            required: true,
-            helpText: "API key from Azure Foundry portal (Endpoints and keys)"
-          },
-          ANTHROPIC_FOUNDRY_RESOURCE: {
-            label: "ANTHROPIC_FOUNDRY_RESOURCE",
-            required: true,
-            placeholder: "my-resource",
-            helpText: "Azure resource name (from portal URL)"
-          }
-        }
-      }
-    },
-    defaultAuthMethod: "api-key",
-    envBindings: {
-      CLAUDE_CODE_USE_FOUNDRY: "1",
-      ANTHROPIC_FOUNDRY_API_KEY: "$secrets.ANTHROPIC_FOUNDRY_API_KEY",
-      ANTHROPIC_FOUNDRY_RESOURCE: "$secrets.ANTHROPIC_FOUNDRY_RESOURCE",
-      ANTHROPIC_MODEL: "$model"
-    },
-    models: [],
-    defaultModel: "",
-    allowCustomModel: true,
-    customModelPlaceholder: "claude-sonnet-4-5"
-  },
-  "aws-bedrock": {
-    framework: "claude-code",
-    label: "AWS Bedrock",
-    helpText: "Run Claude on AWS Bedrock.\nSetup guide: https://code.claude.com/docs/en/amazon-bedrock",
-    authMethods: {
-      "api-key": {
-        label: "Bedrock API Key",
-        helpText: "Use a Bedrock API key for authentication",
-        secrets: {
-          AWS_BEARER_TOKEN_BEDROCK: {
-            label: "AWS_BEARER_TOKEN_BEDROCK",
-            required: true,
-            helpText: "Bedrock API key from AWS console"
-          },
-          AWS_REGION: {
-            label: "AWS_REGION",
-            required: true,
-            placeholder: "us-east-1",
-            helpText: "e.g., us-east-1, us-west-2"
-          }
-        }
-      },
-      "access-keys": {
-        label: "IAM Access Keys",
-        helpText: "Use IAM access key secrets",
-        secrets: {
-          AWS_ACCESS_KEY_ID: {
-            label: "AWS_ACCESS_KEY_ID",
-            required: true,
-            helpText: "IAM access key ID"
-          },
-          AWS_SECRET_ACCESS_KEY: {
-            label: "AWS_SECRET_ACCESS_KEY",
-            required: true,
-            helpText: "IAM secret access key"
-          },
-          AWS_SESSION_TOKEN: {
-            label: "AWS_SESSION_TOKEN",
-            required: false,
-            helpText: "Optional, for temporary secrets"
-          },
-          AWS_REGION: {
-            label: "AWS_REGION",
-            required: true,
-            placeholder: "us-east-1",
-            helpText: "e.g., us-east-1, us-west-2"
-          }
-        }
-      }
-    },
-    defaultAuthMethod: "api-key",
-    envBindings: {
-      CLAUDE_CODE_USE_BEDROCK: "1",
-      AWS_REGION: "$secrets.AWS_REGION",
-      AWS_BEARER_TOKEN_BEDROCK: "$secrets.AWS_BEARER_TOKEN_BEDROCK",
-      AWS_ACCESS_KEY_ID: "$secrets.AWS_ACCESS_KEY_ID",
-      AWS_SECRET_ACCESS_KEY: "$secrets.AWS_SECRET_ACCESS_KEY",
-      AWS_SESSION_TOKEN: "$secrets.AWS_SESSION_TOKEN",
-      ANTHROPIC_MODEL: "$model"
-    },
-    models: [],
-    defaultModel: "",
-    allowCustomModel: true,
-    customModelPlaceholder: "anthropic.claude-sonnet-4-20250514-v1:0"
-  },
-  vm0: {
-    framework: "claude-code",
-    label: "VM0 Managed",
-    models: Object.keys(VM0_MODEL_TO_PROVIDER),
-    defaultModel: DEFAULT_ORG_MODEL_POLICY_DEFAULT_MODEL
-  }
-};
-var HIDDEN_PROVIDER_LIST = ["aws-bedrock", "azure-foundry"];
-var HIDDEN_PROVIDER_TYPES = new Set(
-  HIDDEN_PROVIDER_LIST
-);
-function getSelectableProviderTypes(featureStates) {
-  return Object.keys(MODEL_PROVIDER_TYPES).filter(
-    (type) => {
-      return !HIDDEN_PROVIDER_TYPES.has(type) && isModelProviderTypeEnabled(type, featureStates);
-    }
-  );
-}
-var modelProviderTypeSchema = external_exports.enum(MODEL_PROVIDER_TYPE_IDS);
-var modelProviderFrameworkSchema = external_exports.enum(["claude-code", "codex"]);
-function hasAuthMethods(type) {
-  const config = MODEL_PROVIDER_TYPES[type];
-  if (!config) return false;
-  return "authMethods" in config;
-}
-function getAuthMethodsForType(type) {
-  const config = MODEL_PROVIDER_TYPES[type];
-  if (!config) return void 0;
-  return "authMethods" in config ? config.authMethods : void 0;
-}
-function getDefaultAuthMethod(type) {
-  const config = MODEL_PROVIDER_TYPES[type];
-  return "defaultAuthMethod" in config ? config.defaultAuthMethod : void 0;
-}
-function getSecretsForAuthMethod(type, authMethod) {
-  const authMethods = getAuthMethodsForType(type);
-  if (!authMethods || !(authMethod in authMethods)) {
-    return void 0;
-  }
-  const method = authMethods[authMethod];
-  return method?.secrets;
-}
-var modelProviderSubscriptionUsageWindowSchema = external_exports.object({
-  usedPercent: external_exports.number().nullable(),
-  remainingPercent: external_exports.number().nullable(),
-  resetAt: external_exports.string().nullable(),
-  windowSeconds: external_exports.number().nullable()
-});
-var modelProviderSubscriptionUsageSchema = external_exports.object({
-  fiveHour: modelProviderSubscriptionUsageWindowSchema.nullable(),
-  weekly: modelProviderSubscriptionUsageWindowSchema.nullable()
-});
-var modelProviderResponseSchema = external_exports.object({
-  id: external_exports.uuid(),
-  type: modelProviderTypeSchema,
-  framework: modelProviderFrameworkSchema,
-  secretName: external_exports.string().nullable(),
-  // Legacy single-secret (deprecated for multi-auth)
-  authMethod: external_exports.string().nullable(),
-  // For multi-auth providers
-  secretNames: external_exports.array(external_exports.string()).nullable(),
-  // For multi-auth providers
-  isDefault: external_exports.boolean(),
-  selectedModel: external_exports.string().nullable(),
-  createdAt: external_exports.string(),
-  updatedAt: external_exports.string(),
-  // OAuth account metadata populated by provider-specific connect flows. Other
-  // provider types omit these.
-  accountEmail: external_exports.string().nullable().optional(),
-  workspaceName: external_exports.string().nullable().optional(),
-  planType: external_exports.string().nullable().optional(),
-  // Subscription quota metadata. Providers omit these until an upstream source
-  // exposes the reset cadence or next reset timestamp.
-  subscriptionResetPeriod: external_exports.string().nullable().optional(),
-  subscriptionNextResetAt: external_exports.string().nullable().optional(),
-  subscriptionUsage: modelProviderSubscriptionUsageSchema.nullable().optional(),
-  subscriptionResetCredits: external_exports.number().int().nonnegative().nullable().optional(),
-  // OAuth refresh state. `needsReconnect` flips to true when the firewall's
-  // refresh attempt fails (#11921 writes this on the model_providers row).
-  // `lastRefreshErrorCode` carries the typed code from `ChatgptRefreshError`
-  // (e.g. `refresh_token_expired`) so the UI can render an actionable
-  // re-connect message. Both fields are always emitted for OAuth-typed
-  // providers; non-OAuth types default to false / null.
-  needsReconnect: external_exports.boolean(),
-  lastRefreshErrorCode: external_exports.string().nullable()
-});
-var modelProviderListResponseSchema = external_exports.object({
-  modelProviders: external_exports.array(modelProviderResponseSchema)
-});
-var upsertModelProviderRequestSchema = external_exports.object({
-  type: modelProviderTypeSchema,
-  secret: external_exports.string().min(1).optional(),
-  // Legacy single secret
-  authMethod: external_exports.string().optional(),
-  // For multi-auth providers
-  secrets: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  // For multi-auth providers
-  selectedModel: external_exports.string().optional()
-});
-var upsertModelProviderResponseSchema = external_exports.object({
-  provider: modelProviderResponseSchema,
-  created: external_exports.boolean()
-});
-var orgModelPolicyRouteStatusSchema = external_exports.enum([
-  "valid",
-  "missing_provider",
-  "invalid"
-]);
-var orgModelPolicySchema = external_exports.object({
-  id: external_exports.uuid(),
-  model: supportedRunModelSchema,
-  modelLabel: external_exports.string(),
-  isDefault: external_exports.boolean(),
-  defaultProviderType: modelProviderTypeSchema,
-  credentialScope: modelProviderCredentialScopeSchema,
-  modelProviderId: external_exports.uuid().nullable(),
-  routeStatus: orgModelPolicyRouteStatusSchema,
-  routeStatusReason: external_exports.string().nullable(),
-  createdAt: external_exports.string(),
-  updatedAt: external_exports.string()
-});
-var updateOrgModelPolicySchema = external_exports.object({
-  model: supportedRunModelSchema,
-  isDefault: external_exports.boolean(),
-  defaultProviderType: modelProviderTypeSchema,
-  credentialScope: modelProviderCredentialScopeSchema,
-  modelProviderId: external_exports.uuid().nullable()
-});
-var orgModelPoliciesResponseSchema = external_exports.object({
-  policies: external_exports.array(orgModelPolicySchema),
-  workspaceDefaultModel: supportedRunModelSchema.nullable(),
-  workspaceDefaultPolicyId: external_exports.uuid().nullable()
-});
-var updateOrgModelPoliciesRequestSchema = external_exports.object({
-  policies: external_exports.array(updateOrgModelPolicySchema)
-});
-
 // src/lib/api/domains/registry-resources.ts
 init_esm_shims();
 
@@ -5665,15 +4684,6 @@ var pagedChatMessageBaseSchema = external_exports.object({
   attachFiles: external_exports.array(resolvedAttachFileSchema).optional(),
   generationTemplate: generationTemplateRequestSchema.optional(),
   sequenceNumber: external_exports.number().nullable().optional(),
-  // Deprecated legacy schedule automation metadata. Migration 0545 clears
-  // existing values; new message writes no longer populate these fields.
-  automationId: external_exports.string().optional(),
-  automationTitle: external_exports.string().optional(),
-  automationSnapshot: external_exports.object({
-    id: external_exports.string(),
-    title: external_exports.string(),
-    description: external_exports.string().nullable()
-  }).optional(),
   workflowSnapshot: external_exports.object({
     id: external_exports.string().uuid().optional(),
     agentId: external_exports.string().uuid().optional(),
@@ -11224,8 +10234,14 @@ var secretResponseSchema = external_exports.object({
   createdAt: external_exports.string(),
   updatedAt: external_exports.string()
 });
+var secretListItemResponseSchema = secretResponseSchema.extend({
+  connectorDisplay: external_exports.object({
+    label: external_exports.string(),
+    environmentNames: external_exports.array(external_exports.string())
+  }).nullable()
+});
 var secretListResponseSchema = external_exports.object({
-  secrets: external_exports.array(secretResponseSchema)
+  secrets: external_exports.array(secretListItemResponseSchema)
 });
 var setSecretRequestSchema = external_exports.object({
   name: secretNameSchema,
@@ -15181,19 +14197,6 @@ export {
   validateBaseUrl,
   validateAuthBaseUrl,
   authHeadersSchema,
-  supportedRunModelSchema,
-  getVm0ModelPriceTier,
-  MODEL_PROVIDER_TYPES,
-  getSelectableProviderTypes,
-  modelProviderTypeSchema,
-  hasAuthMethods,
-  getAuthMethodsForType,
-  getDefaultAuthMethod,
-  getSecretsForAuthMethod,
-  modelProviderResponseSchema,
-  modelProviderListResponseSchema,
-  upsertModelProviderRequestSchema,
-  upsertModelProviderResponseSchema,
   runnerGroupSchema,
   volumeConfigSchema,
   agentDefinitionSchema,
@@ -15353,4 +14356,4 @@ export {
   completeHostedSite,
   getHostedSiteFiles
 };
-//# sourceMappingURL=chunk-XX3HVOWG.js.map
+//# sourceMappingURL=chunk-GIACTMOF.js.map