@vm0/cli 9.238.5 → 9.238.6

package/{chunk-GIACTMOF.js → chunk-MSZRROJT.js}

@@ -22,7 +22,7 @@ import {
   updateOrgModelPoliciesRequestSchema,
   upsertModelProviderRequestSchema,
   upsertModelProviderResponseSchema
-} from "./chunk-VC7E6IA7.js";
+} from "./chunk-GE2LI4MS.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -6536,9 +6536,68 @@ var zeroConnectorCatalogContract = c21.router({
   }
 });
 
-// ../../packages/api-contracts/src/contracts/zero-custom-connectors.ts
+// ../../packages/api-contracts/src/contracts/zero-connector-permission-deny.ts
 init_esm_shims();
 var c22 = initContract();
+var connectorPermissionDenyRequestSchema = external_exports.object({
+  method: external_exports.string().min(1).max(16),
+  url: external_exports.string().min(1).max(8192)
+}).strict();
+var connectorPermissionDenyMatchedSchema = external_exports.object({
+  outcome: external_exports.literal("matched"),
+  label: external_exports.string().min(1),
+  base: external_exports.string().min(1),
+  relativePath: external_exports.string().min(1),
+  permissions: external_exports.array(external_exports.string().min(1)).min(1)
+}).strict();
+var connectorPermissionDenyUnknownEndpointSchema = external_exports.object({
+  outcome: external_exports.literal("unknown-endpoint"),
+  label: external_exports.string().min(1),
+  base: external_exports.string().min(1),
+  relativePath: external_exports.string().min(1)
+}).strict();
+var connectorPermissionDenyUnknownConnectorSchema = external_exports.object({ outcome: external_exports.literal("unknown-connector") }).strict();
+var connectorPermissionDenyNoMatchingBaseSchema = external_exports.object({
+  outcome: external_exports.literal("no-matching-base"),
+  label: external_exports.string().min(1)
+}).strict();
+var connectorPermissionDenyUnresolvedDynamicBaseSchema = external_exports.object({
+  outcome: external_exports.literal("unresolved-dynamic-base"),
+  label: external_exports.string().min(1)
+}).strict();
+var connectorPermissionDenyUnsafeInputSchema = external_exports.object({
+  outcome: external_exports.literal("unsafe-input"),
+  reason: external_exports.enum(["invalid-method", "invalid-url", "unsafe-path"])
+}).strict();
+var connectorPermissionDenyDiagnosticResultSchema = external_exports.discriminatedUnion("outcome", [
+  connectorPermissionDenyMatchedSchema,
+  connectorPermissionDenyUnknownEndpointSchema,
+  connectorPermissionDenyUnknownConnectorSchema,
+  connectorPermissionDenyNoMatchingBaseSchema,
+  connectorPermissionDenyUnresolvedDynamicBaseSchema,
+  connectorPermissionDenyUnsafeInputSchema
+]);
+var zeroConnectorPermissionDenyContract = c22.router({
+  diagnose: {
+    method: "POST",
+    path: "/api/zero/connectors/:connectorRef/diagnostics/permission-deny",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({ connectorRef: connectorCatalogRefSchema }),
+    body: connectorPermissionDenyRequestSchema,
+    responses: {
+      200: connectorPermissionDenyDiagnosticResultSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Diagnose a connector permission denial"
+  }
+});
+
+// ../../packages/api-contracts/src/contracts/zero-custom-connectors.ts
+init_esm_shims();
+var c23 = initContract();
 var customConnectorFieldKindSchema = external_exports.enum(["secret", "variable"]);
 var customConnectorFieldSchema = external_exports.object({
   key: external_exports.string().min(1).max(64),
@@ -6635,7 +6694,7 @@ var saveCustomConnectorProposalResponseSchema = external_exports.object({
   connector: customConnectorResponseSchema,
   authorizedAgentId: external_exports.string().uuid().optional()
 });
-var zeroCustomConnectorsContract = c22.router({
+var zeroCustomConnectorsContract = c23.router({
   list: {
     method: "GET",
     path: "/api/zero/custom-connectors",
@@ -6662,7 +6721,7 @@ var zeroCustomConnectorsContract = c22.router({
     summary: "Create an org custom connector"
   }
 });
-var zeroCustomConnectorByIdContract = c22.router({
+var zeroCustomConnectorByIdContract = c23.router({
   get: {
     method: "GET",
     path: "/api/zero/custom-connectors/:id",
@@ -6683,7 +6742,7 @@ var zeroCustomConnectorByIdContract = c22.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -6708,7 +6767,7 @@ var zeroCustomConnectorByIdContract = c22.router({
     summary: "Rename an org custom connector"
   }
 });
-var zeroCustomConnectorSecretContract = c22.router({
+var zeroCustomConnectorSecretContract = c23.router({
   set: {
     method: "PUT",
     path: "/api/zero/custom-connectors/:id/secret",
@@ -6716,7 +6775,7 @@ var zeroCustomConnectorSecretContract = c22.router({
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     body: setCustomConnectorSecretBodySchema,
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema,
@@ -6730,7 +6789,7 @@ var zeroCustomConnectorSecretContract = c22.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -6738,7 +6797,7 @@ var zeroCustomConnectorSecretContract = c22.router({
     summary: "Clear the calling user's secret for a custom connector"
   }
 });
-var zeroCustomConnectorProposalContract = c22.router({
+var zeroCustomConnectorProposalContract = c23.router({
   save: {
     method: "POST",
     path: "/api/zero/custom-connectors/proposals/save",
@@ -6818,6 +6877,24 @@ async function getZeroConnectorCatalogPermissions(connectorRef) {
     `Failed to get connector permission metadata for "${connectorRef}"`
   );
 }
+async function diagnoseZeroConnectorPermissionDeny(connectorRef, method, url) {
+  const config = await getClientConfig();
+  const client = initClient(zeroConnectorPermissionDenyContract, {
+    ...config,
+    validateResponse: true
+  });
+  const result = await client.diagnose({
+    params: { connectorRef },
+    body: { method, url }
+  });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(
+    result,
+    `Failed to diagnose permission denial for "${connectorRef}"`
+  );
+}
 async function getZeroConnector(type) {
   const config = await getClientConfig();
   const client = initClient(zeroConnectorsByTypeContract, config);
@@ -6877,7 +6954,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/runners.ts
 init_esm_shims();
-var c23 = initContract();
+var c24 = initContract();
 var MIN_EPOCH_MS_TIMESTAMP = 1e12;
 var apiStartTimeSchema = external_exports.number().int().min(MIN_EPOCH_MS_TIMESTAMP);
 var CANONICAL_GUEST_HOME_DIR = "/home/user";
@@ -6983,7 +7060,7 @@ var heldSessionStateSchema = external_exports.object({
     profile: external_exports.string()
   }).optional()
 });
-var runnersPollContract = c23.router({
+var runnersPollContract = c24.router({
   poll: {
     method: "POST",
     path: "/api/runners/poll",
@@ -7221,7 +7298,7 @@ var executionContextSchema = external_exports.object({
   // API-owned Codex provider/runtime metadata forwarded through the runner.
   codexRuntimeConfig: modelProviderCodexRuntimeConfigSchema.nullable().optional()
 });
-var runnersJobClaimContract = c23.router({
+var runnersJobClaimContract = c24.router({
   claim: {
     method: "POST",
     path: "/api/runners/jobs/:id/claim",
@@ -7245,7 +7322,7 @@ var runnersJobClaimContract = c23.router({
     summary: "Claim a pending job for execution"
   }
 });
-var runnersNetworkPolicyRefreshContract = c23.router({
+var runnersNetworkPolicyRefreshContract = c24.router({
   refresh: {
     method: "POST",
     path: "/api/runners/runs/:runId/network-policy-refresh",
@@ -7275,7 +7352,7 @@ var runnersNetworkPolicyRefreshContract = c23.router({
     summary: "Refresh active run network policies"
   }
 });
-var runnersBuiltinFirewallsResolveContract = c23.router({
+var runnersBuiltinFirewallsResolveContract = c24.router({
   resolve: {
     method: "POST",
     path: "/api/runners/builtin-firewalls/resolve",
@@ -7304,7 +7381,7 @@ var heartbeatBodySchema = external_exports.object({
   heldSessionStates: external_exports.array(heldSessionStateSchema).max(1024),
   mode: external_exports.enum(["starting", "running", "draining", "stopping"])
 });
-var runnersHeartbeatContract = c23.router({
+var runnersHeartbeatContract = c24.router({
   heartbeat: {
     method: "POST",
     path: "/api/runners/heartbeat",
@@ -7322,7 +7399,7 @@ var runnersHeartbeatContract = c23.router({
 
 // ../../packages/api-contracts/src/contracts/storages.ts
 init_esm_shims();
-var c24 = initContract();
+var c25 = initContract();
 var storageTypeSchema = external_exports.enum(["volume", "artifact"]);
 var versionQuerySchema = external_exports.string().regex(/^[a-f0-9]{8,64}$/i, "Version must be 8-64 hex characters").optional();
 var uploadStorageResponseSchema = external_exports.object({
@@ -7333,7 +7410,7 @@ var uploadStorageResponseSchema = external_exports.object({
   type: storageTypeSchema,
   deduplicated: external_exports.boolean()
 });
-var storagesContract = c24.router({
+var storagesContract = c25.router({
   /**
    * POST /api/storages
    * Upload a storage (tar.gz file)
@@ -7350,7 +7427,7 @@ var storagesContract = c24.router({
     path: "/api/storages",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c24.type(),
+    body: c25.type(),
     responses: {
       200: uploadStorageResponseSchema,
       400: apiErrorSchema,
@@ -7379,9 +7456,9 @@ var storagesContract = c24.router({
     }),
     responses: {
       // Binary response - actual handling done at route level
-      200: c24.otherResponse({
+      200: c25.otherResponse({
         contentType: "application/gzip",
-        body: c24.type()
+        body: c25.type()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -7406,7 +7483,7 @@ var presignedUploadSchema = external_exports.object({
   key: external_exports.string(),
   presignedUrl: external_exports.url()
 });
-var storagesPrepareContract = c24.router({
+var storagesPrepareContract = c25.router({
   prepare: {
     method: "POST",
     path: "/api/storages/prepare",
@@ -7441,7 +7518,7 @@ var storagesPrepareContract = c24.router({
     summary: "Prepare for direct S3 upload"
   }
 });
-var storagesCommitContract = c24.router({
+var storagesCommitContract = c25.router({
   commit: {
     method: "POST",
     path: "/api/storages/commit",
@@ -7475,7 +7552,7 @@ var storagesCommitContract = c24.router({
     summary: "Commit uploaded storage"
   }
 });
-var storagesDownloadContract = c24.router({
+var storagesDownloadContract = c25.router({
   download: {
     method: "GET",
     path: "/api/storages/download",
@@ -7511,7 +7588,7 @@ var storagesDownloadContract = c24.router({
     summary: "Get presigned download URL"
   }
 });
-var storagesListContract = c24.router({
+var storagesListContract = c25.router({
   list: {
     method: "GET",
     path: "/api/storages/list",
@@ -7539,7 +7616,7 @@ var storagesListContract = c24.router({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks.ts
-var c25 = initContract();
+var c26 = initContract();
 var sha256HexSchema = external_exports.string().regex(
   /^[a-f0-9]{64}$/,
   "hash must be a lowercase 64-character SHA-256 hex string"
@@ -7549,11 +7626,11 @@ var thirdPartyWebhookOkSchema = external_exports.union([
   external_exports.string(),
   external_exports.object({ message: external_exports.literal("pong") })
 ]);
-var webhookClerkContract = c25.router({
+var webhookClerkContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/clerk",
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema
@@ -7561,11 +7638,11 @@ var webhookClerkContract = c25.router({
     summary: "Handle Clerk organization and user webhooks"
   }
 });
-var webhookGithubContract = c25.router({
+var webhookGithubContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/github",
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7575,11 +7652,11 @@ var webhookGithubContract = c25.router({
     summary: "Handle GitHub App webhooks"
   }
 });
-var webhookStripeContract = c25.router({
+var webhookStripeContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/stripe",
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema,
@@ -7618,11 +7695,11 @@ var workflowTriggerWebhookResponseSchema = external_exports.object({
   duplicate: external_exports.boolean(),
   runId: external_exports.string().uuid().optional()
 });
-var webhookGmailContract = c25.router({
+var webhookGmailContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/gmail",
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: gmailWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7633,11 +7710,11 @@ var webhookGmailContract = c25.router({
     summary: "Handle Gmail Pub/Sub push notifications"
   }
 });
-var webhookGoogleCalendarContract = c25.router({
+var webhookGoogleCalendarContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/google-calendar",
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: googleCalendarWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7648,11 +7725,11 @@ var webhookGoogleCalendarContract = c25.router({
     summary: "Handle Google Calendar push notifications"
   }
 });
-var webhookGoogleWorkspaceEventsContract = c25.router({
+var webhookGoogleWorkspaceEventsContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/google-workspace-events",
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: googleWorkspaceEventsWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7663,11 +7740,11 @@ var webhookGoogleWorkspaceEventsContract = c25.router({
     summary: "Handle Google Workspace Events Pub/Sub push notifications"
   }
 });
-var webhookNotionContract = c25.router({
+var webhookNotionContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/notion",
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: notionWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7677,14 +7754,14 @@ var webhookNotionContract = c25.router({
     summary: "Handle Notion webhook events"
   }
 });
-var webhookWorkflowTriggerContract = c25.router({
+var webhookWorkflowTriggerContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/workflow-triggers/:token",
     pathParams: external_exports.object({
       token: external_exports.string().min(1)
     }),
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: workflowTriggerWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7697,7 +7774,7 @@ var webhookWorkflowTriggerContract = c25.router({
     summary: "Handle inbound workflow trigger webhooks"
   }
 });
-var webhookBuiltInGenerationFalContract = c25.router({
+var webhookBuiltInGenerationFalContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/built-in-generations/fal/:generationId",
@@ -7708,7 +7785,7 @@ var webhookBuiltInGenerationFalContract = c25.router({
       token: external_exports.string().min(1),
       visualKey: external_exports.string().min(1).optional()
     }),
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7718,7 +7795,7 @@ var webhookBuiltInGenerationFalContract = c25.router({
     summary: "Handle fal built-in generation webhooks"
   }
 });
-var webhookBuiltInGenerationBytePlusContract = c25.router({
+var webhookBuiltInGenerationBytePlusContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/built-in-generations/byteplus/:generationId",
@@ -7729,7 +7806,7 @@ var webhookBuiltInGenerationBytePlusContract = c25.router({
       token: external_exports.string().min(1),
       visualKey: external_exports.string().min(1).optional()
     }),
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7789,7 +7866,7 @@ var firewallAuthResponseSchema = external_exports.object({
   refreshedConnectors: external_exports.array(external_exports.string()),
   refreshedSecrets: external_exports.array(external_exports.string())
 });
-var webhookFirewallAuthContract = c25.router({
+var webhookFirewallAuthContract = c26.router({
   /**
    * POST /api/webhooks/agent/firewall/auth
    * Resolve firewall auth templates and refresh access tokens on demand.
@@ -7831,7 +7908,7 @@ var webhookFirewallAuthContract = c25.router({
     summary: "Resolve firewall auth templates"
   }
 });
-var webhookEventsContract = c25.router({
+var webhookEventsContract = c26.router({
   /**
    * POST /api/webhooks/agent/events
    * Receive agent events from sandbox
@@ -7858,7 +7935,7 @@ var webhookEventsContract = c25.router({
     summary: "Receive agent events from sandbox"
   }
 });
-var webhookCompleteContract = c25.router({
+var webhookCompleteContract = c26.router({
   /**
    * POST /api/webhooks/agent/complete
    * Handle agent run completion (success or failure)
@@ -7895,7 +7972,7 @@ var webhookCompleteContract = c25.router({
     summary: "Handle agent run completion"
   }
 });
-var webhookCheckpointsContract = c25.router({
+var webhookCheckpointsContract = c26.router({
   /**
    * POST /api/webhooks/agent/checkpoints
    * Create a recoverable checkpoint for an agent run.
@@ -7931,7 +8008,7 @@ var webhookCheckpointsContract = c25.router({
     summary: "Create checkpoint for agent run"
   }
 });
-var webhookCheckpointsPrepareHistoryContract = c25.router({
+var webhookCheckpointsPrepareHistoryContract = c26.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/checkpoints/prepare-history",
@@ -7957,7 +8034,7 @@ var webhookCheckpointsPrepareHistoryContract = c25.router({
     summary: "Get presigned URL for uploading session history to S3"
   }
 });
-var webhookHeartbeatContract = c25.router({
+var webhookHeartbeatContract = c26.router({
   /**
    * POST /api/webhooks/agent/heartbeat
    * Receive heartbeat signals from sandbox
@@ -7981,7 +8058,7 @@ var webhookHeartbeatContract = c25.router({
     summary: "Receive heartbeat from sandbox"
   }
 });
-var webhookStoragesContract = c25.router({
+var webhookStoragesContract = c26.router({
   /**
    * POST /api/webhooks/agent/storages
    * Create a new version of a storage from sandbox
@@ -7997,7 +8074,7 @@ var webhookStoragesContract = c25.router({
     path: "/api/webhooks/agent/storages",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -8013,7 +8090,7 @@ var webhookStoragesContract = c25.router({
     summary: "Upload storage version from sandbox"
   }
 });
-var webhookStoragesIncrementalContract = c25.router({
+var webhookStoragesIncrementalContract = c26.router({
   /**
    * POST /api/webhooks/agent/storages/incremental
    * Create a new version using incremental upload
@@ -8031,7 +8108,7 @@ var webhookStoragesIncrementalContract = c25.router({
     path: "/api/webhooks/agent/storages/incremental",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c25.type(),
+    body: c26.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -8125,7 +8202,7 @@ var sandboxOperationSchema = external_exports.object({
   session_history_transfer_encoding_state: sessionHistoryTransferEncodingStateSchema.optional(),
   session_history_download_source: sandboxOperationDownloadSourceSchema
 });
-var webhookTelemetryContract = c25.router({
+var webhookTelemetryContract = c26.router({
   /**
    * POST /api/webhooks/agent/telemetry
    * Receive telemetry data (system log, metrics, network logs, and sandbox operations) from sandbox
@@ -8154,7 +8231,7 @@ var webhookTelemetryContract = c25.router({
     summary: "Receive telemetry data from sandbox"
   }
 });
-var webhookStoragesPrepareContract = c25.router({
+var webhookStoragesPrepareContract = c26.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/storages/prepare",
@@ -8188,7 +8265,7 @@ var webhookStoragesPrepareContract = c25.router({
     summary: "Prepare for direct S3 upload from sandbox"
   }
 });
-var webhookStoragesCommitContract = c25.router({
+var webhookStoragesCommitContract = c26.router({
   commit: {
     method: "POST",
     path: "/api/webhooks/agent/storages/commit",
@@ -8230,7 +8307,7 @@ var webhookUsageEventItemSchema = external_exports.object({
   category: external_exports.string().min(1).max(100),
   quantity: external_exports.number().int().min(0)
 }).strict();
-var webhookUsageEventContract = c25.router({
+var webhookUsageEventContract = c26.router({
   send: {
     method: "POST",
     path: "/api/webhooks/agent/usage-event",
@@ -8263,7 +8340,7 @@ var webhookModelUsageObservationItemSchema = external_exports.object({
   category: modelUsageObservationCategorySchema,
   quantity: external_exports.number().int().min(1)
 }).strict();
-var webhookModelUsageObservationContract = c25.router({
+var webhookModelUsageObservationContract = c26.router({
   send: {
     method: "POST",
     path: "/api/webhooks/agent/model-usage-observation",
@@ -8301,7 +8378,7 @@ var zeroRunRequestSchema = unifiedRunRequestSchema.omit({
   agentId: external_exports.string().optional(),
   modelProvider: external_exports.string().optional()
 });
-var c26 = initContract();
+var c27 = initContract();
 var zeroLogPaginationQuerySchema = createLogPaginationQuerySchema({
   cursorKind: "sequence"
 });
@@ -8311,7 +8388,7 @@ var zeroNetworkLogPaginationQuerySchema = createLogPaginationQuerySchema({
   defaultLimit: 500,
   defaultOrder: "asc"
 });
-var zeroRunsMainContract = c26.router({
+var zeroRunsMainContract = c27.router({
   create: {
     method: "POST",
     path: "/api/zero/runs",
@@ -8330,7 +8407,7 @@ var zeroRunsMainContract = c26.router({
     summary: "Create and execute agent run (zero proxy)"
   }
 });
-var zeroRunsByIdContract = c26.router({
+var zeroRunsByIdContract = c27.router({
   getById: {
     method: "GET",
     path: "/api/zero/runs/:id",
@@ -8348,7 +8425,7 @@ var zeroRunsByIdContract = c26.router({
     summary: "Get agent run by ID (zero proxy)"
   }
 });
-var zeroRunsCancelContract = c26.router({
+var zeroRunsCancelContract = c27.router({
   cancel: {
     method: "POST",
     path: "/api/zero/runs/:id/cancel",
@@ -8367,7 +8444,7 @@ var zeroRunsCancelContract = c26.router({
     summary: "Cancel a pending or running run (zero proxy)"
   }
 });
-var zeroRunsQueueContract = c26.router({
+var zeroRunsQueueContract = c27.router({
   getQueue: {
     method: "GET",
     path: "/api/zero/runs/queue",
@@ -8380,7 +8457,7 @@ var zeroRunsQueueContract = c26.router({
     summary: "Get org run queue status (zero proxy)"
   }
 });
-var zeroRunAgentEventsContract = c26.router({
+var zeroRunAgentEventsContract = c27.router({
   getAgentEvents: {
     method: "GET",
     path: "/api/zero/runs/:id/telemetry/agent",
@@ -8444,7 +8521,7 @@ var runContextResponseSchema = external_exports.object({
   artifact: runContextArtifactSchema.nullable(),
   featureFlags: external_exports.record(external_exports.string(), external_exports.boolean()).nullable()
 });
-var zeroRunContextContract = c26.router({
+var zeroRunContextContract = c27.router({
   getContext: {
     method: "GET",
     path: "/api/zero/runs/:id/context",
@@ -8462,7 +8539,7 @@ var zeroRunContextContract = c26.router({
     summary: "Get run execution context snapshot for debugging"
   }
 });
-var zeroRunNetworkLogsContract = c26.router({
+var zeroRunNetworkLogsContract = c27.router({
   getNetworkLogs: {
     method: "GET",
     path: "/api/zero/runs/:id/network",
@@ -8484,7 +8561,7 @@ var zeroRunNetworkLogsContract = c26.router({
 var runRunnerResponseSchema = external_exports.object({
   sandboxReuseResult: sandboxReuseResultSchema.nullable()
 });
-var zeroRunRunnerContract = c26.router({
+var zeroRunRunnerContract = c27.router({
   getRunner: {
     method: "GET",
     path: "/api/zero/runs/:id/runner",
@@ -8502,7 +8579,7 @@ var zeroRunRunnerContract = c26.router({
     summary: "Get runner-level metadata for a run"
   }
 });
-var zeroLogsSearchContract = c26.router({
+var zeroLogsSearchContract = c27.router({
   searchLogs: {
     method: "GET",
     path: "/api/zero/logs/search",
@@ -8605,7 +8682,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-developer-support.ts
 init_esm_shims();
-var c27 = initContract();
+var c28 = initContract();
 var developerSupportBodySchema = external_exports.object({
   title: external_exports.string().min(1, "Title is required"),
   description: external_exports.string().min(1, "Description is required"),
@@ -8617,7 +8694,7 @@ var consentCodeResponseSchema = external_exports.object({
 var submitResponseSchema = external_exports.object({
   reference: external_exports.string()
 });
-var zeroDeveloperSupportContract = c27.router({
+var zeroDeveloperSupportContract = c28.router({
   submit: {
     method: "POST",
     path: "/api/zero/developer-support",
@@ -8813,7 +8890,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-computer-use.ts
 init_esm_shims();
-var c28 = initContract();
+var c29 = initContract();
 var computerUseHostStatusSchema = external_exports.enum(["online", "offline"]);
 var computerUseReadCommandKindSchema = external_exports.enum([
   "apps.list",
@@ -9188,7 +9265,7 @@ var computerUseAuditEventSchema = external_exports.object({
 var computerUseAuditEventListResponseSchema = external_exports.object({
   auditEvents: external_exports.array(computerUseAuditEventSchema)
 });
-var zeroComputerUseHostsContract = c28.router({
+var zeroComputerUseHostsContract = c29.router({
   start: {
     method: "POST",
     path: "/api/zero/computer-use/hosts/start",
@@ -9227,7 +9304,7 @@ var zeroComputerUseHostsContract = c28.router({
     summary: "Delete a desktop computer-use host"
   }
 });
-var zeroComputerUseHeartbeatContract = c28.router({
+var zeroComputerUseHeartbeatContract = c29.router({
   heartbeat: {
     method: "POST",
     path: "/api/zero/computer-use/heartbeat",
@@ -9252,7 +9329,7 @@ var zeroComputerUseHeartbeatContract = c28.router({
     summary: "Stop a desktop computer-use host"
   }
 });
-var zeroComputerUseAuthorizationRequestsContract = c28.router({
+var zeroComputerUseAuthorizationRequestsContract = c29.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/authorization-requests",
@@ -9299,7 +9376,7 @@ var zeroComputerUseAuthorizationRequestsContract = c28.router({
     summary: "Bind a Computer Use host for a delegated authorization request"
   }
 });
-var zeroComputerUseCommandContract = c28.router({
+var zeroComputerUseCommandContract = c29.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/commands",
@@ -9334,7 +9411,7 @@ var zeroComputerUseCommandContract = c28.router({
     headers: authHeadersSchema,
     pathParams: commandIdPathParamsSchema,
     responses: {
-      200: c28.type(),
+      200: c29.type(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -9347,7 +9424,7 @@ var zeroComputerUseCommandContract = c28.router({
     headers: authHeadersSchema,
     pathParams: commandIdPathParamsSchema,
     responses: {
-      200: c28.type(),
+      200: c29.type(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -9355,7 +9432,7 @@ var zeroComputerUseCommandContract = c28.router({
     summary: "Download offloaded desktop computer-use plugin content"
   }
 });
-var zeroComputerUseWriteCommandContract = c28.router({
+var zeroComputerUseWriteCommandContract = c29.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/write-commands",
@@ -9372,7 +9449,7 @@ var zeroComputerUseWriteCommandContract = c28.router({
     summary: "Create a desktop computer-use write command"
   }
 });
-var zeroComputerUsePluginCommandContract = c28.router({
+var zeroComputerUsePluginCommandContract = c29.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/plugin-commands",
@@ -9389,7 +9466,7 @@ var zeroComputerUsePluginCommandContract = c28.router({
     summary: "Create a desktop computer-use plugin command"
   }
 });
-var zeroComputerUseHostCommandsContract = c28.router({
+var zeroComputerUseHostCommandsContract = c29.router({
   next: {
     method: "POST",
     path: "/api/zero/computer-use/host/commands/next",
@@ -9417,7 +9494,7 @@ var zeroComputerUseHostCommandsContract = c28.router({
     summary: "Complete a desktop computer-use command"
   }
 });
-var zeroComputerUseAuditEventsContract = c28.router({
+var zeroComputerUseAuditEventsContract = c29.router({
   list: {
     method: "GET",
     path: "/api/zero/computer-use/audit-events",
@@ -9716,7 +9793,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/composes.ts
 init_esm_shims();
-var c29 = initContract();
+var c30 = initContract();
 var MOUNT_PATH_TEMPLATE = "${{ working_dir }}";
 var composeVersionQuerySchema = external_exports.string().min(1, "Missing version query parameter").regex(
   /^[a-f0-9]{8,64}$|^latest$/i,
@@ -9836,7 +9913,7 @@ var createComposeResponseSchema = external_exports.object({
   action: external_exports.enum(["created", "existing"]),
   updatedAt: external_exports.string()
 });
-var composesMainContract = c29.router({
+var composesMainContract = c30.router({
   /**
    * GET /api/agent/composes?name={name}&org={org}
    * Get agent compose by name with HEAD version content
@@ -9882,7 +9959,7 @@ var composesMainContract = c29.router({
     summary: "Create or update agent compose version"
   }
 });
-var composesByIdContract = c29.router({
+var composesByIdContract = c30.router({
   /**
    * GET /api/agent/composes/:id
    * Get agent compose by ID with HEAD version content
@@ -9904,7 +9981,7 @@ var composesByIdContract = c29.router({
     summary: "Get agent compose by ID"
   }
 });
-var composesVersionsContract = c29.router({
+var composesVersionsContract = c30.router({
   /**
    * GET /api/agent/composes/versions?composeId={id}&version={hash|tag}
    * Resolve a version specifier to a full version ID
@@ -10058,7 +10135,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/sessions.ts
 init_esm_shims();
-var c30 = initContract();
+var c31 = initContract();
 var sessionResponseSchema = external_exports.object({
   id: external_exports.string(),
   agentComposeId: external_exports.string(),
@@ -10099,7 +10176,7 @@ var checkpointResponseSchema = external_exports.object({
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
   createdAt: external_exports.string()
 });
-var sessionsByIdContract = c30.router({
+var sessionsByIdContract = c31.router({
   /**
    * GET /api/agent/sessions/:id
    * Get session by ID
@@ -10120,7 +10197,7 @@ var sessionsByIdContract = c30.router({
     summary: "Get session by ID"
   }
 });
-var checkpointsByIdContract = c30.router({
+var checkpointsByIdContract = c31.router({
   /**
    * GET /api/agent/checkpoints/:id
    * Get checkpoint by ID
@@ -10273,8 +10350,8 @@ var setVariableRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/zero-secrets.ts
-var c31 = initContract();
-var zeroSecretsContract = c31.router({
+var c32 = initContract();
+var zeroSecretsContract = c32.router({
   list: {
     method: "GET",
     path: "/api/zero/secrets",
@@ -10301,7 +10378,7 @@ var zeroSecretsContract = c31.router({
     summary: "Create or update a secret"
   }
 });
-var zeroSecretsByNameContract = c31.router({
+var zeroSecretsByNameContract = c32.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/secrets/:name",
@@ -10310,7 +10387,7 @@ var zeroSecretsByNameContract = c31.router({
       name: secretNameSchema
     }),
     responses: {
-      204: c31.noBody(),
+      204: c32.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -10318,7 +10395,7 @@ var zeroSecretsByNameContract = c31.router({
     summary: "Delete a secret by name"
   }
 });
-var zeroVariablesContract = c31.router({
+var zeroVariablesContract = c32.router({
   list: {
     method: "GET",
     path: "/api/zero/variables",
@@ -10345,7 +10422,7 @@ var zeroVariablesContract = c31.router({
     summary: "Create or update a variable"
   }
 });
-var zeroVariablesByNameContract = c31.router({
+var zeroVariablesByNameContract = c32.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/variables/:name",
@@ -10354,7 +10431,7 @@ var zeroVariablesByNameContract = c31.router({
       name: variableNameSchema
     }),
     responses: {
-      204: c31.noBody(),
+      204: c32.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -10495,9 +10572,9 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-model-providers.ts
 init_esm_shims();
-var c32 = initContract();
+var c33 = initContract();
 var orgUpsertModelProviderRequestSchema = upsertModelProviderRequestSchema.omit({ selectedModel: true });
-var zeroModelProvidersMainContract = c32.router({
+var zeroModelProvidersMainContract = c33.router({
   list: {
     method: "GET",
     path: "/api/zero/model-providers",
@@ -10526,7 +10603,7 @@ var zeroModelProvidersMainContract = c32.router({
     summary: "Create or update an org-level model provider (admin only)"
   }
 });
-var zeroModelProvidersByTypeContract = c32.router({
+var zeroModelProvidersByTypeContract = c33.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/model-providers/:type",
@@ -10535,7 +10612,7 @@ var zeroModelProvidersByTypeContract = c32.router({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c32.noBody(),
+      204: c33.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -10581,7 +10658,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-workflows.ts
 init_esm_shims();
-var c33 = initContract();
+var c34 = initContract();
 var zeroWorkflowVisibilitySchema = external_exports.enum(["public", "private"]);
 var zeroWorkflowNameSchema = external_exports.string().min(2).max(64).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/);
 var RESERVED_SKILL_FILE = "SKILL.md";
@@ -11226,7 +11303,7 @@ var zeroWorkflowConnectorReadinessResponseSchema = external_exports.object({
   connectors: external_exports.array(zeroWorkflowConnectorReadinessEntrySchema)
 }).strict();
 var workflowIdParams = external_exports.object({ workflowId: external_exports.string().uuid() });
-var zeroWorkflowsCollectionContract = c33.router({
+var zeroWorkflowsCollectionContract = c34.router({
   list: {
     method: "GET",
     path: "/api/zero/workflows",
@@ -11255,7 +11332,7 @@ var zeroWorkflowsCollectionContract = c33.router({
     summary: "Create a workflow under an agent"
   }
 });
-var zeroWorkflowsDetailContract = c33.router({
+var zeroWorkflowsDetailContract = c34.router({
   get: {
     method: "GET",
     path: "/api/zero/workflows/:workflowId",
@@ -11290,9 +11367,9 @@ var zeroWorkflowsDetailContract = c33.router({
     path: "/api/zero/workflows/:workflowId",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c34.noBody(),
     responses: {
-      204: c33.noBody(),
+      204: c34.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -11320,7 +11397,7 @@ var zeroWorkflowsDetailContract = c33.router({
     path: "/api/zero/workflows/:workflowId/chat-thread",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c34.noBody(),
     responses: {
       200: zeroWorkflowChatThreadResponseSchema,
       401: apiErrorSchema,
@@ -11334,7 +11411,7 @@ var zeroWorkflowsDetailContract = c33.router({
     path: "/api/zero/workflows/:workflowId/run",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c34.noBody(),
     responses: {
       200: zeroWorkflowRunResponseSchema,
       401: apiErrorSchema,
@@ -11349,7 +11426,7 @@ var zeroWorkflowsDetailContract = c33.router({
     path: "/api/zero/workflows/:workflowId/connector-readiness",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c34.noBody(),
     responses: {
       200: zeroWorkflowConnectorReadinessResponseSchema,
       400: apiErrorSchema,
@@ -11362,13 +11439,13 @@ var zeroWorkflowsDetailContract = c33.router({
     summary: "Detect the built-in connectors a workflow may need and report their readiness"
   }
 });
-var zeroWorkflowVisibilityContract = c33.router({
+var zeroWorkflowVisibilityContract = c34.router({
   publish: {
     method: "POST",
     path: "/api/zero/workflows/:workflowId/publish",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c34.noBody(),
     responses: {
       200: zeroWorkflowSummarySchema,
       400: apiErrorSchema,
@@ -11384,7 +11461,7 @@ var zeroWorkflowVisibilityContract = c33.router({
     path: "/api/zero/workflows/:workflowId/demote",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c34.noBody(),
     responses: {
       200: zeroWorkflowSummarySchema,
       400: apiErrorSchema,
@@ -11402,7 +11479,7 @@ var zeroWorkflowWebhookSecretResponseSchema = external_exports.object({
   webhookUrl: external_exports.url(),
   webhookSecret: external_exports.string().min(1)
 });
-var zeroWorkflowTriggersContract = c33.router({
+var zeroWorkflowTriggersContract = c34.router({
   listWorkspace: {
     method: "GET",
     path: "/api/zero/workflow-triggers",
@@ -11491,9 +11568,9 @@ var zeroWorkflowTriggersContract = c33.router({
     path: "/api/zero/workflow-triggers/:id",
     headers: authHeadersSchema,
     pathParams: triggerIdParams,
-    body: c33.noBody(),
+    body: c34.noBody(),
     responses: {
-      204: c33.noBody(),
+      204: c34.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -11505,7 +11582,7 @@ var zeroWorkflowTriggersContract = c33.router({
     path: "/api/zero/workflow-triggers/:id/enable",
     headers: authHeadersSchema,
     pathParams: triggerIdParams,
-    body: c33.noBody(),
+    body: c34.noBody(),
     responses: {
       200: zeroWorkflowTriggerSummarySchema,
       400: apiErrorSchema,
@@ -11522,7 +11599,7 @@ var zeroWorkflowTriggersContract = c33.router({
     path: "/api/zero/workflow-triggers/:id/disable",
     headers: authHeadersSchema,
     pathParams: triggerIdParams,
-    body: c33.noBody(),
+    body: c34.noBody(),
     responses: {
       200: zeroWorkflowTriggerSummarySchema,
       401: apiErrorSchema,
@@ -11536,7 +11613,7 @@ var zeroWorkflowTriggersContract = c33.router({
     path: "/api/zero/workflow-triggers/:id/run",
     headers: authHeadersSchema,
     pathParams: triggerIdParams,
-    body: c33.noBody(),
+    body: c34.noBody(),
     responses: {
       201: zeroWorkflowRunResponseSchema,
       400: apiErrorSchema,
@@ -11552,7 +11629,7 @@ var zeroWorkflowTriggersContract = c33.router({
     path: "/api/zero/workflow-triggers/:id/webhook-secret",
     headers: authHeadersSchema,
     pathParams: triggerIdParams,
-    body: c33.noBody(),
+    body: c34.noBody(),
     responses: {
       200: zeroWorkflowWebhookSecretResponseSchema,
       401: apiErrorSchema,
@@ -11667,7 +11744,7 @@ import { pipeline } from "stream/promises";
 
 // ../../packages/api-contracts/src/contracts/integrations.ts
 init_esm_shims();
-var c34 = initContract();
+var c35 = initContract();
 var sendSlackMessageBodySchema = external_exports.object({
   channel: external_exports.string().min(1, "Channel ID is required").optional(),
   user: external_exports.string().min(1, "User ID is required").optional(),
@@ -11685,7 +11762,7 @@ var sendSlackMessageResponseSchema = external_exports.object({
   ts: external_exports.string().optional(),
   channel: external_exports.string().optional()
 });
-var integrationsSlackMessageContract = c34.router({
+var integrationsSlackMessageContract = c35.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/slack/message",
@@ -11713,7 +11790,7 @@ var sendTelegramMessageResponseSchema = external_exports.object({
   messageId: external_exports.number().int(),
   chatId: external_exports.string()
 });
-var integrationsTelegramMessageContract = c34.router({
+var integrationsTelegramMessageContract = c35.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/telegram/message",
@@ -11772,7 +11849,7 @@ var sendTeamsMessageResponseSchema = external_exports.object({
   activityId: external_exports.string().optional(),
   conversationId: external_exports.string()
 });
-var integrationsTeamsMessageContract = c34.router({
+var integrationsTeamsMessageContract = c35.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/teams/message",
@@ -11800,7 +11877,7 @@ var sendPhoneMessageResponseSchema = external_exports.object({
   channel: external_exports.string().nullable(),
   toNumber: external_exports.string()
 });
-var integrationsPhoneMessageContract = c34.router({
+var integrationsPhoneMessageContract = c35.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/phone/message",
@@ -11820,14 +11897,14 @@ var integrationsPhoneMessageContract = c34.router({
 var phoneDownloadFileQuerySchema = external_exports.object({
   file_id: external_exports.string().min(1, "file_id query parameter is required")
 });
-var integrationsPhoneDownloadFileContract = c34.router({
+var integrationsPhoneDownloadFileContract = c35.router({
   download: {
     method: "GET",
     path: "/api/zero/integrations/phone/download-file",
     headers: authHeadersSchema,
     query: phoneDownloadFileQuerySchema,
     responses: {
-      200: c34.type(),
+      200: c35.type(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -11862,7 +11939,7 @@ var telegramBotListItemSchema = external_exports.object({
 var listTelegramBotsResponseSchema = external_exports.object({
   bots: external_exports.array(telegramBotListItemSchema)
 });
-var integrationsTelegramBotListContract = c34.router({
+var integrationsTelegramBotListContract = c35.router({
   listBots: {
     method: "GET",
     path: "/api/zero/integrations/telegram/bots",
@@ -11883,7 +11960,7 @@ var slackUploadInitResponseSchema = external_exports.object({
   uploadUrl: external_exports.string(),
   fileId: external_exports.string()
 });
-var integrationsSlackUploadInitContract = c34.router({
+var integrationsSlackUploadInitContract = c35.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/init",
@@ -11912,7 +11989,7 @@ var telegramUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsTelegramUploadInitContract = c34.router({
+var integrationsTelegramUploadInitContract = c35.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/init",
@@ -11940,7 +12017,7 @@ var teamsUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsTeamsUploadInitContract = c34.router({
+var integrationsTeamsUploadInitContract = c35.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/teams/upload-file/init",
@@ -11972,7 +12049,7 @@ var telegramUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsTelegramUploadCompleteContract = c34.router({
+var integrationsTelegramUploadCompleteContract = c35.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/complete",
@@ -12004,7 +12081,7 @@ var teamsUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsTeamsUploadCompleteContract = c34.router({
+var integrationsTeamsUploadCompleteContract = c35.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/teams/upload-file/complete",
@@ -12034,7 +12111,7 @@ var githubUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsGithubUploadInitContract = c34.router({
+var integrationsGithubUploadInitContract = c35.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/github/upload-file/init",
@@ -12068,7 +12145,7 @@ var githubUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsGithubUploadCompleteContract = c34.router({
+var integrationsGithubUploadCompleteContract = c35.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/github/upload-file/complete",
@@ -12099,7 +12176,7 @@ var phoneUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsPhoneUploadInitContract = c34.router({
+var integrationsPhoneUploadInitContract = c35.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/init",
@@ -12130,7 +12207,7 @@ var phoneUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsPhoneUploadCompleteContract = c34.router({
+var integrationsPhoneUploadCompleteContract = c35.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/complete",
@@ -12158,7 +12235,7 @@ var slackUploadCompleteResponseSchema = external_exports.object({
   fileId: external_exports.string(),
   permalink: external_exports.string()
 });
-var integrationsSlackUploadCompleteContract = c34.router({
+var integrationsSlackUploadCompleteContract = c35.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/complete",
@@ -12605,7 +12682,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-relationships.ts
 init_esm_shims();
-var c35 = initContract();
+var c36 = initContract();
 var RELATIONSHIP_SEARCH_DEFAULT_LIMIT = 100;
 var RELATIONSHIP_SEARCH_MAX_LIMIT = 100;
 var relationshipEntityTypeSchema = external_exports.enum(["person", "organization"]);
@@ -12720,7 +12797,7 @@ var resolveQuerySchema = external_exports.object({
     message: "Provide exactly one of id, email, or domain"
   }
 );
-var zeroRelationshipsContract = c35.router({
+var zeroRelationshipsContract = c36.router({
   gmailStatus: {
     method: "GET",
     path: "/api/zero/relationships/gmail/status",
@@ -12847,7 +12924,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-memory.ts
 init_esm_shims();
-var c36 = initContract();
+var c37 = initContract();
 var memoryFileSchema = external_exports.object({
   path: external_exports.string(),
   size: external_exports.number()
@@ -13395,7 +13472,7 @@ var memoryDetailResponseSchema = external_exports.object({
   files: external_exports.array(memoryFileSchema),
   fileContents: external_exports.array(memoryFileContentSchema)
 });
-var zeroMemoryContract = c36.router({
+var zeroMemoryContract = c37.router({
   get: {
     method: "GET",
     path: "/api/zero/memory",
@@ -14287,6 +14364,7 @@ export {
   listZeroConnectorCatalog,
   listZeroConnectorCatalogStatus,
   getZeroConnectorCatalogPermissions,
+  diagnoseZeroConnectorPermissionDeny,
   getZeroConnector,
   connectZeroConnectorManualGrant,
   listZeroCustomConnectors,
@@ -14356,4 +14434,4 @@ export {
   completeHostedSite,
   getHostedSiteFiles
 };
-//# sourceMappingURL=chunk-GIACTMOF.js.map
+//# sourceMappingURL=chunk-MSZRROJT.js.map