@vm0/cli 9.238.5 → 9.238.7

package/{chunk-GIACTMOF.js → chunk-6NTG5UZE.js}

@@ -22,7 +22,7 @@ import {
   updateOrgModelPoliciesRequestSchema,
   upsertModelProviderRequestSchema,
   upsertModelProviderResponseSchema
-} from "./chunk-VC7E6IA7.js";
+} from "./chunk-RD5IGGLO.js";
 import {
   init_esm_shims
 } from "./chunk-DIRAZ3YX.js";
@@ -65,7 +65,8 @@ var registryResourceDownloadContract = c.router({
     path: "/api/registry/resources/download",
     headers: authHeadersSchema,
     query: external_exports.object({
-      id: external_exports.string().min(1, "Resource id is required")
+      id: external_exports.string().min(1, "Resource id is required"),
+      expectedSha256: external_exports.string().regex(/^[a-f0-9]{64}$/).optional()
     }),
     responses: {
       200: external_exports.object({
@@ -1605,79 +1606,6 @@ function hasUnsafeUrlCodepoint(value) {
 
 // ../../packages/connectors/src/segment-parser.ts
 init_esm_shims();
-var ERROR_HINT = 'use "{name}", "prefix{name}", "{name}suffix", or "prefix{name}suffix"';
-function parseSegment(seg) {
-  const openCount = countChar(seg, "{");
-  const closeCount = countChar(seg, "}");
-  if (openCount === 0 && closeCount === 0) {
-    return { kind: "literal", value: seg };
-  }
-  if (openCount !== closeCount) {
-    return {
-      kind: "error",
-      reason: `unbalanced brace in segment "${seg}" \u2014 ${ERROR_HINT}`
-    };
-  }
-  const open1 = seg.indexOf("{");
-  const close1 = seg.indexOf("}");
-  if (close1 < open1) {
-    return {
-      kind: "error",
-      reason: `unbalanced brace in segment "${seg}" \u2014 ${ERROR_HINT}`
-    };
-  }
-  if (openCount >= 2) {
-    const open2 = seg.indexOf("{", close1 + 1);
-    if (close1 + 1 === open2) {
-      return {
-        kind: "error",
-        reason: `adjacent parameters in segment "${seg}" \u2014 only one parameter per segment is allowed; ${ERROR_HINT}`
-      };
-    }
-    return {
-      kind: "error",
-      reason: `literal-separated parameters in segment "${seg}" \u2014 only one parameter per segment is allowed; ${ERROR_HINT}`
-    };
-  }
-  const prefix = seg.slice(0, open1);
-  const content = seg.slice(open1 + 1, close1);
-  const suffix = seg.slice(close1 + 1);
-  if (prefix.includes("{") || prefix.includes("}") || suffix.includes("{") || suffix.includes("}")) {
-    return {
-      kind: "error",
-      reason: `unbalanced brace in segment "${seg}" \u2014 ${ERROR_HINT}`
-    };
-  }
-  let greedy = "";
-  let name = content;
-  if (content.length > 0) {
-    const last = content[content.length - 1];
-    if (last === "+" || last === "*") {
-      greedy = last;
-      name = content.slice(0, -1);
-    }
-  }
-  if (name.length === 0) {
-    return {
-      kind: "error",
-      reason: `empty parameter name in segment "${seg}" \u2014 ${ERROR_HINT}`
-    };
-  }
-  return { kind: "param", prefix, name, suffix, greedy };
-}
-function splitPathSegments(path) {
-  if (path === "" || path === "/") return [];
-  const pathWithoutLeadingSlash = path.startsWith("/") ? path.slice(1) : path;
-  if (pathWithoutLeadingSlash === "") return [];
-  return pathWithoutLeadingSlash.split("/");
-}
-function countChar(s, ch) {
-  let n = 0;
-  for (let i = 0; i < s.length; i++) {
-    if (s[i] === ch) n++;
-  }
-  return n;
-}
 
 // ../../packages/connectors/src/firewall-types.ts
 var HOST_DOT_EQUIVALENT_PATTERN = /[\u3002\uff0e\uff61]/g;
@@ -1827,96 +1755,17 @@ var networkPolicySchema = external_exports.object({
   unknownPolicy: firewallPolicyValueSchema
 });
 var networkPoliciesSchema = external_exports.record(external_exports.string(), networkPolicySchema);
-var FirewallBaseUrlResolutionError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "FirewallBaseUrlResolutionError";
-  }
-};
 var AUTH_REFERENCE_PATTERN = /\$\{\{\s*(secrets|vars)\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
 var AUTH_REFERENCE_PATTERN_G = new RegExp(AUTH_REFERENCE_PATTERN.source, "g");
 var AUTH_REFERENCE_PREFIX_PATTERN = new RegExp(
   `^${AUTH_REFERENCE_PATTERN.source}`
 );
-var AUTH_TEMPLATE_START = "${{";
-var AUTH_TEMPLATE_URL_PLACEHOLDER = "placeholder";
 var IPV4_MAX_OCTET = 255;
 var IPV4_OCTET_BASE = IPV4_MAX_OCTET + 1;
-var IPV4_NON_PUBLIC_RANGES = [
-  [0, 16777215],
-  [167772160, 184549375],
-  [1681915904, 1686110207],
-  [2130706432, 2147483647],
-  [2851995648, 2852061183],
-  [2886729728, 2887778303],
-  [3221225472, 3221225480],
-  [3221225483, 3221225727],
-  [3221225984, 3221226239],
-  [3227017984, 3227018239],
-  [3232235520, 3232301055],
-  [3323068416, 3323199487],
-  [3325256704, 3325256959],
-  [3405803776, 3405804031],
-  [3758096384, 4294967295]
-];
 var BASE_URL_VARS_PATTERN = /\$\{\{\s*vars\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/;
 var BASE_URL_VARS_PATTERN_G = new RegExp(BASE_URL_VARS_PATTERN.source, "g");
-var URL_COMPONENT_DELIMITER_PATTERN = /[/?#]/;
-var AUTHORITY_VAR_STRUCTURE_CHARS = /* @__PURE__ */ new Set(["/", "?", "#", "@", "\\"]);
-var AUTHORITY_FRAGMENT_VAR_STRUCTURE_CHARS = /* @__PURE__ */ new Set([
-  "/",
-  ":",
-  "?",
-  "#",
-  "@",
-  "\\"
-]);
-var PERCENT_DECODED_BOUNDARY_CHARS = /* @__PURE__ */ new Set(["/", ":", "?", "#", "@", "\\"]);
-var BASE_URL_VAR_PARAMETER_CHARS = /* @__PURE__ */ new Set(["{", "}"]);
 var PATH_VAR_STRUCTURE_CHARS = /* @__PURE__ */ new Set(["/", "?", "#", "\\"]);
-var PORT_VAR_PATTERN = /^[0-9]+$/;
 var MAX_PATH_PERCENT_DECODE_PASSES = 5;
-function hasBaseUrlVars(base) {
-  return BASE_URL_VARS_PATTERN.test(base);
-}
-function baseUrlVariableError(base, serviceName, name, detail) {
-  return new Error(
-    errMsg(base, serviceName, `base URL variable "${name}" ${detail}`)
-  );
-}
-function validateBaseUrlVariableCommonSyntax({
-  base,
-  serviceName,
-  name,
-  value
-}) {
-  if (WHITESPACE_PATTERN.test(value)) {
-    throw baseUrlVariableError(
-      base,
-      serviceName,
-      name,
-      "must not contain whitespace"
-    );
-  }
-  if (hasUnsafeUrlCodepoint(value)) {
-    throw baseUrlVariableError(
-      base,
-      serviceName,
-      name,
-      "must not contain control characters or invalid Unicode"
-    );
-  }
-  for (const char of value) {
-    if (BASE_URL_VAR_PARAMETER_CHARS.has(char)) {
-      throw baseUrlVariableError(
-        base,
-        serviceName,
-        name,
-        "must not contain firewall parameter syntax"
-      );
-    }
-  }
-}
 function pathPartDotPrefix(part) {
   return part.split(";", 1)[0];
 }
@@ -1983,1454 +1832,126 @@ function pathSegmentHasUnsafeSyntax(segment, rejectPathStructure) {
   if (pathSegmentHasUnsafeSyntaxParts(current, rejectPathStructure) || normalizedPathSegmentHasUnsafeSyntax(current, rejectPathStructure)) {
     return true;
   }
-  const decoded = percentDecodePathSegment(current, rejectPathStructure);
-  return decoded === null || decoded !== current;
-}
-function hasUnsafeFirewallPath(path) {
-  return path.split("/").some((segment) => {
-    return pathSegmentHasUnsafeSyntax(segment, false);
-  });
-}
-function validateBaseUrlVariablePercentEncoding({
-  base,
-  serviceName,
-  name,
-  value,
-  structureChars
-}) {
-  for (let i = 0; i < value.length; i += 1) {
-    if (value[i] !== "%") {
-      continue;
-    }
-    if (i + 2 >= value.length || !isHexDigit(value[i + 1]) || !isHexDigit(value[i + 2])) {
-      throw baseUrlVariableError(
-        base,
-        serviceName,
-        name,
-        "has invalid percent encoding"
-      );
-    }
-    let end = i;
-    while (end + 2 < value.length && value[end] === "%" && isHexDigit(value[end + 1]) && isHexDigit(value[end + 2])) {
-      end += 3;
-    }
-    let decoded;
-    try {
-      decoded = decodeURIComponent(value.slice(i, end));
-    } catch {
-      throw baseUrlVariableError(
-        base,
-        serviceName,
-        name,
-        "has invalid percent encoding"
-      );
-    }
-    for (const char of decoded) {
-      if (structureChars.has(char) || WHITESPACE_PATTERN.test(char) || UNICODE_CONTROL_PATTERN.test(char)) {
-        throw baseUrlVariableError(
-          base,
-          serviceName,
-          name,
-          "must not contain encoded URL structure"
-        );
-      }
-    }
-    i = end - 1;
-  }
-  if (!value.includes("%")) {
-    return value;
-  }
-  try {
-    return decodeURIComponent(value);
-  } catch {
-    throw baseUrlVariableError(
-      base,
-      serviceName,
-      name,
-      "has invalid percent encoding"
-    );
-  }
-}
-function validateBaseUrlPathSegment({
-  base,
-  serviceName,
-  name,
-  segment
-}) {
-  if (pathSegmentHasUnsafeSyntax(segment, true)) {
-    throw baseUrlVariableError(
-      base,
-      serviceName,
-      name,
-      "must not contain unsafe path segments"
-    );
-  }
-}
-function rawPathFromBaseUrl(value) {
-  const schemeEnd = value.indexOf("://");
-  if (schemeEnd === -1) return "";
-  const afterScheme = value.slice(schemeEnd + 3);
-  const pathStart = afterScheme.search(/[/?#]/);
-  if (pathStart === -1 || afterScheme[pathStart] !== "/") return "";
-  const pathAndAfter = afterScheme.slice(pathStart);
-  const pathEnd = pathAndAfter.search(/[?#]/);
-  return pathEnd === -1 ? pathAndAfter : pathAndAfter.slice(0, pathEnd);
-}
-function validateBaseUrlPrefixVariable({
-  base,
-  serviceName,
-  name,
-  value
-}) {
-  const rawPath = rawPathFromBaseUrl(value);
-  if (hasUnsafeFirewallPath(rawPath)) {
-    throw baseUrlVariableError(
-      base,
-      serviceName,
-      name,
-      "must not contain unsafe path segments before a fixed path suffix"
-    );
-  }
-  validateBaseUrl(value, serviceName);
-  const url = new URL(value);
-  if (url.search || url.hash) {
-    throw baseUrlVariableError(
-      base,
-      serviceName,
-      name,
-      "must not contain query or fragment before a fixed path suffix"
-    );
-  }
-}
-function validateResolvedBaseUrlPathSafety(templateBase, serviceName, resolved) {
-  const rawPath = rawPathFromBaseUrl(resolved);
-  for (const segment of rawPath.split("/")) {
-    if (pathSegmentHasUnsafeSyntax(segment, false)) {
-      throw new Error(
-        errMsg(
-          templateBase,
-          serviceName,
-          "resolved base URL must not contain unsafe path segments"
-        )
-      );
-    }
-  }
-}
-function validateBaseUrlAuthorityVariable({
-  base,
-  serviceName,
-  name,
-  value
-}) {
-  for (const char of value) {
-    if (AUTHORITY_VAR_STRUCTURE_CHARS.has(char)) {
-      throw baseUrlVariableError(
-        base,
-        serviceName,
-        name,
-        "must not introduce URL structure"
-      );
-    }
-  }
-  validateBaseUrlVariablePercentEncoding({
-    base,
-    serviceName,
-    name,
-    value,
-    structureChars: PERCENT_DECODED_BOUNDARY_CHARS
-  });
-  validateBaseUrl(`https://${value}`, serviceName);
-}
-function validateBaseUrlAuthorityFragmentVariable({
-  base,
-  serviceName,
-  name,
-  value
-}) {
-  for (const char of value) {
-    if (AUTHORITY_FRAGMENT_VAR_STRUCTURE_CHARS.has(char)) {
-      throw baseUrlVariableError(
-        base,
-        serviceName,
-        name,
-        "must not introduce URL structure"
-      );
-    }
-  }
-  validateBaseUrlVariablePercentEncoding({
-    base,
-    serviceName,
-    name,
-    value,
-    structureChars: PERCENT_DECODED_BOUNDARY_CHARS
-  });
-}
-function validateBaseUrlPortVariable({
-  base,
-  serviceName,
-  name,
-  value
-}) {
-  if (!PORT_VAR_PATTERN.test(value)) {
-    throw baseUrlVariableError(
-      base,
-      serviceName,
-      name,
-      "must be a numeric URL port"
-    );
-  }
-}
-function validateBaseUrlPathVariable({
-  base,
-  serviceName,
-  name,
-  value,
-  prefix,
-  suffix
-}) {
-  for (const char of value) {
-    if (PATH_VAR_STRUCTURE_CHARS.has(char)) {
-      throw baseUrlVariableError(
-        base,
-        serviceName,
-        name,
-        "must not introduce path structure"
-      );
-    }
-  }
-  const decoded = validateBaseUrlVariablePercentEncoding({
-    base,
-    serviceName,
-    name,
-    value,
-    structureChars: PATH_VAR_STRUCTURE_CHARS
-  });
-  const prefixSegment = prefix.slice(prefix.lastIndexOf("/") + 1);
-  const suffixSegmentEnd = suffix.search(URL_COMPONENT_DELIMITER_PATTERN);
-  const suffixSegment = suffixSegmentEnd === -1 ? suffix : suffix.slice(0, suffixSegmentEnd);
-  validateBaseUrlPathSegment({
-    base,
-    serviceName,
-    name,
-    segment: `${prefixSegment}${decoded}${suffixSegment}`
-  });
-}
-function prefixIsInsideAuthority(prefix) {
-  const schemeEnd = prefix.indexOf("://");
-  if (schemeEnd === -1) return false;
-  const afterScheme = prefix.slice(schemeEnd + 3);
-  return !URL_COMPONENT_DELIMITER_PATTERN.test(afterScheme);
-}
-function prefixIsInsidePath(prefix) {
-  const schemeEnd = prefix.indexOf("://");
-  if (schemeEnd === -1) return false;
-  const afterScheme = prefix.slice(schemeEnd + 3);
-  if (afterScheme.includes("?") || afterScheme.includes("#")) return false;
-  return afterScheme.includes("/");
-}
-function suffixAuthorityPrefix(suffix) {
-  const delimiterIndex = suffix.search(URL_COMPONENT_DELIMITER_PATTERN);
-  return delimiterIndex === -1 ? suffix : suffix.slice(0, delimiterIndex);
-}
-function validateBaseUrlTemplateVariable({
-  base,
-  serviceName,
-  name,
-  value,
-  prefix,
-  suffix
-}) {
-  validateBaseUrlVariableCommonSyntax({ base, serviceName, name, value });
-  if (prefix === "" && suffix === "") {
-    return;
-  }
-  if (prefix === "" && suffix.startsWith("/")) {
-    validateBaseUrlPrefixVariable({ base, serviceName, name, value });
-    return;
-  }
-  if (prefix.endsWith("://") && (suffix === "" || suffix.startsWith("/"))) {
-    validateBaseUrlAuthorityVariable({ base, serviceName, name, value });
-    return;
-  }
-  if (prefixIsInsideAuthority(prefix) && prefix.endsWith(":") && (suffix === "" || suffix.startsWith("/"))) {
-    validateBaseUrlPortVariable({ base, serviceName, name, value });
-    return;
-  }
-  if (prefixIsInsideAuthority(prefix) && suffixAuthorityPrefix(suffix) !== "") {
-    validateBaseUrlAuthorityFragmentVariable({
-      base,
-      serviceName,
-      name,
-      value
-    });
-    return;
-  }
-  if (prefixIsInsidePath(prefix)) {
-    validateBaseUrlPathVariable({
-      base,
-      serviceName,
-      name,
-      value,
-      prefix,
-      suffix
-    });
-    return;
-  }
-  throw baseUrlVariableError(
-    base,
-    serviceName,
-    name,
-    "is used in an unsupported base URL template position"
-  );
-}
-function baseUrlScheme(base) {
-  const schemeEnd = base.indexOf("://");
-  if (schemeEnd === -1) return "";
-  return base.slice(0, schemeEnd).toLowerCase();
-}
-function validateCredentialedBaseUrlTransportValue(base, serviceName, credentialed) {
-  if (!credentialed) return;
-  if (baseUrlScheme(base) === REQUIRED_AUTH_BASE_URL_SCHEME) return;
-  throw new Error(
-    `Invalid base URL "${base}" in firewall "${serviceName}": credentialed base URL must use https`
-  );
-}
-function normalizeHostPolicyHostname(hostname) {
-  let normalized = hostname.replace(HOST_DOT_EQUIVALENT_PATTERN, ".").toLowerCase();
-  if (normalized.endsWith(".")) {
-    normalized = normalized.slice(0, -1);
-  }
-  return normalized;
-}
-function normalizeHostPolicySuffix(suffix) {
-  const withoutLeadingDot = suffix.startsWith(".") ? suffix.slice(1) : suffix;
-  return normalizeHostPolicyHostname(withoutLeadingDot);
-}
-function parseCanonicalIpv4Address(value) {
-  if (!isCanonicalIpv4Address(value)) {
-    return null;
-  }
-  return value.split(".").map((part) => {
-    return Number(part);
-  });
-}
-function ipv4PartsToNumber(parts) {
-  if (parts.length !== 4) {
-    return null;
-  }
-  return parts.reduce((acc, part) => {
-    return acc * IPV4_OCTET_BASE + part;
-  }, 0);
-}
-function isPublicIpv4Address(parts) {
-  const value = ipv4PartsToNumber(parts);
-  if (value === null) {
-    return false;
-  }
-  return !IPV4_NON_PUBLIC_RANGES.some(([start, end]) => {
-    return value >= start && value <= end;
-  });
-}
-function parseIpv6Word(value) {
-  if (value === "" || value.length > 4 || ![...value].every((char) => {
-    return isHexDigit(char);
-  })) {
-    return null;
-  }
-  return Number.parseInt(value, 16);
-}
-function parseIpv6WordList(value) {
-  if (value === "") {
-    return [];
-  }
-  const words = [];
-  for (const part of value.split(":")) {
-    const word = parseIpv6Word(part);
-    if (word === null) {
-      return null;
-    }
-    words.push(word);
-  }
-  return words;
-}
-function parseIpv6Address(value) {
-  if (value.includes("%")) {
-    return null;
-  }
-  let normalized = value.toLowerCase();
-  if (normalized.includes(".")) {
-    const lastColon = normalized.lastIndexOf(":");
-    if (lastColon === -1) {
-      return null;
-    }
-    const ipv4Parts = parseCanonicalIpv4Address(
-      normalized.slice(lastColon + 1)
-    );
-    if (!ipv4Parts) {
-      return null;
-    }
-    const highWord = (ipv4Parts[0] << 8) + ipv4Parts[1];
-    const lowWord = (ipv4Parts[2] << 8) + ipv4Parts[3];
-    normalized = `${normalized.slice(0, lastColon)}:${highWord.toString(16)}:${lowWord.toString(16)}`;
-  }
-  const compressed = normalized.split("::");
-  if (compressed.length > 2) {
-    return null;
-  }
-  const left = parseIpv6WordList(compressed[0]);
-  const right = compressed.length === 2 ? parseIpv6WordList(compressed[1]) : [];
-  if (!left || !right) {
-    return null;
-  }
-  if (compressed.length === 1) {
-    return left.length === 8 ? left : null;
-  }
-  const zeroCount = 8 - left.length - right.length;
-  if (zeroCount < 1) {
-    return null;
-  }
-  return [
-    ...left,
-    ...Array.from({ length: zeroCount }, () => {
-      return 0;
-    }),
-    ...right
-  ];
-}
-function isPublicIpv6SpecialRegistryException(words) {
-  const second = words[1];
-  if (second === 1 && words[2] === 0 && words[3] === 0 && words[4] === 0 && words[5] === 0 && words[6] === 0 && words[7] >= 1 && words[7] <= 3) {
-    return true;
-  }
-  if (second === 3) {
-    return true;
-  }
-  if (second === 4 && words[2] === 274) {
-    return true;
-  }
-  if (second >= 32 && second <= 47) {
-    return true;
-  }
-  return second >= 48 && second <= 63;
-}
-function isPublicIpv6Address(words) {
-  if (words.length !== 8) {
-    return false;
-  }
-  const first = words[0];
-  const second = words[1];
-  if ((first & 57344) !== 8192) {
-    return false;
-  }
-  if (first === 8193 && second <= 511) {
-    return isPublicIpv6SpecialRegistryException(words);
-  }
-  if (first === 8193 && second === 3512) {
-    return false;
-  }
-  if (first === 16383 && second <= 4095) {
-    return false;
-  }
-  if (first === 8194) {
-    return false;
-  }
-  return true;
-}
-function hostPolicyIpLiteralIsPublic(hostname) {
-  if (hostname.startsWith("[") && hostname.endsWith("]")) {
-    const words = parseIpv6Address(hostname.slice(1, -1));
-    return words ? isPublicIpv6Address(words) : false;
-  }
-  const ipv4Parts = parseCanonicalIpv4Address(hostname);
-  if (ipv4Parts) {
-    return isPublicIpv4Address(ipv4Parts);
-  }
-  const normalizedIpv4Host = normalizeHostForIpv4LiteralSyntax(hostname);
-  if (isIpv4LiteralLike(normalizedIpv4Host)) {
-    return false;
-  }
-  return null;
-}
-function providerOwnedHostMatches(hostname, hostPolicy, options = {}) {
-  if (options.allowExactHosts !== false) {
-    const exactHosts = hostPolicy.exactHosts ?? [];
-    for (const exactHost of exactHosts) {
-      if (hostname === normalizeHostPolicyHostname(exactHost)) {
-        return true;
-      }
-    }
-  }
-  const suffixes = hostPolicy.suffixes ?? [];
-  for (const suffix of suffixes) {
-    const normalizedSuffix = normalizeHostPolicySuffix(suffix);
-    if (normalizedSuffix !== "" && hostname.length > normalizedSuffix.length && hostname.endsWith(`.${normalizedSuffix}`)) {
-      return true;
-    }
-  }
-  return false;
-}
-function baseUrlAuthorityHasParams(base) {
-  const authority = rawAuthorityFromBaseUrl(base);
-  return authority !== null && hasBaseUrlParams(authority);
-}
-function validateHostPolicyShape(base, serviceName, hostPolicy) {
-  const result = firewallBaseHostPolicySchema.safeParse(hostPolicy);
-  if (result.success) return;
-  const message = result.error.issues.map((issue) => {
-    return issue.message;
-  }).join("; ");
-  throw new Error(
-    errMsg(base, serviceName, `hostPolicy is invalid: ${message}`)
-  );
-}
-function urlForHostPolicyValidation(base, serviceName) {
-  if (!baseUrlAuthorityHasParams(base)) return new URL(base);
-  const schemeEnd = base.indexOf("://");
-  const authority = rawAuthorityFromBaseUrl(base);
-  if (schemeEnd === -1 || authority === null) return new URL(base);
-  const authorityParts = splitParameterizedAuthority(
-    authority,
-    base,
-    serviceName
-  );
-  const host = splitAuthorityHostSegments(authorityParts.normalizedHost).map((segment) => {
-    return hostSegmentForSyntaxValidation(segment, base, serviceName);
-  }).join(".");
-  return new URL(
-    `${base.slice(0, schemeEnd)}://${host}${authorityParts.portSuffix}`
-  );
-}
-function validateBaseUrlHostPolicy({
-  base,
-  diagnosticBase = base,
-  serviceName,
-  hostPolicy
-}) {
-  if (!hostPolicy) {
-    return;
-  }
-  validateHostPolicyShape(diagnosticBase, serviceName, hostPolicy);
-  if (hasBaseUrlVars(base)) {
-    return;
-  }
-  const authorityHasParams = baseUrlAuthorityHasParams(base);
-  const url = urlForHostPolicyValidation(base, serviceName);
-  const rawAuthority = rawAuthorityFromBaseUrl(base);
-  const hostname = normalizeHostPolicyHostname(url.hostname);
-  if (hostPolicy.kind === "providerOwned") {
-    if (!providerOwnedHostMatches(hostname, hostPolicy, {
-      allowExactHosts: !authorityHasParams
-    })) {
-      throw new Error(
-        errMsg(
-          diagnosticBase,
-          serviceName,
-          `host policy does not allow resolved host "${hostname}"`
-        )
-      );
-    }
-    if (!hostPolicy.allowNonDefaultPort && url.port !== "") {
-      throw new Error(
-        errMsg(
-          diagnosticBase,
-          serviceName,
-          "host policy does not allow non-default ports"
-        )
-      );
-    }
-    return;
-  }
-  const publicDestinationHost = rawAuthority === null ? url.hostname : rawHostFromAuthority(rawAuthority);
-  const publicIpLiteral = hostPolicyIpLiteralIsPublic(publicDestinationHost);
-  if (publicIpLiteral === false) {
-    throw new Error(
-      errMsg(
-        diagnosticBase,
-        serviceName,
-        `host policy does not allow non-public IP literal "${hostname}"`
-      )
-    );
-  }
-}
-function resolveFirewallBaseUrlTemplate({
-  serviceName,
-  base,
-  vars,
-  credentialed = false,
-  hostPolicy
-}) {
-  if (!hasBaseUrlVars(base)) return base;
-  try {
-    let resolved = "";
-    let lastIndex = 0;
-    for (const match of base.matchAll(BASE_URL_VARS_PATTERN_G)) {
-      const fullMatch = match[0];
-      const name = match[1];
-      const matchIndex = match.index;
-      const value = vars?.[name];
-      if (!value) {
-        throw new FirewallBaseUrlResolutionError(
-          `Firewall "${serviceName}" base URL requires variable "${name}" but it was not provided`
-        );
-      }
-      validateBaseUrlTemplateVariable({
-        base,
-        serviceName,
-        name,
-        value,
-        prefix: base.slice(0, matchIndex),
-        suffix: base.slice(matchIndex + fullMatch.length)
-      });
-      resolved += base.slice(lastIndex, matchIndex) + value;
-      lastIndex = matchIndex + fullMatch.length;
-    }
-    resolved += base.slice(lastIndex);
-    validateResolvedBaseUrlPathSafety(base, serviceName, resolved);
-    validateBaseUrl(resolved, serviceName);
-    validateCredentialedBaseUrlTransportValue(
-      resolved,
-      serviceName,
-      credentialed
-    );
-    validateBaseUrlHostPolicy({
-      base: resolved,
-      diagnosticBase: base,
-      serviceName,
-      hostPolicy
-    });
-    return resolved;
-  } catch (error) {
-    if (error instanceof FirewallBaseUrlResolutionError) {
-      throw error;
-    }
-    if (error instanceof Error) {
-      throw new FirewallBaseUrlResolutionError(error.message);
-    }
-    throw error;
-  }
-}
-function hasBaseUrlParams(base) {
-  let stripped = base;
-  let start = stripped.indexOf("${{");
-  while (start !== -1) {
-    const end = stripped.indexOf("}}", start + 3);
-    if (end === -1) break;
-    stripped = stripped.slice(0, start) + stripped.slice(end + 2);
-    start = stripped.indexOf("${{");
-  }
-  return stripped.includes("{") && stripped.includes("}");
-}
-function errMsg(base, svc, detail) {
-  return `Invalid base URL "${base}" in firewall "${svc}": ${detail}`;
-}
-var HOST_DOT_EQUIVALENTS = /* @__PURE__ */ new Set([".", "\u3002", "\uFF0E", "\uFF61"]);
-var FORBIDDEN_NORMALIZED_LABEL_CHARS = new Set("#%,/:<>?@[\\]^|[]".split(""));
-var ALLOWED_BASE_URL_SCHEMES = /* @__PURE__ */ new Set(["http", "https"]);
-var REQUIRED_AUTH_BASE_URL_SCHEME = "https";
-var WHITESPACE_PATTERN = /\s/u;
-var UNICODE_CONTROL_PATTERN = /\p{C}/u;
-var UNICODE_DECIMAL_NUMBER_PATTERN = /^\p{Decimal_Number}+$/u;
-var UNICODE_MARK_PATTERN = /\p{M}/u;
-var UNICODE_LETTER_PATTERN = /\p{L}/u;
-var GREEK_COMBINING_YPOGEGRAMMENI = "\u0345";
-var GREEK_SMALL_IOTA = "\u03B9";
-var IDNA_BIDI_RTL_LABEL_RANGES = [
-  [1565, 1565],
-  [2160, 2190],
-  [2229, 2229],
-  [2248, 2249],
-  [64450, 64450],
-  [69488, 69505],
-  [69510, 69513]
-];
-var UNSAFE_UTS46_COLLISION_CHARS = /* @__PURE__ */ new Set([
-  "\u03F2",
-  "\u04C0",
-  "\u1E9E",
-  "\u1806",
-  "\u2132",
-  "\u2183",
-  "\u3164",
-  "\uFFA0",
-  "\uFFFC",
-  "\uFFFD",
-  "\u{2F868}",
-  "\u{2F874}",
-  "\u{2F91F}",
-  "\u{2F95F}",
-  "\u{2F9BF}"
-]);
-var UNSAFE_UTS46_COLLISION_RANGES = [
-  [4256, 4293],
-  [4447, 4448],
-  [6068, 6069],
-  [12272, 12283]
-];
-var UNSAFE_UTS46_IGNORABLE_RANGES = [
-  [847, 847],
-  [6155, 6157],
-  [6159, 6159],
-  [65024, 65039],
-  [917760, 917999]
-];
-function isHexDigit(char) {
-  return char >= "0" && char <= "9" || char >= "a" && char <= "f" || char >= "A" && char <= "F";
-}
-function validateBaseUrlScheme(scheme, base, serviceName) {
-  if (!ALLOWED_BASE_URL_SCHEMES.has(scheme.toLowerCase())) {
-    throw new Error(errMsg(base, serviceName, "scheme must be http or https"));
-  }
-}
-function validateUrlSchemeDelimiter(value, serviceName, label, displayValue = value) {
-  if (value.includes("://")) return;
-  const colonIndex = value.indexOf(":");
-  if (colonIndex !== -1) {
-    const scheme = value.slice(0, colonIndex);
-    const schemeDetail = label === "auth.base URL" ? "scheme must be https" : "scheme must be http or https";
-    const allowedScheme = label === "auth.base URL" ? scheme.toLowerCase() === REQUIRED_AUTH_BASE_URL_SCHEME : ALLOWED_BASE_URL_SCHEMES.has(scheme.toLowerCase());
-    if (!allowedScheme) {
-      throw new Error(
-        `Invalid ${label} "${displayValue}" in firewall "${serviceName}": ${schemeDetail}`
-      );
-    }
-    throw new Error(
-      `Invalid ${label} "${displayValue}" in firewall "${serviceName}": URL must include "://" after the scheme`
-    );
-  }
-  throw new Error(
-    `Invalid ${label} "${displayValue}" in firewall "${serviceName}": URL must include a scheme (e.g. "https://${displayValue}")`
-  );
-}
-function isAscii(value) {
-  for (let i = 0; i < value.length; i += 1) {
-    if (value.charCodeAt(i) > 127) return false;
-  }
-  return true;
-}
-function isIpv4NumberComponent(value) {
-  if (value === "") return false;
-  if (value.toLowerCase().startsWith("0x")) {
-    return value.length > 2 && [...value.slice(2)].every((char) => {
-      return isHexDigit(char);
-    });
-  }
-  return UNICODE_DECIMAL_NUMBER_PATTERN.test(value);
-}
-function isIpv4LiteralLike(value) {
-  const parts = value.split(".");
-  return parts.length >= 1 && parts.length <= 4 && parts.every(isIpv4NumberComponent);
-}
-function isCanonicalIpv4Address(value) {
-  const parts = value.split(".");
-  if (parts.length !== 4) return false;
-  return parts.every((part) => {
-    if (part === "" || ![...part].every((char) => {
-      return char >= "0" && char <= "9";
-    })) {
-      return false;
-    }
-    if (part.length > 1 && part.startsWith("0")) return false;
-    return Number(part) <= IPV4_MAX_OCTET;
-  });
-}
-function codePointInRanges(codePoint, ranges) {
-  return ranges.some(([start, end]) => {
-    return start <= codePoint && codePoint <= end;
-  });
-}
-function hasUnsafeUts46MappingChar(value) {
-  for (const char of value) {
-    const codePoint = char.codePointAt(0);
-    if (UNSAFE_UTS46_COLLISION_CHARS.has(char) || codePoint !== void 0 && (codePointInRanges(codePoint, UNSAFE_UTS46_COLLISION_RANGES) || codePointInRanges(codePoint, UNSAFE_UTS46_IGNORABLE_RANGES))) {
-      return true;
-    }
-  }
-  return false;
-}
-function normalizesToAscii(value) {
-  return isAscii(normalizeLabelTextForIdnaValidation(value));
-}
-function normalizeLabelTextForIdnaValidation(value) {
-  return value.replaceAll(GREEK_COMBINING_YPOGEGRAMMENI, GREEK_SMALL_IOTA).normalize("NFKD").normalize("NFC").toLowerCase();
-}
-function hasForbiddenNormalizedLabelChar(value) {
-  for (const char of normalizeLabelTextForIdnaValidation(value)) {
-    if (FORBIDDEN_NORMALIZED_LABEL_CHARS.has(char) || HOST_DOT_EQUIVALENTS.has(char) || WHITESPACE_PATTERN.test(char) || UNICODE_CONTROL_PATTERN.test(char)) {
-      return true;
-    }
-  }
-  return false;
-}
-function normalizedLabelStartsWithMark(value) {
-  const [firstChar] = normalizeLabelTextForIdnaValidation(value);
-  return firstChar !== void 0 && UNICODE_MARK_PATTERN.test(firstChar);
-}
-function isIdnaBidiRtlLabelChar(char) {
-  const codePoint = char.codePointAt(0);
-  return codePoint !== void 0 && codePointInRanges(codePoint, IDNA_BIDI_RTL_LABEL_RANGES);
-}
-function isLtrLetterForBidiCheck(char) {
-  return UNICODE_LETTER_PATTERN.test(char) && !isIdnaBidiRtlLabelChar(char);
-}
-function isAsciiDigit(char) {
-  return char >= "0" && char <= "9";
-}
-function isArabicNumberForBidiCheck(char) {
-  const codePoint = char.codePointAt(0);
-  return codePoint !== void 0 && 1632 <= codePoint && codePoint <= 1641;
-}
-function effectiveBidiEndChar(chars) {
-  for (let index = chars.length - 1; index >= 0; index -= 1) {
-    const char = chars[index];
-    if (!UNICODE_MARK_PATTERN.test(char)) return char;
-  }
-  return chars.at(-1);
-}
-function firstEffectiveBidiChar(chars) {
-  return chars.find((char) => {
-    return !UNICODE_MARK_PATTERN.test(char);
-  });
-}
-function isRtlEndCharForBidiCheck(char) {
-  return isIdnaBidiRtlLabelChar(char) || isAsciiDigit(char) || isArabicNumberForBidiCheck(char);
-}
-function hasInvalidMixedBidiLabelText(value) {
-  const chars = Array.from(normalizeLabelTextForIdnaValidation(value));
-  const firstRtlIndex = chars.findIndex((char) => {
-    return isIdnaBidiRtlLabelChar(char);
-  });
-  if (firstRtlIndex === -1) return false;
-  const suffix = chars.slice(firstRtlIndex + 1);
-  if (firstRtlIndex === 0) {
-    const suffixHasLtrLetter2 = suffix.some((char) => {
-      return isLtrLetterForBidiCheck(char);
-    });
-    if (suffixHasLtrLetter2) return true;
-    const endChar2 = effectiveBidiEndChar(chars);
-    return endChar2 !== void 0 && !isRtlEndCharForBidiCheck(endChar2);
-  }
-  const suffixHasLtrLetter = suffix.some((char) => {
-    return isLtrLetterForBidiCheck(char);
-  });
-  if (suffixHasLtrLetter) return true;
-  const prefix = chars.slice(0, firstRtlIndex);
-  const prefixHasLtrLetter = prefix.some((char) => {
-    return isLtrLetterForBidiCheck(char);
-  });
-  if (prefixHasLtrLetter) {
-    if (prefix.some(isArabicNumberForBidiCheck)) return true;
-    const firstPrefixChar = firstEffectiveBidiChar(prefix);
-    if (firstPrefixChar === void 0 || !isLtrLetterForBidiCheck(firstPrefixChar)) {
-      return true;
-    }
-    return suffix.some((char) => {
-      return !UNICODE_MARK_PATTERN.test(char);
-    });
-  }
-  const endChar = effectiveBidiEndChar(chars);
-  return endChar !== void 0 && !isRtlEndCharForBidiCheck(endChar);
-}
-function baseUrlRawSyntaxTarget(base) {
-  return base.replace(BASE_URL_VARS_PATTERN_G, AUTH_TEMPLATE_URL_PLACEHOLDER);
-}
-function validateHostPercentEncoding(host, base, serviceName) {
-  if (host.includes(",")) {
-    throw new Error(errMsg(base, serviceName, "host must not contain commas"));
-  }
-  for (let i = 0; i < host.length; i += 1) {
-    if (host[i] !== "%") continue;
-    if (i + 2 >= host.length || !isHexDigit(host[i + 1]) || !isHexDigit(host[i + 2])) {
-      throw new Error(
-        errMsg(base, serviceName, "host has invalid percent encoding")
-      );
-    }
-    let end = i;
-    while (end + 2 < host.length && host[end] === "%" && isHexDigit(host[end + 1]) && isHexDigit(host[end + 2])) {
-      end += 3;
-    }
-    let decoded;
-    try {
-      decoded = decodeURIComponent(host.slice(i, end));
-    } catch {
-      throw new Error(
-        errMsg(base, serviceName, "host has invalid percent encoding")
-      );
-    }
-    for (const char of decoded) {
-      if (char === "{" || char === "}") {
-        throw new Error(
-          errMsg(
-            base,
-            serviceName,
-            "host must not contain percent-encoded braces"
-          )
-        );
-      }
-      if (HOST_DOT_EQUIVALENTS.has(char)) {
-        throw new Error(
-          errMsg(
-            base,
-            serviceName,
-            "host must not contain percent-encoded dots"
-          )
-        );
-      }
-      if (char === ",") {
-        throw new Error(
-          errMsg(base, serviceName, "host must not contain commas")
-        );
-      }
-      if (char === "*") {
-        throw new Error(
-          errMsg(
-            base,
-            serviceName,
-            "host must not contain wildcard characters"
-          )
-        );
-      }
-    }
-    i = end - 1;
-  }
-  if (host.includes("%")) {
-    let decoded;
-    try {
-      decoded = decodeURIComponent(host);
-    } catch {
-      throw new Error(
-        errMsg(base, serviceName, "host has invalid percent encoding")
-      );
-    }
-    validateHostHasNoUnsafeIdnaMappings(decoded, base, serviceName);
-  }
-}
-function rawAuthorityFromBaseUrl(base) {
-  const schemeEnd = base.indexOf("://");
-  if (schemeEnd === -1) return null;
-  const rest = base.slice(schemeEnd + 3);
-  const delimiterIndexes = [
-    rest.indexOf("/"),
-    rest.indexOf("?"),
-    rest.indexOf("#")
-  ].filter((index) => {
-    return index !== -1;
-  });
-  const authorityEnd = delimiterIndexes.length === 0 ? -1 : Math.min(...delimiterIndexes);
-  return authorityEnd === -1 ? rest : rest.slice(0, authorityEnd);
-}
-function authorityHasEmptyPort(authority) {
-  if (authority.startsWith("[")) {
-    const closeBracket = authority.indexOf("]");
-    if (closeBracket === -1) return false;
-    return authority.slice(closeBracket + 1) === ":";
-  }
-  const portSeparator = authority.lastIndexOf(":");
-  if (portSeparator === -1) return false;
-  return authority.indexOf(":") === portSeparator && portSeparator === authority.length - 1;
-}
-function validateNoUserinfo(authority, base, serviceName) {
-  if (authority.includes("@")) {
-    throw new Error(errMsg(base, serviceName, "must not contain userinfo"));
-  }
-}
-function validateHostHasNoEmptyLabels(host, base, serviceName) {
-  let normalizedHost = host.replace(HOST_DOT_EQUIVALENT_PATTERN, ".");
-  if (normalizedHost.endsWith(".")) {
-    normalizedHost = normalizedHost.slice(0, -1);
-  }
-  if (normalizedHost === "" || normalizedHost.endsWith(".") || normalizedHost.split(".").some((label) => {
-    return label === "";
-  })) {
-    throw new Error(
-      errMsg(base, serviceName, "host must not contain empty labels")
-    );
-  }
-  return normalizedHost;
-}
-function normalizeHostForIpv4LiteralSyntax(host) {
-  let normalized = host.replace(HOST_DOT_EQUIVALENT_PATTERN, ".").toLowerCase();
-  if (normalized.endsWith(".")) {
-    normalized = normalized.slice(0, -1);
-  }
-  return normalized;
-}
-function rawHostForCanonicalIpv4Syntax(host) {
-  const normalized = host.toLowerCase();
-  return normalized.endsWith(".") ? normalized.slice(0, -1) : normalized;
-}
-function splitAuthorityHostSegments(host) {
-  if (host.startsWith("[") && host.endsWith("]")) {
-    return [host];
-  }
-  return host.split(".");
-}
-function rawHostFromAuthority(authority) {
-  const withoutUserinfo = authority.slice(authority.lastIndexOf("@") + 1);
-  if (withoutUserinfo.startsWith("[")) {
-    const closeBracket = withoutUserinfo.indexOf("]");
-    return closeBracket === -1 ? withoutUserinfo : withoutUserinfo.slice(0, closeBracket + 1);
-  }
-  const portSeparator = withoutUserinfo.lastIndexOf(":");
-  return portSeparator === -1 ? withoutUserinfo : withoutUserinfo.slice(0, portSeparator);
-}
-function validateLabelHasNoUnsafeIdnaMappings(label, base, serviceName) {
-  const parsed = parseSegment(label);
-  const value = parsed.kind === "param" ? `${parsed.prefix}${parsed.suffix}` : label;
-  if (value === "" || isAscii(value)) return;
-  if (hasForbiddenNormalizedLabelChar(value)) {
-    throw new Error(
-      errMsg(
-        base,
-        serviceName,
-        "host must not contain characters that normalize to forbidden host syntax"
-      )
-    );
-  }
-  if (normalizedLabelStartsWithMark(value)) {
-    throw new Error(
-      errMsg(
-        base,
-        serviceName,
-        "host label must not start with a combining mark"
-      )
-    );
-  }
-  if (hasInvalidMixedBidiLabelText(value)) {
-    throw new Error(
-      errMsg(
-        base,
-        serviceName,
-        "host must not contain invalid bidirectional label text"
-      )
-    );
-  }
-  if (hasUnsafeUts46MappingChar(value) || normalizesToAscii(value)) {
-    throw new Error(
-      errMsg(
-        base,
-        serviceName,
-        "host must not contain unsafe IDNA compatibility mappings"
-      )
-    );
-  }
-}
-function validateHostHasNoUnsafeIdnaMappings(authorityOrHost, base, serviceName) {
-  const host = rawHostFromAuthority(authorityOrHost);
-  if (host.startsWith("[") && host.endsWith("]")) return;
-  for (const label of host.replace(HOST_DOT_EQUIVALENT_PATTERN, ".").split(".")) {
-    validateLabelHasNoUnsafeIdnaMappings(label, base, serviceName);
-  }
-}
-function validateHostHasCanonicalIpv4Syntax(authorityOrHost, base, serviceName) {
-  const host = rawHostFromAuthority(authorityOrHost);
-  if (host.startsWith("[") && host.endsWith("]")) return;
-  const normalizedHost = normalizeHostForIpv4LiteralSyntax(host);
-  if (isIpv4LiteralLike(normalizedHost) && (rawHostForCanonicalIpv4Syntax(host) !== normalizedHost || !isCanonicalIpv4Address(normalizedHost))) {
-    throw new Error(
-      errMsg(base, serviceName, "host must use canonical IPv4 address syntax")
-    );
-  }
-}
-function splitParameterizedAuthority(authority, base, serviceName) {
-  let host = authority;
-  let portSuffix = "";
-  if (authority.startsWith("[")) {
-    const closeBracket = authority.indexOf("]");
-    if (closeBracket === -1) {
-      throw new Error(errMsg(base, serviceName, "not a valid URL authority"));
-    }
-    host = authority.slice(0, closeBracket + 1);
-    portSuffix = authority.slice(closeBracket + 1);
-    if (portSuffix !== "" && !portSuffix.startsWith(":")) {
-      throw new Error(errMsg(base, serviceName, "not a valid URL authority"));
-    }
-  } else {
-    const portSeparator = authority.lastIndexOf(":");
-    if (portSeparator !== -1) {
-      host = authority.slice(0, portSeparator);
-      portSuffix = authority.slice(portSeparator);
-    }
-  }
-  const normalizedHost = validateHostHasNoEmptyLabels(host, base, serviceName);
-  return { normalizedHost, portSuffix };
-}
-function validateStaticHostLabels(hostname, base, serviceName) {
-  if (hostname.startsWith("[") && hostname.endsWith("]")) return;
-  validateHostHasNoEmptyLabels(hostname, base, serviceName);
-  validateHostHasNoRawWildcards(hostname, base, serviceName);
-}
-function hostSegmentHasRawWildcard(segment) {
-  const parsed = parseSegment(segment);
-  if (parsed.kind === "literal") return parsed.value.includes("*");
-  if (parsed.kind === "param") {
-    return parsed.prefix.includes("*") || parsed.suffix.includes("*");
-  }
-  return false;
-}
-function validateHostHasNoRawWildcards(host, base, serviceName) {
-  if (host.startsWith("[") && host.endsWith("]")) return;
-  for (const segment of host.replace(HOST_DOT_EQUIVALENT_PATTERN, ".").split(".")) {
-    if (hostSegmentHasRawWildcard(segment)) {
-      throw new Error(
-        errMsg(base, serviceName, "host must not contain wildcard characters")
-      );
-    }
-  }
-}
-function hostSegmentForSyntaxValidation(seg, base, svc) {
-  const parsed = parseSegment(seg);
-  if (parsed.kind === "literal") return seg;
-  if (parsed.kind === "error") {
-    throw new Error(errMsg(base, svc, parsed.reason));
-  }
-  if (!isAscii(parsed.prefix) || !isAscii(parsed.suffix)) {
-    throw new Error(
-      errMsg(
-        base,
-        svc,
-        `host parameter segment "${seg}" must use ASCII literal prefix and suffix`
-      )
-    );
-  }
-  return `${parsed.prefix}x${parsed.suffix}`;
-}
-function validateParameterizedHostUrlSyntax(scheme, authority, base, serviceName) {
-  const syntaxHost = splitAuthorityHostSegments(authority.normalizedHost).map((seg) => {
-    return hostSegmentForSyntaxValidation(seg, base, serviceName);
-  }).join(".");
-  try {
-    new URL(`${scheme}://${syntaxHost}${authority.portSuffix}`);
-  } catch {
-    throw new Error(errMsg(base, serviceName, "not a valid URL authority"));
-  }
-}
-function validateHostParams(segments, paramNames, base, svc) {
-  if (segments.length < 2) {
-    throw new Error(errMsg(base, svc, "host must have at least two segments"));
-  }
-  let hasStatic = false;
-  for (let i = 0; i < segments.length; i++) {
-    const seg = segments[i];
-    const parsed = parseSegment(seg);
-    if (parsed.kind === "error") {
-      throw new Error(errMsg(base, svc, parsed.reason));
-    }
-    if (parsed.kind === "literal") {
-      hasStatic = true;
-      continue;
-    }
-    const { name, greedy, prefix, suffix } = parsed;
-    if (paramNames.has(name)) {
-      throw new Error(
-        errMsg(base, svc, `duplicate parameter name "{${name}}" in host`)
-      );
-    }
-    paramNames.add(name);
-    if (greedy && i !== 0) {
-      throw new Error(
-        errMsg(base, svc, `{${name}${greedy}} must be the first host segment`)
-      );
-    }
-    if (greedy && (prefix !== "" || suffix !== "")) {
-      throw new Error(
-        errMsg(
-          base,
-          svc,
-          `greedy parameter {${name}${greedy}} cannot be combined with a literal prefix or suffix in host segment "${seg}"`
-        )
-      );
-    }
-  }
-  if (!hasStatic) {
-    throw new Error(
-      errMsg(base, svc, "host must have at least one static segment")
-    );
-  }
-}
-function validatePathParams(segments, paramNames, base, svc) {
-  for (const seg of segments) {
-    const parsed = parseSegment(seg);
-    if (parsed.kind === "error") {
-      throw new Error(errMsg(base, svc, parsed.reason));
-    }
-    if (parsed.kind === "literal") continue;
-    const { name, greedy } = parsed;
-    if (greedy) {
-      throw new Error(
-        errMsg(
-          base,
-          svc,
-          `greedy parameter {${name}${greedy}} is not allowed in base URL path`
-        )
-      );
-    }
-    if (paramNames.has(name)) {
-      throw new Error(
-        errMsg(base, svc, `duplicate parameter name "{${name}}"`)
-      );
-    }
-    paramNames.add(name);
-  }
-}
-function validateBaseUrlParams(base, serviceName) {
-  const schemeEnd = base.indexOf("://");
-  if (schemeEnd === -1) {
-    throw new Error(errMsg(base, serviceName, "missing scheme"));
-  }
-  const scheme = base.slice(0, schemeEnd);
-  if (scheme.includes("{")) {
-    throw new Error(
-      errMsg(base, serviceName, "scheme must not contain parameters")
-    );
-  }
-  validateBaseUrlScheme(scheme, base, serviceName);
-  if (base.includes("?")) {
-    throw new Error(errMsg(base, serviceName, "must not contain query string"));
-  }
-  if (base.includes("#")) {
-    throw new Error(errMsg(base, serviceName, "must not contain fragment"));
-  }
-  const rest = base.slice(schemeEnd + 3);
-  const slashIdx = rest.indexOf("/");
-  const host = slashIdx === -1 ? rest : rest.slice(0, slashIdx);
-  const path = slashIdx === -1 ? "" : rest.slice(slashIdx);
-  if (authorityHasEmptyPort(host)) {
-    throw new Error(errMsg(base, serviceName, "not a valid URL authority"));
-  }
-  validateNoUserinfo(host, base, serviceName);
-  validateHostPercentEncoding(host, base, serviceName);
-  const authority = splitParameterizedAuthority(host, base, serviceName);
-  validateHostHasCanonicalIpv4Syntax(
-    authority.normalizedHost,
-    base,
-    serviceName
-  );
-  validateHostHasNoUnsafeIdnaMappings(
-    authority.normalizedHost,
-    base,
-    serviceName
-  );
-  validateHostHasNoRawWildcards(authority.normalizedHost, base, serviceName);
-  validateParameterizedHostUrlSyntax(
-    base.slice(0, schemeEnd),
-    authority,
-    base,
-    serviceName
-  );
-  const paramNames = /* @__PURE__ */ new Set();
-  validateHostParams(
-    splitAuthorityHostSegments(authority.normalizedHost),
-    paramNames,
-    base,
-    serviceName
-  );
-  if (path) {
-    validatePathParams(splitPathSegments(path), paramNames, base, serviceName);
-  }
-}
-function validateBaseUrl(base, serviceName) {
-  if (base.includes("\\")) {
-    throw new Error(
-      `Invalid base URL "${base}" in firewall "${serviceName}": must not contain backslash`
-    );
-  }
-  const hasTemplateVars = hasBaseUrlVars(base);
-  const rawSyntaxTarget = baseUrlRawSyntaxTarget(base);
-  if (hasRawWhitespace(rawSyntaxTarget)) {
-    throw new Error(
-      `Invalid base URL "${base}" in firewall "${serviceName}": must not contain whitespace`
-    );
-  }
-  if (hasUnsafeUrlCodepoint(rawSyntaxTarget)) {
-    throw new Error(
-      `Invalid base URL "${base}" in firewall "${serviceName}": must not contain control characters or invalid Unicode`
-    );
-  }
-  let knownRawPath = rawPathFromBaseUrl(rawSyntaxTarget);
-  if (knownRawPath === "" && hasTemplateVars && rawSyntaxTarget.startsWith(`${AUTH_TEMPLATE_URL_PLACEHOLDER}/`)) {
-    knownRawPath = rawSyntaxTarget.slice(AUTH_TEMPLATE_URL_PLACEHOLDER.length);
-  }
-  if (hasUnsafeFirewallPath(knownRawPath)) {
-    throw new Error(
-      errMsg(base, serviceName, "must not contain unsafe path segments")
-    );
-  }
-  if (hasTemplateVars) return;
-  validateUrlSchemeDelimiter(base, serviceName, "base URL");
-  if (hasBaseUrlParams(base)) {
-    validateBaseUrlParams(base, serviceName);
-    return;
-  }
-  let url;
-  try {
-    url = new URL(base);
-  } catch {
-    if (!base.includes("://")) {
-      throw new Error(
-        `Invalid base URL "${base}" in firewall "${serviceName}": URL must include a scheme (e.g. "https://${base}")`
-      );
-    }
-    throw new Error(
-      `Invalid base URL "${base}" in firewall "${serviceName}": not a valid URL`
-    );
-  }
-  validateBaseUrlScheme(url.protocol.slice(0, -1), base, serviceName);
-  if (url.search) {
-    throw new Error(
-      `Invalid base URL "${base}" in firewall "${serviceName}": must not contain query string`
-    );
-  }
-  if (url.hash) {
-    throw new Error(
-      `Invalid base URL "${base}" in firewall "${serviceName}": must not contain fragment`
-    );
-  }
-  const authority = rawAuthorityFromBaseUrl(base);
-  if (authority !== null) {
-    if (authority === "") {
-      throw new Error(
-        `Invalid base URL "${base}" in firewall "${serviceName}": not a valid URL authority`
-      );
-    }
-    if (authorityHasEmptyPort(authority)) {
-      throw new Error(
-        `Invalid base URL "${base}" in firewall "${serviceName}": not a valid URL authority`
-      );
-    }
-    validateNoUserinfo(authority, base, serviceName);
-    validateHostPercentEncoding(authority, base, serviceName);
-    validateHostHasCanonicalIpv4Syntax(authority, base, serviceName);
-    validateHostHasNoUnsafeIdnaMappings(authority, base, serviceName);
-  }
-  validateStaticHostLabels(url.hostname, base, serviceName);
-  if (url.hostname.includes("{") || url.hostname.includes("}")) {
-    throw new Error(
-      `Invalid base URL "${base}" in firewall "${serviceName}": host must not contain braces`
-    );
-  }
-}
-function authBaseForStaticUrlValidation(authBase) {
-  if (!authBase.includes(AUTH_TEMPLATE_START)) {
-    return { url: authBase, dynamicPrefixSuffix: "" };
-  }
-  const replaced = authBase.replace(
-    AUTH_REFERENCE_PATTERN_G,
-    AUTH_TEMPLATE_URL_PLACEHOLDER
-  );
-  if (replaced.includes(AUTH_TEMPLATE_START)) {
-    return { url: authBase, dynamicPrefixSuffix: "" };
-  }
-  const prefixMatch = AUTH_REFERENCE_PREFIX_PATTERN.exec(authBase);
-  if (prefixMatch) {
-    return {
-      url: null,
-      dynamicPrefixSuffix: authBase.slice(prefixMatch[0].length).replace(AUTH_REFERENCE_PATTERN_G, AUTH_TEMPLATE_URL_PLACEHOLDER)
-    };
-  }
-  return { url: replaced, dynamicPrefixSuffix: "" };
+  const decoded = percentDecodePathSegment(current, rejectPathStructure);
+  return decoded === null || decoded !== current;
 }
-function validateDynamicAuthBaseSuffix(authBase, suffix, serviceName) {
-  if (suffix.includes(AUTH_TEMPLATE_START)) {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": contains unsupported template reference`
-    );
-  }
-  if (hasRawWhitespace(suffix)) {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain whitespace`
-    );
+function hasUnsafeFirewallPath(path) {
+  return path.split("/").some((segment) => {
+    return pathSegmentHasUnsafeSyntax(segment, false);
+  });
+}
+function parseCanonicalIpv4Address(value) {
+  if (!isCanonicalIpv4Address(value)) {
+    return null;
   }
-  if (hasUnsafeUrlCodepoint(suffix)) {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain control characters or invalid Unicode`
-    );
+  return value.split(".").map((part) => {
+    return Number(part);
+  });
+}
+function parseIpv6Word(value) {
+  if (value === "" || value.length > 4 || ![...value].every((char) => {
+    return isHexDigit(char);
+  })) {
+    return null;
   }
-  if (suffix.includes("#")) {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain fragment`
-    );
+  return Number.parseInt(value, 16);
+}
+function parseIpv6WordList(value) {
+  if (value === "") {
+    return [];
   }
-  if (suffix !== "" && !suffix.startsWith("/") && !suffix.startsWith("?")) {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": dynamic URL suffix must start with "/" or "?"`
-    );
+  const words = [];
+  for (const part of value.split(":")) {
+    const word = parseIpv6Word(part);
+    if (word === null) {
+      return null;
+    }
+    words.push(word);
   }
+  return words;
 }
-function validateAuthBaseUrl(authBase, serviceName) {
-  if (authBase.includes("\\")) {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain backslash`
-    );
+function parseIpv6Address(value) {
+  if (value.includes("%")) {
+    return null;
   }
-  const target = authBaseForStaticUrlValidation(authBase);
-  validateDynamicAuthBaseSuffix(
-    authBase,
-    target.dynamicPrefixSuffix,
-    serviceName
-  );
-  const validationUrl = target.url;
-  if (validationUrl === null) return;
-  if (validationUrl.includes(AUTH_TEMPLATE_START)) {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": contains unsupported template reference`
+  let normalized = value.toLowerCase();
+  if (normalized.includes(".")) {
+    const lastColon = normalized.lastIndexOf(":");
+    if (lastColon === -1) {
+      return null;
+    }
+    const ipv4Parts = parseCanonicalIpv4Address(
+      normalized.slice(lastColon + 1)
     );
+    if (!ipv4Parts) {
+      return null;
+    }
+    const highWord = (ipv4Parts[0] << 8) + ipv4Parts[1];
+    const lowWord = (ipv4Parts[2] << 8) + ipv4Parts[3];
+    normalized = `${normalized.slice(0, lastColon)}:${highWord.toString(16)}:${lowWord.toString(16)}`;
   }
-  if (hasRawWhitespace(validationUrl)) {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain whitespace`
-    );
+  const compressed = normalized.split("::");
+  if (compressed.length > 2) {
+    return null;
   }
-  if (hasUnsafeUrlCodepoint(validationUrl)) {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain control characters or invalid Unicode`
-    );
+  const left = parseIpv6WordList(compressed[0]);
+  const right = compressed.length === 2 ? parseIpv6WordList(compressed[1]) : [];
+  if (!left || !right) {
+    return null;
   }
-  validateUrlSchemeDelimiter(
-    validationUrl,
-    serviceName,
-    "auth.base URL",
-    authBase
-  );
-  let url;
-  try {
-    url = new URL(validationUrl);
-  } catch {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": not a valid URL`
-    );
+  if (compressed.length === 1) {
+    return left.length === 8 ? left : null;
   }
-  if (url.protocol.slice(0, -1).toLowerCase() !== REQUIRED_AUTH_BASE_URL_SCHEME) {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": scheme must be https`
-    );
+  const zeroCount = 8 - left.length - right.length;
+  if (zeroCount < 1) {
+    return null;
   }
-  if (url.hash) {
-    throw new Error(
-      `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain fragment`
-    );
+  return [
+    ...left,
+    ...Array.from({ length: zeroCount }, () => {
+      return 0;
+    }),
+    ...right
+  ];
+}
+var FORBIDDEN_NORMALIZED_LABEL_CHARS = new Set("#%,/:<>?@[\\]^|[]".split(""));
+var WHITESPACE_PATTERN = /\s/u;
+var UNICODE_CONTROL_PATTERN = /\p{C}/u;
+var UNICODE_DECIMAL_NUMBER_PATTERN = /^\p{Decimal_Number}+$/u;
+function isHexDigit(char) {
+  return char >= "0" && char <= "9" || char >= "a" && char <= "f" || char >= "A" && char <= "F";
+}
+function isAscii(value) {
+  for (let i = 0; i < value.length; i += 1) {
+    if (value.charCodeAt(i) > 127) return false;
   }
-  const authority = rawAuthorityFromBaseUrl(validationUrl);
-  if (authority !== null) {
-    if (authority === "") {
-      throw new Error(
-        `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": not a valid URL authority`
-      );
-    }
-    if (authorityHasEmptyPort(authority)) {
-      throw new Error(
-        `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": not a valid URL authority`
-      );
-    }
-    if (authority.includes("@")) {
-      throw new Error(
-        `Invalid auth.base URL "${authBase}" in firewall "${serviceName}": must not contain userinfo`
-      );
-    }
-    validateHostPercentEncoding(authority, validationUrl, serviceName);
-    validateHostHasCanonicalIpv4Syntax(authority, validationUrl, serviceName);
-    validateHostHasNoUnsafeIdnaMappings(authority, validationUrl, serviceName);
+  return true;
+}
+function isIpv4NumberComponent(value) {
+  if (value === "") return false;
+  if (value.toLowerCase().startsWith("0x")) {
+    return value.length > 2 && [...value.slice(2)].every((char) => {
+      return isHexDigit(char);
+    });
   }
-  validateStaticHostLabels(url.hostname, validationUrl, serviceName);
+  return UNICODE_DECIMAL_NUMBER_PATTERN.test(value);
+}
+function isIpv4LiteralLike(value) {
+  const parts = value.split(".");
+  return parts.length >= 1 && parts.length <= 4 && parts.every(isIpv4NumberComponent);
+}
+function isCanonicalIpv4Address(value) {
+  const parts = value.split(".");
+  if (parts.length !== 4) return false;
+  return parts.every((part) => {
+    if (part === "" || ![...part].every((char) => {
+      return char >= "0" && char <= "9";
+    })) {
+      return false;
+    }
+    if (part.length > 1 && part.startsWith("0")) return false;
+    return Number(part) <= IPV4_MAX_OCTET;
+  });
 }
 
 // ../../packages/api-contracts/src/contracts/logs.ts
@@ -6536,9 +5057,234 @@ var zeroConnectorCatalogContract = c21.router({
   }
 });
 
-// ../../packages/api-contracts/src/contracts/zero-custom-connectors.ts
+// ../../packages/api-contracts/src/contracts/zero-connector-check.ts
 init_esm_shims();
 var c22 = initContract();
+var boundedNameSchema = external_exports.string().min(1).max(255);
+var connectorCheckUrlRequestSchema = external_exports.object({
+  mode: external_exports.literal("url"),
+  method: external_exports.string().min(1).max(16),
+  url: external_exports.string().min(1).max(8192),
+  connectorRef: connectorCatalogRefSchema.optional(),
+  environmentName: boundedNameSchema.optional()
+}).strict();
+var connectorCheckEnvironmentRequestSchema = external_exports.object({
+  mode: external_exports.literal("environment"),
+  environmentName: boundedNameSchema,
+  permission: boundedNameSchema.optional()
+}).strict();
+var connectorCheckRequestSchema = external_exports.discriminatedUnion("mode", [
+  connectorCheckUrlRequestSchema,
+  connectorCheckEnvironmentRequestSchema
+]);
+var connectorCheckIdentitySchema = external_exports.object({
+  connectorRef: connectorCatalogRefSchema,
+  label: external_exports.string().min(1),
+  visibility: external_exports.enum(["available", "unavailable"]),
+  credentialResolution: external_exports.enum(["network-boundary", "none"])
+}).strict();
+var connectorCheckCandidateSchema = external_exports.object({
+  connectorRef: connectorCatalogRefSchema,
+  label: external_exports.string().min(1)
+}).strict();
+var connectorCheckNotScopedRunSchema = external_exports.object({ status: external_exports.literal("not-scoped") }).strict();
+var connectorCheckConfiguredRunSchema = external_exports.object({
+  status: external_exports.literal("configured"),
+  bases: external_exports.array(external_exports.string().min(1))
+}).strict();
+var connectorCheckNotConfiguredRunSchema = external_exports.object({ status: external_exports.literal("not-configured") }).strict();
+var connectorCheckRunSchema = external_exports.discriminatedUnion("status", [
+  connectorCheckNotScopedRunSchema,
+  connectorCheckConfiguredRunSchema,
+  connectorCheckNotConfiguredRunSchema
+]);
+var connectorCheckAllowPolicySchema = external_exports.object({
+  outcome: external_exports.literal("allow"),
+  basis: external_exports.enum(["allow-list", "not-blocked", "no-policy", "unknown-policy"])
+}).strict();
+var connectorCheckDenyPolicySchema = external_exports.object({
+  outcome: external_exports.literal("deny"),
+  basis: external_exports.enum(["deny-list", "unknown-policy"])
+}).strict();
+var connectorCheckAskPolicySchema = external_exports.object({
+  outcome: external_exports.literal("ask"),
+  basis: external_exports.enum(["ask-list", "unknown-policy"])
+}).strict();
+var connectorCheckUnavailablePolicySchema = external_exports.object({
+  outcome: external_exports.literal("unavailable"),
+  basis: external_exports.enum([
+    "not-run-scoped",
+    "policies-unavailable",
+    "connector-not-configured"
+  ])
+}).strict();
+var connectorCheckPolicySchema = external_exports.discriminatedUnion("outcome", [
+  connectorCheckAllowPolicySchema,
+  connectorCheckDenyPolicySchema,
+  connectorCheckAskPolicySchema,
+  connectorCheckUnavailablePolicySchema
+]);
+var connectorCheckMatchedPermissionSchema = external_exports.object({
+  name: external_exports.string().min(1),
+  policy: connectorCheckPolicySchema
+}).strict();
+var connectorCheckMatchedPermissionsSchema = external_exports.object({
+  kind: external_exports.literal("matched"),
+  permissions: external_exports.array(connectorCheckMatchedPermissionSchema).min(1)
+}).strict();
+var connectorCheckUnknownEndpointSchema = external_exports.object({
+  kind: external_exports.literal("unknown-endpoint"),
+  policy: connectorCheckPolicySchema
+}).strict();
+var connectorCheckPermissionResultSchema = external_exports.discriminatedUnion("kind", [
+  connectorCheckMatchedPermissionsSchema,
+  connectorCheckUnknownEndpointSchema
+]);
+var connectorCheckResolvedUrlSchema = external_exports.object({
+  outcome: external_exports.literal("resolved"),
+  mode: external_exports.literal("url"),
+  connector: connectorCheckIdentitySchema,
+  environmentNames: external_exports.array(boundedNameSchema).nullable(),
+  run: connectorCheckRunSchema,
+  method: external_exports.string().min(1).max(16),
+  base: external_exports.string().min(1),
+  relativePath: external_exports.string().min(1),
+  permission: connectorCheckPermissionResultSchema
+}).strict();
+var connectorCheckResolvedEnvironmentSchema = external_exports.object({
+  outcome: external_exports.literal("resolved"),
+  mode: external_exports.literal("environment"),
+  connector: connectorCheckIdentitySchema,
+  environmentName: boundedNameSchema,
+  run: connectorCheckRunSchema,
+  permission: connectorCheckPolicySchema.nullable()
+}).strict();
+var connectorCheckUnsafeInputSchema = external_exports.object({
+  outcome: external_exports.literal("unsafe-input"),
+  reason: external_exports.enum(["invalid-method", "invalid-url", "unsafe-path"])
+}).strict();
+var connectorCheckUnknownConnectorSchema = external_exports.object({ outcome: external_exports.literal("unknown-connector") }).strict();
+var connectorCheckUnknownEnvironmentSchema = external_exports.object({ outcome: external_exports.literal("unknown-environment") }).strict();
+var connectorCheckNoMatchSchema = external_exports.object({
+  outcome: external_exports.literal("no-match"),
+  scope: external_exports.enum(["run", "catalog"])
+}).strict();
+var connectorCheckAmbiguousSchema = external_exports.object({
+  outcome: external_exports.literal("ambiguous"),
+  candidates: external_exports.array(connectorCheckCandidateSchema).min(2)
+}).strict();
+var connectorCheckMismatchSchema = external_exports.object({
+  outcome: external_exports.literal("connector-mismatch"),
+  connector: connectorCheckIdentitySchema
+}).strict();
+var connectorCheckEnvironmentNotOwnedSchema = external_exports.object({
+  outcome: external_exports.literal("environment-not-owned"),
+  connector: connectorCheckIdentitySchema
+}).strict();
+var connectorCheckEnvironmentNotUsedSchema = external_exports.object({
+  outcome: external_exports.literal("environment-not-used"),
+  connector: connectorCheckIdentitySchema,
+  environmentNames: external_exports.array(boundedNameSchema)
+}).strict();
+var connectorCheckUnresolvedDynamicBaseSchema = external_exports.object({
+  outcome: external_exports.literal("unresolved-dynamic-base"),
+  connector: connectorCheckIdentitySchema
+}).strict();
+var connectorCheckRunContextUnavailableSchema = external_exports.object({ outcome: external_exports.literal("run-context-unavailable") }).strict();
+var connectorCheckDiagnosticResultSchema = external_exports.union([
+  connectorCheckResolvedUrlSchema,
+  connectorCheckResolvedEnvironmentSchema,
+  connectorCheckUnsafeInputSchema,
+  connectorCheckUnknownConnectorSchema,
+  connectorCheckUnknownEnvironmentSchema,
+  connectorCheckNoMatchSchema,
+  connectorCheckAmbiguousSchema,
+  connectorCheckMismatchSchema,
+  connectorCheckEnvironmentNotOwnedSchema,
+  connectorCheckEnvironmentNotUsedSchema,
+  connectorCheckUnresolvedDynamicBaseSchema,
+  connectorCheckRunContextUnavailableSchema
+]);
+var zeroConnectorCheckContract = c22.router({
+  check: {
+    method: "POST",
+    path: "/api/zero/connectors/diagnostics/check",
+    headers: authHeadersSchema,
+    body: connectorCheckRequestSchema,
+    responses: {
+      200: connectorCheckDiagnosticResultSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Resolve connector runtime diagnostics"
+  }
+});
+
+// ../../packages/api-contracts/src/contracts/zero-connector-permission-deny.ts
+init_esm_shims();
+var c23 = initContract();
+var connectorPermissionDenyRequestSchema = external_exports.object({
+  method: external_exports.string().min(1).max(16),
+  url: external_exports.string().min(1).max(8192)
+}).strict();
+var connectorPermissionDenyMatchedSchema = external_exports.object({
+  outcome: external_exports.literal("matched"),
+  label: external_exports.string().min(1),
+  base: external_exports.string().min(1),
+  relativePath: external_exports.string().min(1),
+  permissions: external_exports.array(external_exports.string().min(1)).min(1)
+}).strict();
+var connectorPermissionDenyUnknownEndpointSchema = external_exports.object({
+  outcome: external_exports.literal("unknown-endpoint"),
+  label: external_exports.string().min(1),
+  base: external_exports.string().min(1),
+  relativePath: external_exports.string().min(1)
+}).strict();
+var connectorPermissionDenyUnknownConnectorSchema = external_exports.object({ outcome: external_exports.literal("unknown-connector") }).strict();
+var connectorPermissionDenyNoMatchingBaseSchema = external_exports.object({
+  outcome: external_exports.literal("no-matching-base"),
+  label: external_exports.string().min(1)
+}).strict();
+var connectorPermissionDenyUnresolvedDynamicBaseSchema = external_exports.object({
+  outcome: external_exports.literal("unresolved-dynamic-base"),
+  label: external_exports.string().min(1)
+}).strict();
+var connectorPermissionDenyUnsafeInputSchema = external_exports.object({
+  outcome: external_exports.literal("unsafe-input"),
+  reason: external_exports.enum(["invalid-method", "invalid-url", "unsafe-path"])
+}).strict();
+var connectorPermissionDenyDiagnosticResultSchema = external_exports.discriminatedUnion("outcome", [
+  connectorPermissionDenyMatchedSchema,
+  connectorPermissionDenyUnknownEndpointSchema,
+  connectorPermissionDenyUnknownConnectorSchema,
+  connectorPermissionDenyNoMatchingBaseSchema,
+  connectorPermissionDenyUnresolvedDynamicBaseSchema,
+  connectorPermissionDenyUnsafeInputSchema
+]);
+var zeroConnectorPermissionDenyContract = c23.router({
+  diagnose: {
+    method: "POST",
+    path: "/api/zero/connectors/:connectorRef/diagnostics/permission-deny",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({ connectorRef: connectorCatalogRefSchema }),
+    body: connectorPermissionDenyRequestSchema,
+    responses: {
+      200: connectorPermissionDenyDiagnosticResultSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Diagnose a connector permission denial"
+  }
+});
+
+// ../../packages/api-contracts/src/contracts/zero-custom-connectors.ts
+init_esm_shims();
+var c24 = initContract();
 var customConnectorFieldKindSchema = external_exports.enum(["secret", "variable"]);
 var customConnectorFieldSchema = external_exports.object({
   key: external_exports.string().min(1).max(64),
@@ -6635,7 +5381,7 @@ var saveCustomConnectorProposalResponseSchema = external_exports.object({
   connector: customConnectorResponseSchema,
   authorizedAgentId: external_exports.string().uuid().optional()
 });
-var zeroCustomConnectorsContract = c22.router({
+var zeroCustomConnectorsContract = c24.router({
   list: {
     method: "GET",
     path: "/api/zero/custom-connectors",
@@ -6662,7 +5408,7 @@ var zeroCustomConnectorsContract = c22.router({
     summary: "Create an org custom connector"
   }
 });
-var zeroCustomConnectorByIdContract = c22.router({
+var zeroCustomConnectorByIdContract = c24.router({
   get: {
     method: "GET",
     path: "/api/zero/custom-connectors/:id",
@@ -6683,7 +5429,7 @@ var zeroCustomConnectorByIdContract = c22.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     responses: {
-      204: c22.noBody(),
+      204: c24.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -6708,7 +5454,7 @@ var zeroCustomConnectorByIdContract = c22.router({
     summary: "Rename an org custom connector"
   }
 });
-var zeroCustomConnectorSecretContract = c22.router({
+var zeroCustomConnectorSecretContract = c24.router({
   set: {
     method: "PUT",
     path: "/api/zero/custom-connectors/:id/secret",
@@ -6716,7 +5462,7 @@ var zeroCustomConnectorSecretContract = c22.router({
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     body: setCustomConnectorSecretBodySchema,
     responses: {
-      204: c22.noBody(),
+      204: c24.noBody(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema,
@@ -6730,7 +5476,7 @@ var zeroCustomConnectorSecretContract = c22.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     responses: {
-      204: c22.noBody(),
+      204: c24.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -6738,7 +5484,7 @@ var zeroCustomConnectorSecretContract = c22.router({
     summary: "Clear the calling user's secret for a custom connector"
   }
 });
-var zeroCustomConnectorProposalContract = c22.router({
+var zeroCustomConnectorProposalContract = c24.router({
   save: {
     method: "POST",
     path: "/api/zero/custom-connectors/proposals/save",
@@ -6766,18 +5512,6 @@ async function listZeroConnectors() {
   }
   handleError(result, "Failed to list connectors");
 }
-async function searchZeroConnectors(keyword) {
-  const config = await getClientConfig();
-  const client = initClient(zeroConnectorsSearchContract, config);
-  const result = await client.search({
-    headers: {},
-    query: keyword ? { keyword } : {}
-  });
-  if (result.status === 200) {
-    return result.body;
-  }
-  handleError(result, "Failed to search connectors");
-}
 async function listZeroConnectorCatalog() {
   const config = await getClientConfig();
   const client = initClient(zeroConnectorCatalogContract, config);
@@ -6818,6 +5552,36 @@ async function getZeroConnectorCatalogPermissions(connectorRef) {
     `Failed to get connector permission metadata for "${connectorRef}"`
   );
 }
+async function diagnoseZeroConnectorCheck(request) {
+  const config = await getClientConfig();
+  const client = initClient(zeroConnectorCheckContract, {
+    ...config,
+    validateResponse: true
+  });
+  const result = await client.check({ body: request });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(result, "Failed to diagnose connector");
+}
+async function diagnoseZeroConnectorPermissionDeny(connectorRef, method, url) {
+  const config = await getClientConfig();
+  const client = initClient(zeroConnectorPermissionDenyContract, {
+    ...config,
+    validateResponse: true
+  });
+  const result = await client.diagnose({
+    params: { connectorRef },
+    body: { method, url }
+  });
+  if (result.status === 200) {
+    return result.body;
+  }
+  handleError(
+    result,
+    `Failed to diagnose permission denial for "${connectorRef}"`
+  );
+}
 async function getZeroConnector(type) {
   const config = await getClientConfig();
   const client = initClient(zeroConnectorsByTypeContract, config);
@@ -6877,7 +5641,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/runners.ts
 init_esm_shims();
-var c23 = initContract();
+var c25 = initContract();
 var MIN_EPOCH_MS_TIMESTAMP = 1e12;
 var apiStartTimeSchema = external_exports.number().int().min(MIN_EPOCH_MS_TIMESTAMP);
 var CANONICAL_GUEST_HOME_DIR = "/home/user";
@@ -6983,7 +5747,7 @@ var heldSessionStateSchema = external_exports.object({
     profile: external_exports.string()
   }).optional()
 });
-var runnersPollContract = c23.router({
+var runnersPollContract = c25.router({
   poll: {
     method: "POST",
     path: "/api/runners/poll",
@@ -7221,7 +5985,7 @@ var executionContextSchema = external_exports.object({
   // API-owned Codex provider/runtime metadata forwarded through the runner.
   codexRuntimeConfig: modelProviderCodexRuntimeConfigSchema.nullable().optional()
 });
-var runnersJobClaimContract = c23.router({
+var runnersJobClaimContract = c25.router({
   claim: {
     method: "POST",
     path: "/api/runners/jobs/:id/claim",
@@ -7245,7 +6009,7 @@ var runnersJobClaimContract = c23.router({
     summary: "Claim a pending job for execution"
   }
 });
-var runnersNetworkPolicyRefreshContract = c23.router({
+var runnersNetworkPolicyRefreshContract = c25.router({
   refresh: {
     method: "POST",
     path: "/api/runners/runs/:runId/network-policy-refresh",
@@ -7275,7 +6039,7 @@ var runnersNetworkPolicyRefreshContract = c23.router({
     summary: "Refresh active run network policies"
   }
 });
-var runnersBuiltinFirewallsResolveContract = c23.router({
+var runnersBuiltinFirewallsResolveContract = c25.router({
   resolve: {
     method: "POST",
     path: "/api/runners/builtin-firewalls/resolve",
@@ -7304,7 +6068,7 @@ var heartbeatBodySchema = external_exports.object({
   heldSessionStates: external_exports.array(heldSessionStateSchema).max(1024),
   mode: external_exports.enum(["starting", "running", "draining", "stopping"])
 });
-var runnersHeartbeatContract = c23.router({
+var runnersHeartbeatContract = c25.router({
   heartbeat: {
     method: "POST",
     path: "/api/runners/heartbeat",
@@ -7322,7 +6086,7 @@ var runnersHeartbeatContract = c23.router({
 
 // ../../packages/api-contracts/src/contracts/storages.ts
 init_esm_shims();
-var c24 = initContract();
+var c26 = initContract();
 var storageTypeSchema = external_exports.enum(["volume", "artifact"]);
 var versionQuerySchema = external_exports.string().regex(/^[a-f0-9]{8,64}$/i, "Version must be 8-64 hex characters").optional();
 var uploadStorageResponseSchema = external_exports.object({
@@ -7333,7 +6097,7 @@ var uploadStorageResponseSchema = external_exports.object({
   type: storageTypeSchema,
   deduplicated: external_exports.boolean()
 });
-var storagesContract = c24.router({
+var storagesContract = c26.router({
   /**
    * POST /api/storages
    * Upload a storage (tar.gz file)
@@ -7350,7 +6114,7 @@ var storagesContract = c24.router({
     path: "/api/storages",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c24.type(),
+    body: c26.type(),
     responses: {
       200: uploadStorageResponseSchema,
       400: apiErrorSchema,
@@ -7379,9 +6143,9 @@ var storagesContract = c24.router({
     }),
     responses: {
       // Binary response - actual handling done at route level
-      200: c24.otherResponse({
+      200: c26.otherResponse({
         contentType: "application/gzip",
-        body: c24.type()
+        body: c26.type()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -7406,7 +6170,7 @@ var presignedUploadSchema = external_exports.object({
   key: external_exports.string(),
   presignedUrl: external_exports.url()
 });
-var storagesPrepareContract = c24.router({
+var storagesPrepareContract = c26.router({
   prepare: {
     method: "POST",
     path: "/api/storages/prepare",
@@ -7441,7 +6205,7 @@ var storagesPrepareContract = c24.router({
     summary: "Prepare for direct S3 upload"
   }
 });
-var storagesCommitContract = c24.router({
+var storagesCommitContract = c26.router({
   commit: {
     method: "POST",
     path: "/api/storages/commit",
@@ -7475,7 +6239,7 @@ var storagesCommitContract = c24.router({
     summary: "Commit uploaded storage"
   }
 });
-var storagesDownloadContract = c24.router({
+var storagesDownloadContract = c26.router({
   download: {
     method: "GET",
     path: "/api/storages/download",
@@ -7511,7 +6275,7 @@ var storagesDownloadContract = c24.router({
     summary: "Get presigned download URL"
   }
 });
-var storagesListContract = c24.router({
+var storagesListContract = c26.router({
   list: {
     method: "GET",
     path: "/api/storages/list",
@@ -7539,7 +6303,7 @@ var storagesListContract = c24.router({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks.ts
-var c25 = initContract();
+var c27 = initContract();
 var sha256HexSchema = external_exports.string().regex(
   /^[a-f0-9]{64}$/,
   "hash must be a lowercase 64-character SHA-256 hex string"
@@ -7549,11 +6313,11 @@ var thirdPartyWebhookOkSchema = external_exports.union([
   external_exports.string(),
   external_exports.object({ message: external_exports.literal("pong") })
 ]);
-var webhookClerkContract = c25.router({
+var webhookClerkContract = c27.router({
   post: {
     method: "POST",
     path: "/api/webhooks/clerk",
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema
@@ -7561,11 +6325,11 @@ var webhookClerkContract = c25.router({
     summary: "Handle Clerk organization and user webhooks"
   }
 });
-var webhookGithubContract = c25.router({
+var webhookGithubContract = c27.router({
   post: {
     method: "POST",
     path: "/api/webhooks/github",
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7575,11 +6339,11 @@ var webhookGithubContract = c25.router({
     summary: "Handle GitHub App webhooks"
   }
 });
-var webhookStripeContract = c25.router({
+var webhookStripeContract = c27.router({
   post: {
     method: "POST",
     path: "/api/webhooks/stripe",
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema,
@@ -7618,11 +6382,11 @@ var workflowTriggerWebhookResponseSchema = external_exports.object({
   duplicate: external_exports.boolean(),
   runId: external_exports.string().uuid().optional()
 });
-var webhookGmailContract = c25.router({
+var webhookGmailContract = c27.router({
   post: {
     method: "POST",
     path: "/api/webhooks/gmail",
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: gmailWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7633,11 +6397,11 @@ var webhookGmailContract = c25.router({
     summary: "Handle Gmail Pub/Sub push notifications"
   }
 });
-var webhookGoogleCalendarContract = c25.router({
+var webhookGoogleCalendarContract = c27.router({
   post: {
     method: "POST",
     path: "/api/webhooks/google-calendar",
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: googleCalendarWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7648,11 +6412,11 @@ var webhookGoogleCalendarContract = c25.router({
     summary: "Handle Google Calendar push notifications"
   }
 });
-var webhookGoogleWorkspaceEventsContract = c25.router({
+var webhookGoogleWorkspaceEventsContract = c27.router({
   post: {
     method: "POST",
     path: "/api/webhooks/google-workspace-events",
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: googleWorkspaceEventsWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7663,11 +6427,11 @@ var webhookGoogleWorkspaceEventsContract = c25.router({
     summary: "Handle Google Workspace Events Pub/Sub push notifications"
   }
 });
-var webhookNotionContract = c25.router({
+var webhookNotionContract = c27.router({
   post: {
     method: "POST",
     path: "/api/webhooks/notion",
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: notionWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7677,14 +6441,14 @@ var webhookNotionContract = c25.router({
     summary: "Handle Notion webhook events"
   }
 });
-var webhookWorkflowTriggerContract = c25.router({
+var webhookWorkflowTriggerContract = c27.router({
   post: {
     method: "POST",
     path: "/api/webhooks/workflow-triggers/:token",
     pathParams: external_exports.object({
       token: external_exports.string().min(1)
     }),
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: workflowTriggerWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7697,7 +6461,7 @@ var webhookWorkflowTriggerContract = c25.router({
     summary: "Handle inbound workflow trigger webhooks"
   }
 });
-var webhookBuiltInGenerationFalContract = c25.router({
+var webhookBuiltInGenerationFalContract = c27.router({
   post: {
     method: "POST",
     path: "/api/webhooks/built-in-generations/fal/:generationId",
@@ -7708,7 +6472,7 @@ var webhookBuiltInGenerationFalContract = c25.router({
       token: external_exports.string().min(1),
       visualKey: external_exports.string().min(1).optional()
     }),
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7718,7 +6482,7 @@ var webhookBuiltInGenerationFalContract = c25.router({
     summary: "Handle fal built-in generation webhooks"
   }
 });
-var webhookBuiltInGenerationBytePlusContract = c25.router({
+var webhookBuiltInGenerationBytePlusContract = c27.router({
   post: {
     method: "POST",
     path: "/api/webhooks/built-in-generations/byteplus/:generationId",
@@ -7729,7 +6493,7 @@ var webhookBuiltInGenerationBytePlusContract = c25.router({
       token: external_exports.string().min(1),
       visualKey: external_exports.string().min(1).optional()
     }),
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7789,7 +6553,7 @@ var firewallAuthResponseSchema = external_exports.object({
   refreshedConnectors: external_exports.array(external_exports.string()),
   refreshedSecrets: external_exports.array(external_exports.string())
 });
-var webhookFirewallAuthContract = c25.router({
+var webhookFirewallAuthContract = c27.router({
   /**
    * POST /api/webhooks/agent/firewall/auth
    * Resolve firewall auth templates and refresh access tokens on demand.
@@ -7831,7 +6595,7 @@ var webhookFirewallAuthContract = c25.router({
     summary: "Resolve firewall auth templates"
   }
 });
-var webhookEventsContract = c25.router({
+var webhookEventsContract = c27.router({
   /**
    * POST /api/webhooks/agent/events
    * Receive agent events from sandbox
@@ -7858,7 +6622,7 @@ var webhookEventsContract = c25.router({
     summary: "Receive agent events from sandbox"
   }
 });
-var webhookCompleteContract = c25.router({
+var webhookCompleteContract = c27.router({
   /**
    * POST /api/webhooks/agent/complete
    * Handle agent run completion (success or failure)
@@ -7895,7 +6659,7 @@ var webhookCompleteContract = c25.router({
     summary: "Handle agent run completion"
   }
 });
-var webhookCheckpointsContract = c25.router({
+var webhookCheckpointsContract = c27.router({
   /**
    * POST /api/webhooks/agent/checkpoints
    * Create a recoverable checkpoint for an agent run.
@@ -7931,7 +6695,7 @@ var webhookCheckpointsContract = c25.router({
     summary: "Create checkpoint for agent run"
   }
 });
-var webhookCheckpointsPrepareHistoryContract = c25.router({
+var webhookCheckpointsPrepareHistoryContract = c27.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/checkpoints/prepare-history",
@@ -7957,7 +6721,7 @@ var webhookCheckpointsPrepareHistoryContract = c25.router({
     summary: "Get presigned URL for uploading session history to S3"
   }
 });
-var webhookHeartbeatContract = c25.router({
+var webhookHeartbeatContract = c27.router({
   /**
    * POST /api/webhooks/agent/heartbeat
    * Receive heartbeat signals from sandbox
@@ -7981,7 +6745,7 @@ var webhookHeartbeatContract = c25.router({
     summary: "Receive heartbeat from sandbox"
   }
 });
-var webhookStoragesContract = c25.router({
+var webhookStoragesContract = c27.router({
   /**
    * POST /api/webhooks/agent/storages
    * Create a new version of a storage from sandbox
@@ -7997,7 +6761,7 @@ var webhookStoragesContract = c25.router({
     path: "/api/webhooks/agent/storages",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -8013,7 +6777,7 @@ var webhookStoragesContract = c25.router({
     summary: "Upload storage version from sandbox"
   }
 });
-var webhookStoragesIncrementalContract = c25.router({
+var webhookStoragesIncrementalContract = c27.router({
   /**
    * POST /api/webhooks/agent/storages/incremental
    * Create a new version using incremental upload
@@ -8031,7 +6795,7 @@ var webhookStoragesIncrementalContract = c25.router({
     path: "/api/webhooks/agent/storages/incremental",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c25.type(),
+    body: c27.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -8125,7 +6889,7 @@ var sandboxOperationSchema = external_exports.object({
   session_history_transfer_encoding_state: sessionHistoryTransferEncodingStateSchema.optional(),
   session_history_download_source: sandboxOperationDownloadSourceSchema
 });
-var webhookTelemetryContract = c25.router({
+var webhookTelemetryContract = c27.router({
   /**
    * POST /api/webhooks/agent/telemetry
    * Receive telemetry data (system log, metrics, network logs, and sandbox operations) from sandbox
@@ -8154,7 +6918,7 @@ var webhookTelemetryContract = c25.router({
     summary: "Receive telemetry data from sandbox"
   }
 });
-var webhookStoragesPrepareContract = c25.router({
+var webhookStoragesPrepareContract = c27.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/storages/prepare",
@@ -8188,7 +6952,7 @@ var webhookStoragesPrepareContract = c25.router({
     summary: "Prepare for direct S3 upload from sandbox"
   }
 });
-var webhookStoragesCommitContract = c25.router({
+var webhookStoragesCommitContract = c27.router({
   commit: {
     method: "POST",
     path: "/api/webhooks/agent/storages/commit",
@@ -8230,7 +6994,7 @@ var webhookUsageEventItemSchema = external_exports.object({
   category: external_exports.string().min(1).max(100),
   quantity: external_exports.number().int().min(0)
 }).strict();
-var webhookUsageEventContract = c25.router({
+var webhookUsageEventContract = c27.router({
   send: {
     method: "POST",
     path: "/api/webhooks/agent/usage-event",
@@ -8263,7 +7027,7 @@ var webhookModelUsageObservationItemSchema = external_exports.object({
   category: modelUsageObservationCategorySchema,
   quantity: external_exports.number().int().min(1)
 }).strict();
-var webhookModelUsageObservationContract = c25.router({
+var webhookModelUsageObservationContract = c27.router({
   send: {
     method: "POST",
     path: "/api/webhooks/agent/model-usage-observation",
@@ -8301,7 +7065,7 @@ var zeroRunRequestSchema = unifiedRunRequestSchema.omit({
   agentId: external_exports.string().optional(),
   modelProvider: external_exports.string().optional()
 });
-var c26 = initContract();
+var c28 = initContract();
 var zeroLogPaginationQuerySchema = createLogPaginationQuerySchema({
   cursorKind: "sequence"
 });
@@ -8311,7 +7075,7 @@ var zeroNetworkLogPaginationQuerySchema = createLogPaginationQuerySchema({
   defaultLimit: 500,
   defaultOrder: "asc"
 });
-var zeroRunsMainContract = c26.router({
+var zeroRunsMainContract = c28.router({
   create: {
     method: "POST",
     path: "/api/zero/runs",
@@ -8330,7 +7094,7 @@ var zeroRunsMainContract = c26.router({
     summary: "Create and execute agent run (zero proxy)"
   }
 });
-var zeroRunsByIdContract = c26.router({
+var zeroRunsByIdContract = c28.router({
   getById: {
     method: "GET",
     path: "/api/zero/runs/:id",
@@ -8348,7 +7112,7 @@ var zeroRunsByIdContract = c26.router({
     summary: "Get agent run by ID (zero proxy)"
   }
 });
-var zeroRunsCancelContract = c26.router({
+var zeroRunsCancelContract = c28.router({
   cancel: {
     method: "POST",
     path: "/api/zero/runs/:id/cancel",
@@ -8367,7 +7131,7 @@ var zeroRunsCancelContract = c26.router({
     summary: "Cancel a pending or running run (zero proxy)"
   }
 });
-var zeroRunsQueueContract = c26.router({
+var zeroRunsQueueContract = c28.router({
   getQueue: {
     method: "GET",
     path: "/api/zero/runs/queue",
@@ -8380,7 +7144,7 @@ var zeroRunsQueueContract = c26.router({
     summary: "Get org run queue status (zero proxy)"
   }
 });
-var zeroRunAgentEventsContract = c26.router({
+var zeroRunAgentEventsContract = c28.router({
   getAgentEvents: {
     method: "GET",
     path: "/api/zero/runs/:id/telemetry/agent",
@@ -8444,7 +7208,7 @@ var runContextResponseSchema = external_exports.object({
   artifact: runContextArtifactSchema.nullable(),
   featureFlags: external_exports.record(external_exports.string(), external_exports.boolean()).nullable()
 });
-var zeroRunContextContract = c26.router({
+var zeroRunContextContract = c28.router({
   getContext: {
     method: "GET",
     path: "/api/zero/runs/:id/context",
@@ -8462,7 +7226,7 @@ var zeroRunContextContract = c26.router({
     summary: "Get run execution context snapshot for debugging"
   }
 });
-var zeroRunNetworkLogsContract = c26.router({
+var zeroRunNetworkLogsContract = c28.router({
   getNetworkLogs: {
     method: "GET",
     path: "/api/zero/runs/:id/network",
@@ -8484,7 +7248,7 @@ var zeroRunNetworkLogsContract = c26.router({
 var runRunnerResponseSchema = external_exports.object({
   sandboxReuseResult: sandboxReuseResultSchema.nullable()
 });
-var zeroRunRunnerContract = c26.router({
+var zeroRunRunnerContract = c28.router({
   getRunner: {
     method: "GET",
     path: "/api/zero/runs/:id/runner",
@@ -8502,7 +7266,7 @@ var zeroRunRunnerContract = c26.router({
     summary: "Get runner-level metadata for a run"
   }
 });
-var zeroLogsSearchContract = c26.router({
+var zeroLogsSearchContract = c28.router({
   searchLogs: {
     method: "GET",
     path: "/api/zero/logs/search",
@@ -8535,13 +7299,6 @@ async function getZeroRunAgentEvents(id, options) {
   if (result.status === 200) return result.body;
   handleError(result, `Failed to get zero run events for "${id}"`);
 }
-async function getZeroRunContext(id) {
-  const config = await getClientConfig();
-  const client = initClient(zeroRunContextContract, config);
-  const result = await client.getContext({ params: { id } });
-  if (result.status === 200) return result.body;
-  handleError(result, `Failed to get zero run context for "${id}"`);
-}
 
 // src/lib/api/domains/zero-chat.ts
 init_esm_shims();
@@ -8605,7 +7362,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-developer-support.ts
 init_esm_shims();
-var c27 = initContract();
+var c29 = initContract();
 var developerSupportBodySchema = external_exports.object({
   title: external_exports.string().min(1, "Title is required"),
   description: external_exports.string().min(1, "Description is required"),
@@ -8617,7 +7374,7 @@ var consentCodeResponseSchema = external_exports.object({
 var submitResponseSchema = external_exports.object({
   reference: external_exports.string()
 });
-var zeroDeveloperSupportContract = c27.router({
+var zeroDeveloperSupportContract = c29.router({
   submit: {
     method: "POST",
     path: "/api/zero/developer-support",
@@ -8813,7 +7570,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-computer-use.ts
 init_esm_shims();
-var c28 = initContract();
+var c30 = initContract();
 var computerUseHostStatusSchema = external_exports.enum(["online", "offline"]);
 var computerUseReadCommandKindSchema = external_exports.enum([
   "apps.list",
@@ -9188,7 +7945,7 @@ var computerUseAuditEventSchema = external_exports.object({
 var computerUseAuditEventListResponseSchema = external_exports.object({
   auditEvents: external_exports.array(computerUseAuditEventSchema)
 });
-var zeroComputerUseHostsContract = c28.router({
+var zeroComputerUseHostsContract = c30.router({
   start: {
     method: "POST",
     path: "/api/zero/computer-use/hosts/start",
@@ -9227,7 +7984,7 @@ var zeroComputerUseHostsContract = c28.router({
     summary: "Delete a desktop computer-use host"
   }
 });
-var zeroComputerUseHeartbeatContract = c28.router({
+var zeroComputerUseHeartbeatContract = c30.router({
   heartbeat: {
     method: "POST",
     path: "/api/zero/computer-use/heartbeat",
@@ -9252,7 +8009,7 @@ var zeroComputerUseHeartbeatContract = c28.router({
     summary: "Stop a desktop computer-use host"
   }
 });
-var zeroComputerUseAuthorizationRequestsContract = c28.router({
+var zeroComputerUseAuthorizationRequestsContract = c30.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/authorization-requests",
@@ -9299,7 +8056,7 @@ var zeroComputerUseAuthorizationRequestsContract = c28.router({
     summary: "Bind a Computer Use host for a delegated authorization request"
   }
 });
-var zeroComputerUseCommandContract = c28.router({
+var zeroComputerUseCommandContract = c30.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/commands",
@@ -9334,7 +8091,7 @@ var zeroComputerUseCommandContract = c28.router({
     headers: authHeadersSchema,
     pathParams: commandIdPathParamsSchema,
     responses: {
-      200: c28.type(),
+      200: c30.type(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -9347,7 +8104,7 @@ var zeroComputerUseCommandContract = c28.router({
     headers: authHeadersSchema,
     pathParams: commandIdPathParamsSchema,
     responses: {
-      200: c28.type(),
+      200: c30.type(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -9355,7 +8112,7 @@ var zeroComputerUseCommandContract = c28.router({
     summary: "Download offloaded desktop computer-use plugin content"
   }
 });
-var zeroComputerUseWriteCommandContract = c28.router({
+var zeroComputerUseWriteCommandContract = c30.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/write-commands",
@@ -9372,7 +8129,7 @@ var zeroComputerUseWriteCommandContract = c28.router({
     summary: "Create a desktop computer-use write command"
   }
 });
-var zeroComputerUsePluginCommandContract = c28.router({
+var zeroComputerUsePluginCommandContract = c30.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/plugin-commands",
@@ -9389,7 +8146,7 @@ var zeroComputerUsePluginCommandContract = c28.router({
     summary: "Create a desktop computer-use plugin command"
   }
 });
-var zeroComputerUseHostCommandsContract = c28.router({
+var zeroComputerUseHostCommandsContract = c30.router({
   next: {
     method: "POST",
     path: "/api/zero/computer-use/host/commands/next",
@@ -9417,7 +8174,7 @@ var zeroComputerUseHostCommandsContract = c28.router({
     summary: "Complete a desktop computer-use command"
   }
 });
-var zeroComputerUseAuditEventsContract = c28.router({
+var zeroComputerUseAuditEventsContract = c30.router({
   list: {
     method: "GET",
     path: "/api/zero/computer-use/audit-events",
@@ -9716,7 +8473,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/composes.ts
 init_esm_shims();
-var c29 = initContract();
+var c31 = initContract();
 var MOUNT_PATH_TEMPLATE = "${{ working_dir }}";
 var composeVersionQuerySchema = external_exports.string().min(1, "Missing version query parameter").regex(
   /^[a-f0-9]{8,64}$|^latest$/i,
@@ -9836,7 +8593,7 @@ var createComposeResponseSchema = external_exports.object({
   action: external_exports.enum(["created", "existing"]),
   updatedAt: external_exports.string()
 });
-var composesMainContract = c29.router({
+var composesMainContract = c31.router({
   /**
    * GET /api/agent/composes?name={name}&org={org}
    * Get agent compose by name with HEAD version content
@@ -9882,7 +8639,7 @@ var composesMainContract = c29.router({
     summary: "Create or update agent compose version"
   }
 });
-var composesByIdContract = c29.router({
+var composesByIdContract = c31.router({
   /**
    * GET /api/agent/composes/:id
    * Get agent compose by ID with HEAD version content
@@ -9904,7 +8661,7 @@ var composesByIdContract = c29.router({
     summary: "Get agent compose by ID"
   }
 });
-var composesVersionsContract = c29.router({
+var composesVersionsContract = c31.router({
   /**
    * GET /api/agent/composes/versions?composeId={id}&version={hash|tag}
    * Resolve a version specifier to a full version ID
@@ -10058,7 +8815,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/sessions.ts
 init_esm_shims();
-var c30 = initContract();
+var c32 = initContract();
 var sessionResponseSchema = external_exports.object({
   id: external_exports.string(),
   agentComposeId: external_exports.string(),
@@ -10099,7 +8856,7 @@ var checkpointResponseSchema = external_exports.object({
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
   createdAt: external_exports.string()
 });
-var sessionsByIdContract = c30.router({
+var sessionsByIdContract = c32.router({
   /**
    * GET /api/agent/sessions/:id
    * Get session by ID
@@ -10120,7 +8877,7 @@ var sessionsByIdContract = c30.router({
     summary: "Get session by ID"
   }
 });
-var checkpointsByIdContract = c30.router({
+var checkpointsByIdContract = c32.router({
   /**
    * GET /api/agent/checkpoints/:id
    * Get checkpoint by ID
@@ -10273,8 +9030,8 @@ var setVariableRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/zero-secrets.ts
-var c31 = initContract();
-var zeroSecretsContract = c31.router({
+var c33 = initContract();
+var zeroSecretsContract = c33.router({
   list: {
     method: "GET",
     path: "/api/zero/secrets",
@@ -10301,7 +9058,7 @@ var zeroSecretsContract = c31.router({
     summary: "Create or update a secret"
   }
 });
-var zeroSecretsByNameContract = c31.router({
+var zeroSecretsByNameContract = c33.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/secrets/:name",
@@ -10310,7 +9067,7 @@ var zeroSecretsByNameContract = c31.router({
       name: secretNameSchema
     }),
     responses: {
-      204: c31.noBody(),
+      204: c33.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -10318,7 +9075,7 @@ var zeroSecretsByNameContract = c31.router({
     summary: "Delete a secret by name"
   }
 });
-var zeroVariablesContract = c31.router({
+var zeroVariablesContract = c33.router({
   list: {
     method: "GET",
     path: "/api/zero/variables",
@@ -10345,7 +9102,7 @@ var zeroVariablesContract = c31.router({
     summary: "Create or update a variable"
   }
 });
-var zeroVariablesByNameContract = c31.router({
+var zeroVariablesByNameContract = c33.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/variables/:name",
@@ -10354,7 +9111,7 @@ var zeroVariablesByNameContract = c31.router({
       name: variableNameSchema
     }),
     responses: {
-      204: c31.noBody(),
+      204: c33.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -10495,9 +9252,9 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-model-providers.ts
 init_esm_shims();
-var c32 = initContract();
+var c34 = initContract();
 var orgUpsertModelProviderRequestSchema = upsertModelProviderRequestSchema.omit({ selectedModel: true });
-var zeroModelProvidersMainContract = c32.router({
+var zeroModelProvidersMainContract = c34.router({
   list: {
     method: "GET",
     path: "/api/zero/model-providers",
@@ -10526,7 +9283,7 @@ var zeroModelProvidersMainContract = c32.router({
     summary: "Create or update an org-level model provider (admin only)"
   }
 });
-var zeroModelProvidersByTypeContract = c32.router({
+var zeroModelProvidersByTypeContract = c34.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/model-providers/:type",
@@ -10535,7 +9292,7 @@ var zeroModelProvidersByTypeContract = c32.router({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c32.noBody(),
+      204: c34.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -10581,7 +9338,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-workflows.ts
 init_esm_shims();
-var c33 = initContract();
+var c35 = initContract();
 var zeroWorkflowVisibilitySchema = external_exports.enum(["public", "private"]);
 var zeroWorkflowNameSchema = external_exports.string().min(2).max(64).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/);
 var RESERVED_SKILL_FILE = "SKILL.md";
@@ -11226,7 +9983,7 @@ var zeroWorkflowConnectorReadinessResponseSchema = external_exports.object({
   connectors: external_exports.array(zeroWorkflowConnectorReadinessEntrySchema)
 }).strict();
 var workflowIdParams = external_exports.object({ workflowId: external_exports.string().uuid() });
-var zeroWorkflowsCollectionContract = c33.router({
+var zeroWorkflowsCollectionContract = c35.router({
   list: {
     method: "GET",
     path: "/api/zero/workflows",
@@ -11255,7 +10012,7 @@ var zeroWorkflowsCollectionContract = c33.router({
     summary: "Create a workflow under an agent"
   }
 });
-var zeroWorkflowsDetailContract = c33.router({
+var zeroWorkflowsDetailContract = c35.router({
   get: {
     method: "GET",
     path: "/api/zero/workflows/:workflowId",
@@ -11290,9 +10047,9 @@ var zeroWorkflowsDetailContract = c33.router({
     path: "/api/zero/workflows/:workflowId",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c35.noBody(),
     responses: {
-      204: c33.noBody(),
+      204: c35.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -11320,7 +10077,7 @@ var zeroWorkflowsDetailContract = c33.router({
     path: "/api/zero/workflows/:workflowId/chat-thread",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c35.noBody(),
     responses: {
       200: zeroWorkflowChatThreadResponseSchema,
       401: apiErrorSchema,
@@ -11334,7 +10091,7 @@ var zeroWorkflowsDetailContract = c33.router({
     path: "/api/zero/workflows/:workflowId/run",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c35.noBody(),
     responses: {
       200: zeroWorkflowRunResponseSchema,
       401: apiErrorSchema,
@@ -11349,7 +10106,7 @@ var zeroWorkflowsDetailContract = c33.router({
     path: "/api/zero/workflows/:workflowId/connector-readiness",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c35.noBody(),
     responses: {
       200: zeroWorkflowConnectorReadinessResponseSchema,
       400: apiErrorSchema,
@@ -11362,13 +10119,13 @@ var zeroWorkflowsDetailContract = c33.router({
     summary: "Detect the built-in connectors a workflow may need and report their readiness"
   }
 });
-var zeroWorkflowVisibilityContract = c33.router({
+var zeroWorkflowVisibilityContract = c35.router({
   publish: {
     method: "POST",
     path: "/api/zero/workflows/:workflowId/publish",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c35.noBody(),
     responses: {
       200: zeroWorkflowSummarySchema,
       400: apiErrorSchema,
@@ -11384,7 +10141,7 @@ var zeroWorkflowVisibilityContract = c33.router({
     path: "/api/zero/workflows/:workflowId/demote",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c33.noBody(),
+    body: c35.noBody(),
     responses: {
       200: zeroWorkflowSummarySchema,
       400: apiErrorSchema,
@@ -11402,7 +10159,7 @@ var zeroWorkflowWebhookSecretResponseSchema = external_exports.object({
   webhookUrl: external_exports.url(),
   webhookSecret: external_exports.string().min(1)
 });
-var zeroWorkflowTriggersContract = c33.router({
+var zeroWorkflowTriggersContract = c35.router({
   listWorkspace: {
     method: "GET",
     path: "/api/zero/workflow-triggers",
@@ -11491,9 +10248,9 @@ var zeroWorkflowTriggersContract = c33.router({
     path: "/api/zero/workflow-triggers/:id",
     headers: authHeadersSchema,
     pathParams: triggerIdParams,
-    body: c33.noBody(),
+    body: c35.noBody(),
     responses: {
-      204: c33.noBody(),
+      204: c35.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -11505,7 +10262,7 @@ var zeroWorkflowTriggersContract = c33.router({
     path: "/api/zero/workflow-triggers/:id/enable",
     headers: authHeadersSchema,
     pathParams: triggerIdParams,
-    body: c33.noBody(),
+    body: c35.noBody(),
     responses: {
       200: zeroWorkflowTriggerSummarySchema,
       400: apiErrorSchema,
@@ -11522,7 +10279,7 @@ var zeroWorkflowTriggersContract = c33.router({
     path: "/api/zero/workflow-triggers/:id/disable",
     headers: authHeadersSchema,
     pathParams: triggerIdParams,
-    body: c33.noBody(),
+    body: c35.noBody(),
     responses: {
       200: zeroWorkflowTriggerSummarySchema,
       401: apiErrorSchema,
@@ -11536,7 +10293,7 @@ var zeroWorkflowTriggersContract = c33.router({
     path: "/api/zero/workflow-triggers/:id/run",
     headers: authHeadersSchema,
     pathParams: triggerIdParams,
-    body: c33.noBody(),
+    body: c35.noBody(),
     responses: {
       201: zeroWorkflowRunResponseSchema,
       400: apiErrorSchema,
@@ -11552,7 +10309,7 @@ var zeroWorkflowTriggersContract = c33.router({
     path: "/api/zero/workflow-triggers/:id/webhook-secret",
     headers: authHeadersSchema,
     pathParams: triggerIdParams,
-    body: c33.noBody(),
+    body: c35.noBody(),
     responses: {
       200: zeroWorkflowWebhookSecretResponseSchema,
       401: apiErrorSchema,
@@ -11667,7 +10424,7 @@ import { pipeline } from "stream/promises";
 
 // ../../packages/api-contracts/src/contracts/integrations.ts
 init_esm_shims();
-var c34 = initContract();
+var c36 = initContract();
 var sendSlackMessageBodySchema = external_exports.object({
   channel: external_exports.string().min(1, "Channel ID is required").optional(),
   user: external_exports.string().min(1, "User ID is required").optional(),
@@ -11685,7 +10442,7 @@ var sendSlackMessageResponseSchema = external_exports.object({
   ts: external_exports.string().optional(),
   channel: external_exports.string().optional()
 });
-var integrationsSlackMessageContract = c34.router({
+var integrationsSlackMessageContract = c36.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/slack/message",
@@ -11713,7 +10470,7 @@ var sendTelegramMessageResponseSchema = external_exports.object({
   messageId: external_exports.number().int(),
   chatId: external_exports.string()
 });
-var integrationsTelegramMessageContract = c34.router({
+var integrationsTelegramMessageContract = c36.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/telegram/message",
@@ -11772,7 +10529,7 @@ var sendTeamsMessageResponseSchema = external_exports.object({
   activityId: external_exports.string().optional(),
   conversationId: external_exports.string()
 });
-var integrationsTeamsMessageContract = c34.router({
+var integrationsTeamsMessageContract = c36.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/teams/message",
@@ -11800,7 +10557,7 @@ var sendPhoneMessageResponseSchema = external_exports.object({
   channel: external_exports.string().nullable(),
   toNumber: external_exports.string()
 });
-var integrationsPhoneMessageContract = c34.router({
+var integrationsPhoneMessageContract = c36.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/phone/message",
@@ -11820,14 +10577,14 @@ var integrationsPhoneMessageContract = c34.router({
 var phoneDownloadFileQuerySchema = external_exports.object({
   file_id: external_exports.string().min(1, "file_id query parameter is required")
 });
-var integrationsPhoneDownloadFileContract = c34.router({
+var integrationsPhoneDownloadFileContract = c36.router({
   download: {
     method: "GET",
     path: "/api/zero/integrations/phone/download-file",
     headers: authHeadersSchema,
     query: phoneDownloadFileQuerySchema,
     responses: {
-      200: c34.type(),
+      200: c36.type(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -11862,7 +10619,7 @@ var telegramBotListItemSchema = external_exports.object({
 var listTelegramBotsResponseSchema = external_exports.object({
   bots: external_exports.array(telegramBotListItemSchema)
 });
-var integrationsTelegramBotListContract = c34.router({
+var integrationsTelegramBotListContract = c36.router({
   listBots: {
     method: "GET",
     path: "/api/zero/integrations/telegram/bots",
@@ -11883,7 +10640,7 @@ var slackUploadInitResponseSchema = external_exports.object({
   uploadUrl: external_exports.string(),
   fileId: external_exports.string()
 });
-var integrationsSlackUploadInitContract = c34.router({
+var integrationsSlackUploadInitContract = c36.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/init",
@@ -11912,7 +10669,7 @@ var telegramUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsTelegramUploadInitContract = c34.router({
+var integrationsTelegramUploadInitContract = c36.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/init",
@@ -11940,7 +10697,7 @@ var teamsUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsTeamsUploadInitContract = c34.router({
+var integrationsTeamsUploadInitContract = c36.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/teams/upload-file/init",
@@ -11972,7 +10729,7 @@ var telegramUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsTelegramUploadCompleteContract = c34.router({
+var integrationsTelegramUploadCompleteContract = c36.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/complete",
@@ -12004,7 +10761,7 @@ var teamsUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsTeamsUploadCompleteContract = c34.router({
+var integrationsTeamsUploadCompleteContract = c36.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/teams/upload-file/complete",
@@ -12034,7 +10791,7 @@ var githubUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsGithubUploadInitContract = c34.router({
+var integrationsGithubUploadInitContract = c36.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/github/upload-file/init",
@@ -12068,7 +10825,7 @@ var githubUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsGithubUploadCompleteContract = c34.router({
+var integrationsGithubUploadCompleteContract = c36.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/github/upload-file/complete",
@@ -12099,7 +10856,7 @@ var phoneUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsPhoneUploadInitContract = c34.router({
+var integrationsPhoneUploadInitContract = c36.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/init",
@@ -12130,7 +10887,7 @@ var phoneUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsPhoneUploadCompleteContract = c34.router({
+var integrationsPhoneUploadCompleteContract = c36.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/complete",
@@ -12158,7 +10915,7 @@ var slackUploadCompleteResponseSchema = external_exports.object({
   fileId: external_exports.string(),
   permalink: external_exports.string()
 });
-var integrationsSlackUploadCompleteContract = c34.router({
+var integrationsSlackUploadCompleteContract = c36.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/complete",
@@ -12605,7 +11362,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-relationships.ts
 init_esm_shims();
-var c35 = initContract();
+var c37 = initContract();
 var RELATIONSHIP_SEARCH_DEFAULT_LIMIT = 100;
 var RELATIONSHIP_SEARCH_MAX_LIMIT = 100;
 var relationshipEntityTypeSchema = external_exports.enum(["person", "organization"]);
@@ -12720,7 +11477,7 @@ var resolveQuerySchema = external_exports.object({
     message: "Provide exactly one of id, email, or domain"
   }
 );
-var zeroRelationshipsContract = c35.router({
+var zeroRelationshipsContract = c37.router({
   gmailStatus: {
     method: "GET",
     path: "/api/zero/relationships/gmail/status",
@@ -12847,7 +11604,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-memory.ts
 init_esm_shims();
-var c36 = initContract();
+var c38 = initContract();
 var memoryFileSchema = external_exports.object({
   path: external_exports.string(),
   size: external_exports.number()
@@ -13395,7 +12152,7 @@ var memoryDetailResponseSchema = external_exports.object({
   files: external_exports.array(memoryFileSchema),
   fileContents: external_exports.array(memoryFileContentSchema)
 });
-var zeroMemoryContract = c36.router({
+var zeroMemoryContract = c38.router({
   get: {
     method: "GET",
     path: "/api/zero/memory",
@@ -14185,17 +12942,9 @@ async function getHostedSiteFiles(publicSlug) {
 export {
   connectorCatalogRefSchema,
   guaranteedConnectorProvidedBindingNames,
-  hasRawWhitespace,
-  hasUnsafeUrlCodepoint,
-  parseSegment,
-  splitPathSegments,
   UNKNOWN_PERMISSION_GRANT,
   firewallPoliciesSchema,
   hasUnsafeFirewallPath,
-  resolveFirewallBaseUrlTemplate,
-  hasBaseUrlParams,
-  validateBaseUrl,
-  validateAuthBaseUrl,
   authHeadersSchema,
   runnerGroupSchema,
   volumeConfigSchema,
@@ -14283,10 +13032,11 @@ export {
   clearGoal,
   customConnectorProposalSchema,
   listZeroConnectors,
-  searchZeroConnectors,
   listZeroConnectorCatalog,
   listZeroConnectorCatalogStatus,
   getZeroConnectorCatalogPermissions,
+  diagnoseZeroConnectorCheck,
+  diagnoseZeroConnectorPermissionDeny,
   getZeroConnector,
   connectZeroConnectorManualGrant,
   listZeroCustomConnectors,
@@ -14312,7 +13062,6 @@ export {
   completePhoneFileUpload,
   downloadPhoneFile,
   getZeroRunAgentEvents,
-  getZeroRunContext,
   listZeroLogs,
   searchZeroLogs,
   searchZeroChat,
@@ -14356,4 +13105,4 @@ export {
   completeHostedSite,
   getHostedSiteFiles
 };
-//# sourceMappingURL=chunk-GIACTMOF.js.map
+//# sourceMappingURL=chunk-6NTG5UZE.js.map