@vm0/cli 9.241.8 → 9.241.10

package/{chunk-MZDPLIUI.js → chunk-SIG5BQU7.js}

@@ -22,7 +22,7 @@ import {
   updateOrgModelPoliciesRequestSchema,
   upsertModelProviderRequestSchema,
   upsertModelProviderResponseSchema
-} from "./chunk-Q3H5XOMH.js";
+} from "./chunk-44EKQ5HS.js";
 import {
   __commonJS,
   __esm,
@@ -2361,82 +2361,6 @@ var IPV4_MAX_OCTET = 255;
 var IPV4_OCTET_BASE = IPV4_MAX_OCTET + 1;
 var BASE_URL_VARS_PATTERN = /\$\{\{\s*vars\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/;
 var BASE_URL_VARS_PATTERN_G = new RegExp(BASE_URL_VARS_PATTERN.source, "g");
-var PATH_VAR_STRUCTURE_CHARS = /* @__PURE__ */ new Set(["/", "?", "#", "\\"]);
-var MAX_PATH_PERCENT_DECODE_PASSES = 5;
-function pathPartDotPrefix(part) {
-  return part.split(";", 1)[0];
-}
-function pathPartIsDotSegment(part) {
-  const dotPrefix = pathPartDotPrefix(part);
-  return dotPrefix === "." || dotPrefix === "..";
-}
-function pathSegmentContainsDotPathPart(segment) {
-  if (pathPartIsDotSegment(segment)) return true;
-  return segment.split("/").some((part) => {
-    return pathPartIsDotSegment(part);
-  });
-}
-function pathSegmentHasUnsafeSyntaxParts(segment, rejectPathStructure) {
-  if (hasUnsafeUrlCodepoint(segment)) return true;
-  if (segment.includes("\\")) return true;
-  if (pathSegmentContainsDotPathPart(segment)) return true;
-  if (!rejectPathStructure) return false;
-  for (const char of segment) {
-    if (PATH_VAR_STRUCTURE_CHARS.has(char)) return true;
-  }
-  return false;
-}
-function normalizedPathSegmentHasUnsafeSyntax(segment, rejectPathStructure) {
-  const normalized = segment.normalize("NFKC");
-  if (normalized === segment) return false;
-  if (normalized.includes("%")) return true;
-  return pathSegmentHasUnsafeSyntaxParts(normalized, rejectPathStructure);
-}
-function percentDecodePathSegment(segment, rejectPathStructure) {
-  if (!segment.includes("%")) return segment;
-  for (let i = 0; i < segment.length; i += 1) {
-    if (segment[i] !== "%") continue;
-    if (i + 2 >= segment.length || !isHexDigit(segment[i + 1]) || !isHexDigit(segment[i + 2])) {
-      return null;
-    }
-  }
-  let decoded;
-  try {
-    decoded = decodeURIComponent(segment);
-  } catch {
-    return null;
-  }
-  if (rejectPathStructure) {
-    for (const char of decoded) {
-      if (PATH_VAR_STRUCTURE_CHARS.has(char) || WHITESPACE_PATTERN.test(char) || UNICODE_CONTROL_PATTERN.test(char)) {
-        return null;
-      }
-    }
-  }
-  return decoded;
-}
-function pathSegmentHasUnsafeSyntax(segment, rejectPathStructure) {
-  let current = segment;
-  for (let pass = 0; pass < MAX_PATH_PERCENT_DECODE_PASSES; pass += 1) {
-    if (pathSegmentHasUnsafeSyntaxParts(current, rejectPathStructure) || normalizedPathSegmentHasUnsafeSyntax(current, rejectPathStructure)) {
-      return true;
-    }
-    const decoded2 = percentDecodePathSegment(current, rejectPathStructure);
-    if (decoded2 === null) return true;
-    if (decoded2 === current) return false;
-    current = decoded2;
-  }
-  if (pathSegmentHasUnsafeSyntaxParts(current, rejectPathStructure) || normalizedPathSegmentHasUnsafeSyntax(current, rejectPathStructure)) {
-    return true;
-  }
-  const decoded = percentDecodePathSegment(current, rejectPathStructure);
-  return decoded === null || decoded !== current;
-}
-function hasUnsafeFirewallPath(path) {
-  return path.split("/").some((segment) => {
-    return pathSegmentHasUnsafeSyntax(segment, false);
-  });
-}
 function parseCanonicalIpv4Address(value) {
   if (!isCanonicalIpv4Address(value)) {
     return null;
@@ -2512,8 +2436,6 @@ function parseIpv6Address(value) {
   ];
 }
 var FORBIDDEN_NORMALIZED_LABEL_CHARS = new Set("#%,/:<>?@[\\]^|[]".split(""));
-var WHITESPACE_PATTERN = /\s/u;
-var UNICODE_CONTROL_PATTERN = /\p{C}/u;
 var UNICODE_DECIMAL_NUMBER_PATTERN = /^\p{Decimal_Number}+$/u;
 function isHexDigit(char) {
   return char >= "0" && char <= "9" || char >= "a" && char <= "f" || char >= "A" && char <= "F";
@@ -5915,68 +5837,9 @@ var zeroConnectorCheckContract = c22.router({
   }
 });
 
-// ../../packages/api-contracts/src/contracts/zero-connector-permission-deny.ts
-init_esm_shims();
-var c23 = initContract();
-var connectorPermissionDenyRequestSchema = external_exports.object({
-  method: external_exports.string().min(1).max(16),
-  url: external_exports.string().min(1).max(8192)
-}).strict();
-var connectorPermissionDenyMatchedSchema = external_exports.object({
-  outcome: external_exports.literal("matched"),
-  label: external_exports.string().min(1),
-  base: external_exports.string().min(1),
-  relativePath: external_exports.string().min(1),
-  permissions: external_exports.array(external_exports.string().min(1)).min(1)
-}).strict();
-var connectorPermissionDenyUnknownEndpointSchema = external_exports.object({
-  outcome: external_exports.literal("unknown-endpoint"),
-  label: external_exports.string().min(1),
-  base: external_exports.string().min(1),
-  relativePath: external_exports.string().min(1)
-}).strict();
-var connectorPermissionDenyUnknownConnectorSchema = external_exports.object({ outcome: external_exports.literal("unknown-connector") }).strict();
-var connectorPermissionDenyNoMatchingBaseSchema = external_exports.object({
-  outcome: external_exports.literal("no-matching-base"),
-  label: external_exports.string().min(1)
-}).strict();
-var connectorPermissionDenyUnresolvedDynamicBaseSchema = external_exports.object({
-  outcome: external_exports.literal("unresolved-dynamic-base"),
-  label: external_exports.string().min(1)
-}).strict();
-var connectorPermissionDenyUnsafeInputSchema = external_exports.object({
-  outcome: external_exports.literal("unsafe-input"),
-  reason: external_exports.enum(["invalid-method", "invalid-url", "unsafe-path"])
-}).strict();
-var connectorPermissionDenyDiagnosticResultSchema = external_exports.discriminatedUnion("outcome", [
-  connectorPermissionDenyMatchedSchema,
-  connectorPermissionDenyUnknownEndpointSchema,
-  connectorPermissionDenyUnknownConnectorSchema,
-  connectorPermissionDenyNoMatchingBaseSchema,
-  connectorPermissionDenyUnresolvedDynamicBaseSchema,
-  connectorPermissionDenyUnsafeInputSchema
-]);
-var zeroConnectorPermissionDenyContract = c23.router({
-  diagnose: {
-    method: "POST",
-    path: "/api/zero/connectors/:connectorRef/diagnostics/permission-deny",
-    headers: authHeadersSchema,
-    pathParams: external_exports.object({ connectorRef: connectorCatalogRefSchema }),
-    body: connectorPermissionDenyRequestSchema,
-    responses: {
-      200: connectorPermissionDenyDiagnosticResultSchema,
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      403: apiErrorSchema,
-      500: apiErrorSchema
-    },
-    summary: "Diagnose a connector permission denial"
-  }
-});
-
 // ../../packages/api-contracts/src/contracts/zero-custom-connectors.ts
 init_esm_shims();
-var c24 = initContract();
+var c23 = initContract();
 var customConnectorFieldKindSchema = external_exports.enum(["secret", "variable"]);
 var customConnectorFieldSchema = external_exports.object({
   key: external_exports.string().min(1).max(64),
@@ -6062,7 +5925,7 @@ var saveCustomConnectorProposalResponseSchema = external_exports.object({
   connector: customConnectorResponseSchema,
   authorizedAgentId: external_exports.string().uuid().optional()
 });
-var zeroCustomConnectorsContract = c24.router({
+var zeroCustomConnectorsContract = c23.router({
   list: {
     method: "GET",
     path: "/api/zero/custom-connectors",
@@ -6089,7 +5952,7 @@ var zeroCustomConnectorsContract = c24.router({
     summary: "Create an org custom connector"
   }
 });
-var zeroCustomConnectorByIdContract = c24.router({
+var zeroCustomConnectorByIdContract = c23.router({
   get: {
     method: "GET",
     path: "/api/zero/custom-connectors/:id",
@@ -6110,7 +5973,7 @@ var zeroCustomConnectorByIdContract = c24.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     responses: {
-      204: c24.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -6135,7 +5998,7 @@ var zeroCustomConnectorByIdContract = c24.router({
     summary: "Rename an org custom connector"
   }
 });
-var zeroCustomConnectorSecretContract = c24.router({
+var zeroCustomConnectorSecretContract = c23.router({
   set: {
     method: "PUT",
     path: "/api/zero/custom-connectors/:id/secret",
@@ -6143,7 +6006,7 @@ var zeroCustomConnectorSecretContract = c24.router({
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     body: setCustomConnectorSecretBodySchema,
     responses: {
-      204: c24.noBody(),
+      204: c23.noBody(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       404: apiErrorSchema,
@@ -6157,7 +6020,7 @@ var zeroCustomConnectorSecretContract = c24.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     responses: {
-      204: c24.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -6165,7 +6028,7 @@ var zeroCustomConnectorSecretContract = c24.router({
     summary: "Clear the calling user's secret for a custom connector"
   }
 });
-var zeroCustomConnectorProposalContract = c24.router({
+var zeroCustomConnectorProposalContract = c23.router({
   save: {
     method: "POST",
     path: "/api/zero/custom-connectors/proposals/save",
@@ -6245,24 +6108,6 @@ async function diagnoseZeroConnectorCheck(request) {
   }
   handleError(result, "Failed to diagnose connector");
 }
-async function diagnoseZeroConnectorPermissionDeny(connectorRef, method, url) {
-  const config = await getClientConfig();
-  const client = initClient(zeroConnectorPermissionDenyContract, {
-    ...config,
-    validateResponse: true
-  });
-  const result = await client.diagnose({
-    params: { connectorRef },
-    body: { method, url }
-  });
-  if (result.status === 200) {
-    return result.body;
-  }
-  handleError(
-    result,
-    `Failed to diagnose permission denial for "${connectorRef}"`
-  );
-}
 async function getZeroConnector(type) {
   const config = await getClientConfig();
   const client = initClient(zeroConnectorsByTypeContract, config);
@@ -6322,7 +6167,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/runners.ts
 init_esm_shims();
-var c25 = initContract();
+var c24 = initContract();
 var MIN_EPOCH_MS_TIMESTAMP = 1e12;
 var apiStartTimeSchema = external_exports.number().int().min(MIN_EPOCH_MS_TIMESTAMP);
 var CANONICAL_GUEST_HOME_DIR = "/home/user";
@@ -6358,6 +6203,16 @@ var runnerClaimPollReasonSchema = external_exports.enum([
   "slow",
   "fast"
 ]);
+var sessionAffinityResourceSchema = external_exports.enum([
+  "reusableSandbox",
+  "workspaceCache"
+]);
+var sessionAffinityLocalResourceSchema = external_exports.enum([
+  "reusableSandbox",
+  "workspaceCache",
+  "legacySession"
+]);
+var runnerLocalAdmissionResourceSchema = external_exports.enum(["reusableSandbox", "fresh"]);
 var runnerClaimDiscoverySourceSchema = external_exports.enum(["ably", "poll"]);
 var runnerPreLocalAdmissionOutcomeSchema = external_exports.enum([
   "not_protected",
@@ -6385,6 +6240,9 @@ var runnerClaimTelemetrySchema = external_exports.object({
   providerDiscoveryToMainLoopMs: external_exports.number().int().nonnegative().optional(),
   mainLoopToLocalAdmissionMs: external_exports.number().int().nonnegative().optional(),
   preLocalAdmissionOutcome: runnerPreLocalAdmissionOutcomeSchema.optional(),
+  sessionAffinityResource: sessionAffinityResourceSchema.optional(),
+  sessionAffinityLocalResource: sessionAffinityLocalResourceSchema.optional(),
+  localAdmissionResource: runnerLocalAdmissionResourceSchema.optional(),
   sessionHistoryGenerationRelationship: sessionHistoryGenerationRelationshipSchema.optional(),
   sessionHistoryGenerationLocalAvailability: sessionHistoryGenerationLocalAvailabilitySchema.optional(),
   pollDueToJobDiscoveredMs: external_exports.number().int().nonnegative().optional(),
@@ -6433,7 +6291,8 @@ var jobSchema = external_exports.object({
   cliAgentSessionId: external_exports.string().nullable().optional(),
   historyGenerationRunId: external_exports.uuid().optional(),
   historyGenerationAffinityProtectedUntil: external_exports.string().datetime({ offset: true }).nullable().optional(),
-  affinityProtectedUntil: external_exports.string().datetime({ offset: true }).nullable().optional()
+  affinityProtectedUntil: external_exports.string().datetime({ offset: true }).nullable().optional(),
+  sessionAffinityResource: sessionAffinityResourceSchema.optional()
 });
 var heldSessionStateSchema = external_exports.object({
   // Compatibility wire name. Semantically this is the Claude/Codex CLI agent
@@ -6446,11 +6305,12 @@ var heldSessionStateSchema = external_exports.object({
   }).optional(),
   workspaceCaches: external_exports.array(
     external_exports.object({
-      profile: external_exports.string()
+      profile: external_exports.string(),
+      workspaceAffinityVersion: external_exports.literal(1).optional()
     })
   ).max(8).optional()
 });
-var runnersPollContract = c25.router({
+var runnersPollContract = c24.router({
   poll: {
     method: "POST",
     path: "/api/runners/poll",
@@ -6689,7 +6549,7 @@ var executionContextSchema = external_exports.object({
   // API-owned Codex provider/runtime metadata forwarded through the runner.
   codexRuntimeConfig: modelProviderCodexRuntimeConfigSchema.nullable().optional()
 });
-var runnersJobClaimContract = c25.router({
+var runnersJobClaimContract = c24.router({
   claim: {
     method: "POST",
     path: "/api/runners/jobs/:id/claim",
@@ -6713,7 +6573,7 @@ var runnersJobClaimContract = c25.router({
     summary: "Claim a pending job for execution"
   }
 });
-var runnersNetworkPolicyRefreshContract = c25.router({
+var runnersNetworkPolicyRefreshContract = c24.router({
   refresh: {
     method: "POST",
     path: "/api/runners/runs/:runId/network-policy-refresh",
@@ -6743,7 +6603,7 @@ var runnersNetworkPolicyRefreshContract = c25.router({
     summary: "Refresh active run network policies"
   }
 });
-var runnersBuiltinFirewallsResolveContract = c25.router({
+var runnersBuiltinFirewallsResolveContract = c24.router({
   resolve: {
     method: "POST",
     path: "/api/runners/builtin-firewalls/resolve",
@@ -6787,7 +6647,7 @@ var heartbeatBodySchema = external_exports.object({
     message: "heldSessionStates may contain at most 1024 workspace caches"
   });
 });
-var runnersHeartbeatContract = c25.router({
+var runnersHeartbeatContract = c24.router({
   heartbeat: {
     method: "POST",
     path: "/api/runners/heartbeat",
@@ -6805,7 +6665,7 @@ var runnersHeartbeatContract = c25.router({
 
 // ../../packages/api-contracts/src/contracts/storages.ts
 init_esm_shims();
-var c26 = initContract();
+var c25 = initContract();
 var storageTypeSchema = external_exports.enum(["volume", "artifact"]);
 var versionQuerySchema = external_exports.string().regex(/^[a-f0-9]{8,64}$/i, "Version must be 8-64 hex characters").optional();
 var uploadStorageResponseSchema = external_exports.object({
@@ -6816,7 +6676,7 @@ var uploadStorageResponseSchema = external_exports.object({
   type: storageTypeSchema,
   deduplicated: external_exports.boolean()
 });
-var storagesContract = c26.router({
+var storagesContract = c25.router({
   /**
    * POST /api/storages
    * Upload a storage (tar.gz file)
@@ -6833,7 +6693,7 @@ var storagesContract = c26.router({
     path: "/api/storages",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c26.type(),
+    body: c25.type(),
     responses: {
       200: uploadStorageResponseSchema,
       400: apiErrorSchema,
@@ -6862,9 +6722,9 @@ var storagesContract = c26.router({
     }),
     responses: {
       // Binary response - actual handling done at route level
-      200: c26.otherResponse({
+      200: c25.otherResponse({
         contentType: "application/gzip",
-        body: c26.type()
+        body: c25.type()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -6889,7 +6749,7 @@ var presignedUploadSchema = external_exports.object({
   key: external_exports.string(),
   presignedUrl: external_exports.url()
 });
-var storagesPrepareContract = c26.router({
+var storagesPrepareContract = c25.router({
   prepare: {
     method: "POST",
     path: "/api/storages/prepare",
@@ -6924,7 +6784,7 @@ var storagesPrepareContract = c26.router({
     summary: "Prepare for direct S3 upload"
   }
 });
-var storagesCommitContract = c26.router({
+var storagesCommitContract = c25.router({
   commit: {
     method: "POST",
     path: "/api/storages/commit",
@@ -6958,7 +6818,7 @@ var storagesCommitContract = c26.router({
     summary: "Commit uploaded storage"
   }
 });
-var storagesDownloadContract = c26.router({
+var storagesDownloadContract = c25.router({
   download: {
     method: "GET",
     path: "/api/storages/download",
@@ -6994,7 +6854,7 @@ var storagesDownloadContract = c26.router({
     summary: "Get presigned download URL"
   }
 });
-var storagesListContract = c26.router({
+var storagesListContract = c25.router({
   list: {
     method: "GET",
     path: "/api/storages/list",
@@ -7022,7 +6882,7 @@ var storagesListContract = c26.router({
 });
 
 // ../../packages/api-contracts/src/contracts/webhooks.ts
-var c27 = initContract();
+var c26 = initContract();
 var sha256HexSchema = external_exports.string().regex(
   /^[a-f0-9]{64}$/,
   "hash must be a lowercase 64-character SHA-256 hex string"
@@ -7032,11 +6892,11 @@ var thirdPartyWebhookOkSchema = external_exports.union([
   external_exports.string(),
   external_exports.object({ message: external_exports.literal("pong") })
 ]);
-var webhookClerkContract = c27.router({
+var webhookClerkContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/clerk",
-    body: c27.type(),
+    body: c26.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema
@@ -7044,11 +6904,11 @@ var webhookClerkContract = c27.router({
     summary: "Handle Clerk organization and user webhooks"
   }
 });
-var webhookGithubContract = c27.router({
+var webhookGithubContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/github",
-    body: c27.type(),
+    body: c26.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7058,11 +6918,11 @@ var webhookGithubContract = c27.router({
     summary: "Handle GitHub App webhooks"
   }
 });
-var webhookStripeContract = c27.router({
+var webhookStripeContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/stripe",
-    body: c27.type(),
+    body: c26.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       401: thirdPartyWebhookErrorSchema,
@@ -7101,11 +6961,11 @@ var workflowAutomationWebhookResponseSchema = external_exports.object({
   duplicate: external_exports.boolean(),
   runId: external_exports.string().uuid().optional()
 });
-var webhookGmailContract = c27.router({
+var webhookGmailContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/gmail",
-    body: c27.type(),
+    body: c26.type(),
     responses: {
       200: gmailWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7116,11 +6976,11 @@ var webhookGmailContract = c27.router({
     summary: "Handle Gmail Pub/Sub push notifications"
   }
 });
-var webhookGoogleCalendarContract = c27.router({
+var webhookGoogleCalendarContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/google-calendar",
-    body: c27.type(),
+    body: c26.type(),
     responses: {
       200: googleCalendarWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7131,11 +6991,11 @@ var webhookGoogleCalendarContract = c27.router({
     summary: "Handle Google Calendar push notifications"
   }
 });
-var webhookGoogleWorkspaceEventsContract = c27.router({
+var webhookGoogleWorkspaceEventsContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/google-workspace-events",
-    body: c27.type(),
+    body: c26.type(),
     responses: {
       200: googleWorkspaceEventsWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7146,11 +7006,11 @@ var webhookGoogleWorkspaceEventsContract = c27.router({
     summary: "Handle Google Workspace Events Pub/Sub push notifications"
   }
 });
-var webhookNotionContract = c27.router({
+var webhookNotionContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/notion",
-    body: c27.type(),
+    body: c26.type(),
     responses: {
       200: notionWebhookResponseSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7165,7 +7025,7 @@ var workflowAutomationWebhookPostRoute = {
   pathParams: external_exports.object({
     token: external_exports.string().min(1)
   }),
-  body: c27.type(),
+  body: c26.type(),
   responses: {
     200: workflowAutomationWebhookResponseSchema,
     400: thirdPartyWebhookErrorSchema,
@@ -7176,14 +7036,14 @@ var workflowAutomationWebhookPostRoute = {
     500: thirdPartyWebhookErrorSchema
   }
 };
-var webhookWorkflowAutomationContract = c27.router({
+var webhookWorkflowAutomationContract = c26.router({
   post: {
     ...workflowAutomationWebhookPostRoute,
     path: "/api/webhooks/workflow-automations/:token",
     summary: "Handle inbound workflow automation webhooks"
   }
 });
-var webhookBuiltInGenerationFalContract = c27.router({
+var webhookBuiltInGenerationFalContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/built-in-generations/fal/:generationId",
@@ -7194,7 +7054,7 @@ var webhookBuiltInGenerationFalContract = c27.router({
       token: external_exports.string().min(1),
       visualKey: external_exports.string().min(1).optional()
     }),
-    body: c27.type(),
+    body: c26.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7204,7 +7064,7 @@ var webhookBuiltInGenerationFalContract = c27.router({
     summary: "Handle fal built-in generation webhooks"
   }
 });
-var webhookBuiltInGenerationBytePlusContract = c27.router({
+var webhookBuiltInGenerationBytePlusContract = c26.router({
   post: {
     method: "POST",
     path: "/api/webhooks/built-in-generations/byteplus/:generationId",
@@ -7215,7 +7075,7 @@ var webhookBuiltInGenerationBytePlusContract = c27.router({
       token: external_exports.string().min(1),
       visualKey: external_exports.string().min(1).optional()
     }),
-    body: c27.type(),
+    body: c26.type(),
     responses: {
       200: thirdPartyWebhookOkSchema,
       400: thirdPartyWebhookErrorSchema,
@@ -7275,7 +7135,7 @@ var firewallAuthResponseSchema = external_exports.object({
   refreshedConnectors: external_exports.array(external_exports.string()),
   refreshedSecrets: external_exports.array(external_exports.string())
 });
-var webhookFirewallAuthContract = c27.router({
+var webhookFirewallAuthContract = c26.router({
   /**
    * POST /api/webhooks/agent/firewall/auth
    * Resolve firewall auth templates and refresh access tokens on demand.
@@ -7317,7 +7177,7 @@ var webhookFirewallAuthContract = c27.router({
     summary: "Resolve firewall auth templates"
   }
 });
-var webhookEventsContract = c27.router({
+var webhookEventsContract = c26.router({
   /**
    * POST /api/webhooks/agent/events
    * Receive agent events from sandbox
@@ -7344,7 +7204,7 @@ var webhookEventsContract = c27.router({
     summary: "Receive agent events from sandbox"
   }
 });
-var webhookCompleteContract = c27.router({
+var webhookCompleteContract = c26.router({
   /**
    * POST /api/webhooks/agent/complete
    * Handle agent run completion (success or failure)
@@ -7381,7 +7241,7 @@ var webhookCompleteContract = c27.router({
     summary: "Handle agent run completion"
   }
 });
-var webhookCheckpointsContract = c27.router({
+var webhookCheckpointsContract = c26.router({
   /**
    * POST /api/webhooks/agent/checkpoints
    * Create a recoverable checkpoint for an agent run.
@@ -7417,7 +7277,7 @@ var webhookCheckpointsContract = c27.router({
     summary: "Create checkpoint for agent run"
   }
 });
-var webhookCheckpointsPrepareHistoryContract = c27.router({
+var webhookCheckpointsPrepareHistoryContract = c26.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/checkpoints/prepare-history",
@@ -7443,7 +7303,7 @@ var webhookCheckpointsPrepareHistoryContract = c27.router({
     summary: "Get presigned URL for uploading session history to S3"
   }
 });
-var webhookHeartbeatContract = c27.router({
+var webhookHeartbeatContract = c26.router({
   /**
    * POST /api/webhooks/agent/heartbeat
    * Receive heartbeat signals from sandbox
@@ -7467,7 +7327,7 @@ var webhookHeartbeatContract = c27.router({
     summary: "Receive heartbeat from sandbox"
   }
 });
-var webhookStoragesContract = c27.router({
+var webhookStoragesContract = c26.router({
   /**
    * POST /api/webhooks/agent/storages
    * Create a new version of a storage from sandbox
@@ -7483,7 +7343,7 @@ var webhookStoragesContract = c27.router({
     path: "/api/webhooks/agent/storages",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c27.type(),
+    body: c26.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -7499,7 +7359,7 @@ var webhookStoragesContract = c27.router({
     summary: "Upload storage version from sandbox"
   }
 });
-var webhookStoragesIncrementalContract = c27.router({
+var webhookStoragesIncrementalContract = c26.router({
   /**
    * POST /api/webhooks/agent/storages/incremental
    * Create a new version using incremental upload
@@ -7517,7 +7377,7 @@ var webhookStoragesIncrementalContract = c27.router({
     path: "/api/webhooks/agent/storages/incremental",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c27.type(),
+    body: c26.type(),
     responses: {
       200: external_exports.object({
         versionId: external_exports.string(),
@@ -7611,7 +7471,7 @@ var sandboxOperationSchema = external_exports.object({
   session_history_transfer_encoding_state: sessionHistoryTransferEncodingStateSchema.optional(),
   session_history_download_source: sandboxOperationDownloadSourceSchema
 });
-var webhookTelemetryContract = c27.router({
+var webhookTelemetryContract = c26.router({
   /**
    * POST /api/webhooks/agent/telemetry
    * Receive telemetry data (system log, metrics, network logs, and sandbox operations) from sandbox
@@ -7640,7 +7500,7 @@ var webhookTelemetryContract = c27.router({
     summary: "Receive telemetry data from sandbox"
   }
 });
-var webhookStoragesPrepareContract = c27.router({
+var webhookStoragesPrepareContract = c26.router({
   prepare: {
     method: "POST",
     path: "/api/webhooks/agent/storages/prepare",
@@ -7674,7 +7534,7 @@ var webhookStoragesPrepareContract = c27.router({
     summary: "Prepare for direct S3 upload from sandbox"
   }
 });
-var webhookStoragesCommitContract = c27.router({
+var webhookStoragesCommitContract = c26.router({
   commit: {
     method: "POST",
     path: "/api/webhooks/agent/storages/commit",
@@ -7717,7 +7577,7 @@ var webhookUsageEventItemSchema = external_exports.object({
   quantity: external_exports.number().int().min(0),
   grossCredits: external_exports.number().int().min(0).optional()
 }).strict();
-var webhookUsageEventContract = c27.router({
+var webhookUsageEventContract = c26.router({
   send: {
     method: "POST",
     path: "/api/webhooks/agent/usage-event",
@@ -7750,7 +7610,7 @@ var webhookModelUsageObservationItemSchema = external_exports.object({
   category: modelUsageObservationCategorySchema,
   quantity: external_exports.number().int().min(1)
 }).strict();
-var webhookModelUsageObservationContract = c27.router({
+var webhookModelUsageObservationContract = c26.router({
   send: {
     method: "POST",
     path: "/api/webhooks/agent/model-usage-observation",
@@ -7788,7 +7648,7 @@ var zeroRunRequestSchema = unifiedRunRequestSchema.omit({
   agentId: external_exports.string().optional(),
   modelProvider: external_exports.string().optional()
 });
-var c28 = initContract();
+var c27 = initContract();
 var zeroLogPaginationQuerySchema = createLogPaginationQuerySchema({
   cursorKind: "sequence"
 });
@@ -7798,7 +7658,7 @@ var zeroNetworkLogPaginationQuerySchema = createLogPaginationQuerySchema({
   defaultLimit: 500,
   defaultOrder: "asc"
 });
-var zeroRunsMainContract = c28.router({
+var zeroRunsMainContract = c27.router({
   create: {
     method: "POST",
     path: "/api/zero/runs",
@@ -7817,7 +7677,7 @@ var zeroRunsMainContract = c28.router({
     summary: "Create and execute agent run (zero proxy)"
   }
 });
-var zeroRunsByIdContract = c28.router({
+var zeroRunsByIdContract = c27.router({
   getById: {
     method: "GET",
     path: "/api/zero/runs/:id",
@@ -7835,7 +7695,7 @@ var zeroRunsByIdContract = c28.router({
     summary: "Get agent run by ID (zero proxy)"
   }
 });
-var zeroRunsCancelContract = c28.router({
+var zeroRunsCancelContract = c27.router({
   cancel: {
     method: "POST",
     path: "/api/zero/runs/:id/cancel",
@@ -7854,7 +7714,7 @@ var zeroRunsCancelContract = c28.router({
     summary: "Cancel a pending or running run (zero proxy)"
   }
 });
-var zeroRunsQueueContract = c28.router({
+var zeroRunsQueueContract = c27.router({
   getQueue: {
     method: "GET",
     path: "/api/zero/runs/queue",
@@ -7867,7 +7727,7 @@ var zeroRunsQueueContract = c28.router({
     summary: "Get org run queue status (zero proxy)"
   }
 });
-var zeroRunAgentEventsContract = c28.router({
+var zeroRunAgentEventsContract = c27.router({
   getAgentEvents: {
     method: "GET",
     path: "/api/zero/runs/:id/telemetry/agent",
@@ -7931,7 +7791,7 @@ var runContextResponseSchema = external_exports.object({
   artifact: runContextArtifactSchema.nullable(),
   featureFlags: external_exports.record(external_exports.string(), external_exports.boolean()).nullable()
 });
-var zeroRunContextContract = c28.router({
+var zeroRunContextContract = c27.router({
   getContext: {
     method: "GET",
     path: "/api/zero/runs/:id/context",
@@ -7949,7 +7809,7 @@ var zeroRunContextContract = c28.router({
     summary: "Get run execution context snapshot for debugging"
   }
 });
-var zeroRunNetworkLogsContract = c28.router({
+var zeroRunNetworkLogsContract = c27.router({
   getNetworkLogs: {
     method: "GET",
     path: "/api/zero/runs/:id/network",
@@ -7971,7 +7831,7 @@ var zeroRunNetworkLogsContract = c28.router({
 var runRunnerResponseSchema = external_exports.object({
   sandboxReuseResult: sandboxReuseResultSchema.nullable()
 });
-var zeroRunRunnerContract = c28.router({
+var zeroRunRunnerContract = c27.router({
   getRunner: {
     method: "GET",
     path: "/api/zero/runs/:id/runner",
@@ -7989,7 +7849,7 @@ var zeroRunRunnerContract = c28.router({
     summary: "Get runner-level metadata for a run"
   }
 });
-var zeroLogsSearchContract = c28.router({
+var zeroLogsSearchContract = c27.router({
   searchLogs: {
     method: "GET",
     path: "/api/zero/logs/search",
@@ -8085,7 +7945,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-developer-support.ts
 init_esm_shims();
-var c29 = initContract();
+var c28 = initContract();
 var developerSupportBodySchema = external_exports.object({
   title: external_exports.string().min(1, "Title is required"),
   description: external_exports.string().min(1, "Description is required"),
@@ -8097,7 +7957,7 @@ var consentCodeResponseSchema = external_exports.object({
 var submitResponseSchema = external_exports.object({
   reference: external_exports.string()
 });
-var zeroDeveloperSupportContract = c29.router({
+var zeroDeveloperSupportContract = c28.router({
   submit: {
     method: "POST",
     path: "/api/zero/developer-support",
@@ -8293,7 +8153,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-computer-use.ts
 init_esm_shims();
-var c30 = initContract();
+var c29 = initContract();
 var computerUseHostStatusSchema = external_exports.enum(["online", "offline"]);
 var computerUseReadCommandKindSchema = external_exports.enum([
   "apps.list",
@@ -8668,7 +8528,7 @@ var computerUseAuditEventSchema = external_exports.object({
 var computerUseAuditEventListResponseSchema = external_exports.object({
   auditEvents: external_exports.array(computerUseAuditEventSchema)
 });
-var zeroComputerUseHostsContract = c30.router({
+var zeroComputerUseHostsContract = c29.router({
   start: {
     method: "POST",
     path: "/api/zero/computer-use/hosts/start",
@@ -8707,7 +8567,7 @@ var zeroComputerUseHostsContract = c30.router({
     summary: "Delete a desktop computer-use host"
   }
 });
-var zeroComputerUseHeartbeatContract = c30.router({
+var zeroComputerUseHeartbeatContract = c29.router({
   heartbeat: {
     method: "POST",
     path: "/api/zero/computer-use/heartbeat",
@@ -8732,7 +8592,7 @@ var zeroComputerUseHeartbeatContract = c30.router({
     summary: "Stop a desktop computer-use host"
   }
 });
-var zeroComputerUseAuthorizationRequestsContract = c30.router({
+var zeroComputerUseAuthorizationRequestsContract = c29.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/authorization-requests",
@@ -8779,7 +8639,7 @@ var zeroComputerUseAuthorizationRequestsContract = c30.router({
     summary: "Bind a Computer Use host for a delegated authorization request"
   }
 });
-var zeroComputerUseCommandContract = c30.router({
+var zeroComputerUseCommandContract = c29.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/commands",
@@ -8814,7 +8674,7 @@ var zeroComputerUseCommandContract = c30.router({
     headers: authHeadersSchema,
     pathParams: commandIdPathParamsSchema,
     responses: {
-      200: c30.type(),
+      200: c29.type(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -8827,7 +8687,7 @@ var zeroComputerUseCommandContract = c30.router({
     headers: authHeadersSchema,
     pathParams: commandIdPathParamsSchema,
     responses: {
-      200: c30.type(),
+      200: c29.type(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -8835,7 +8695,7 @@ var zeroComputerUseCommandContract = c30.router({
     summary: "Download offloaded desktop computer-use plugin content"
   }
 });
-var zeroComputerUseWriteCommandContract = c30.router({
+var zeroComputerUseWriteCommandContract = c29.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/write-commands",
@@ -8852,7 +8712,7 @@ var zeroComputerUseWriteCommandContract = c30.router({
     summary: "Create a desktop computer-use write command"
   }
 });
-var zeroComputerUsePluginCommandContract = c30.router({
+var zeroComputerUsePluginCommandContract = c29.router({
   create: {
     method: "POST",
     path: "/api/zero/computer-use/plugin-commands",
@@ -8869,7 +8729,7 @@ var zeroComputerUsePluginCommandContract = c30.router({
     summary: "Create a desktop computer-use plugin command"
   }
 });
-var zeroComputerUseHostCommandsContract = c30.router({
+var zeroComputerUseHostCommandsContract = c29.router({
   next: {
     method: "POST",
     path: "/api/zero/computer-use/host/commands/next",
@@ -8897,7 +8757,7 @@ var zeroComputerUseHostCommandsContract = c30.router({
     summary: "Complete a desktop computer-use command"
   }
 });
-var zeroComputerUseAuditEventsContract = c30.router({
+var zeroComputerUseAuditEventsContract = c29.router({
   list: {
     method: "GET",
     path: "/api/zero/computer-use/audit-events",
@@ -9133,7 +8993,7 @@ async function callZeroMaps(operation, body) {
 
 // ../../packages/api-contracts/src/contracts/zero-scrape.ts
 init_esm_shims();
-var c31 = initContract();
+var c30 = initContract();
 var zeroScrapeFormatSchema = external_exports.enum(["markdown", "links"]);
 var zeroScrapeModeSchema = external_exports.enum(["standard", "enhanced"]);
 var zeroScrapeBillingCategorySchema = external_exports.enum([
@@ -9213,7 +9073,7 @@ var scrapeResponses = {
   502: apiErrorSchema,
   503: apiErrorSchema
 };
-var zeroScrapeContract = c31.router({
+var zeroScrapeContract = c30.router({
   scrape: {
     method: "POST",
     path: "/api/zero/scrape",
@@ -9238,7 +9098,7 @@ async function callZeroScrape(body) {
 
 // ../../packages/api-contracts/src/contracts/zero-web-search.ts
 init_esm_shims();
-var c32 = initContract();
+var c31 = initContract();
 var ZERO_WEB_SEARCH_DEFAULT_LIMIT = 5;
 var ZERO_WEB_SEARCH_MAX_LIMIT = 10;
 var ZERO_WEB_SEARCH_MAX_QUERY_CHARS = 2048;
@@ -9305,7 +9165,7 @@ var webSearchResponses = {
   502: apiErrorSchema,
   503: apiErrorSchema
 };
-var zeroWebSearchContract = c32.router({
+var zeroWebSearchContract = c31.router({
   search: {
     method: "POST",
     path: "/api/zero/web-search",
@@ -9393,7 +9253,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/composes.ts
 init_esm_shims();
-var c33 = initContract();
+var c32 = initContract();
 var MOUNT_PATH_TEMPLATE = "${{ working_dir }}";
 var composeVersionQuerySchema = external_exports.string().min(1, "Missing version query parameter").regex(
   /^[a-f0-9]{8,64}$|^latest$/i,
@@ -9513,7 +9373,7 @@ var createComposeResponseSchema = external_exports.object({
   action: external_exports.enum(["created", "existing"]),
   updatedAt: external_exports.string()
 });
-var composesMainContract = c33.router({
+var composesMainContract = c32.router({
   /**
    * GET /api/agent/composes?name={name}&org={org}
    * Get agent compose by name with HEAD version content
@@ -9559,7 +9419,7 @@ var composesMainContract = c33.router({
     summary: "Create or update agent compose version"
   }
 });
-var composesByIdContract = c33.router({
+var composesByIdContract = c32.router({
   /**
    * GET /api/agent/composes/:id
    * Get agent compose by ID with HEAD version content
@@ -9581,7 +9441,7 @@ var composesByIdContract = c33.router({
     summary: "Get agent compose by ID"
   }
 });
-var composesVersionsContract = c33.router({
+var composesVersionsContract = c32.router({
   /**
    * GET /api/agent/composes/versions?composeId={id}&version={hash|tag}
    * Resolve a version specifier to a full version ID
@@ -9735,7 +9595,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/sessions.ts
 init_esm_shims();
-var c34 = initContract();
+var c33 = initContract();
 var sessionResponseSchema = external_exports.object({
   id: external_exports.string(),
   agentComposeId: external_exports.string(),
@@ -9776,7 +9636,7 @@ var checkpointResponseSchema = external_exports.object({
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
   createdAt: external_exports.string()
 });
-var sessionsByIdContract = c34.router({
+var sessionsByIdContract = c33.router({
   /**
    * GET /api/agent/sessions/:id
    * Get session by ID
@@ -9797,7 +9657,7 @@ var sessionsByIdContract = c34.router({
     summary: "Get session by ID"
   }
 });
-var checkpointsByIdContract = c34.router({
+var checkpointsByIdContract = c33.router({
   /**
    * GET /api/agent/checkpoints/:id
    * Get checkpoint by ID
@@ -9950,8 +9810,8 @@ var setVariableRequestSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/zero-secrets.ts
-var c35 = initContract();
-var zeroSecretsContract = c35.router({
+var c34 = initContract();
+var zeroSecretsContract = c34.router({
   list: {
     method: "GET",
     path: "/api/zero/secrets",
@@ -9978,7 +9838,7 @@ var zeroSecretsContract = c35.router({
     summary: "Create or update a secret"
   }
 });
-var zeroSecretsByNameContract = c35.router({
+var zeroSecretsByNameContract = c34.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/secrets/:name",
@@ -9987,7 +9847,7 @@ var zeroSecretsByNameContract = c35.router({
       name: secretNameSchema
     }),
     responses: {
-      204: c35.noBody(),
+      204: c34.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -9995,7 +9855,7 @@ var zeroSecretsByNameContract = c35.router({
     summary: "Delete a secret by name"
   }
 });
-var zeroVariablesContract = c35.router({
+var zeroVariablesContract = c34.router({
   list: {
     method: "GET",
     path: "/api/zero/variables",
@@ -10022,7 +9882,7 @@ var zeroVariablesContract = c35.router({
     summary: "Create or update a variable"
   }
 });
-var zeroVariablesByNameContract = c35.router({
+var zeroVariablesByNameContract = c34.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/variables/:name",
@@ -10031,7 +9891,7 @@ var zeroVariablesByNameContract = c35.router({
       name: variableNameSchema
     }),
     responses: {
-      204: c35.noBody(),
+      204: c34.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -10172,9 +10032,9 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-model-providers.ts
 init_esm_shims();
-var c36 = initContract();
+var c35 = initContract();
 var orgUpsertModelProviderRequestSchema = upsertModelProviderRequestSchema.omit({ selectedModel: true });
-var zeroModelProvidersMainContract = c36.router({
+var zeroModelProvidersMainContract = c35.router({
   list: {
     method: "GET",
     path: "/api/zero/model-providers",
@@ -10203,7 +10063,7 @@ var zeroModelProvidersMainContract = c36.router({
     summary: "Create or update an org-level model provider (admin only)"
   }
 });
-var zeroModelProvidersByTypeContract = c36.router({
+var zeroModelProvidersByTypeContract = c35.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/model-providers/:type",
@@ -10212,7 +10072,7 @@ var zeroModelProvidersByTypeContract = c36.router({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c36.noBody(),
+      204: c35.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -10258,7 +10118,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-workflows.ts
 init_esm_shims();
-var c37 = initContract();
+var c36 = initContract();
 var zeroWorkflowVisibilitySchema = external_exports.enum(["public", "private"]);
 var zeroWorkflowNameSchema = external_exports.string().min(2).max(64).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/);
 var RESERVED_SKILL_FILE = "SKILL.md";
@@ -10901,7 +10761,7 @@ var zeroWorkflowConnectorReadinessResponseSchema = external_exports.object({
   connectors: external_exports.array(zeroWorkflowConnectorReadinessEntrySchema)
 }).strict();
 var workflowIdParams = external_exports.object({ workflowId: external_exports.string().uuid() });
-var zeroWorkflowsCollectionContract = c37.router({
+var zeroWorkflowsCollectionContract = c36.router({
   list: {
     method: "GET",
     path: "/api/zero/workflows",
@@ -10930,7 +10790,7 @@ var zeroWorkflowsCollectionContract = c37.router({
     summary: "Create a workflow under an agent"
   }
 });
-var zeroWorkflowsDetailContract = c37.router({
+var zeroWorkflowsDetailContract = c36.router({
   get: {
     method: "GET",
     path: "/api/zero/workflows/:workflowId",
@@ -10965,9 +10825,9 @@ var zeroWorkflowsDetailContract = c37.router({
     path: "/api/zero/workflows/:workflowId",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c37.noBody(),
+    body: c36.noBody(),
     responses: {
-      204: c37.noBody(),
+      204: c36.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -10995,7 +10855,7 @@ var zeroWorkflowsDetailContract = c37.router({
     path: "/api/zero/workflows/:workflowId/chat-thread",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c37.noBody(),
+    body: c36.noBody(),
     responses: {
       200: zeroWorkflowChatThreadResponseSchema,
       401: apiErrorSchema,
@@ -11009,7 +10869,7 @@ var zeroWorkflowsDetailContract = c37.router({
     path: "/api/zero/workflows/:workflowId/run",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c37.noBody(),
+    body: c36.noBody(),
     responses: {
       200: zeroWorkflowRunResponseSchema,
       401: apiErrorSchema,
@@ -11024,7 +10884,7 @@ var zeroWorkflowsDetailContract = c37.router({
     path: "/api/zero/workflows/:workflowId/connector-readiness",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c37.noBody(),
+    body: c36.noBody(),
     responses: {
       200: zeroWorkflowConnectorReadinessResponseSchema,
       400: apiErrorSchema,
@@ -11037,13 +10897,13 @@ var zeroWorkflowsDetailContract = c37.router({
     summary: "Detect the built-in connectors a workflow may need and report their readiness"
   }
 });
-var zeroWorkflowVisibilityContract = c37.router({
+var zeroWorkflowVisibilityContract = c36.router({
   publish: {
     method: "POST",
     path: "/api/zero/workflows/:workflowId/publish",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c37.noBody(),
+    body: c36.noBody(),
     responses: {
       200: zeroWorkflowSummarySchema,
       400: apiErrorSchema,
@@ -11059,7 +10919,7 @@ var zeroWorkflowVisibilityContract = c37.router({
     path: "/api/zero/workflows/:workflowId/demote",
     headers: authHeadersSchema,
     pathParams: workflowIdParams,
-    body: c37.noBody(),
+    body: c36.noBody(),
     responses: {
       200: zeroWorkflowSummarySchema,
       400: apiErrorSchema,
@@ -11077,7 +10937,7 @@ var zeroWorkflowWebhookSecretResponseSchema = external_exports.object({
   webhookUrl: external_exports.url(),
   webhookSecret: external_exports.string().min(1)
 });
-var zeroWorkflowAutomationsContract = c37.router({
+var zeroWorkflowAutomationsContract = c36.router({
   listWorkspace: {
     method: "GET",
     path: "/api/zero/workflow-automations",
@@ -11166,9 +11026,9 @@ var zeroWorkflowAutomationsContract = c37.router({
     path: "/api/zero/workflow-automations/:id",
     headers: authHeadersSchema,
     pathParams: automationIdParams,
-    body: c37.noBody(),
+    body: c36.noBody(),
     responses: {
-      204: c37.noBody(),
+      204: c36.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -11180,7 +11040,7 @@ var zeroWorkflowAutomationsContract = c37.router({
     path: "/api/zero/workflow-automations/:id/enable",
     headers: authHeadersSchema,
     pathParams: automationIdParams,
-    body: c37.noBody(),
+    body: c36.noBody(),
     responses: {
       200: zeroWorkflowAutomationSummarySchema,
       400: apiErrorSchema,
@@ -11197,7 +11057,7 @@ var zeroWorkflowAutomationsContract = c37.router({
     path: "/api/zero/workflow-automations/:id/disable",
     headers: authHeadersSchema,
     pathParams: automationIdParams,
-    body: c37.noBody(),
+    body: c36.noBody(),
     responses: {
       200: zeroWorkflowAutomationSummarySchema,
       401: apiErrorSchema,
@@ -11211,7 +11071,7 @@ var zeroWorkflowAutomationsContract = c37.router({
     path: "/api/zero/workflow-automations/:id/run",
     headers: authHeadersSchema,
     pathParams: automationIdParams,
-    body: c37.noBody(),
+    body: c36.noBody(),
     responses: {
       201: zeroWorkflowRunResponseSchema,
       400: apiErrorSchema,
@@ -11227,7 +11087,7 @@ var zeroWorkflowAutomationsContract = c37.router({
     path: "/api/zero/workflow-automations/:id/webhook-secret",
     headers: authHeadersSchema,
     pathParams: automationIdParams,
-    body: c37.noBody(),
+    body: c36.noBody(),
     responses: {
       200: zeroWorkflowWebhookSecretResponseSchema,
       401: apiErrorSchema,
@@ -11342,7 +11202,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-mail.ts
 init_esm_shims();
-var c38 = initContract();
+var c37 = initContract();
 var zeroMailProviderSchema = external_exports.enum(["gmail", "outlook"]);
 var zeroMailDraftStatusSchema = external_exports.enum([
   "draft",
@@ -11380,7 +11240,7 @@ var zeroMailDraftResponseSchema = external_exports.object({
 var zeroMailDraftPathParamsSchema = external_exports.object({
   mailDraftId: external_exports.string().uuid()
 });
-var zeroMailContract = c38.router({
+var zeroMailContract = c37.router({
   createDraft: {
     method: "POST",
     path: "/api/zero/mail/drafts",
@@ -11434,7 +11294,7 @@ var zeroMailContract = c38.router({
     path: "/api/zero/mail/drafts/:mailDraftId/cancel",
     headers: authHeadersSchema,
     pathParams: zeroMailDraftPathParamsSchema,
-    body: c38.noBody(),
+    body: c37.noBody(),
     responses: {
       200: zeroMailDraftResponseSchema,
       401: apiErrorSchema,
@@ -11483,7 +11343,7 @@ import { pipeline } from "stream/promises";
 
 // ../../packages/api-contracts/src/contracts/integrations.ts
 init_esm_shims();
-var c39 = initContract();
+var c38 = initContract();
 var sendSlackMessageBodySchema = external_exports.object({
   channel: external_exports.string().min(1, "Channel ID is required").optional(),
   user: external_exports.string().min(1, "User ID is required").optional(),
@@ -11501,7 +11361,7 @@ var sendSlackMessageResponseSchema = external_exports.object({
   ts: external_exports.string().optional(),
   channel: external_exports.string().optional()
 });
-var integrationsSlackMessageContract = c39.router({
+var integrationsSlackMessageContract = c38.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/slack/message",
@@ -11529,7 +11389,7 @@ var sendTelegramMessageResponseSchema = external_exports.object({
   messageId: external_exports.number().int(),
   chatId: external_exports.string()
 });
-var integrationsTelegramMessageContract = c39.router({
+var integrationsTelegramMessageContract = c38.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/telegram/message",
@@ -11588,7 +11448,7 @@ var sendTeamsMessageResponseSchema = external_exports.object({
   activityId: external_exports.string().optional(),
   conversationId: external_exports.string()
 });
-var integrationsTeamsMessageContract = c39.router({
+var integrationsTeamsMessageContract = c38.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/teams/message",
@@ -11616,7 +11476,7 @@ var sendPhoneMessageResponseSchema = external_exports.object({
   channel: external_exports.string().nullable(),
   toNumber: external_exports.string()
 });
-var integrationsPhoneMessageContract = c39.router({
+var integrationsPhoneMessageContract = c38.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/phone/message",
@@ -11636,14 +11496,14 @@ var integrationsPhoneMessageContract = c39.router({
 var phoneDownloadFileQuerySchema = external_exports.object({
   file_id: external_exports.string().min(1, "file_id query parameter is required")
 });
-var integrationsPhoneDownloadFileContract = c39.router({
+var integrationsPhoneDownloadFileContract = c38.router({
   download: {
     method: "GET",
     path: "/api/zero/integrations/phone/download-file",
     headers: authHeadersSchema,
     query: phoneDownloadFileQuerySchema,
     responses: {
-      200: c39.type(),
+      200: c38.type(),
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -11678,7 +11538,7 @@ var telegramBotListItemSchema = external_exports.object({
 var listTelegramBotsResponseSchema = external_exports.object({
   bots: external_exports.array(telegramBotListItemSchema)
 });
-var integrationsTelegramBotListContract = c39.router({
+var integrationsTelegramBotListContract = c38.router({
   listBots: {
     method: "GET",
     path: "/api/zero/integrations/telegram/bots",
@@ -11699,7 +11559,7 @@ var slackUploadInitResponseSchema = external_exports.object({
   uploadUrl: external_exports.string(),
   fileId: external_exports.string()
 });
-var integrationsSlackUploadInitContract = c39.router({
+var integrationsSlackUploadInitContract = c38.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/init",
@@ -11728,7 +11588,7 @@ var telegramUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsTelegramUploadInitContract = c39.router({
+var integrationsTelegramUploadInitContract = c38.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/init",
@@ -11756,7 +11616,7 @@ var teamsUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsTeamsUploadInitContract = c39.router({
+var integrationsTeamsUploadInitContract = c38.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/teams/upload-file/init",
@@ -11788,7 +11648,7 @@ var telegramUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsTelegramUploadCompleteContract = c39.router({
+var integrationsTelegramUploadCompleteContract = c38.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/telegram/upload-file/complete",
@@ -11820,7 +11680,7 @@ var teamsUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsTeamsUploadCompleteContract = c39.router({
+var integrationsTeamsUploadCompleteContract = c38.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/teams/upload-file/complete",
@@ -11850,7 +11710,7 @@ var githubUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsGithubUploadInitContract = c39.router({
+var integrationsGithubUploadInitContract = c38.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/github/upload-file/init",
@@ -11884,7 +11744,7 @@ var githubUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsGithubUploadCompleteContract = c39.router({
+var integrationsGithubUploadCompleteContract = c38.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/github/upload-file/complete",
@@ -11915,7 +11775,7 @@ var phoneUploadInitResponseSchema = external_exports.object({
   contentType: external_exports.string(),
   size: external_exports.number().int().nonnegative()
 });
-var integrationsPhoneUploadInitContract = c39.router({
+var integrationsPhoneUploadInitContract = c38.router({
   init: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/init",
@@ -11946,7 +11806,7 @@ var phoneUploadCompleteResponseSchema = external_exports.object({
   size: external_exports.number().int().nonnegative(),
   url: external_exports.string()
 });
-var integrationsPhoneUploadCompleteContract = c39.router({
+var integrationsPhoneUploadCompleteContract = c38.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/phone/upload-file/complete",
@@ -11974,7 +11834,7 @@ var slackUploadCompleteResponseSchema = external_exports.object({
   fileId: external_exports.string(),
   permalink: external_exports.string()
 });
-var integrationsSlackUploadCompleteContract = c39.router({
+var integrationsSlackUploadCompleteContract = c38.router({
   complete: {
     method: "POST",
     path: "/api/zero/integrations/slack/upload-file/complete",
@@ -12612,7 +12472,6 @@ export {
   guaranteedConnectorProvidedBindingNames,
   UNKNOWN_PERMISSION_GRANT,
   firewallPoliciesSchema,
-  hasUnsafeFirewallPath,
   authHeadersSchema,
   runnerGroupSchema,
   volumeConfigSchema,
@@ -12704,7 +12563,6 @@ export {
   listZeroConnectorCatalogStatus,
   getZeroConnectorCatalogPermissions,
   diagnoseZeroConnectorCheck,
-  diagnoseZeroConnectorPermissionDeny,
   getZeroConnector,
   connectZeroConnectorManualGrant,
   listZeroCustomConnectors,
@@ -12771,4 +12629,4 @@ export {
   completeHostedSite,
   getHostedSiteFiles
 };
-//# sourceMappingURL=chunk-MZDPLIUI.js.map
+//# sourceMappingURL=chunk-SIG5BQU7.js.map