@vm0/cli 9.241.9 → 9.241.10

package/doctor-PGH6KBWK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/commands/zero/doctor/index.ts","../src/commands/zero/doctor/check-connector.ts","../src/commands/zero/doctor/permission-deny.ts","../src/commands/zero/doctor/computer-use-guidance.ts","../src/commands/zero/doctor/permission-change.ts","../src/commands/zero/doctor/credit.ts"],"sourcesContent":["import { Command } from \"commander\";\nimport { checkConnectorCommand } from \"./check-connector\";\nimport { permissionDenyCommand } from \"./permission-deny\";\nimport { permissionChangeCommand } from \"./permission-change\";\nimport { creditCommand } from \"./credit\";\n\nexport const zeroDoctorCommand = new Command()\n  .name(\"doctor\")\n  .description(\"Diagnose runtime issues (connector health, permission denials)\")\n  .addCommand(checkConnectorCommand)\n  .addCommand(creditCommand)\n  .addCommand(permissionDenyCommand)\n  .addCommand(permissionChangeCommand)\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  Check a connector?     zero doctor check-connector --env-name GITHUB_TOKEN\n  Check a URL?           zero doctor check-connector --url https://api.github.com/repos/owner/repo\n  Check credits?         zero doctor credit\n  Check with permission? zero doctor check-connector --env-name SLACK_TOKEN --check-permission chat:write\n  Permission denied?     zero doctor permission-deny github --method GET --url https://api.github.com/repos/owner/repo\n  Change a permission?   zero doctor permission-change github --permission contents:read --enable --duration 1h\n  Disable unknown URLs?  zero doctor permission-change cloudflare --permission __unknown__ --disable\n\nNotes:\n  - Use zero doctor credit when a run or generation fails because the org has insufficient credits, when a user asks how to recharge, or before trying to buy credits\n  - Use this when your task fails due to a missing connector environment name or permission denial\n  - Use zero generate <type> (no --prompt) to see every provider available for a given generation type\n  - The doctor will identify the issue and give the user a link to resolve it`,\n  );\n","import { Command, Option } from \"commander\";\nimport type { ConnectorCatalogRef } from \"@vm0/api-contracts/contracts/connector-identity\";\nimport type {\n  ConnectorCheckDiagnosticResult,\n  ConnectorCheckPolicy,\n  ConnectorCheckRequest,\n} from \"@vm0/api-contracts/contracts/zero-connector-check\";\n\nimport { getApiUrl } from \"../../../lib/api/config\";\nimport {\n  diagnoseZeroConnectorCheck,\n  getZeroConnector,\n} from \"../../../lib/api/domains/zero-connectors\";\nimport { getZeroAgentUserConnectors } from \"../../../lib/api/domains/zero-agents\";\nimport { withErrorHandler } from \"../../../lib/command\";\nimport { toPlatformUrl } from \"./platform-url\";\n\ninterface CheckConnectorOptions {\n  readonly connector?: string;\n  readonly envName?: string;\n  readonly url?: string;\n  readonly method: string;\n  readonly checkPermission?: string;\n}\n\ntype ValidatedCheckConnectorOptions = CheckConnectorOptions &\n  (\n    | { readonly url: string }\n    | { readonly url?: undefined; readonly envName: string }\n  );\n\ntype ResolvedDiagnostic = Extract<\n  ConnectorCheckDiagnosticResult,\n  { readonly outcome: \"resolved\" }\n>;\ntype ResolvedUrlDiagnostic = Extract<\n  ResolvedDiagnostic,\n  { readonly mode: \"url\" }\n>;\ntype ResolvedEnvironmentDiagnostic = Extract<\n  ResolvedDiagnostic,\n  { readonly mode: \"environment\" }\n>;\ntype UrlDiagnosticRequest = Extract<\n  ConnectorCheckRequest,\n  { readonly mode: \"url\" }\n>;\n\ninterface DiagContext {\n  readonly environmentNames: readonly string[] | null;\n  readonly connectorRef: ConnectorCatalogRef;\n  readonly label: string;\n  readonly connectorAvailable: boolean;\n  readonly credentialResolution: \"network-boundary\" | \"none\";\n  readonly run: ResolvedDiagnostic[\"run\"];\n  readonly platformOrigin: string;\n  readonly agentId: string | undefined;\n}\n\nfunction stripUrlQueryAndFragment(url: string): string {\n  const queryIndex = url.indexOf(\"?\");\n  const fragmentIndex = url.indexOf(\"#\");\n  let end = url.length;\n  if (queryIndex !== -1) end = Math.min(end, queryIndex);\n  if (fragmentIndex !== -1) end = Math.min(end, fragmentIndex);\n  return url.slice(0, end);\n}\n\nfunction rawUrlAuthorityHasUserinfo(url: string): boolean {\n  const schemeEnd = url.indexOf(\"://\");\n  if (schemeEnd === -1) return false;\n\n  const authorityStart = schemeEnd + 3;\n  let authorityEnd = url.length;\n  for (const delimiter of [\"/\", \"?\", \"#\"]) {\n    const delimiterIndex = url.indexOf(delimiter, authorityStart);\n    if (delimiterIndex !== -1) {\n      authorityEnd = Math.min(authorityEnd, delimiterIndex);\n    }\n  }\n  return url.slice(authorityStart, authorityEnd).includes(\"@\");\n}\n\nfunction shellQuoteArg(value: string): string {\n  return `'${value.replaceAll(\"'\", \"'\\\\''\")}'`;\n}\n\nfunction connectorSelectionCommand(\n  url: string,\n  method: string,\n  connectorRef: string,\n): string {\n  const args = [\n    `--url ${shellQuoteArg(url)}`,\n    `--connector ${shellQuoteArg(connectorRef)}`,\n  ];\n  if (method !== \"GET\") {\n    args.push(`--method ${shellQuoteArg(method)}`);\n  }\n  return `zero doctor check-connector ${args.join(\" \")}`;\n}\n\nfunction validateCheckConnectorOptions(\n  opts: CheckConnectorOptions,\n  command: Command,\n): asserts opts is ValidatedCheckConnectorOptions {\n  const hasUrl = opts.url !== undefined;\n  // Reject embedded credentials before the diagnostic request leaves the client.\n  if (opts.url !== undefined && rawUrlAuthorityHasUserinfo(opts.url)) {\n    throw unsafeInputError(\"invalid-url\");\n  }\n  if (opts.connector !== undefined && !hasUrl) {\n    throw new Error(\n      \"--connector can only be used with --url. Add --url <URL> or remove --connector.\",\n    );\n  }\n  if (opts.checkPermission !== undefined && hasUrl) {\n    throw new Error(\n      \"--check-permission cannot be used with --url because the permission is derived from the request. Remove --check-permission.\",\n    );\n  }\n  if (opts.checkPermission?.trim() === \"\") {\n    throw new Error(\"--check-permission requires a non-empty permission name.\");\n  }\n  if (!hasUrl && command.getOptionValueSource(\"method\") === \"cli\") {\n    throw new Error(\n      \"--method can only be used with --url. Add --url <URL> or remove --method.\",\n    );\n  }\n  if (opts.envName === undefined && !hasUrl) {\n    throw new Error(\n      \"Either --env-name or --url is required. Use --help for usage.\",\n    );\n  }\n}\n\nfunction buildDiagnosticRequest(\n  opts: ValidatedCheckConnectorOptions,\n  method: string,\n): ConnectorCheckRequest {\n  if (opts.url !== undefined) {\n    return {\n      mode: \"url\",\n      method,\n      url: stripUrlQueryAndFragment(opts.url),\n      ...(opts.connector !== undefined ? { connectorRef: opts.connector } : {}),\n      ...(opts.envName !== undefined ? { environmentName: opts.envName } : {}),\n    };\n  }\n\n  return {\n    mode: \"environment\",\n    environmentName: opts.envName,\n    ...(opts.checkPermission !== undefined\n      ? { permission: opts.checkPermission }\n      : {}),\n  };\n}\n\nfunction requireUrlRequest(\n  request: ConnectorCheckRequest,\n): UrlDiagnosticRequest {\n  if (request.mode !== \"url\") {\n    throw new Error(\n      \"Connector diagnostic returned a URL-only outcome for an environment request.\",\n    );\n  }\n  return request;\n}\n\nfunction requestedEnvironmentName(request: ConnectorCheckRequest): string {\n  if (request.environmentName === undefined) {\n    throw new Error(\n      \"Connector diagnostic returned an environment outcome without an environment name.\",\n    );\n  }\n  return request.environmentName;\n}\n\nfunction unsafeInputError(\n  reason: Extract<\n    ConnectorCheckDiagnosticResult,\n    { readonly outcome: \"unsafe-input\" }\n  >[\"reason\"],\n): Error {\n  switch (reason) {\n    case \"invalid-method\":\n      return new Error(\n        \"check-connector requires --method to be a supported HTTP method.\",\n      );\n    case \"invalid-url\":\n      return new Error(\n        \"check-connector requires --url to be a valid absolute http or https URL.\",\n      );\n    case \"unsafe-path\":\n      return new Error(\n        \"check-connector cannot diagnose unsafe URL paths because they are blocked before permission policy evaluation.\",\n      );\n  }\n}\n\nfunction ambiguousConnectorError(\n  request: UrlDiagnosticRequest,\n  result: Extract<\n    ConnectorCheckDiagnosticResult,\n    { readonly outcome: \"ambiguous\" }\n  >,\n): Error {\n  const candidates = [...result.candidates].sort((left, right) => {\n    return left.connectorRef.localeCompare(right.connectorRef);\n  });\n  const commands = candidates.map((candidate) => {\n    return `  ${connectorSelectionCommand(request.url, request.method, candidate.connectorRef)}`;\n  });\n  return new Error(\n    `Multiple connectors match ${request.method} ${request.url}: ${candidates\n      .map((candidate) => {\n        return candidate.connectorRef;\n      })\n      .join(\", \")}\\nSelect one explicitly:\\n${commands.join(\"\\n\")}`,\n  );\n}\n\nfunction unknownConnectorError(request: ConnectorCheckRequest): Error {\n  if (request.mode === \"url\" && request.connectorRef !== undefined) {\n    return new Error(\n      `Unknown connector type: ${request.connectorRef}\\nRun: zero connector search ${shellQuoteArg(request.connectorRef)}`,\n    );\n  }\n  return new Error(\"The requested connector is unknown.\");\n}\n\nfunction noMatchError(\n  result: Extract<\n    ConnectorCheckDiagnosticResult,\n    { readonly outcome: \"no-match\" }\n  >,\n): Error {\n  return new Error(\n    result.scope === \"run\"\n      ? \"No connector found for provided URL — no connector configured for the current run matches this URL\"\n      : \"No connector found for provided URL — no registered connector base URL matches this URL\",\n  );\n}\n\nfunction connectorMismatchError(\n  request: UrlDiagnosticRequest,\n  result: Extract<\n    ConnectorCheckDiagnosticResult,\n    { readonly outcome: \"connector-mismatch\" }\n  >,\n): Error {\n  const requestedRef = request.connectorRef ?? \"the requested connector\";\n  return new Error(\n    `Connector ${requestedRef} does not own ${request.method} ${request.url}; the matching connector is ${result.connector.connectorRef}\\nRun: ${connectorSelectionCommand(request.url, request.method, result.connector.connectorRef)}`,\n  );\n}\n\nfunction environmentNotOwnedError(\n  request: ConnectorCheckRequest,\n  result: Extract<\n    ConnectorCheckDiagnosticResult,\n    { readonly outcome: \"environment-not-owned\" }\n  >,\n): Error {\n  const environmentName = requestedEnvironmentName(request);\n  return new Error(\n    `${environmentName} is not an environment name for the ${result.connector.label} connector. Remove --env-name to use the matched route metadata.`,\n  );\n}\n\nfunction environmentNotUsedError(\n  request: ConnectorCheckRequest,\n  result: Extract<\n    ConnectorCheckDiagnosticResult,\n    { readonly outcome: \"environment-not-used\" }\n  >,\n): Error {\n  const environmentName = requestedEnvironmentName(request);\n  return new Error(\n    `${environmentName} is not used by the matched API route. Expected one of: ${result.environmentNames.join(\", \") || \"none\"}. Remove --env-name to use the matched route metadata.`,\n  );\n}\n\nfunction resolvedDiagnostic(\n  request: ConnectorCheckRequest,\n  result: ConnectorCheckDiagnosticResult,\n): ResolvedDiagnostic {\n  switch (result.outcome) {\n    case \"resolved\":\n      return result;\n    case \"unsafe-input\":\n      throw unsafeInputError(result.reason);\n    case \"unknown-connector\":\n      throw unknownConnectorError(request);\n    case \"unknown-environment\":\n      throw new Error(\n        `Unknown environment name: ${requestedEnvironmentName(request)} — not managed by any connector`,\n      );\n    case \"no-match\":\n      throw noMatchError(result);\n    case \"ambiguous\":\n      throw ambiguousConnectorError(requireUrlRequest(request), result);\n    case \"connector-mismatch\":\n      throw connectorMismatchError(requireUrlRequest(request), result);\n    case \"environment-not-owned\":\n      throw environmentNotOwnedError(request, result);\n    case \"environment-not-used\":\n      throw environmentNotUsedError(request, result);\n    case \"unresolved-dynamic-base\":\n      throw new Error(\n        `No authoritative ${result.connector.label} base URL is available for this diagnostic. Verify the ${result.connector.connectorRef} connector configuration for the affected context and retry.`,\n      );\n    case \"run-context-unavailable\":\n      throw new Error(\n        \"The current run context is unavailable for connector diagnosis. Retry from an active run or start a new run.\",\n      );\n  }\n}\n\nfunction printDiagnosticSummary(\n  request: ConnectorCheckRequest,\n  result: ResolvedDiagnostic,\n): void {\n  if (result.mode === \"url\") {\n    const urlRequest = requireUrlRequest(request);\n    console.log(\n      `URL ${urlRequest.url} matches the ${result.connector.label} connector (type: ${result.connector.connectorRef}).`,\n    );\n    console.log(`  Matched base URL: ${result.base}`);\n    console.log(`  Relative path:    ${result.relativePath}`);\n    if (result.environmentNames === null) {\n      console.log(\"  Environment names: unavailable\");\n    } else {\n      console.log(\n        `  Environment names: [${result.environmentNames.join(\", \")}]`,\n      );\n    }\n    return;\n  }\n\n  console.log(\n    `${result.environmentName} is managed by the ${result.connector.label} connector (type: ${result.connector.connectorRef}).`,\n  );\n}\n\nfunction diagnosticEnvironmentNames(\n  result: ResolvedDiagnostic,\n): readonly string[] | null {\n  return result.mode === \"url\"\n    ? result.environmentNames\n    : [result.environmentName];\n}\n\nfunction printConnectorConnectionStatus(\n  ctx: DiagContext,\n  isConnected: boolean,\n  isExpired: boolean,\n  hasPermission: boolean,\n): void {\n  console.log(\n    \"### 2a: Connector status (user must configure via OAuth login or API key)\",\n  );\n  console.log(\"\");\n  if (!ctx.connectorAvailable) {\n    console.log(\n      `The ${ctx.label} connector is not available for this account.`,\n    );\n  } else if (!isConnected) {\n    console.log(`The ${ctx.label} connector is not connected.`);\n    if (ctx.agentId && hasPermission) {\n      const connectUrl = `${ctx.platformOrigin}/connectors/${ctx.connectorRef}/connect?agentId=${ctx.agentId}`;\n      console.log(`Connect it at: [Connect ${ctx.label}](${connectUrl})`);\n    } else if (!ctx.agentId) {\n      const connectUrl = `${ctx.platformOrigin}/connectors/${ctx.connectorRef}/connect`;\n      console.log(`Connect it at: [Connect ${ctx.label}](${connectUrl})`);\n    }\n  } else if (isExpired) {\n    const url = `${ctx.platformOrigin}/connectors`;\n    console.log(\n      `The ${ctx.label} connector is connected but has expired and needs to be reconnected.`,\n    );\n    console.log(`Reconnect it at: [Reconnect ${ctx.label}](${url})`);\n  } else {\n    console.log(`The ${ctx.label} connector is connected and active.`);\n  }\n  console.log(\"\");\n}\n\nfunction printAgentAuthorizationStatus(\n  ctx: DiagContext,\n  isConnected: boolean,\n  isExpired: boolean,\n  hasPermission: boolean,\n): void {\n  if (!ctx.agentId) {\n    console.log(\"ZERO_AGENT_ID is not set — cannot check agent authorization.\");\n  } else if (isExpired) {\n    console.log(\n      `Skipped — agent authorization can only be checked once the ${ctx.label} connector is reconnected (see 2a).`,\n    );\n  } else if (hasPermission) {\n    console.log(\n      isConnected\n        ? `The ${ctx.label} connector is authorized for this agent.`\n        : `The ${ctx.label} connector is authorized for this agent, but it is not connected.`,\n    );\n  } else {\n    const url = `${ctx.platformOrigin}/connectors/${ctx.connectorRef}/authorize?agentId=${ctx.agentId}`;\n    console.log(\n      isConnected\n        ? `The ${ctx.label} connector is not authorized for this agent (${ctx.agentId}).`\n        : `The ${ctx.label} connector needs to be connected and authorized for this agent (${ctx.agentId}).`,\n    );\n    console.log(`Authorize it at: [Authorize ${ctx.label}](${url})`);\n  }\n}\n\nfunction printConnectorAuthorizationStatus(\n  ctx: DiagContext,\n  isConnected: boolean,\n  isExpired: boolean,\n  hasPermission: boolean,\n): void {\n  console.log(\n    \"### 2b: Agent authorization (user must authorize agent to use this connector)\",\n  );\n  console.log(\"\");\n  if (!ctx.connectorAvailable) {\n    console.log(\n      `Skipped — the ${ctx.label} connector is not available for this account.`,\n    );\n  } else {\n    printAgentAuthorizationStatus(ctx, isConnected, isExpired, hasPermission);\n  }\n  console.log(\n    `This run uses agent-scoped connector authorization for ${ctx.label} access.`,\n  );\n  console.log(\"\");\n}\n\nfunction checkEnvironmentNames(ctx: DiagContext): void {\n  console.log(\"## Step 1: Sandbox environment name\");\n  console.log(\"\");\n  if (ctx.environmentNames === null) {\n    console.log(\n      \"Environment metadata is unavailable for this run's sanitized firewall entry, so no environment name was guessed.\",\n    );\n    console.log(\"\");\n    return;\n  }\n  if (ctx.environmentNames.length === 0) {\n    console.log(\n      \"The matched API route does not use a sandbox environment name.\",\n    );\n    console.log(\"\");\n    return;\n  }\n\n  let environmentPresent = false;\n  for (const environmentName of ctx.environmentNames) {\n    const present = Boolean(process.env[environmentName]);\n    environmentPresent ||= present;\n    console.log(\n      `Checking process.env.${environmentName}: ${present ? \"present\" : \"not present\"}`,\n    );\n  }\n  if (environmentPresent) {\n    console.log(\n      \"At least one connector value is present in the sandbox environment. These values may be non-secret connector settings or credential placeholders; real credentials are never injected and are resolved at the network boundary for registered base URLs.\",\n    );\n  } else {\n    console.log(\n      \"No value found for these environment names. Note: credential replacement at the network boundary is independent of these names — the proxy injects auth headers based on the destination URL.\",\n    );\n  }\n  console.log(\"\");\n}\n\nasync function checkConnectorStatus(ctx: DiagContext): Promise<{\n  readonly isConnected: boolean;\n  readonly isExpired: boolean;\n  readonly hasPermission: boolean;\n}> {\n  console.log(\"## Step 2: Connector configuration\");\n  console.log(\"\");\n  console.log(\n    \"A Connector holds the real credentials (OAuth tokens or API keys) for an external service. These credentials are never injected into the sandbox. Instead, when the sandbox sends an HTTP request to a base URL registered by the Connector, the network boundary intercepts the request and replaces the auth headers with real credentials. For this to work, three conditions must be met:\",\n  );\n  console.log(\"\");\n\n  const [connector, enabledTypes] = await Promise.all([\n    getZeroConnector(ctx.connectorRef),\n    ctx.agentId\n      ? getZeroAgentUserConnectors(ctx.agentId)\n      : Promise.resolve(null),\n  ]);\n\n  const isConnected = connector !== null;\n  const isExpired = connector?.connectionStatus === \"reconnect-required\";\n  const hasPermission =\n    enabledTypes !== null && enabledTypes.includes(ctx.connectorRef);\n\n  printConnectorConnectionStatus(ctx, isConnected, isExpired, hasPermission);\n  printConnectorAuthorizationStatus(ctx, isConnected, isExpired, hasPermission);\n\n  return { isConnected, isExpired, hasPermission };\n}\n\nfunction checkConnectorDomains(ctx: DiagContext): boolean | null {\n  console.log(\n    \"### 2c: Registered base URLs (credential replacement only applies to URLs matching these prefixes)\",\n  );\n  console.log(\"\");\n\n  switch (ctx.run.status) {\n    case \"not-scoped\":\n      console.log(\n        \"This diagnostic is not scoped to a run — skipping the run base URL check.\",\n      );\n      console.log(\"\");\n      return null;\n    case \"not-configured\":\n      console.log(\n        `No configuration found for the ${ctx.label} connector in this run.`,\n      );\n      console.log(\n        \"This means no base URLs are registered for credential replacement for this connector.\",\n      );\n      console.log(\"\");\n      return false;\n    case \"configured\":\n      console.log(\n        `The ${ctx.label} connector is configured for this run with the following base URLs:`,\n      );\n      for (const base of ctx.run.bases) {\n        console.log(`  - ${base}`);\n      }\n      console.log(\"\");\n      if (ctx.credentialResolution === \"network-boundary\") {\n        console.log(\n          \"Credentials are resolved at the network boundary for requests matching these registered base URLs.\",\n        );\n      }\n      console.log(\"\");\n      return true;\n  }\n}\n\nfunction printUnavailablePolicy(\n  policy: Extract<\n    ConnectorCheckPolicy,\n    {\n      readonly outcome: \"unavailable\";\n    }\n  >,\n): void {\n  switch (policy.basis) {\n    case \"not-run-scoped\":\n      console.log(\n        \"Result: Permission policy is unavailable because this diagnostic is not scoped to a run.\",\n      );\n      return;\n    case \"policies-unavailable\":\n      console.log(\n        \"Result: Network policies are unavailable for this run, so the permission status cannot be determined.\",\n      );\n      return;\n    case \"connector-not-configured\":\n      console.log(\n        \"Result: The connector is not configured for this run, so requests cannot receive credentials.\",\n      );\n      return;\n  }\n}\n\nfunction printNamedPolicyResult(\n  permission: string,\n  policy: ConnectorCheckPolicy,\n): void {\n  switch (policy.outcome) {\n    case \"allow\": {\n      switch (policy.basis) {\n        case \"allow-list\":\n          console.log(\n            `Result: \"${permission}\" is in the allow list — allowed.`,\n          );\n          return;\n        case \"not-blocked\":\n          console.log(\n            `Result: \"${permission}\" is not blocked by the deny or ask list — allowed.`,\n          );\n          return;\n        case \"no-policy\":\n          console.log(\n            `Result: No policy entry exists for this connector — \"${permission}\" is allowed.`,\n          );\n          return;\n        case \"unknown-policy\":\n          console.log(\n            `Result: The server policy allows \"${permission}\" through the unknown-endpoint policy.`,\n          );\n          return;\n      }\n      break;\n    }\n    case \"deny\":\n      console.log(\n        policy.basis === \"deny-list\"\n          ? `Result: \"${permission}\" is in the deny list — denied.`\n          : `Result: The unknown-endpoint policy denies \"${permission}\".`,\n      );\n      return;\n    case \"ask\":\n      console.log(\n        policy.basis === \"ask-list\"\n          ? `Result: \"${permission}\" is in the ask list — blocked until approval.`\n          : `Result: The unknown-endpoint policy blocks \"${permission}\" until approval.`,\n      );\n      return;\n    case \"unavailable\":\n      printUnavailablePolicy(policy);\n      return;\n  }\n}\n\nfunction unknownPermissionChangeCommand(connectorRef: string): string {\n  return `zero doctor permission-change ${connectorRef} --permission __unknown__ --enable --duration 1h`;\n}\n\nfunction printUnknownEndpointPolicy(\n  connectorRef: string,\n  policy: ConnectorCheckPolicy,\n): void {\n  switch (policy.outcome) {\n    case \"allow\":\n      console.log(\n        policy.basis === \"no-policy\"\n          ? \"Result: No policy entry exists for this connector, so the request is allowed.\"\n          : \"Result: No permission matched. The unknown endpoint policy allows this request.\",\n      );\n      return;\n    case \"deny\":\n      console.log(\n        \"Result: No permission matched. The unknown endpoint policy denies this request.\",\n      );\n      console.log(\n        `To allow unknown endpoints, run: ${unknownPermissionChangeCommand(connectorRef)}`,\n      );\n      return;\n    case \"ask\":\n      console.log(\n        \"Result: No permission matched. The unknown endpoint policy requires approval.\",\n      );\n      console.log(\n        `To allow unknown endpoints, run: ${unknownPermissionChangeCommand(connectorRef)}`,\n      );\n      return;\n    case \"unavailable\":\n      printUnavailablePolicy(policy);\n      return;\n  }\n}\n\nfunction printUrlPermissionDiagnostic(result: ResolvedUrlDiagnostic): void {\n  console.log(\"## Step 3: Permission policy check (auto-detected from URL)\");\n  console.log(\"\");\n  console.log(\n    `Matching ${result.method} ${result.relativePath} (relative to base URL ${result.base}) against the ${result.connector.label} connector's permission rules.`,\n  );\n  console.log(\"\");\n\n  if (result.permission.kind === \"matched\") {\n    console.log(\n      `Matched permissions: [${result.permission.permissions\n        .map((permission) => {\n          return permission.name;\n        })\n        .join(\", \")}]`,\n    );\n    console.log(\"\");\n    for (const permission of result.permission.permissions) {\n      printNamedPolicyResult(permission.name, permission.policy);\n    }\n  } else {\n    console.log(\n      `No named permission matches ${result.method} ${result.relativePath}. This request falls through to the unknown-endpoint policy.`,\n    );\n    console.log(\"\");\n    printUnknownEndpointPolicy(\n      result.connector.connectorRef,\n      result.permission.policy,\n    );\n  }\n  console.log(\"\");\n}\n\nfunction printEnvironmentPermissionDiagnostic(\n  result: ResolvedEnvironmentDiagnostic,\n  permissionName: string | undefined,\n): void {\n  if (result.permission === null) {\n    return;\n  }\n  if (permissionName === undefined) {\n    throw new Error(\n      \"Connector diagnostic returned a permission outcome without a requested permission.\",\n    );\n  }\n  console.log(\"## Step 3: Permission policy check\");\n  console.log(\"\");\n  console.log(\n    `Checking permission: \"${permissionName}\" for the ${result.connector.label} connector.`,\n  );\n  console.log(\"\");\n  printNamedPolicyResult(permissionName, result.permission);\n  console.log(\"\");\n}\n\nfunction printRediagnoseHint(\n  opts: CheckConnectorOptions,\n  method: string,\n): void {\n  const args: string[] = [];\n  if (opts.url !== undefined) {\n    args.push(`--url ${shellQuoteArg(stripUrlQueryAndFragment(opts.url))}`);\n    if (opts.connector !== undefined) {\n      args.push(`--connector ${shellQuoteArg(opts.connector)}`);\n    }\n    if (opts.envName !== undefined) {\n      args.push(`--env-name ${shellQuoteArg(opts.envName)}`);\n    }\n    if (method !== \"GET\") {\n      args.push(`--method ${shellQuoteArg(method)}`);\n    }\n  } else if (opts.envName !== undefined) {\n    args.push(`--env-name ${shellQuoteArg(opts.envName)}`);\n  }\n  if (opts.checkPermission !== undefined) {\n    args.push(`--check-permission ${shellQuoteArg(opts.checkPermission)}`);\n  }\n  console.log(\n    `To re-diagnose after changes, run: zero doctor check-connector ${args.join(\" \")}`,\n  );\n}\n\nexport const checkConnectorCommand = new Command()\n  .name(\"check-connector\")\n  .description(\n    \"Diagnose connector health: environment names, connector configuration, and permission policies\",\n  )\n  .addOption(\n    new Option(\n      \"--env-name <ENV_NAME>\",\n      \"The connector environment name to check (e.g. GITHUB_TOKEN)\",\n    ),\n  )\n  .addOption(\n    new Option(\n      \"--url <URL>\",\n      \"A full URL to diagnose — matches connector ownership, route environment names, and permission (e.g. https://api.github.com/repos/owner/repo)\",\n    ),\n  )\n  .addOption(\n    new Option(\n      \"--connector <type>\",\n      \"Select the connector when multiple connectors own the same URL route\",\n    ),\n  )\n  .addOption(\n    new Option(\n      \"--method <METHOD>\",\n      \"HTTP method to use when matching permissions with --url (default: GET)\",\n    ).default(\"GET\"),\n  )\n  .addOption(\n    new Option(\n      \"--check-permission <name>\",\n      \"Check whether a specific permission is allowed or denied (e.g. contents:read)\",\n    ),\n  )\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  zero doctor check-connector --env-name GITHUB_TOKEN\n  zero doctor check-connector --url https://api.github.com/repos/owner/repo\n  zero doctor check-connector --url https://api.accounts.nintendo.com/2.0.0/users/me --connector nintendo-store\n  zero doctor check-connector --url https://slack.com/api/chat.postMessage --method POST\n  zero doctor check-connector --env-name SLACK_TOKEN --check-permission chat:write\n\nHow connectors work:\n  A Connector holds the real credentials for an external service. These credentials\n  are never injected into the sandbox. Instead, when the sandbox sends an HTTP\n  request to a base URL registered by the Connector, the network boundary intercepts\n  the request and replaces the auth headers with real credentials.\n\n  This command checks each part of that pipeline and reports what it finds.`,\n  )\n  .action(\n    withErrorHandler(async (opts: CheckConnectorOptions, command: Command) => {\n      validateCheckConnectorOptions(opts, command);\n      const method = opts.method.toUpperCase();\n      const request = buildDiagnosticRequest(opts, method);\n      const diagnostic = await diagnoseZeroConnectorCheck(request);\n      const result = resolvedDiagnostic(request, diagnostic);\n\n      printDiagnosticSummary(request, result);\n      console.log(\"\");\n\n      const platformUrl = toPlatformUrl(await getApiUrl());\n      const ctx: DiagContext = {\n        environmentNames: diagnosticEnvironmentNames(result),\n        connectorRef: result.connector.connectorRef,\n        label: result.connector.label,\n        connectorAvailable: result.connector.visibility === \"available\",\n        credentialResolution: result.connector.credentialResolution,\n        run: result.run,\n        platformOrigin: platformUrl.origin,\n        agentId: process.env.ZERO_AGENT_ID || undefined,\n      };\n\n      checkEnvironmentNames(ctx);\n      const { isConnected, isExpired, hasPermission } =\n        await checkConnectorStatus(ctx);\n      const configuredForRun = checkConnectorDomains(ctx);\n\n      if (configuredForRun === false) {\n        console.log(\n          `Steps 1-2 summary: The ${ctx.label} connector is not configured for this run. Check the agent authorization settings, then start a new run after updating them.`,\n        );\n      } else if (isConnected && !isExpired && hasPermission) {\n        console.log(\n          `Steps 1-2 summary: The ${ctx.label} connector is connected, active, and authorized. Outbound requests to the registered base URLs will have credentials injected at the network boundary.`,\n        );\n      }\n      console.log(\"\");\n\n      if (result.mode === \"url\") {\n        printUrlPermissionDiagnostic(result);\n      } else {\n        printEnvironmentPermissionDiagnostic(\n          result,\n          request.mode === \"environment\" ? request.permission : undefined,\n        );\n      }\n\n      printRediagnoseHint(opts, method);\n    }),\n  );\n","import { Command, Option } from \"commander\";\nimport type { ConnectorPermissionDenyDiagnosticResult } from \"@vm0/api-contracts/contracts/zero-connector-permission-deny\";\nimport {\n  hasUnsafeFirewallPath,\n  UNKNOWN_PERMISSION_GRANT,\n} from \"@vm0/connectors/firewall-types\";\nimport { diagnoseZeroConnectorPermissionDeny } from \"../../../lib/api\";\nimport { withErrorHandler } from \"../../../lib/command\";\nimport {\n  isComputerUsePermissionTarget,\n  printComputerUsePermissionGuidance,\n} from \"./computer-use-guidance\";\n\ninterface PermissionDenyOptions {\n  readonly method: string;\n  readonly url?: string;\n  readonly path?: string;\n}\n\ntype UnsafeInputReason = Extract<\n  ConnectorPermissionDenyDiagnosticResult,\n  { readonly outcome: \"unsafe-input\" }\n>[\"reason\"];\n\nconst VALID_DENIED_METHODS = new Set([\n  \"GET\",\n  \"POST\",\n  \"PUT\",\n  \"PATCH\",\n  \"DELETE\",\n  \"HEAD\",\n  \"OPTIONS\",\n]);\n\nfunction unknownPermissionChangeCommand(connectorRef: string): string {\n  return `zero doctor permission-change ${connectorRef} --permission ${UNKNOWN_PERMISSION_GRANT} --enable --duration 1h`;\n}\n\nfunction pathOnlyError(): Error {\n  return new Error(\n    \"permission-deny now requires --url because method/path alone can match the wrong API base.\",\n  );\n}\n\nfunction invalidUrlError(): Error {\n  return new Error(\n    \"permission-deny requires --url to be a valid absolute http or https URL.\",\n  );\n}\n\nfunction invalidMethodError(): Error {\n  return new Error(\n    \"permission-deny requires --method to be one of GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS.\",\n  );\n}\n\nfunction unsafePathError(): Error {\n  return new Error(\n    \"permission-deny cannot diagnose unsafe URL paths because they are blocked before permission policy evaluation.\",\n  );\n}\n\nfunction parseDeniedMethod(method: string): string {\n  const upperMethod = method.toUpperCase();\n  if (!VALID_DENIED_METHODS.has(upperMethod)) {\n    throw invalidMethodError();\n  }\n  return upperMethod;\n}\n\nfunction rawAuthorityFromDeniedUrl(url: string): string | null {\n  const schemeEnd = url.indexOf(\"://\");\n  if (schemeEnd === -1) return null;\n\n  const authorityStart = schemeEnd + 3;\n  let authorityEnd = url.length;\n  for (const delimiter of [\"/\", \"?\", \"#\"]) {\n    const index = url.indexOf(delimiter, authorityStart);\n    if (index !== -1) authorityEnd = Math.min(authorityEnd, index);\n  }\n  return url.slice(authorityStart, authorityEnd);\n}\n\nfunction rawAuthorityHasUnsafeSyntax(url: string): boolean {\n  const authority = rawAuthorityFromDeniedUrl(url);\n  if (authority === null) return false;\n  return (\n    authority === \"\" ||\n    authority.includes(\"\\\\\") ||\n    authority.includes(\"%\") ||\n    [...authority].some((char) => {\n      return char.charCodeAt(0) > 0x7f;\n    })\n  );\n}\n\nfunction validateDeniedUrl(url: string): void {\n  if (\n    !url.includes(\"://\") ||\n    /\\s/.test(url) ||\n    rawAuthorityHasUnsafeSyntax(url)\n  ) {\n    throw invalidUrlError();\n  }\n\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n      throw invalidUrlError();\n    }\n    if (parsed.username !== \"\" || parsed.password !== \"\") {\n      throw invalidUrlError();\n    }\n  } catch {\n    throw invalidUrlError();\n  }\n}\n\nfunction stripUrlQueryAndFragment(url: string): string {\n  const queryIndex = url.indexOf(\"?\");\n  const fragmentIndex = url.indexOf(\"#\");\n  let end = url.length;\n  if (queryIndex !== -1) end = Math.min(end, queryIndex);\n  if (fragmentIndex !== -1) end = Math.min(end, fragmentIndex);\n  return url.slice(0, end);\n}\n\nfunction rawPathFromDeniedUrl(url: string): string {\n  const urlWithoutQuery = stripUrlQueryAndFragment(url);\n  const schemeEnd = urlWithoutQuery.indexOf(\"://\");\n  const authorityStart = schemeEnd === -1 ? 0 : schemeEnd + 3;\n  const pathStart = urlWithoutQuery.indexOf(\"/\", authorityStart);\n  return pathStart === -1 ? \"/\" : urlWithoutQuery.slice(pathStart);\n}\n\nfunction printPermissionChangeGuidance(\n  connectorRef: string,\n  permissions: readonly string[],\n): void {\n  const sortedPermissions = [...permissions].sort();\n  if (sortedPermissions.length === 1) {\n    const permission = sortedPermissions[0]!;\n    console.log(`This is covered by the \"${permission}\" permission.`);\n    console.log(\n      `To allow this permission, run: zero doctor permission-change ${connectorRef} --permission ${permission} --enable --duration 1h`,\n    );\n    return;\n  }\n\n  console.log(\n    `This is covered by these permissions: ${sortedPermissions.join(\", \")}.`,\n  );\n  for (const permission of sortedPermissions) {\n    console.log(\n      `To allow ${permission}, run: zero doctor permission-change ${connectorRef} --permission ${permission} --enable --duration 1h`,\n    );\n  }\n}\n\nfunction printFilteredRequest(\n  label: string,\n  method: string,\n  relativePath: string,\n  base: string,\n): void {\n  console.log(\n    `The ${label} permission filtered ${method} ${relativePath} relative to base URL ${base}.`,\n  );\n}\n\nfunction unsafeInputError(reason: UnsafeInputReason): Error {\n  switch (reason) {\n    case \"invalid-method\":\n      return invalidMethodError();\n    case \"invalid-url\":\n      return invalidUrlError();\n    case \"unsafe-path\":\n      return unsafePathError();\n  }\n}\n\nfunction handleDiagnosticResult(\n  connectorRef: string,\n  method: string,\n  result: ConnectorPermissionDenyDiagnosticResult,\n): void {\n  switch (result.outcome) {\n    case \"matched\":\n      printFilteredRequest(\n        result.label,\n        method,\n        result.relativePath,\n        result.base,\n      );\n      printPermissionChangeGuidance(connectorRef, result.permissions);\n      return;\n    case \"unknown-endpoint\":\n      printFilteredRequest(\n        result.label,\n        method,\n        result.relativePath,\n        result.base,\n      );\n      console.log(\"No named permission was found covering this request.\");\n      console.log(\"This request is governed by the unknown endpoint policy.\");\n      console.log(\n        `To allow unknown endpoints, run: ${unknownPermissionChangeCommand(connectorRef)}`,\n      );\n      return;\n    case \"unknown-connector\":\n      throw new Error(`Unknown connector type: ${connectorRef}`);\n    case \"no-matching-base\":\n      throw new Error(\n        `No registered ${result.label} base URL matches the provided URL.`,\n      );\n    case \"unresolved-dynamic-base\":\n      throw new Error(\n        `No authoritative ${result.label} base URL is available for this diagnostic. Verify the ${connectorRef} connector configuration for the affected context and retry.`,\n      );\n    case \"unsafe-input\":\n      throw unsafeInputError(result.reason);\n  }\n\n  const exhaustiveResult: never = result;\n  return exhaustiveResult;\n}\n\nexport const permissionDenyCommand = new Command()\n  .name(\"permission-deny\")\n  .description(\n    \"Diagnose a permission denial and find the permission that covers it\",\n  )\n  .argument(\"<connector-ref>\", \"The connector type (e.g. github)\")\n  .addOption(\n    new Option(\n      \"--method <method>\",\n      \"The denied HTTP method\",\n    ).makeOptionMandatory(),\n  )\n  .addOption(\n    new Option(\n      \"--url <url>\",\n      \"The denied request URL; query strings are ignored (required)\",\n    ),\n  )\n  .addOption(new Option(\"--path <path>\", \"Deprecated: use --url\").hideHelp())\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  zero doctor permission-deny github --method GET --url https://api.github.com/repos/owner/repo/pulls\n  zero doctor permission-deny slack --method POST --url https://slack.com/api/chat.postMessage\n  zero doctor permission-deny youtube --method PUT --url https://youtube.googleapis.com/upload/youtube/v3/videos\n\nNotes:\n  - Identifies which named permission covers a denied request\n  - If the firewall denial response includes a url field, pass that value to --url\n  - Requires the denied URL origin and path because method/path alone can match the wrong API base\n  - Query strings and fragments are ignored for matching; omit them when they may contain secrets\n  - Use permission-change to request or enable the permission\n  - Permission-change enable requests default to --duration 1h; pick 24h, 7d, or always only when appropriate`,\n  )\n  .action(\n    withErrorHandler(\n      async (connectorRef: string, opts: PermissionDenyOptions) => {\n        if (opts.path !== undefined) {\n          throw pathOnlyError();\n        }\n        if (!opts.url) {\n          throw pathOnlyError();\n        }\n\n        const method = parseDeniedMethod(opts.method);\n        validateDeniedUrl(opts.url);\n        const deniedPath = rawPathFromDeniedUrl(opts.url);\n        if (hasUnsafeFirewallPath(deniedPath)) {\n          throw unsafePathError();\n        }\n\n        if (\n          isComputerUsePermissionTarget({\n            connectorRef,\n            path: deniedPath,\n          })\n        ) {\n          printComputerUsePermissionGuidance();\n          return;\n        }\n\n        const result = await diagnoseZeroConnectorPermissionDeny(\n          connectorRef,\n          method,\n          stripUrlQueryAndFragment(opts.url),\n        );\n        handleDiagnosticResult(connectorRef, method, result);\n      },\n    ),\n  );\n","const COMPUTER_USE_CONNECTOR_REF = \"computer-use\";\nconst COMPUTER_USE_CAPABILITY = \"computer-use:write\";\nconst COMPUTER_USE_PATH_PREFIX = \"/computer-use\";\nconst COMPUTER_USE_PATH_PREFIX_WITH_SLASH = `${COMPUTER_USE_PATH_PREFIX}/`;\n\ninterface ComputerUsePermissionTarget {\n  readonly connectorRef: string;\n  readonly path?: string;\n  readonly permission?: string;\n}\n\nexport function isComputerUsePermissionTarget(\n  target: ComputerUsePermissionTarget,\n): boolean {\n  return (\n    target.connectorRef === COMPUTER_USE_CONNECTOR_REF ||\n    target.permission === COMPUTER_USE_CAPABILITY ||\n    target.path === COMPUTER_USE_PATH_PREFIX ||\n    target.path?.startsWith(COMPUTER_USE_PATH_PREFIX_WITH_SLASH) === true\n  );\n}\n\nexport function printComputerUsePermissionGuidance(): void {\n  console.log(\"Computer Use access is not managed as a connector permission.\");\n  console.log(\n    \"The current run token needs computer-use:write, which is issued only when a Zero Desktop Computer Use host is selected for the chat or thread before the run starts.\",\n  );\n  console.log(\n    \"Open Zero Desktop, make sure Computer Use is online, select the Computer Use host for this chat/thread, then start a new run. Existing run tokens cannot be upgraded in place.\",\n  );\n  console.log(\n    \"Run `zero whoami` to confirm whether the current ZERO_TOKEN includes computer-use:write.\",\n  );\n}\n","import { Command, Option } from \"commander\";\nimport type { UserPermissionGrantExpiresIn } from \"@vm0/api-contracts/contracts/zero-user-permission-grants\";\nimport { findFirewallMetadataPermission } from \"@vm0/connectors/firewall-metadata/policy\";\nimport { UNKNOWN_PERMISSION_GRANT } from \"@vm0/connectors/firewall-types\";\nimport { withErrorHandler } from \"../../../lib/command\";\nimport { getPlatformOrigin } from \"./platform-url\";\nimport {\n  isComputerUsePermissionTarget,\n  printComputerUsePermissionGuidance,\n} from \"./computer-use-guidance\";\nimport {\n  ApiRequestError,\n  createComputerUseAuthorizationRequest,\n  getZeroConnectorCatalogPermissions,\n} from \"../../../lib/api\";\n\nconst DEFAULT_PERMISSION_GRANT_DURATION: UserPermissionGrantExpiresIn = \"1h\";\nconst PERMISSION_GRANT_DURATIONS = [\n  \"1h\",\n  \"24h\",\n  \"7d\",\n  \"always\",\n] as const satisfies readonly UserPermissionGrantExpiresIn[];\n\ntype PermissionAction = \"enable\" | \"disable\";\n\nfunction permissionDescription(permission: string): string {\n  return permission === UNKNOWN_PERMISSION_GRANT\n    ? \"unknown endpoints\"\n    : `the \"${permission}\" permission`;\n}\n\nfunction printSensitivePermissionGuidance(\n  connectorRef: string,\n  permission: string,\n  action: PermissionAction,\n): void {\n  if (action !== \"enable\") return;\n\n  // Slack chat:write: strongly recommend bot-based messaging over user identity\n  if (connectorRef === \"slack\" && permission === \"chat:write\") {\n    console.log(\"\");\n    console.log(\n      \"IMPORTANT: Granting chat:write allows sending messages AS THE USER's identity, not as a bot.\",\n    );\n    console.log(\n      \"Use `zero slack message send -c <channel> -t <text>` to send messages as the bot instead — this is the recommended approach for most use cases.\",\n    );\n    console.log(\n      \"Only allow this permission below if acting as the user is specifically required.\",\n    );\n    console.log(\"\");\n  }\n\n  // Gmail send permissions: strongly recommend draft-based workflow over direct send.\n  if (\n    connectorRef === \"gmail\" &&\n    (permission === \"messages.send\" || permission === \"drafts.send\")\n  ) {\n    console.log(\"\");\n    console.log(\n      \"IMPORTANT: Granting Gmail send permissions allows the agent to send emails directly as the user.\",\n    );\n    console.log(\n      \"Consider keeping messages.send and drafts.send disabled and using drafts.write instead — the agent can create drafts for the user to review and send manually.\",\n    );\n    console.log(\n      \"Only allow this permission below if direct sending is specifically required.\",\n    );\n    console.log(\"\");\n  }\n}\n\nfunction printPermissionActionMessage(args: {\n  readonly action: PermissionAction;\n  readonly permission: string;\n  readonly label: string;\n  readonly url: string;\n  readonly duration: UserPermissionGrantExpiresIn | undefined;\n}): void {\n  const grantAction = args.action === \"enable\" ? \"allow\" : \"deny\";\n  console.log(\n    `You can ${grantAction} ${permissionDescription(args.permission)} for your connector access: [Manage ${args.label} permissions](${args.url})`,\n  );\n  if (args.duration) {\n    console.log(\n      `Requested duration: ${args.duration}. Use --duration 1h|24h|7d|always to choose a different grant lifetime.`,\n    );\n  }\n}\n\nfunction printComputerUseAuthorizationLink(args: {\n  readonly authorizationUrl: string;\n  readonly expiresAt: string;\n}): void {\n  console.log(\n    \"Computer Use needs a Zero Desktop host selected before a run starts.\",\n  );\n  console.log(\n    \"Ask the user to authorize a host for future runs in this chat or Slack thread:\",\n  );\n  console.log(args.authorizationUrl);\n  console.log(\n    `This link expires at ${args.expiresAt}. Existing run tokens cannot be upgraded in place; start a new run after authorization.`,\n  );\n}\n\nasync function printComputerUsePermissionChangeMessage(\n  action: PermissionAction,\n): Promise<void> {\n  if (action !== \"enable\") {\n    printComputerUsePermissionGuidance();\n    return;\n  }\n\n  if (!process.env.ZERO_TOKEN) {\n    printComputerUsePermissionGuidance();\n    return;\n  }\n\n  try {\n    const request = await createComputerUseAuthorizationRequest();\n    printComputerUseAuthorizationLink({\n      authorizationUrl: request.authorizationUrl,\n      expiresAt: request.expiresAt,\n    });\n  } catch (error) {\n    if (error instanceof ApiRequestError) {\n      console.log(\n        `Computer Use authorization link unavailable: ${error.message}`,\n      );\n      printComputerUsePermissionGuidance();\n      return;\n    }\n    const message = error instanceof Error ? error.message : \"Unknown error\";\n    console.log(`Computer Use authorization link unavailable: ${message}`);\n    printComputerUsePermissionGuidance();\n  }\n}\n\nasync function outputPermissionChangeMessage(\n  connectorRef: string,\n  label: string,\n  permission: string,\n  action: PermissionAction,\n  duration: UserPermissionGrantExpiresIn | undefined,\n  agentId: string | undefined,\n): Promise<void> {\n  const platformOrigin = await getPlatformOrigin();\n\n  const urlParams = new URLSearchParams({\n    ref: connectorRef,\n    permission,\n    action: action === \"enable\" ? \"allow\" : \"deny\",\n  });\n  if (action === \"enable\") {\n    urlParams.set(\"expiresIn\", duration ?? DEFAULT_PERMISSION_GRANT_DURATION);\n  }\n\n  const pagePath = agentId ? `/agents/${agentId}/permissions` : \"/agents\";\n  const url = `${platformOrigin}${pagePath}?${urlParams.toString()}`;\n\n  printSensitivePermissionGuidance(connectorRef, permission, action);\n  printPermissionActionMessage({\n    action,\n    permission,\n    label,\n    url,\n    duration:\n      action === \"enable\"\n        ? (duration ?? DEFAULT_PERMISSION_GRANT_DURATION)\n        : undefined,\n  });\n}\n\nexport const permissionChangeCommand = new Command()\n  .name(\"permission-change\")\n  .description(\"Change or request a permission (enable or disable)\")\n  .argument(\"<connector-ref>\", \"The connector type (e.g. github)\")\n  .addOption(\n    new Option(\n      \"--permission <name>\",\n      \"The permission name to change\",\n    ).makeOptionMandatory(),\n  )\n  .addOption(\n    new Option(\n      \"--enable\",\n      \"Enable or request enabling the permission\",\n    ).conflicts(\"disable\"),\n  )\n  .addOption(\n    new Option(\n      \"--disable\",\n      \"Disable or request disabling the permission\",\n    ).conflicts(\"enable\"),\n  )\n  .addOption(\n    new Option(\n      \"--duration <duration>\",\n      \"Requested allow duration: 1h, 24h, 7d, or always (default: 1h)\",\n    ).choices([...PERMISSION_GRANT_DURATIONS]),\n  )\n  .addOption(\n    new Option(\"--reason <text>\", \"Brief reason for the permission change\"),\n  )\n  .addOption(\n    new Option(\n      \"--agent <id>\",\n      \"Agent ID whose permission page should be opened (defaults to ZERO_AGENT_ID)\",\n    ),\n  )\n  .addHelpText(\n    \"after\",\n    `\nExamples:\n  zero doctor permission-change github --permission contents:read --enable\n  zero doctor permission-change github --permission contents:write --enable --duration 24h\n  zero doctor permission-change gmail --permission messages.write --enable --agent <agent-id>\n  zero doctor permission-change slack --permission chat:write --disable\n  zero doctor permission-change cloudflare --permission __unknown__ --disable\n  zero doctor permission-change computer-use --permission computer-use:write --enable\n\nNotes:\n  - Outputs a platform URL for the user to adjust the permission\n  - Use --permission __unknown__ to change unknown endpoint policy\n  - Use --agent to request a permission for another agent; defaults to ZERO_AGENT_ID\n  - Enable requests default to --duration 1h; use 24h or 7d for longer user-approved work\n  - Use --duration always only when the user explicitly asks for persistent access\n  - Permission changes update the current user's connector grants`,\n  )\n  .action(\n    withErrorHandler(\n      async (\n        connectorRef: string,\n        opts: {\n          permission: string;\n          enable?: boolean;\n          disable?: boolean;\n          duration?: UserPermissionGrantExpiresIn;\n          reason?: string;\n          agent?: string;\n        },\n      ) => {\n        if (!opts.enable && !opts.disable) {\n          throw new Error(\"Either --enable or --disable is required\");\n        }\n        if (opts.disable && opts.duration !== undefined) {\n          throw new Error(\"--duration is only supported with --enable\");\n        }\n\n        if (\n          isComputerUsePermissionTarget({\n            connectorRef,\n            permission: opts.permission,\n          })\n        ) {\n          await printComputerUsePermissionChangeMessage(\n            opts.enable ? \"enable\" : \"disable\",\n          );\n          return;\n        }\n\n        const metadata = await getZeroConnectorCatalogPermissions(connectorRef);\n        if (!metadata) {\n          throw new Error(`Unknown connector type: ${connectorRef}`);\n        }\n\n        if (\n          opts.permission !== UNKNOWN_PERMISSION_GRANT &&\n          !findFirewallMetadataPermission(metadata, opts.permission)\n        ) {\n          throw new Error(\n            `Unknown permission \"${opts.permission}\" for ${connectorRef}`,\n          );\n        }\n\n        const action = opts.enable ? \"enable\" : \"disable\";\n        await outputPermissionChangeMessage(\n          connectorRef,\n          metadata.label,\n          opts.permission,\n          action,\n          opts.duration,\n          opts.agent ?? process.env.ZERO_AGENT_ID,\n        );\n      },\n    ),\n  );\n","import { Command } from \"commander\";\nimport chalk from \"chalk\";\n\nimport {\n  getZeroBillingStatus,\n  getZeroOrg,\n  getZeroOrgMembers,\n} from \"../../../lib/api\";\nimport { withErrorHandler } from \"../../../lib/command\";\n\nfunction memberName(member: {\n  readonly email: string;\n  readonly firstName: string | null;\n  readonly lastName: string | null;\n}): string {\n  const name = [member.firstName, member.lastName].filter(Boolean).join(\" \");\n  return name ? `${name} <${member.email}>` : member.email;\n}\n\nexport const creditCommand = new Command()\n  .name(\"credit\")\n  .description(\"Diagnose current organization credit and purchase access\")\n  .action(\n    withErrorHandler(async () => {\n      const [org, billing, members] = await Promise.all([\n        getZeroOrg(),\n        getZeroBillingStatus(),\n        getZeroOrgMembers(),\n      ]);\n      const admins = members.members.filter((member) => {\n        return member.role === \"admin\";\n      });\n      const isAdmin = members.role === \"admin\";\n      const canPurchaseCredits = isAdmin;\n\n      console.log(chalk.bold(\"Credit diagnostics:\"));\n      console.log(`  Org: ${chalk.green(org.slug)}`);\n      console.log(`  Tier: ${chalk.cyan(billing.tier)}`);\n      console.log(\n        `  Available credits: ${chalk.cyan(billing.credits.toLocaleString())}`,\n      );\n      console.log(`  Current user role: ${chalk.cyan(members.role)}`);\n      console.log(\n        `  Can purchase credits: ${\n          canPurchaseCredits ? chalk.green(\"yes\") : chalk.yellow(\"no\")\n        }`,\n      );\n      console.log(\n        `  Auto-recharge: ${\n          billing.autoRecharge.enabled ? chalk.green(\"enabled\") : \"disabled\"\n        }`,\n      );\n      if (billing.autoRecharge.enabled) {\n        console.log(\n          `    Threshold: ${billing.autoRecharge.threshold?.toLocaleString() ?? \"not set\"}`,\n        );\n        console.log(\n          `    Amount: ${billing.autoRecharge.amount?.toLocaleString() ?? \"not set\"}`,\n        );\n      }\n\n      if (!isAdmin) {\n        console.log(chalk.bold(\"\\nOrganization admins:\"));\n        for (const admin of admins) {\n          console.log(`  - ${memberName(admin)}`);\n        }\n        console.log(\n          chalk.yellow(\n            \"\\nAsk an organization admin to buy credits or upgrade the plan.\",\n          ),\n        );\n      } else if (billing.tier === \"free\") {\n        console.log(\n          \"\\nFree-tier admins can upgrade to Pro from billing or buy credits with `zero credit <credits>`.\",\n        );\n      } else {\n        console.log(\"\\nUse `zero credit <credits>` to buy more credits.\");\n      }\n    }),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;ACAA;AA2DA,SAAS,yBAAyB,KAAqB;AACrD,QAAM,aAAa,IAAI,QAAQ,GAAG;AAClC,QAAM,gBAAgB,IAAI,QAAQ,GAAG;AACrC,MAAI,MAAM,IAAI;AACd,MAAI,eAAe,GAAI,OAAM,KAAK,IAAI,KAAK,UAAU;AACrD,MAAI,kBAAkB,GAAI,OAAM,KAAK,IAAI,KAAK,aAAa;AAC3D,SAAO,IAAI,MAAM,GAAG,GAAG;AACzB;AAEA,SAAS,2BAA2B,KAAsB;AACxD,QAAM,YAAY,IAAI,QAAQ,KAAK;AACnC,MAAI,cAAc,GAAI,QAAO;AAE7B,QAAM,iBAAiB,YAAY;AACnC,MAAI,eAAe,IAAI;AACvB,aAAW,aAAa,CAAC,KAAK,KAAK,GAAG,GAAG;AACvC,UAAM,iBAAiB,IAAI,QAAQ,WAAW,cAAc;AAC5D,QAAI,mBAAmB,IAAI;AACzB,qBAAe,KAAK,IAAI,cAAc,cAAc;AAAA,IACtD;AAAA,EACF;AACA,SAAO,IAAI,MAAM,gBAAgB,YAAY,EAAE,SAAS,GAAG;AAC7D;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AAC3C;AAEA,SAAS,0BACP,KACA,QACA,cACQ;AACR,QAAM,OAAO;AAAA,IACX,SAAS,cAAc,GAAG,CAAC;AAAA,IAC3B,eAAe,cAAc,YAAY,CAAC;AAAA,EAC5C;AACA,MAAI,WAAW,OAAO;AACpB,SAAK,KAAK,YAAY,cAAc,MAAM,CAAC,EAAE;AAAA,EAC/C;AACA,SAAO,+BAA+B,KAAK,KAAK,GAAG,CAAC;AACtD;AAEA,SAAS,8BACP,MACA,SACgD;AAChD,QAAM,SAAS,KAAK,QAAQ;AAE5B,MAAI,KAAK,QAAQ,UAAa,2BAA2B,KAAK,GAAG,GAAG;AAClE,UAAM,iBAAiB,aAAa;AAAA,EACtC;AACA,MAAI,KAAK,cAAc,UAAa,CAAC,QAAQ;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,oBAAoB,UAAa,QAAQ;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,iBAAiB,KAAK,MAAM,IAAI;AACvC,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,MAAI,CAAC,UAAU,QAAQ,qBAAqB,QAAQ,MAAM,OAAO;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,YAAY,UAAa,CAAC,QAAQ;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,uBACP,MACA,QACuB;AACvB,MAAI,KAAK,QAAQ,QAAW;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,KAAK,yBAAyB,KAAK,GAAG;AAAA,MACtC,GAAI,KAAK,cAAc,SAAY,EAAE,cAAc,KAAK,UAAU,IAAI,CAAC;AAAA,MACvE,GAAI,KAAK,YAAY,SAAY,EAAE,iBAAiB,KAAK,QAAQ,IAAI,CAAC;AAAA,IACxE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,iBAAiB,KAAK;AAAA,IACtB,GAAI,KAAK,oBAAoB,SACzB,EAAE,YAAY,KAAK,gBAAgB,IACnC,CAAC;AAAA,EACP;AACF;AAEA,SAAS,kBACP,SACsB;AACtB,MAAI,QAAQ,SAAS,OAAO;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,SAAwC;AACxE,MAAI,QAAQ,oBAAoB,QAAW;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,iBACP,QAIO;AACP,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,IAAI;AAAA,QACT;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO,IAAI;AAAA,QACT;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO,IAAI;AAAA,QACT;AAAA,MACF;AAAA,EACJ;AACF;AAEA,SAAS,wBACP,SACA,QAIO;AACP,QAAM,aAAa,CAAC,GAAG,OAAO,UAAU,EAAE,KAAK,CAAC,MAAM,UAAU;AAC9D,WAAO,KAAK,aAAa,cAAc,MAAM,YAAY;AAAA,EAC3D,CAAC;AACD,QAAM,WAAW,WAAW,IAAI,CAAC,cAAc;AAC7C,WAAO,KAAK,0BAA0B,QAAQ,KAAK,QAAQ,QAAQ,UAAU,YAAY,CAAC;AAAA,EAC5F,CAAC;AACD,SAAO,IAAI;AAAA,IACT,6BAA6B,QAAQ,MAAM,IAAI,QAAQ,GAAG,KAAK,WAC5D,IAAI,CAAC,cAAc;AAClB,aAAO,UAAU;AAAA,IACnB,CAAC,EACA,KAAK,IAAI,CAAC;AAAA;AAAA,EAA6B,SAAS,KAAK,IAAI,CAAC;AAAA,EAC/D;AACF;AAEA,SAAS,sBAAsB,SAAuC;AACpE,MAAI,QAAQ,SAAS,SAAS,QAAQ,iBAAiB,QAAW;AAChE,WAAO,IAAI;AAAA,MACT,2BAA2B,QAAQ,YAAY;AAAA,6BAAgC,cAAc,QAAQ,YAAY,CAAC;AAAA,IACpH;AAAA,EACF;AACA,SAAO,IAAI,MAAM,qCAAqC;AACxD;AAEA,SAAS,aACP,QAIO;AACP,SAAO,IAAI;AAAA,IACT,OAAO,UAAU,QACb,4GACA;AAAA,EACN;AACF;AAEA,SAAS,uBACP,SACA,QAIO;AACP,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,SAAO,IAAI;AAAA,IACT,aAAa,YAAY,iBAAiB,QAAQ,MAAM,IAAI,QAAQ,GAAG,+BAA+B,OAAO,UAAU,YAAY;AAAA,OAAU,0BAA0B,QAAQ,KAAK,QAAQ,QAAQ,OAAO,UAAU,YAAY,CAAC;AAAA,EACpO;AACF;AAEA,SAAS,yBACP,SACA,QAIO;AACP,QAAM,kBAAkB,yBAAyB,OAAO;AACxD,SAAO,IAAI;AAAA,IACT,GAAG,eAAe,uCAAuC,OAAO,UAAU,KAAK;AAAA,EACjF;AACF;AAEA,SAAS,wBACP,SACA,QAIO;AACP,QAAM,kBAAkB,yBAAyB,OAAO;AACxD,SAAO,IAAI;AAAA,IACT,GAAG,eAAe,2DAA2D,OAAO,iBAAiB,KAAK,IAAI,KAAK,MAAM;AAAA,EAC3H;AACF;AAEA,SAAS,mBACP,SACA,QACoB;AACpB,UAAQ,OAAO,SAAS;AAAA,IACtB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,YAAM,iBAAiB,OAAO,MAAM;AAAA,IACtC,KAAK;AACH,YAAM,sBAAsB,OAAO;AAAA,IACrC,KAAK;AACH,YAAM,IAAI;AAAA,QACR,6BAA6B,yBAAyB,OAAO,CAAC;AAAA,MAChE;AAAA,IACF,KAAK;AACH,YAAM,aAAa,MAAM;AAAA,IAC3B,KAAK;AACH,YAAM,wBAAwB,kBAAkB,OAAO,GAAG,MAAM;AAAA,IAClE,KAAK;AACH,YAAM,uBAAuB,kBAAkB,OAAO,GAAG,MAAM;AAAA,IACjE,KAAK;AACH,YAAM,yBAAyB,SAAS,MAAM;AAAA,IAChD,KAAK;AACH,YAAM,wBAAwB,SAAS,MAAM;AAAA,IAC/C,KAAK;AACH,YAAM,IAAI;AAAA,QACR,oBAAoB,OAAO,UAAU,KAAK,0DAA0D,OAAO,UAAU,YAAY;AAAA,MACnI;AAAA,IACF,KAAK;AACH,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,EACJ;AACF;AAEA,SAAS,uBACP,SACA,QACM;AACN,MAAI,OAAO,SAAS,OAAO;AACzB,UAAM,aAAa,kBAAkB,OAAO;AAC5C,YAAQ;AAAA,MACN,OAAO,WAAW,GAAG,gBAAgB,OAAO,UAAU,KAAK,qBAAqB,OAAO,UAAU,YAAY;AAAA,IAC/G;AACA,YAAQ,IAAI,uBAAuB,OAAO,IAAI,EAAE;AAChD,YAAQ,IAAI,uBAAuB,OAAO,YAAY,EAAE;AACxD,QAAI,OAAO,qBAAqB,MAAM;AACpC,cAAQ,IAAI,kCAAkC;AAAA,IAChD,OAAO;AACL,cAAQ;AAAA,QACN,yBAAyB,OAAO,iBAAiB,KAAK,IAAI,CAAC;AAAA,MAC7D;AAAA,IACF;AACA;AAAA,EACF;AAEA,UAAQ;AAAA,IACN,GAAG,OAAO,eAAe,sBAAsB,OAAO,UAAU,KAAK,qBAAqB,OAAO,UAAU,YAAY;AAAA,EACzH;AACF;AAEA,SAAS,2BACP,QAC0B;AAC1B,SAAO,OAAO,SAAS,QACnB,OAAO,mBACP,CAAC,OAAO,eAAe;AAC7B;AAEA,SAAS,+BACP,KACA,aACA,WACA,eACM;AACN,UAAQ;AAAA,IACN;AAAA,EACF;AACA,UAAQ,IAAI,EAAE;AACd,MAAI,CAAC,IAAI,oBAAoB;AAC3B,YAAQ;AAAA,MACN,OAAO,IAAI,KAAK;AAAA,IAClB;AAAA,EACF,WAAW,CAAC,aAAa;AACvB,YAAQ,IAAI,OAAO,IAAI,KAAK,8BAA8B;AAC1D,QAAI,IAAI,WAAW,eAAe;AAChC,YAAM,aAAa,GAAG,IAAI,cAAc,eAAe,IAAI,YAAY,oBAAoB,IAAI,OAAO;AACtG,cAAQ,IAAI,2BAA2B,IAAI,KAAK,KAAK,UAAU,GAAG;AAAA,IACpE,WAAW,CAAC,IAAI,SAAS;AACvB,YAAM,aAAa,GAAG,IAAI,cAAc,eAAe,IAAI,YAAY;AACvE,cAAQ,IAAI,2BAA2B,IAAI,KAAK,KAAK,UAAU,GAAG;AAAA,IACpE;AAAA,EACF,WAAW,WAAW;AACpB,UAAM,MAAM,GAAG,IAAI,cAAc;AACjC,YAAQ;AAAA,MACN,OAAO,IAAI,KAAK;AAAA,IAClB;AACA,YAAQ,IAAI,+BAA+B,IAAI,KAAK,KAAK,GAAG,GAAG;AAAA,EACjE,OAAO;AACL,YAAQ,IAAI,OAAO,IAAI,KAAK,qCAAqC;AAAA,EACnE;AACA,UAAQ,IAAI,EAAE;AAChB;AAEA,SAAS,8BACP,KACA,aACA,WACA,eACM;AACN,MAAI,CAAC,IAAI,SAAS;AAChB,YAAQ,IAAI,mEAA8D;AAAA,EAC5E,WAAW,WAAW;AACpB,YAAQ;AAAA,MACN,mEAA8D,IAAI,KAAK;AAAA,IACzE;AAAA,EACF,WAAW,eAAe;AACxB,YAAQ;AAAA,MACN,cACI,OAAO,IAAI,KAAK,6CAChB,OAAO,IAAI,KAAK;AAAA,IACtB;AAAA,EACF,OAAO;AACL,UAAM,MAAM,GAAG,IAAI,cAAc,eAAe,IAAI,YAAY,sBAAsB,IAAI,OAAO;AACjG,YAAQ;AAAA,MACN,cACI,OAAO,IAAI,KAAK,gDAAgD,IAAI,OAAO,OAC3E,OAAO,IAAI,KAAK,mEAAmE,IAAI,OAAO;AAAA,IACpG;AACA,YAAQ,IAAI,+BAA+B,IAAI,KAAK,KAAK,GAAG,GAAG;AAAA,EACjE;AACF;AAEA,SAAS,kCACP,KACA,aACA,WACA,eACM;AACN,UAAQ;AAAA,IACN;AAAA,EACF;AACA,UAAQ,IAAI,EAAE;AACd,MAAI,CAAC,IAAI,oBAAoB;AAC3B,YAAQ;AAAA,MACN,sBAAiB,IAAI,KAAK;AAAA,IAC5B;AAAA,EACF,OAAO;AACL,kCAA8B,KAAK,aAAa,WAAW,aAAa;AAAA,EAC1E;AACA,UAAQ;AAAA,IACN,0DAA0D,IAAI,KAAK;AAAA,EACrE;AACA,UAAQ,IAAI,EAAE;AAChB;AAEA,SAAS,sBAAsB,KAAwB;AACrD,UAAQ,IAAI,qCAAqC;AACjD,UAAQ,IAAI,EAAE;AACd,MAAI,IAAI,qBAAqB,MAAM;AACjC,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ,IAAI,EAAE;AACd;AAAA,EACF;AACA,MAAI,IAAI,iBAAiB,WAAW,GAAG;AACrC,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ,IAAI,EAAE;AACd;AAAA,EACF;AAEA,MAAI,qBAAqB;AACzB,aAAW,mBAAmB,IAAI,kBAAkB;AAClD,UAAM,UAAU,QAAQ,QAAQ,IAAI,eAAe,CAAC;AACpD,2BAAuB;AACvB,YAAQ;AAAA,MACN,wBAAwB,eAAe,KAAK,UAAU,YAAY,aAAa;AAAA,IACjF;AAAA,EACF;AACA,MAAI,oBAAoB;AACtB,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF,OAAO;AACL,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACA,UAAQ,IAAI,EAAE;AAChB;AAEA,eAAe,qBAAqB,KAIjC;AACD,UAAQ,IAAI,oCAAoC;AAChD,UAAQ,IAAI,EAAE;AACd,UAAQ;AAAA,IACN;AAAA,EACF;AACA,UAAQ,IAAI,EAAE;AAEd,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,IAClD,iBAAiB,IAAI,YAAY;AAAA,IACjC,IAAI,UACA,2BAA2B,IAAI,OAAO,IACtC,QAAQ,QAAQ,IAAI;AAAA,EAC1B,CAAC;AAED,QAAM,cAAc,cAAc;AAClC,QAAM,YAAY,WAAW,qBAAqB;AAClD,QAAM,gBACJ,iBAAiB,QAAQ,aAAa,SAAS,IAAI,YAAY;AAEjE,iCAA+B,KAAK,aAAa,WAAW,aAAa;AACzE,oCAAkC,KAAK,aAAa,WAAW,aAAa;AAE5E,SAAO,EAAE,aAAa,WAAW,cAAc;AACjD;AAEA,SAAS,sBAAsB,KAAkC;AAC/D,UAAQ;AAAA,IACN;AAAA,EACF;AACA,UAAQ,IAAI,EAAE;AAEd,UAAQ,IAAI,IAAI,QAAQ;AAAA,IACtB,KAAK;AACH,cAAQ;AAAA,QACN;AAAA,MACF;AACA,cAAQ,IAAI,EAAE;AACd,aAAO;AAAA,IACT,KAAK;AACH,cAAQ;AAAA,QACN,kCAAkC,IAAI,KAAK;AAAA,MAC7C;AACA,cAAQ;AAAA,QACN;AAAA,MACF;AACA,cAAQ,IAAI,EAAE;AACd,aAAO;AAAA,IACT,KAAK;AACH,cAAQ;AAAA,QACN,OAAO,IAAI,KAAK;AAAA,MAClB;AACA,iBAAW,QAAQ,IAAI,IAAI,OAAO;AAChC,gBAAQ,IAAI,OAAO,IAAI,EAAE;AAAA,MAC3B;AACA,cAAQ,IAAI,EAAE;AACd,UAAI,IAAI,yBAAyB,oBAAoB;AACnD,gBAAQ;AAAA,UACN;AAAA,QACF;AAAA,MACF;AACA,cAAQ,IAAI,EAAE;AACd,aAAO;AAAA,EACX;AACF;AAEA,SAAS,uBACP,QAMM;AACN,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,cAAQ;AAAA,QACN;AAAA,MACF;AACA;AAAA,IACF,KAAK;AACH,cAAQ;AAAA,QACN;AAAA,MACF;AACA;AAAA,IACF,KAAK;AACH,cAAQ;AAAA,QACN;AAAA,MACF;AACA;AAAA,EACJ;AACF;AAEA,SAAS,uBACP,YACA,QACM;AACN,UAAQ,OAAO,SAAS;AAAA,IACtB,KAAK,SAAS;AACZ,cAAQ,OAAO,OAAO;AAAA,QACpB,KAAK;AACH,kBAAQ;AAAA,YACN,YAAY,UAAU;AAAA,UACxB;AACA;AAAA,QACF,KAAK;AACH,kBAAQ;AAAA,YACN,YAAY,UAAU;AAAA,UACxB;AACA;AAAA,QACF,KAAK;AACH,kBAAQ;AAAA,YACN,6DAAwD,UAAU;AAAA,UACpE;AACA;AAAA,QACF,KAAK;AACH,kBAAQ;AAAA,YACN,qCAAqC,UAAU;AAAA,UACjD;AACA;AAAA,MACJ;AACA;AAAA,IACF;AAAA,IACA,KAAK;AACH,cAAQ;AAAA,QACN,OAAO,UAAU,cACb,YAAY,UAAU,yCACtB,+CAA+C,UAAU;AAAA,MAC/D;AACA;AAAA,IACF,KAAK;AACH,cAAQ;AAAA,QACN,OAAO,UAAU,aACb,YAAY,UAAU,wDACtB,+CAA+C,UAAU;AAAA,MAC/D;AACA;AAAA,IACF,KAAK;AACH,6BAAuB,MAAM;AAC7B;AAAA,EACJ;AACF;AAEA,SAAS,+BAA+B,cAA8B;AACpE,SAAO,iCAAiC,YAAY;AACtD;AAEA,SAAS,2BACP,cACA,QACM;AACN,UAAQ,OAAO,SAAS;AAAA,IACtB,KAAK;AACH,cAAQ;AAAA,QACN,OAAO,UAAU,cACb,kFACA;AAAA,MACN;AACA;AAAA,IACF,KAAK;AACH,cAAQ;AAAA,QACN;AAAA,MACF;AACA,cAAQ;AAAA,QACN,oCAAoC,+BAA+B,YAAY,CAAC;AAAA,MAClF;AACA;AAAA,IACF,KAAK;AACH,cAAQ;AAAA,QACN;AAAA,MACF;AACA,cAAQ;AAAA,QACN,oCAAoC,+BAA+B,YAAY,CAAC;AAAA,MAClF;AACA;AAAA,IACF,KAAK;AACH,6BAAuB,MAAM;AAC7B;AAAA,EACJ;AACF;AAEA,SAAS,6BAA6B,QAAqC;AACzE,UAAQ,IAAI,6DAA6D;AACzE,UAAQ,IAAI,EAAE;AACd,UAAQ;AAAA,IACN,YAAY,OAAO,MAAM,IAAI,OAAO,YAAY,0BAA0B,OAAO,IAAI,iBAAiB,OAAO,UAAU,KAAK;AAAA,EAC9H;AACA,UAAQ,IAAI,EAAE;AAEd,MAAI,OAAO,WAAW,SAAS,WAAW;AACxC,YAAQ;AAAA,MACN,yBAAyB,OAAO,WAAW,YACxC,IAAI,CAAC,eAAe;AACnB,eAAO,WAAW;AAAA,MACpB,CAAC,EACA,KAAK,IAAI,CAAC;AAAA,IACf;AACA,YAAQ,IAAI,EAAE;AACd,eAAW,cAAc,OAAO,WAAW,aAAa;AACtD,6BAAuB,WAAW,MAAM,WAAW,MAAM;AAAA,IAC3D;AAAA,EACF,OAAO;AACL,YAAQ;AAAA,MACN,+BAA+B,OAAO,MAAM,IAAI,OAAO,YAAY;AAAA,IACrE;AACA,YAAQ,IAAI,EAAE;AACd;AAAA,MACE,OAAO,UAAU;AAAA,MACjB,OAAO,WAAW;AAAA,IACpB;AAAA,EACF;AACA,UAAQ,IAAI,EAAE;AAChB;AAEA,SAAS,qCACP,QACA,gBACM;AACN,MAAI,OAAO,eAAe,MAAM;AAC9B;AAAA,EACF;AACA,MAAI,mBAAmB,QAAW;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,UAAQ,IAAI,oCAAoC;AAChD,UAAQ,IAAI,EAAE;AACd,UAAQ;AAAA,IACN,yBAAyB,cAAc,aAAa,OAAO,UAAU,KAAK;AAAA,EAC5E;AACA,UAAQ,IAAI,EAAE;AACd,yBAAuB,gBAAgB,OAAO,UAAU;AACxD,UAAQ,IAAI,EAAE;AAChB;AAEA,SAAS,oBACP,MACA,QACM;AACN,QAAM,OAAiB,CAAC;AACxB,MAAI,KAAK,QAAQ,QAAW;AAC1B,SAAK,KAAK,SAAS,cAAc,yBAAyB,KAAK,GAAG,CAAC,CAAC,EAAE;AACtE,QAAI,KAAK,cAAc,QAAW;AAChC,WAAK,KAAK,eAAe,cAAc,KAAK,SAAS,CAAC,EAAE;AAAA,IAC1D;AACA,QAAI,KAAK,YAAY,QAAW;AAC9B,WAAK,KAAK,cAAc,cAAc,KAAK,OAAO,CAAC,EAAE;AAAA,IACvD;AACA,QAAI,WAAW,OAAO;AACpB,WAAK,KAAK,YAAY,cAAc,MAAM,CAAC,EAAE;AAAA,IAC/C;AAAA,EACF,WAAW,KAAK,YAAY,QAAW;AACrC,SAAK,KAAK,cAAc,cAAc,KAAK,OAAO,CAAC,EAAE;AAAA,EACvD;AACA,MAAI,KAAK,oBAAoB,QAAW;AACtC,SAAK,KAAK,sBAAsB,cAAc,KAAK,eAAe,CAAC,EAAE;AAAA,EACvE;AACA,UAAQ;AAAA,IACN,kEAAkE,KAAK,KAAK,GAAG,CAAC;AAAA,EAClF;AACF;AAEO,IAAM,wBAAwB,IAAI,QAAQ,EAC9C,KAAK,iBAAiB,EACtB;AAAA,EACC;AACF,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EAAE,QAAQ,KAAK;AACjB,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF,EACC;AAAA,EACC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeF,EACC;AAAA,EACC,iBAAiB,OAAO,MAA6B,YAAqB;AACxE,kCAA8B,MAAM,OAAO;AAC3C,UAAM,SAAS,KAAK,OAAO,YAAY;AACvC,UAAM,UAAU,uBAAuB,MAAM,MAAM;AACnD,UAAM,aAAa,MAAM,2BAA2B,OAAO;AAC3D,UAAM,SAAS,mBAAmB,SAAS,UAAU;AAErD,2BAAuB,SAAS,MAAM;AACtC,YAAQ,IAAI,EAAE;AAEd,UAAM,cAAc,cAAc,MAAM,UAAU,CAAC;AACnD,UAAM,MAAmB;AAAA,MACvB,kBAAkB,2BAA2B,MAAM;AAAA,MACnD,cAAc,OAAO,UAAU;AAAA,MAC/B,OAAO,OAAO,UAAU;AAAA,MACxB,oBAAoB,OAAO,UAAU,eAAe;AAAA,MACpD,sBAAsB,OAAO,UAAU;AAAA,MACvC,KAAK,OAAO;AAAA,MACZ,gBAAgB,YAAY;AAAA,MAC5B,SAAS,QAAQ,IAAI,iBAAiB;AAAA,IACxC;AAEA,0BAAsB,GAAG;AACzB,UAAM,EAAE,aAAa,WAAW,cAAc,IAC5C,MAAM,qBAAqB,GAAG;AAChC,UAAM,mBAAmB,sBAAsB,GAAG;AAElD,QAAI,qBAAqB,OAAO;AAC9B,cAAQ;AAAA,QACN,0BAA0B,IAAI,KAAK;AAAA,MACrC;AAAA,IACF,WAAW,eAAe,CAAC,aAAa,eAAe;AACrD,cAAQ;AAAA,QACN,0BAA0B,IAAI,KAAK;AAAA,MACrC;AAAA,IACF;AACA,YAAQ,IAAI,EAAE;AAEd,QAAI,OAAO,SAAS,OAAO;AACzB,mCAA6B,MAAM;AAAA,IACrC,OAAO;AACL;AAAA,QACE;AAAA,QACA,QAAQ,SAAS,gBAAgB,QAAQ,aAAa;AAAA,MACxD;AAAA,IACF;AAEA,wBAAoB,MAAM,MAAM;AAAA,EAClC,CAAC;AACH;;;ACj1BF;;;ACAA;AAAA,IAAM,6BAA6B;AACnC,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AACjC,IAAM,sCAAsC,GAAG,wBAAwB;AAQhE,SAAS,8BACd,QACS;AACT,SACE,OAAO,iBAAiB,8BACxB,OAAO,eAAe,2BACtB,OAAO,SAAS,4BAChB,OAAO,MAAM,WAAW,mCAAmC,MAAM;AAErE;AAEO,SAAS,qCAA2C;AACzD,UAAQ,IAAI,+DAA+D;AAC3E,UAAQ;AAAA,IACN;AAAA,EACF;AACA,UAAQ;AAAA,IACN;AAAA,EACF;AACA,UAAQ;AAAA,IACN;AAAA,EACF;AACF;;;ADTA,IAAM,uBAAuB,oBAAI,IAAI;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAASA,gCAA+B,cAA8B;AACpE,SAAO,iCAAiC,YAAY,iBAAiB,wBAAwB;AAC/F;AAEA,SAAS,gBAAuB;AAC9B,SAAO,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,kBAAyB;AAChC,SAAO,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,qBAA4B;AACnC,SAAO,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,kBAAyB;AAChC,SAAO,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,QAAwB;AACjD,QAAM,cAAc,OAAO,YAAY;AACvC,MAAI,CAAC,qBAAqB,IAAI,WAAW,GAAG;AAC1C,UAAM,mBAAmB;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,SAAS,0BAA0B,KAA4B;AAC7D,QAAM,YAAY,IAAI,QAAQ,KAAK;AACnC,MAAI,cAAc,GAAI,QAAO;AAE7B,QAAM,iBAAiB,YAAY;AACnC,MAAI,eAAe,IAAI;AACvB,aAAW,aAAa,CAAC,KAAK,KAAK,GAAG,GAAG;AACvC,UAAM,QAAQ,IAAI,QAAQ,WAAW,cAAc;AACnD,QAAI,UAAU,GAAI,gBAAe,KAAK,IAAI,cAAc,KAAK;AAAA,EAC/D;AACA,SAAO,IAAI,MAAM,gBAAgB,YAAY;AAC/C;AAEA,SAAS,4BAA4B,KAAsB;AACzD,QAAM,YAAY,0BAA0B,GAAG;AAC/C,MAAI,cAAc,KAAM,QAAO;AAC/B,SACE,cAAc,MACd,UAAU,SAAS,IAAI,KACvB,UAAU,SAAS,GAAG,KACtB,CAAC,GAAG,SAAS,EAAE,KAAK,CAAC,SAAS;AAC5B,WAAO,KAAK,WAAW,CAAC,IAAI;AAAA,EAC9B,CAAC;AAEL;AAEA,SAAS,kBAAkB,KAAmB;AAC5C,MACE,CAAC,IAAI,SAAS,KAAK,KACnB,KAAK,KAAK,GAAG,KACb,4BAA4B,GAAG,GAC/B;AACA,UAAM,gBAAgB;AAAA,EACxB;AAEA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,YAAM,gBAAgB;AAAA,IACxB;AACA,QAAI,OAAO,aAAa,MAAM,OAAO,aAAa,IAAI;AACpD,YAAM,gBAAgB;AAAA,IACxB;AAAA,EACF,QAAQ;AACN,UAAM,gBAAgB;AAAA,EACxB;AACF;AAEA,SAASC,0BAAyB,KAAqB;AACrD,QAAM,aAAa,IAAI,QAAQ,GAAG;AAClC,QAAM,gBAAgB,IAAI,QAAQ,GAAG;AACrC,MAAI,MAAM,IAAI;AACd,MAAI,eAAe,GAAI,OAAM,KAAK,IAAI,KAAK,UAAU;AACrD,MAAI,kBAAkB,GAAI,OAAM,KAAK,IAAI,KAAK,aAAa;AAC3D,SAAO,IAAI,MAAM,GAAG,GAAG;AACzB;AAEA,SAAS,qBAAqB,KAAqB;AACjD,QAAM,kBAAkBA,0BAAyB,GAAG;AACpD,QAAM,YAAY,gBAAgB,QAAQ,KAAK;AAC/C,QAAM,iBAAiB,cAAc,KAAK,IAAI,YAAY;AAC1D,QAAM,YAAY,gBAAgB,QAAQ,KAAK,cAAc;AAC7D,SAAO,cAAc,KAAK,MAAM,gBAAgB,MAAM,SAAS;AACjE;AAEA,SAAS,8BACP,cACA,aACM;AACN,QAAM,oBAAoB,CAAC,GAAG,WAAW,EAAE,KAAK;AAChD,MAAI,kBAAkB,WAAW,GAAG;AAClC,UAAM,aAAa,kBAAkB,CAAC;AACtC,YAAQ,IAAI,2BAA2B,UAAU,eAAe;AAChE,YAAQ;AAAA,MACN,gEAAgE,YAAY,iBAAiB,UAAU;AAAA,IACzG;AACA;AAAA,EACF;AAEA,UAAQ;AAAA,IACN,yCAAyC,kBAAkB,KAAK,IAAI,CAAC;AAAA,EACvE;AACA,aAAW,cAAc,mBAAmB;AAC1C,YAAQ;AAAA,MACN,YAAY,UAAU,wCAAwC,YAAY,iBAAiB,UAAU;AAAA,IACvG;AAAA,EACF;AACF;AAEA,SAAS,qBACP,OACA,QACA,cACA,MACM;AACN,UAAQ;AAAA,IACN,OAAO,KAAK,wBAAwB,MAAM,IAAI,YAAY,yBAAyB,IAAI;AAAA,EACzF;AACF;AAEA,SAASC,kBAAiB,QAAkC;AAC1D,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,mBAAmB;AAAA,IAC5B,KAAK;AACH,aAAO,gBAAgB;AAAA,IACzB,KAAK;AACH,aAAO,gBAAgB;AAAA,EAC3B;AACF;AAEA,SAAS,uBACP,cACA,QACA,QACM;AACN,UAAQ,OAAO,SAAS;AAAA,IACtB,KAAK;AACH;AAAA,QACE,OAAO;AAAA,QACP;AAAA,QACA,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AACA,oCAA8B,cAAc,OAAO,WAAW;AAC9D;AAAA,IACF,KAAK;AACH;AAAA,QACE,OAAO;AAAA,QACP;AAAA,QACA,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AACA,cAAQ,IAAI,sDAAsD;AAClE,cAAQ,IAAI,0DAA0D;AACtE,cAAQ;AAAA,QACN,oCAAoCF,gCAA+B,YAAY,CAAC;AAAA,MAClF;AACA;AAAA,IACF,KAAK;AACH,YAAM,IAAI,MAAM,2BAA2B,YAAY,EAAE;AAAA,IAC3D,KAAK;AACH,YAAM,IAAI;AAAA,QACR,iBAAiB,OAAO,KAAK;AAAA,MAC/B;AAAA,IACF,KAAK;AACH,YAAM,IAAI;AAAA,QACR,oBAAoB,OAAO,KAAK,0DAA0D,YAAY;AAAA,MACxG;AAAA,IACF,KAAK;AACH,YAAME,kBAAiB,OAAO,MAAM;AAAA,EACxC;AAEA,QAAM,mBAA0B;AAChC,SAAO;AACT;AAEO,IAAM,wBAAwB,IAAI,QAAQ,EAC9C,KAAK,iBAAiB,EACtB;AAAA,EACC;AACF,EACC,SAAS,mBAAmB,kCAAkC,EAC9D;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EAAE,oBAAoB;AACxB,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF,EACC,UAAU,IAAI,OAAO,iBAAiB,uBAAuB,EAAE,SAAS,CAAC,EACzE;AAAA,EACC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaF,EACC;AAAA,EACC;AAAA,IACE,OAAO,cAAsB,SAAgC;AAC3D,UAAI,KAAK,SAAS,QAAW;AAC3B,cAAM,cAAc;AAAA,MACtB;AACA,UAAI,CAAC,KAAK,KAAK;AACb,cAAM,cAAc;AAAA,MACtB;AAEA,YAAM,SAAS,kBAAkB,KAAK,MAAM;AAC5C,wBAAkB,KAAK,GAAG;AAC1B,YAAM,aAAa,qBAAqB,KAAK,GAAG;AAChD,UAAI,sBAAsB,UAAU,GAAG;AACrC,cAAM,gBAAgB;AAAA,MACxB;AAEA,UACE,8BAA8B;AAAA,QAC5B;AAAA,QACA,MAAM;AAAA,MACR,CAAC,GACD;AACA,2CAAmC;AACnC;AAAA,MACF;AAEA,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACAD,0BAAyB,KAAK,GAAG;AAAA,MACnC;AACA,6BAAuB,cAAc,QAAQ,MAAM;AAAA,IACrD;AAAA,EACF;AACF;;;AEzSF;AAgBA,IAAM,oCAAkE;AACxE,IAAM,6BAA6B;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,SAAS,sBAAsB,YAA4B;AACzD,SAAO,eAAe,2BAClB,sBACA,QAAQ,UAAU;AACxB;AAEA,SAAS,iCACP,cACA,YACA,QACM;AACN,MAAI,WAAW,SAAU;AAGzB,MAAI,iBAAiB,WAAW,eAAe,cAAc;AAC3D,YAAQ,IAAI,EAAE;AACd,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ,IAAI,EAAE;AAAA,EAChB;AAGA,MACE,iBAAiB,YAChB,eAAe,mBAAmB,eAAe,gBAClD;AACA,YAAQ,IAAI,EAAE;AACd,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ,IAAI,EAAE;AAAA,EAChB;AACF;AAEA,SAAS,6BAA6B,MAM7B;AACP,QAAM,cAAc,KAAK,WAAW,WAAW,UAAU;AACzD,UAAQ;AAAA,IACN,WAAW,WAAW,IAAI,sBAAsB,KAAK,UAAU,CAAC,uCAAuC,KAAK,KAAK,iBAAiB,KAAK,GAAG;AAAA,EAC5I;AACA,MAAI,KAAK,UAAU;AACjB,YAAQ;AAAA,MACN,uBAAuB,KAAK,QAAQ;AAAA,IACtC;AAAA,EACF;AACF;AAEA,SAAS,kCAAkC,MAGlC;AACP,UAAQ;AAAA,IACN;AAAA,EACF;AACA,UAAQ;AAAA,IACN;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,gBAAgB;AACjC,UAAQ;AAAA,IACN,wBAAwB,KAAK,SAAS;AAAA,EACxC;AACF;AAEA,eAAe,wCACb,QACe;AACf,MAAI,WAAW,UAAU;AACvB,uCAAmC;AACnC;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,IAAI,YAAY;AAC3B,uCAAmC;AACnC;AAAA,EACF;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,sCAAsC;AAC5D,sCAAkC;AAAA,MAChC,kBAAkB,QAAQ;AAAA,MAC1B,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAiB;AACpC,cAAQ;AAAA,QACN,gDAAgD,MAAM,OAAO;AAAA,MAC/D;AACA,yCAAmC;AACnC;AAAA,IACF;AACA,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAQ,IAAI,gDAAgD,OAAO,EAAE;AACrE,uCAAmC;AAAA,EACrC;AACF;AAEA,eAAe,8BACb,cACA,OACA,YACA,QACA,UACA,SACe;AACf,QAAM,iBAAiB,MAAM,kBAAkB;AAE/C,QAAM,YAAY,IAAI,gBAAgB;AAAA,IACpC,KAAK;AAAA,IACL;AAAA,IACA,QAAQ,WAAW,WAAW,UAAU;AAAA,EAC1C,CAAC;AACD,MAAI,WAAW,UAAU;AACvB,cAAU,IAAI,aAAa,YAAY,iCAAiC;AAAA,EAC1E;AAEA,QAAM,WAAW,UAAU,WAAW,OAAO,iBAAiB;AAC9D,QAAM,MAAM,GAAG,cAAc,GAAG,QAAQ,IAAI,UAAU,SAAS,CAAC;AAEhE,mCAAiC,cAAc,YAAY,MAAM;AACjE,+BAA6B;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UACE,WAAW,WACN,YAAY,oCACb;AAAA,EACR,CAAC;AACH;AAEO,IAAM,0BAA0B,IAAI,QAAQ,EAChD,KAAK,mBAAmB,EACxB,YAAY,oDAAoD,EAChE,SAAS,mBAAmB,kCAAkC,EAC9D;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EAAE,oBAAoB;AACxB,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EAAE,UAAU,SAAS;AACvB,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EAAE,UAAU,QAAQ;AACtB,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EAAE,QAAQ,CAAC,GAAG,0BAA0B,CAAC;AAC3C,EACC;AAAA,EACC,IAAI,OAAO,mBAAmB,wCAAwC;AACxE,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACF,EACC;AAAA,EACC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBF,EACC;AAAA,EACC;AAAA,IACE,OACE,cACA,SAQG;AACH,UAAI,CAAC,KAAK,UAAU,CAAC,KAAK,SAAS;AACjC,cAAM,IAAI,MAAM,0CAA0C;AAAA,MAC5D;AACA,UAAI,KAAK,WAAW,KAAK,aAAa,QAAW;AAC/C,cAAM,IAAI,MAAM,4CAA4C;AAAA,MAC9D;AAEA,UACE,8BAA8B;AAAA,QAC5B;AAAA,QACA,YAAY,KAAK;AAAA,MACnB,CAAC,GACD;AACA,cAAM;AAAA,UACJ,KAAK,SAAS,WAAW;AAAA,QAC3B;AACA;AAAA,MACF;AAEA,YAAM,WAAW,MAAM,mCAAmC,YAAY;AACtE,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,MAAM,2BAA2B,YAAY,EAAE;AAAA,MAC3D;AAEA,UACE,KAAK,eAAe,4BACpB,CAAC,+BAA+B,UAAU,KAAK,UAAU,GACzD;AACA,cAAM,IAAI;AAAA,UACR,uBAAuB,KAAK,UAAU,SAAS,YAAY;AAAA,QAC7D;AAAA,MACF;AAEA,YAAM,SAAS,KAAK,SAAS,WAAW;AACxC,YAAM;AAAA,QACJ;AAAA,QACA,SAAS;AAAA,QACT,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,QACL,KAAK,SAAS,QAAQ,IAAI;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACF;;;AChSF;AAUA,SAAS,WAAW,QAIT;AACT,QAAM,OAAO,CAAC,OAAO,WAAW,OAAO,QAAQ,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG;AACzE,SAAO,OAAO,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM,OAAO;AACrD;AAEO,IAAM,gBAAgB,IAAI,QAAQ,EACtC,KAAK,QAAQ,EACb,YAAY,0DAA0D,EACtE;AAAA,EACC,iBAAiB,YAAY;AAC3B,UAAM,CAAC,KAAK,SAAS,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,MAChD,WAAW;AAAA,MACX,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,IACpB,CAAC;AACD,UAAM,SAAS,QAAQ,QAAQ,OAAO,CAAC,WAAW;AAChD,aAAO,OAAO,SAAS;AAAA,IACzB,CAAC;AACD,UAAM,UAAU,QAAQ,SAAS;AACjC,UAAM,qBAAqB;AAE3B,YAAQ,IAAI,eAAM,KAAK,qBAAqB,CAAC;AAC7C,YAAQ,IAAI,UAAU,eAAM,MAAM,IAAI,IAAI,CAAC,EAAE;AAC7C,YAAQ,IAAI,WAAW,eAAM,KAAK,QAAQ,IAAI,CAAC,EAAE;AACjD,YAAQ;AAAA,MACN,wBAAwB,eAAM,KAAK,QAAQ,QAAQ,eAAe,CAAC,CAAC;AAAA,IACtE;AACA,YAAQ,IAAI,wBAAwB,eAAM,KAAK,QAAQ,IAAI,CAAC,EAAE;AAC9D,YAAQ;AAAA,MACN,2BACE,qBAAqB,eAAM,MAAM,KAAK,IAAI,eAAM,OAAO,IAAI,CAC7D;AAAA,IACF;AACA,YAAQ;AAAA,MACN,oBACE,QAAQ,aAAa,UAAU,eAAM,MAAM,SAAS,IAAI,UAC1D;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS;AAChC,cAAQ;AAAA,QACN,kBAAkB,QAAQ,aAAa,WAAW,eAAe,KAAK,SAAS;AAAA,MACjF;AACA,cAAQ;AAAA,QACN,eAAe,QAAQ,aAAa,QAAQ,eAAe,KAAK,SAAS;AAAA,MAC3E;AAAA,IACF;AAEA,QAAI,CAAC,SAAS;AACZ,cAAQ,IAAI,eAAM,KAAK,wBAAwB,CAAC;AAChD,iBAAW,SAAS,QAAQ;AAC1B,gBAAQ,IAAI,OAAO,WAAW,KAAK,CAAC,EAAE;AAAA,MACxC;AACA,cAAQ;AAAA,QACN,eAAM;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,QAAQ,SAAS,QAAQ;AAClC,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,IAAI,oDAAoD;AAAA,IAClE;AAAA,EACF,CAAC;AACH;;;ALzEK,IAAM,oBAAoB,IAAI,QAAQ,EAC1C,KAAK,QAAQ,EACb,YAAY,gEAAgE,EAC5E,WAAW,qBAAqB,EAChC,WAAW,aAAa,EACxB,WAAW,qBAAqB,EAChC,WAAW,uBAAuB,EAClC;AAAA,EACC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeF;","names":["unknownPermissionChangeCommand","stripUrlQueryAndFragment","unsafeInputError"]}

package/search-JSTRJBHA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/commands/zero/search/index.ts"],"sourcesContent":["import { Command } from \"commander\";\nimport chalk from \"chalk\";\nimport { withErrorHandler } from \"../../../lib/command\";\nimport { runLogsSearch, type LogsSearchCliOptions } from \"../logs/search\";\nimport { searchZeroChat } from \"../../../lib/api\";\nimport type {\n  ChatSearchMessage,\n  ChatSearchResponse,\n} from \"@vm0/api-contracts/contracts/chat-threads\";\nimport { parseTime } from \"../../../lib/utils/time-parser\";\nimport { formatIsoTimestamp } from \"../../../lib/utils/time-format\";\nimport { parseBoundedLogCount } from \"../../../lib/utils/log-pagination\";\nimport { parseSearchQuery } from \"../../../lib/utils/search-query\";\nimport { isUUID } from \"../../run/shared\";\n\nconst SUPPORTED_SOURCES = [\"logs\", \"chat\", \"slack\"] as const;\ntype Source = (typeof SUPPORTED_SOURCES)[number];\n\nconst SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;\n\nexport const SEARCH_EXPLAINER = `\nAvailable sources:\n  logs   full agent event stream (tool calls, tokens, system events) from agent runs\n  chat   user/assistant text messages as shown in the web chat UI\n  slack  returns a recipe for calling the Slack API directly; requires the Slack connector\n\nUsage: zero search <query> --source <logs|chat|slack> [flags]\nRun 'zero search --help' for all flags.`;\n\nexport function buildSlackRecipe(query: string): string {\n  const encoded = encodeURIComponent(query);\n  return `The \\`slack\\` source does not call Slack from this CLI. Run the\nfollowing inside an agent sandbox that has $SLACK_TOKEN available:\n\n  curl -H \"Authorization: Bearer $SLACK_TOKEN\" \\\\\n    \"https://slack.com/api/search.messages?query=${encoded}\"\n\nIf you don't have $SLACK_TOKEN, check the connector status:\n  zero connector status slack\n\nTo verify the token and network policy end-to-end:\n  zero doctor check-connector --env-name SLACK_TOKEN\n\nSlack API docs: https://api.slack.com/methods/search.messages\n\nNote: CLI-local flags (--limit, --since, -A/-B/-C) are ignored for the\nslack source. Pass equivalents to Slack's API via count= / highlight=\nquery parameters instead.`;\n}\n\ninterface SearchOptions {\n  source: string[];\n  agent?: string;\n  run?: string;\n  since?: string;\n  limit?: string;\n  afterContext?: string;\n  beforeContext?: string;\n  context?: string;\n}\n\nfunction collectSource(value: string, previous: string[]): string[] {\n  return [...previous, value];\n}\n\nfunction parseContextOptions(options: SearchOptions): {\n  before: number;\n  after: number;\n} {\n  const contextN =\n    options.context !== undefined\n      ? parseBoundedLogCount(options.context, \"--context\", 0, 10)\n      : 0;\n  const before =\n    options.beforeContext !== undefined\n      ? parseBoundedLogCount(options.beforeContext, \"--before-context\", 0, 10)\n      : contextN;\n  const after =\n    options.afterContext !== undefined\n      ? parseBoundedLogCount(options.afterContext, \"--after-context\", 0, 10)\n      : contextN;\n\n  return { before, after };\n}\n\nfunction parseLimit(value: string | undefined): number | undefined {\n  if (value === undefined) return undefined;\n  return parseBoundedLogCount(value, \"--limit\", 1, 50);\n}\n\nasync function runLogsSource(\n  query: string,\n  options: SearchOptions,\n): Promise<void> {\n  const logsOptions: LogsSearchCliOptions = {\n    afterContext: options.afterContext,\n    beforeContext: options.beforeContext,\n    context: options.context,\n    agentId: options.agent,\n    run: options.run,\n    since: options.since,\n    limit: options.limit,\n  };\n  await runLogsSearch(query, logsOptions);\n}\n\nfunction formatTimestamp(iso: string): string {\n  return formatIsoTimestamp(iso);\n}\n\nfunction renderChatMessage(msg: ChatSearchMessage, isMatch: boolean): void {\n  const marker = isMatch ? chalk.yellow(\"▸\") : chalk.dim(\"·\");\n  const header = `${marker} ${chalk.dim(msg.role)} ${chalk.dim(formatTimestamp(msg.createdAt))}`;\n  console.log(header);\n  console.log(isMatch ? msg.content : chalk.dim(msg.content));\n}\n\nfunction renderChatResults(response: ChatSearchResponse): void {\n  let isFirst = true;\n  for (const result of response.results) {\n    if (!isFirst) console.log();\n    isFirst = false;\n\n    console.log(\n      chalk.bold(\n        `── Thread ${result.chatThreadId} (${result.agentName}) ──────────`,\n      ),\n    );\n    for (const msg of result.contextBefore) {\n      renderChatMessage(msg, false);\n    }\n    renderChatMessage(result.matchedMessage, true);\n    for (const msg of result.contextAfter) {\n      renderChatMessage(msg, false);\n    }\n  }\n\n  if (response.hasMore) {\n    console.log();\n    console.log(\n      chalk.dim(\n        `  Showing first ${response.results.length} matches. Use --limit to see more.`,\n      ),\n    );\n  }\n}\n\nasync function runChatSource(\n  query: string,\n  options: SearchOptions,\n): Promise<void> {\n  if (options.run !== undefined) {\n    throw new Error(\"--run is not supported with --source chat\");\n  }\n  if (options.agent !== undefined && !isUUID(options.agent)) {\n    console.error(\n      chalk.red(`✗ Invalid agent ID \"${options.agent}\" — expected a UUID`),\n    );\n    console.error(chalk.dim(\"  Run: zero logs list    to find agent IDs\"));\n    process.exit(1);\n  }\n\n  const { before, after } = parseContextOptions(options);\n  const limit = parseLimit(options.limit);\n  const since =\n    options.since !== undefined\n      ? parseTime(options.since)\n      : Date.now() - SEVEN_DAYS_MS;\n\n  const response = await searchZeroChat({\n    keyword: query,\n    agentId: options.agent,\n    since,\n    limit,\n    before,\n    after,\n  });\n\n  if (response.results.length === 0) {\n    console.log(chalk.dim(\"No matches found\"));\n    console.log(\n      chalk.dim(\n        \"  Try a broader search with --since 30d or a different keyword\",\n      ),\n    );\n    return;\n  }\n\n  renderChatResults(response);\n}\n\nasync function runSlackSource(\n  query: string,\n  _options: SearchOptions,\n): Promise<void> {\n  console.log(buildSlackRecipe(query));\n}\n\nexport const zeroSearchCommand = new Command()\n  .name(\"search\")\n  .description(\"Search logs, chat, or get a recipe for external sources\")\n  .argument(\"<query>\", \"Search query\")\n  .option(\n    \"--source <type>\",\n    \"Source to search: logs | chat | slack (pass once)\",\n    collectSource,\n    [] as string[],\n  )\n  .option(\"--agent <id>\", \"Filter by Zero agent ID\")\n  .option(\"--run <id>\", \"Filter by run ID\")\n  .option(\"--since <time>\", \"Time window (e.g., 7d, 2h)\")\n  .option(\"--limit <n>\", \"Maximum number of matches\")\n  .option(\"-A, --after-context <n>\", \"Show n items after each match\")\n  .option(\"-B, --before-context <n>\", \"Show n items before each match\")\n  .option(\"-C, --context <n>\", \"Show n items before and after each match\")\n  .addHelpText(\"after\", SEARCH_EXPLAINER)\n  .action(\n    withErrorHandler(async (query: string, options: SearchOptions) => {\n      const searchQuery = parseSearchQuery(query, \"Query\");\n      const sources = options.source;\n\n      if (sources.length === 0) {\n        console.log(SEARCH_EXPLAINER);\n        return;\n      }\n\n      if (sources.length > 1) {\n        throw new Error(\"Only one --source is allowed.\");\n      }\n\n      const source = sources[0]!;\n      if (!SUPPORTED_SOURCES.includes(source as Source)) {\n        throw new Error(\n          `Unknown --source \"${source}\". Expected one of: ${SUPPORTED_SOURCES.join(\", \")}`,\n        );\n      }\n\n      switch (source as Source) {\n        case \"logs\":\n          await runLogsSource(searchQuery, options);\n          return;\n        case \"chat\":\n          await runChatSource(searchQuery, options);\n          return;\n        case \"slack\":\n          await runSlackSource(searchQuery, options);\n          return;\n      }\n    }),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAeA,IAAM,oBAAoB,CAAC,QAAQ,QAAQ,OAAO;AAGlD,IAAM,gBAAgB,IAAI,KAAK,KAAK,KAAK;AAElC,IAAM,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AASzB,SAAS,iBAAiB,OAAuB;AACtD,QAAM,UAAU,mBAAmB,KAAK;AACxC,SAAO;AAAA;AAAA;AAAA;AAAA,mDAI0C,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAa1D;AAaA,SAAS,cAAc,OAAe,UAA8B;AAClE,SAAO,CAAC,GAAG,UAAU,KAAK;AAC5B;AAEA,SAAS,oBAAoB,SAG3B;AACA,QAAM,WACJ,QAAQ,YAAY,SAChB,qBAAqB,QAAQ,SAAS,aAAa,GAAG,EAAE,IACxD;AACN,QAAM,SACJ,QAAQ,kBAAkB,SACtB,qBAAqB,QAAQ,eAAe,oBAAoB,GAAG,EAAE,IACrE;AACN,QAAM,QACJ,QAAQ,iBAAiB,SACrB,qBAAqB,QAAQ,cAAc,mBAAmB,GAAG,EAAE,IACnE;AAEN,SAAO,EAAE,QAAQ,MAAM;AACzB;AAEA,SAAS,WAAW,OAA+C;AACjE,MAAI,UAAU,OAAW,QAAO;AAChC,SAAO,qBAAqB,OAAO,WAAW,GAAG,EAAE;AACrD;AAEA,eAAe,cACb,OACA,SACe;AACf,QAAM,cAAoC;AAAA,IACxC,cAAc,QAAQ;AAAA,IACtB,eAAe,QAAQ;AAAA,IACvB,SAAS,QAAQ;AAAA,IACjB,SAAS,QAAQ;AAAA,IACjB,KAAK,QAAQ;AAAA,IACb,OAAO,QAAQ;AAAA,IACf,OAAO,QAAQ;AAAA,EACjB;AACA,QAAM,cAAc,OAAO,WAAW;AACxC;AAEA,SAAS,gBAAgB,KAAqB;AAC5C,SAAO,mBAAmB,GAAG;AAC/B;AAEA,SAAS,kBAAkB,KAAwB,SAAwB;AACzE,QAAM,SAAS,UAAU,eAAM,OAAO,QAAG,IAAI,eAAM,IAAI,MAAG;AAC1D,QAAM,SAAS,GAAG,MAAM,IAAI,eAAM,IAAI,IAAI,IAAI,CAAC,IAAI,eAAM,IAAI,gBAAgB,IAAI,SAAS,CAAC,CAAC;AAC5F,UAAQ,IAAI,MAAM;AAClB,UAAQ,IAAI,UAAU,IAAI,UAAU,eAAM,IAAI,IAAI,OAAO,CAAC;AAC5D;AAEA,SAAS,kBAAkB,UAAoC;AAC7D,MAAI,UAAU;AACd,aAAW,UAAU,SAAS,SAAS;AACrC,QAAI,CAAC,QAAS,SAAQ,IAAI;AAC1B,cAAU;AAEV,YAAQ;AAAA,MACN,eAAM;AAAA,QACJ,uBAAa,OAAO,YAAY,KAAK,OAAO,SAAS;AAAA,MACvD;AAAA,IACF;AACA,eAAW,OAAO,OAAO,eAAe;AACtC,wBAAkB,KAAK,KAAK;AAAA,IAC9B;AACA,sBAAkB,OAAO,gBAAgB,IAAI;AAC7C,eAAW,OAAO,OAAO,cAAc;AACrC,wBAAkB,KAAK,KAAK;AAAA,IAC9B;AAAA,EACF;AAEA,MAAI,SAAS,SAAS;AACpB,YAAQ,IAAI;AACZ,YAAQ;AAAA,MACN,eAAM;AAAA,QACJ,mBAAmB,SAAS,QAAQ,MAAM;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,cACb,OACA,SACe;AACf,MAAI,QAAQ,QAAQ,QAAW;AAC7B,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,MAAI,QAAQ,UAAU,UAAa,CAAC,OAAO,QAAQ,KAAK,GAAG;AACzD,YAAQ;AAAA,MACN,eAAM,IAAI,4BAAuB,QAAQ,KAAK,0BAAqB;AAAA,IACrE;AACA,YAAQ,MAAM,eAAM,IAAI,4CAA4C,CAAC;AACrE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,EAAE,QAAQ,MAAM,IAAI,oBAAoB,OAAO;AACrD,QAAM,QAAQ,WAAW,QAAQ,KAAK;AACtC,QAAM,QACJ,QAAQ,UAAU,SACd,UAAU,QAAQ,KAAK,IACvB,KAAK,IAAI,IAAI;AAEnB,QAAM,WAAW,MAAM,eAAe;AAAA,IACpC,SAAS;AAAA,IACT,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,SAAS,QAAQ,WAAW,GAAG;AACjC,YAAQ,IAAI,eAAM,IAAI,kBAAkB,CAAC;AACzC,YAAQ;AAAA,MACN,eAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAEA,oBAAkB,QAAQ;AAC5B;AAEA,eAAe,eACb,OACA,UACe;AACf,UAAQ,IAAI,iBAAiB,KAAK,CAAC;AACrC;AAEO,IAAM,oBAAoB,IAAI,QAAQ,EAC1C,KAAK,QAAQ,EACb,YAAY,yDAAyD,EACrE,SAAS,WAAW,cAAc,EAClC;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA,CAAC;AACH,EACC,OAAO,gBAAgB,yBAAyB,EAChD,OAAO,cAAc,kBAAkB,EACvC,OAAO,kBAAkB,4BAA4B,EACrD,OAAO,eAAe,2BAA2B,EACjD,OAAO,2BAA2B,+BAA+B,EACjE,OAAO,4BAA4B,gCAAgC,EACnE,OAAO,qBAAqB,0CAA0C,EACtE,YAAY,SAAS,gBAAgB,EACrC;AAAA,EACC,iBAAiB,OAAO,OAAe,YAA2B;AAChE,UAAM,cAAc,iBAAiB,OAAO,OAAO;AACnD,UAAM,UAAU,QAAQ;AAExB,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,gBAAgB;AAC5B;AAAA,IACF;AAEA,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AAEA,UAAM,SAAS,QAAQ,CAAC;AACxB,QAAI,CAAC,kBAAkB,SAAS,MAAgB,GAAG;AACjD,YAAM,IAAI;AAAA,QACR,qBAAqB,MAAM,uBAAuB,kBAAkB,KAAK,IAAI,CAAC;AAAA,MAChF;AAAA,IACF;AAEA,YAAQ,QAAkB;AAAA,MACxB,KAAK;AACH,cAAM,cAAc,aAAa,OAAO;AACxC;AAAA,MACF,KAAK;AACH,cAAM,cAAc,aAAa,OAAO;AACxC;AAAA,MACF,KAAK;AACH,cAAM,eAAe,aAAa,OAAO;AACzC;AAAA,IACJ;AAAA,EACF,CAAC;AACH;","names":[]}