@vm0/cli 9.244.8 → 9.245.0

package/{chunk-65MTNZ44.js → chunk-6P7XBY46.js}

@@ -6,13 +6,12 @@ import {
 } from "./chunk-DWWE7STW.js";
 import {
   authHeadersSchema,
-  composeListItemSchema,
   connectorCatalogRefSchema,
-  firewallPoliciesSchema,
-  getEvents,
+  firewallsSchema,
   runnerGroupSchema,
+  searchZeroLogs,
   zeroAgentVisibilitySchema
-} from "./chunk-MX32FFQR.js";
+} from "./chunk-5XVBOER3.js";
 import {
   apiErrorSchema,
   external_exports,
@@ -23,8 +22,12 @@ import {
   source_default,
   supportedRunModelSchema,
   upsertModelProviderRequestSchema,
-  upsertModelProviderResponseSchema
-} from "./chunk-MA37R4QS.js";
+  upsertModelProviderResponseSchema,
+  withErrorHandler
+} from "./chunk-XYZN3XWH.js";
+import {
+  Command
+} from "./chunk-B3W2RUBP.js";
 import {
   __commonJS,
   __require,
@@ -6955,14 +6958,14 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs2 = this.flowScalar(this.type);
+              const fs = this.flowScalar(this.type);
               if (atNextItem || it.value) {
-                map.items.push({ start, key: fs2, sep: [] });
+                map.items.push({ start, key: fs, sep: [] });
                 this.onKeyLine = true;
               } else if (it.sep) {
-                this.stack.push(fs2);
+                this.stack.push(fs);
               } else {
-                Object.assign(it, { key: fs2, sep: [] });
+                Object.assign(it, { key: fs, sep: [] });
                 this.onKeyLine = true;
               }
               return;
@@ -7090,13 +7093,13 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs2 = this.flowScalar(this.type);
+              const fs = this.flowScalar(this.type);
               if (!it || it.value)
-                fc.items.push({ start: [], key: fs2, sep: [] });
+                fc.items.push({ start: [], key: fs, sep: [] });
               else if (it.sep)
-                this.stack.push(fs2);
+                this.stack.push(fs);
               else
-                Object.assign(it, { key: fs2, sep: [] });
+                Object.assign(it, { key: fs, sep: [] });
               return;
             }
             case "flow-map-end":
@@ -7406,401 +7409,89 @@ var require_dist = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/dotenv@17.3.1/node_modules/dotenv/package.json
-var require_package = __commonJS({
-  "../../node_modules/.pnpm/dotenv@17.3.1/node_modules/dotenv/package.json"(exports, module) {
-    module.exports = {
-      name: "dotenv",
-      version: "17.3.1",
-      description: "Loads environment variables from .env file",
-      main: "lib/main.js",
-      types: "lib/main.d.ts",
-      exports: {
-        ".": {
-          types: "./lib/main.d.ts",
-          require: "./lib/main.js",
-          default: "./lib/main.js"
-        },
-        "./config": "./config.js",
-        "./config.js": "./config.js",
-        "./lib/env-options": "./lib/env-options.js",
-        "./lib/env-options.js": "./lib/env-options.js",
-        "./lib/cli-options": "./lib/cli-options.js",
-        "./lib/cli-options.js": "./lib/cli-options.js",
-        "./package.json": "./package.json"
-      },
-      scripts: {
-        "dts-check": "tsc --project tests/types/tsconfig.json",
-        lint: "standard",
-        pretest: "npm run lint && npm run dts-check",
-        test: "tap run tests/**/*.js --allow-empty-coverage --disable-coverage --timeout=60000",
-        "test:coverage": "tap run tests/**/*.js --show-full-coverage --timeout=60000 --coverage-report=text --coverage-report=lcov",
-        prerelease: "npm test",
-        release: "standard-version"
-      },
-      repository: {
-        type: "git",
-        url: "git://github.com/motdotla/dotenv.git"
-      },
-      homepage: "https://github.com/motdotla/dotenv#readme",
-      funding: "https://dotenvx.com",
-      keywords: [
-        "dotenv",
-        "env",
-        ".env",
-        "environment",
-        "variables",
-        "config",
-        "settings"
-      ],
-      readmeFilename: "README.md",
-      license: "BSD-2-Clause",
-      devDependencies: {
-        "@types/node": "^18.11.3",
-        decache: "^4.6.2",
-        sinon: "^14.0.1",
-        standard: "^17.0.0",
-        "standard-version": "^9.5.0",
-        tap: "^19.2.0",
-        typescript: "^4.8.4"
-      },
-      engines: {
-        node: ">=12"
-      },
-      browser: {
-        fs: false
-      }
-    };
-  }
-});
-
-// ../../node_modules/.pnpm/dotenv@17.3.1/node_modules/dotenv/lib/main.js
-var require_main = __commonJS({
-  "../../node_modules/.pnpm/dotenv@17.3.1/node_modules/dotenv/lib/main.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var fs2 = __require("fs");
-    var path = __require("path");
-    var os = __require("os");
-    var crypto = __require("crypto");
-    var packageJson = require_package();
-    var version = packageJson.version;
-    var TIPS = [
-      "\u{1F510} encrypt with Dotenvx: https://dotenvx.com",
-      "\u{1F510} prevent committing .env to code: https://dotenvx.com/precommit",
-      "\u{1F510} prevent building .env in docker: https://dotenvx.com/prebuild",
-      "\u{1F916} agentic secret storage: https://dotenvx.com/as2",
-      "\u26A1\uFE0F secrets for agents: https://dotenvx.com/as2",
-      "\u{1F6E1}\uFE0F auth for agents: https://vestauth.com",
-      "\u{1F6E0}\uFE0F  run anywhere with `dotenvx run -- yourcommand`",
-      "\u2699\uFE0F  specify custom .env file path with { path: '/custom/path/.env' }",
-      "\u2699\uFE0F  enable debug logging with { debug: true }",
-      "\u2699\uFE0F  override existing env vars with { override: true }",
-      "\u2699\uFE0F  suppress all logs with { quiet: true }",
-      "\u2699\uFE0F  write to custom object with { processEnv: myObject }",
-      "\u2699\uFE0F  load multiple .env files with { path: ['.env.local', '.env'] }"
-    ];
-    function _getRandomTip() {
-      return TIPS[Math.floor(Math.random() * TIPS.length)];
-    }
-    function parseBoolean(value) {
-      if (typeof value === "string") {
-        return !["false", "0", "no", "off", ""].includes(value.toLowerCase());
-      }
-      return Boolean(value);
-    }
-    function supportsAnsi() {
-      return process.stdout.isTTY;
-    }
-    function dim(text) {
-      return supportsAnsi() ? `\x1B[2m${text}\x1B[0m` : text;
-    }
-    var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg;
-    function parse(src) {
-      const obj = {};
-      let lines = src.toString();
-      lines = lines.replace(/\r\n?/mg, "\n");
-      let match;
-      while ((match = LINE.exec(lines)) != null) {
-        const key = match[1];
-        let value = match[2] || "";
-        value = value.trim();
-        const maybeQuote = value[0];
-        value = value.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");
-        if (maybeQuote === '"') {
-          value = value.replace(/\\n/g, "\n");
-          value = value.replace(/\\r/g, "\r");
-        }
-        obj[key] = value;
-      }
-      return obj;
-    }
-    function _parseVault(options) {
-      options = options || {};
-      const vaultPath = _vaultPath(options);
-      options.path = vaultPath;
-      const result = DotenvModule.configDotenv(options);
-      if (!result.parsed) {
-        const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
-        err.code = "MISSING_DATA";
-        throw err;
-      }
-      const keys = _dotenvKey(options).split(",");
-      const length = keys.length;
-      let decrypted;
-      for (let i = 0; i < length; i++) {
-        try {
-          const key = keys[i].trim();
-          const attrs = _instructions(result, key);
-          decrypted = DotenvModule.decrypt(attrs.ciphertext, attrs.key);
-          break;
-        } catch (error) {
-          if (i + 1 >= length) {
-            throw error;
-          }
-        }
-      }
-      return DotenvModule.parse(decrypted);
-    }
-    function _warn(message) {
-      console.error(`[dotenv@${version}][WARN] ${message}`);
-    }
-    function _debug(message) {
-      console.log(`[dotenv@${version}][DEBUG] ${message}`);
-    }
-    function _log(message) {
-      console.log(`[dotenv@${version}] ${message}`);
-    }
-    function _dotenvKey(options) {
-      if (options && options.DOTENV_KEY && options.DOTENV_KEY.length > 0) {
-        return options.DOTENV_KEY;
-      }
-      if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) {
-        return process.env.DOTENV_KEY;
-      }
-      return "";
-    }
-    function _instructions(result, dotenvKey) {
-      let uri;
-      try {
-        uri = new URL(dotenvKey);
-      } catch (error) {
-        if (error.code === "ERR_INVALID_URL") {
-          const err = new Error("INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development");
-          err.code = "INVALID_DOTENV_KEY";
-          throw err;
-        }
-        throw error;
-      }
-      const key = uri.password;
-      if (!key) {
-        const err = new Error("INVALID_DOTENV_KEY: Missing key part");
-        err.code = "INVALID_DOTENV_KEY";
-        throw err;
-      }
-      const environment = uri.searchParams.get("environment");
-      if (!environment) {
-        const err = new Error("INVALID_DOTENV_KEY: Missing environment part");
-        err.code = "INVALID_DOTENV_KEY";
-        throw err;
-      }
-      const environmentKey = `DOTENV_VAULT_${environment.toUpperCase()}`;
-      const ciphertext = result.parsed[environmentKey];
-      if (!ciphertext) {
-        const err = new Error(`NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate environment ${environmentKey} in your .env.vault file.`);
-        err.code = "NOT_FOUND_DOTENV_ENVIRONMENT";
-        throw err;
-      }
-      return { ciphertext, key };
-    }
-    function _vaultPath(options) {
-      let possibleVaultPath = null;
-      if (options && options.path && options.path.length > 0) {
-        if (Array.isArray(options.path)) {
-          for (const filepath of options.path) {
-            if (fs2.existsSync(filepath)) {
-              possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
-            }
-          }
-        } else {
-          possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
-        }
-      } else {
-        possibleVaultPath = path.resolve(process.cwd(), ".env.vault");
-      }
-      if (fs2.existsSync(possibleVaultPath)) {
-        return possibleVaultPath;
-      }
-      return null;
-    }
-    function _resolveHome(envPath) {
-      return envPath[0] === "~" ? path.join(os.homedir(), envPath.slice(1)) : envPath;
-    }
-    function _configVault(options) {
-      const debug = parseBoolean(process.env.DOTENV_CONFIG_DEBUG || options && options.debug);
-      const quiet = parseBoolean(process.env.DOTENV_CONFIG_QUIET || options && options.quiet);
-      if (debug || !quiet) {
-        _log("Loading env from encrypted .env.vault");
-      }
-      const parsed = DotenvModule._parseVault(options);
-      let processEnv = process.env;
-      if (options && options.processEnv != null) {
-        processEnv = options.processEnv;
-      }
-      DotenvModule.populate(processEnv, parsed, options);
-      return { parsed };
-    }
-    function configDotenv(options) {
-      const dotenvPath = path.resolve(process.cwd(), ".env");
-      let encoding = "utf8";
-      let processEnv = process.env;
-      if (options && options.processEnv != null) {
-        processEnv = options.processEnv;
-      }
-      let debug = parseBoolean(processEnv.DOTENV_CONFIG_DEBUG || options && options.debug);
-      let quiet = parseBoolean(processEnv.DOTENV_CONFIG_QUIET || options && options.quiet);
-      if (options && options.encoding) {
-        encoding = options.encoding;
-      } else {
-        if (debug) {
-          _debug("No encoding is specified. UTF-8 is used by default");
-        }
-      }
-      let optionPaths = [dotenvPath];
-      if (options && options.path) {
-        if (!Array.isArray(options.path)) {
-          optionPaths = [_resolveHome(options.path)];
-        } else {
-          optionPaths = [];
-          for (const filepath of options.path) {
-            optionPaths.push(_resolveHome(filepath));
-          }
-        }
-      }
-      let lastError;
-      const parsedAll = {};
-      for (const path2 of optionPaths) {
-        try {
-          const parsed = DotenvModule.parse(fs2.readFileSync(path2, { encoding }));
-          DotenvModule.populate(parsedAll, parsed, options);
-        } catch (e) {
-          if (debug) {
-            _debug(`Failed to load ${path2} ${e.message}`);
-          }
-          lastError = e;
-        }
-      }
-      const populated = DotenvModule.populate(processEnv, parsedAll, options);
-      debug = parseBoolean(processEnv.DOTENV_CONFIG_DEBUG || debug);
-      quiet = parseBoolean(processEnv.DOTENV_CONFIG_QUIET || quiet);
-      if (debug || !quiet) {
-        const keysCount = Object.keys(populated).length;
-        const shortPaths = [];
-        for (const filePath of optionPaths) {
-          try {
-            const relative = path.relative(process.cwd(), filePath);
-            shortPaths.push(relative);
-          } catch (e) {
-            if (debug) {
-              _debug(`Failed to load ${filePath} ${e.message}`);
-            }
-            lastError = e;
-          }
-        }
-        _log(`injecting env (${keysCount}) from ${shortPaths.join(",")} ${dim(`-- tip: ${_getRandomTip()}`)}`);
-      }
-      if (lastError) {
-        return { parsed: parsedAll, error: lastError };
-      } else {
-        return { parsed: parsedAll };
-      }
-    }
-    function config(options) {
-      if (_dotenvKey(options).length === 0) {
-        return DotenvModule.configDotenv(options);
-      }
-      const vaultPath = _vaultPath(options);
-      if (!vaultPath) {
-        _warn(`You set DOTENV_KEY but you are missing a .env.vault file at ${vaultPath}. Did you forget to build it?`);
-        return DotenvModule.configDotenv(options);
-      }
-      return DotenvModule._configVault(options);
-    }
-    function decrypt(encrypted, keyStr) {
-      const key = Buffer.from(keyStr.slice(-64), "hex");
-      let ciphertext = Buffer.from(encrypted, "base64");
-      const nonce = ciphertext.subarray(0, 12);
-      const authTag = ciphertext.subarray(-16);
-      ciphertext = ciphertext.subarray(12, -16);
-      try {
-        const aesgcm = crypto.createDecipheriv("aes-256-gcm", key, nonce);
-        aesgcm.setAuthTag(authTag);
-        return `${aesgcm.update(ciphertext)}${aesgcm.final()}`;
-      } catch (error) {
-        const isRange = error instanceof RangeError;
-        const invalidKeyLength = error.message === "Invalid key length";
-        const decryptionFailed = error.message === "Unsupported state or unable to authenticate data";
-        if (isRange || invalidKeyLength) {
-          const err = new Error("INVALID_DOTENV_KEY: It must be 64 characters long (or more)");
-          err.code = "INVALID_DOTENV_KEY";
-          throw err;
-        } else if (decryptionFailed) {
-          const err = new Error("DECRYPTION_FAILED: Please check your DOTENV_KEY");
-          err.code = "DECRYPTION_FAILED";
-          throw err;
-        } else {
-          throw error;
-        }
-      }
+// src/lib/utils/time-parser.ts
+init_esm_shims();
+var ISO_8601_PATTERN = /^(\d{4})-(\d{2})-(\d{2})(?:[Tt](\d{2}):(\d{2})(?::(\d{2})(?:\.\d{1,9})?)?(?:[Zz]|[+-]\d{2}:?\d{2})?)?$/;
+var DAYS_BY_MONTH = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+var MAX_DATE_TIMESTAMP_MS = 864e13;
+function parseTime(timeStr) {
+  const relativeMatch = timeStr.match(/^(\d+)([smhdw])$/);
+  if (relativeMatch) {
+    const value = Number(relativeMatch[1]);
+    const unit = relativeMatch[2];
+    const timestamp2 = parseRelativeTime(value, unit);
+    if (timestamp2 !== void 0) {
+      return timestamp2;
     }
-    function populate(processEnv, parsed, options = {}) {
-      const debug = Boolean(options && options.debug);
-      const override = Boolean(options && options.override);
-      const populated = {};
-      if (typeof parsed !== "object") {
-        const err = new Error("OBJECT_REQUIRED: Please check the processEnv argument being passed to populate");
-        err.code = "OBJECT_REQUIRED";
-        throw err;
-      }
-      for (const key of Object.keys(parsed)) {
-        if (Object.prototype.hasOwnProperty.call(processEnv, key)) {
-          if (override === true) {
-            processEnv[key] = parsed[key];
-            populated[key] = parsed[key];
-          }
-          if (debug) {
-            if (override === true) {
-              _debug(`"${key}" is already defined and WAS overwritten`);
-            } else {
-              _debug(`"${key}" is already defined and was NOT overwritten`);
-            }
-          }
-        } else {
-          processEnv[key] = parsed[key];
-          populated[key] = parsed[key];
-        }
-      }
-      return populated;
+  }
+  if (/^\d+$/.test(timeStr)) {
+    const rawTimestamp = Number(timeStr);
+    const timestamp2 = rawTimestamp < 1e10 ? rawTimestamp * 1e3 : rawTimestamp;
+    if (isValidTimestamp(timestamp2)) {
+      return timestamp2;
     }
-    var DotenvModule = {
-      configDotenv,
-      _configVault,
-      _parseVault,
-      config,
-      decrypt,
-      parse,
-      populate
-    };
-    module.exports.configDotenv = DotenvModule.configDotenv;
-    module.exports._configVault = DotenvModule._configVault;
-    module.exports._parseVault = DotenvModule._parseVault;
-    module.exports.config = DotenvModule.config;
-    module.exports.decrypt = DotenvModule.decrypt;
-    module.exports.parse = DotenvModule.parse;
-    module.exports.populate = DotenvModule.populate;
-    module.exports = DotenvModule;
   }
-});
+  const timestamp = parseIsoTime(timeStr);
+  if (timestamp !== void 0) {
+    return timestamp;
+  }
+  throw new Error(
+    `Invalid time format: "${timeStr}". Supported formats: relative (5m, 2h, 1d), ISO 8601 (2024-01-15T10:30:00Z), Unix timestamp`
+  );
+}
+function parseIsoTime(timeStr) {
+  const match = ISO_8601_PATTERN.exec(timeStr);
+  if (!match) {
+    return void 0;
+  }
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const hour = match[4] ? Number(match[4]) : 0;
+  const minute = match[5] ? Number(match[5]) : 0;
+  const second = match[6] ? Number(match[6]) : 0;
+  if (!Number.isInteger(year) || !Number.isInteger(month) || !Number.isInteger(day) || !Number.isInteger(hour) || !Number.isInteger(minute) || !Number.isInteger(second) || month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month) || hour > 23 || minute > 59 || second > 59) {
+    return void 0;
+  }
+  const timestamp = new Date(timeStr).getTime();
+  return isValidTimestamp(timestamp) ? timestamp : void 0;
+}
+function daysInMonth(year, month) {
+  if (month === 2) {
+    return isLeapYear(year) ? 29 : 28;
+  }
+  return DAYS_BY_MONTH[month - 1] ?? 0;
+}
+function isLeapYear(year) {
+  return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+}
+function parseRelativeTime(value, unit) {
+  if (!Number.isSafeInteger(value)) {
+    return void 0;
+  }
+  const now = Date.now();
+  const multipliers = {
+    s: 1e3,
+    // seconds
+    m: 60 * 1e3,
+    // minutes
+    h: 60 * 60 * 1e3,
+    // hours
+    d: 24 * 60 * 60 * 1e3,
+    // days
+    w: 7 * 24 * 60 * 60 * 1e3
+    // weeks
+  };
+  const multiplier = multipliers[unit];
+  if (!multiplier) {
+    throw new Error(`Unknown time unit: ${unit}`);
+  }
+  const timestamp = now - value * multiplier;
+  return isValidTimestamp(timestamp) ? timestamp : void 0;
+}
+function isValidTimestamp(timestamp) {
+  return Number.isSafeInteger(timestamp) && Math.abs(timestamp) <= MAX_DATE_TIMESTAMP_MS;
+}
 
 // ../../packages/core/src/frameworks.ts
 init_esm_shims();
@@ -7844,57 +7535,6 @@ init_esm_shims();
 
 // ../../packages/core/src/variable-expander.ts
 init_esm_shims();
-var VARIABLE_PATTERN = /\$\{\{\s*(env|vars|secrets)\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
-function extractVariableReferencesFromString(value) {
-  const refs = [];
-  const matches = value.matchAll(VARIABLE_PATTERN);
-  for (const match of matches) {
-    const source = match[1];
-    const name = match[2];
-    refs.push({ source, name });
-  }
-  return refs;
-}
-function extractVariableReferences(obj) {
-  const refs = [];
-  const seen = /* @__PURE__ */ new Set();
-  function scan(value) {
-    if (typeof value === "string") {
-      const stringRefs = extractVariableReferencesFromString(value);
-      for (const ref of stringRefs) {
-        const key = `${ref.source}.${ref.name}`;
-        if (!seen.has(key)) {
-          seen.add(key);
-          refs.push(ref);
-        }
-      }
-    } else if (Array.isArray(value)) {
-      for (const item of value) {
-        scan(item);
-      }
-    } else if (value !== null && typeof value === "object") {
-      for (const val of Object.values(value)) {
-        scan(val);
-      }
-    }
-  }
-  scan(obj);
-  return refs;
-}
-function groupVariablesBySource(refs) {
-  const groups = {
-    env: [],
-    vars: [],
-    secrets: []
-  };
-  for (const ref of refs) {
-    groups[ref.source].push(ref);
-  }
-  return groups;
-}
-function extractAndGroupVariables(obj) {
-  return groupVariablesBySource(extractVariableReferences(obj));
-}
 
 // ../../packages/core/src/usage-source-bucket.ts
 init_esm_shims();
@@ -10845,9 +10485,235 @@ var desktopAuthConsumeContract = c3.router({
   }
 });
 
-// ../../packages/api-contracts/src/contracts/zero-user-model-preference.ts
+// ../../packages/api-contracts/src/contracts/composes.ts
 init_esm_shims();
 var c4 = initContract();
+var MOUNT_PATH_TEMPLATE = "${{ working_dir }}";
+var composeVersionQuerySchema = external_exports.string().min(1, "Missing version query parameter").regex(
+  /^[a-f0-9]{8,64}$|^latest$/i,
+  "Version must be 8-64 hex characters or 'latest'"
+);
+var AGENT_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9-]{1,62}[a-zA-Z0-9]$/;
+var agentNameSchema = external_exports.string().min(3, "Agent name must be at least 3 characters").max(64, "Agent name must be 64 characters or less").regex(
+  AGENT_NAME_REGEX,
+  "Agent name must start and end with letter or number, and contain only letters, numbers, and hyphens"
+);
+var volumeConfigSchema = external_exports.object({
+  name: external_exports.string().min(1, "Volume name is required"),
+  version: external_exports.string().min(1, "Volume version is required"),
+  /** When true, skip mounting without error if volume doesn't exist */
+  optional: external_exports.boolean().optional()
+});
+var mountPathSchema = external_exports.string().min(1, "mount_path cannot be empty").refine((val) => {
+  return val === MOUNT_PATH_TEMPLATE || val.startsWith("/");
+}, "mount_path must be an absolute path or ${{ working_dir }}");
+var artifactConfigSchema = external_exports.object({
+  name: external_exports.string().min(1, "Artifact name is required"),
+  version: external_exports.string().min(1).optional(),
+  mount_path: mountPathSchema.optional()
+});
+var artifactsArraySchema = external_exports.array(artifactConfigSchema).refine((items) => {
+  const names = items.map((i) => {
+    return i.name;
+  });
+  return new Set(names).size === names.length;
+}, "Artifact names must be unique");
+var agentFirewallsMapSchema = external_exports.record(
+  external_exports.string(),
+  external_exports.object({
+    permissions: external_exports.union([external_exports.literal("all"), external_exports.array(external_exports.string()).min(1)])
+  })
+);
+var legacyAgentFirewallsSchema = external_exports.union([
+  agentFirewallsMapSchema,
+  firewallsSchema
+]);
+var agentDefinitionSchema = external_exports.object({
+  description: external_exports.string().optional(),
+  framework: external_exports.enum(["claude-code", "codex"]),
+  volumes: external_exports.array(external_exports.string()).optional(),
+  environment: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  /**
+   * Path to instructions file (e.g., AGENTS.md).
+   * Auto-uploaded as volume and mounted at /home/user/.claude/CLAUDE.md
+   */
+  instructions: external_exports.string().min(1, "Instructions path cannot be empty").refine((val) => {
+    return !val.includes("..") && !val.startsWith("/") && !val.startsWith("\\");
+  }, "Instructions path must be a relative path without '..' segments").optional(),
+  /**
+   * @deprecated Skills are no longer processed by the CLI path. Declare
+   * mounts via `volumes:` / `--volume` instead. Field retained as optional
+   * so older CLI clients posting `skills:` are not rejected; server strips
+   * the field before persisting compose content.
+   */
+  skills: external_exports.array(external_exports.string()).optional(),
+  /**
+   * Route this agent to a self-hosted runner instead of E2B.
+   * When specified, runs will be queued for the specified runner group.
+   */
+  experimental_runner: external_exports.object({
+    group: external_exports.string().regex(
+      /^[a-z0-9-]+\/[a-z0-9-]+$/,
+      "Runner group must be in vm0/<name> format (e.g., vm0/production)"
+    )
+  }).optional(),
+  /**
+   * VM profile for resource allocation (e.g., "vm0/default").
+   * Determines rootfs image and VM resources (vCPU, memory).
+   * Defaults to "vm0/default" when omitted.
+   */
+  experimental_profile: external_exports.string().regex(
+    /^[a-z0-9-]+\/[a-z0-9-]+$/,
+    "Profile must be in org/name format (e.g., vm0/default)"
+  ).optional(),
+  /**
+   * External firewall rules for proxy-side token replacement.
+   * Map format: { slack: { permissions: [...] | "all" } }
+   * Resolved to full ExpandedFirewallConfig[] at runtime.
+   */
+  firewalls: agentFirewallsMapSchema.optional()
+});
+var agentComposeContentSchema = external_exports.object({
+  version: external_exports.string().min(1, "Version is required"),
+  agents: external_exports.record(external_exports.string(), agentDefinitionSchema),
+  volumes: external_exports.record(external_exports.string(), volumeConfigSchema).optional(),
+  artifacts: artifactsArraySchema.optional()
+});
+var agentComposeApiContentSchema = external_exports.object({
+  version: external_exports.string().min(1, "Version is required"),
+  agents: external_exports.record(
+    external_exports.string(),
+    agentDefinitionSchema.extend({
+      // Legacy: older compose versions may have this field (map or expanded array).
+      // Accepted for backward compat but ignored at runtime.
+      firewalls: legacyAgentFirewallsSchema.optional()
+    })
+  ),
+  volumes: external_exports.record(external_exports.string(), volumeConfigSchema).optional(),
+  artifacts: artifactsArraySchema.optional()
+});
+var composeResponseSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  headVersionId: external_exports.string().nullable(),
+  content: agentComposeApiContentSchema.nullable(),
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string()
+});
+var createComposeResponseSchema = external_exports.object({
+  composeId: external_exports.string(),
+  name: external_exports.string(),
+  versionId: external_exports.string(),
+  action: external_exports.enum(["created", "existing"]),
+  updatedAt: external_exports.string()
+});
+var composesMainContract = c4.router({
+  /**
+   * GET /api/agent/composes?name={name}&org={org}
+   * Get agent compose by name with HEAD version content
+   * If org is not provided, uses the authenticated user's default org
+   */
+  getByName: {
+    method: "GET",
+    path: "/api/agent/composes",
+    headers: authHeadersSchema,
+    query: external_exports.object({
+      name: external_exports.string().min(1, "Missing name query parameter")
+    }),
+    responses: {
+      200: composeResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get agent compose by name"
+  },
+  /**
+   * POST /api/agent/composes
+   * Create or update an agent compose version
+   *
+   * Returns 201 when a new compose is created, 200 when updating an existing compose.
+   * The action field indicates whether a new version was created or an existing one reused.
+   */
+  create: {
+    method: "POST",
+    path: "/api/agent/composes",
+    headers: authHeadersSchema,
+    body: external_exports.object({
+      content: agentComposeApiContentSchema
+    }),
+    responses: {
+      200: createComposeResponseSchema,
+      201: createComposeResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema
+    },
+    summary: "Create or update agent compose version"
+  }
+});
+var composesByIdContract = c4.router({
+  /**
+   * GET /api/agent/composes/:id
+   * Get agent compose by ID with HEAD version content
+   */
+  getById: {
+    method: "GET",
+    path: "/api/agent/composes/:id",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({
+      id: external_exports.string().uuid("Compose ID must be a valid UUID")
+    }),
+    responses: {
+      200: composeResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get agent compose by ID"
+  }
+});
+var composesVersionsContract = c4.router({
+  /**
+   * GET /api/agent/composes/versions?composeId={id}&version={hash|tag}
+   * Resolve a version specifier to a full version ID
+   */
+  resolveVersion: {
+    method: "GET",
+    path: "/api/agent/composes/versions",
+    headers: authHeadersSchema,
+    query: external_exports.object({
+      composeId: external_exports.string().min(1, "Missing composeId query parameter"),
+      version: composeVersionQuerySchema
+    }),
+    responses: {
+      200: external_exports.object({
+        versionId: external_exports.string(),
+        tag: external_exports.string().optional()
+      }),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Resolve version specifier to full version ID"
+  }
+});
+var composeListItemSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  displayName: external_exports.string().nullable().optional(),
+  description: external_exports.string().nullable().optional(),
+  sound: external_exports.string().nullable().optional(),
+  headVersionId: external_exports.string().nullable(),
+  updatedAt: external_exports.string()
+});
+
+// ../../packages/api-contracts/src/contracts/zero-user-model-preference.ts
+init_esm_shims();
+var c5 = initContract();
 var userModelPreferenceResponseSchema = external_exports.object({
   selectedModel: supportedRunModelSchema.nullable(),
   updatedAt: external_exports.string().nullable()
@@ -10855,7 +10721,7 @@ var userModelPreferenceResponseSchema = external_exports.object({
 var updateUserModelPreferenceRequestSchema = external_exports.object({
   selectedModel: supportedRunModelSchema.nullable()
 });
-var zeroUserModelPreferenceContract = c4.router({
+var zeroUserModelPreferenceContract = c5.router({
   get: {
     method: "GET",
     path: "/api/zero/user-model-preference",
@@ -10888,7 +10754,7 @@ var zeroUserModelPreferenceContract = c4.router({
 
 // ../../packages/api-contracts/src/contracts/presentation-images.ts
 init_esm_shims();
-var c5 = initContract();
+var c6 = initContract();
 var presentationImageOrientationSchema = external_exports.enum([
   "landscape",
   "portrait",
@@ -10946,7 +10812,7 @@ var presentationImageResolveResponseSchema = external_exports.object({
     ])
   )
 }).strict();
-var presentationImagesContract = c5.router({
+var presentationImagesContract = c6.router({
   resolve: {
     method: "POST",
     path: "/api/presentation/images/resolve",
@@ -10965,7 +10831,7 @@ var presentationImagesContract = c5.router({
 
 // ../../packages/api-contracts/src/contracts/test-telegram-dispatch-probe.ts
 init_esm_shims();
-var c6 = initContract();
+var c7 = initContract();
 var testTelegramDispatchProbeBodySchema = external_exports.object({
   bot_id: external_exports.string(),
   chat_id: external_exports.string(),
@@ -10990,7 +10856,7 @@ var testTelegramDispatchProbeHandlerErrorSchema = external_exports.object({
     stack: external_exports.string().optional()
   })
 });
-var testTelegramDispatchProbeContract = c6.router({
+var testTelegramDispatchProbeContract = c7.router({
   post: {
     method: "POST",
     path: "/api/test/telegram-dispatch-probe",
@@ -11009,7 +10875,7 @@ var testTelegramDispatchProbeContract = c6.router({
 
 // ../../packages/api-contracts/src/contracts/test-teams-dispatch-probe.ts
 init_esm_shims();
-var c7 = initContract();
+var c8 = initContract();
 var testTeamsDispatchProbeBodySchema = external_exports.object({
   tenant_id: external_exports.string(),
   conversation_id: external_exports.string(),
@@ -11048,7 +10914,7 @@ var testTeamsDispatchProbeResponseSchema = external_exports.union([
   testTeamsDispatchProbeSuccessResponseSchema,
   testTeamsDispatchProbeFailureResponseSchema
 ]);
-var testTeamsDispatchProbeContract = c7.router({
+var testTeamsDispatchProbeContract = c8.router({
   post: {
     method: "POST",
     path: "/api/test/teams-dispatch-probe",
@@ -11091,7 +10957,7 @@ var internalCallbackErrorSchema = external_exports.object({
 });
 
 // ../../packages/api-contracts/src/contracts/zero-email.ts
-var c8 = initContract();
+var c9 = initContract();
 var emailRecipientsSchema = external_exports.array(external_exports.string()).optional();
 var zeroEmailReplyCallbackPayloadSchema = external_exports.object({
   emailThreadSessionId: external_exports.string(),
@@ -11114,7 +10980,7 @@ var zeroEmailTriggerCallbackPayloadSchema = external_exports.object({
   replyRecipientTo: emailRecipientsSchema,
   replyRecipientCc: emailRecipientsSchema
 }).passthrough();
-var zeroEmailReplyCallbackContract = c8.router({
+var zeroEmailReplyCallbackContract = c9.router({
   post: {
     method: "POST",
     path: "/api/zero/email/callbacks/reply",
@@ -11131,7 +10997,7 @@ var zeroEmailReplyCallbackContract = c8.router({
     summary: "Handle Zero email reply completion callbacks"
   }
 });
-var zeroEmailTriggerCallbackContract = c8.router({
+var zeroEmailTriggerCallbackContract = c9.router({
   post: {
     method: "POST",
     path: "/api/zero/email/callbacks/trigger",
@@ -11148,7 +11014,7 @@ var zeroEmailTriggerCallbackContract = c8.router({
     summary: "Handle Zero email trigger completion callbacks"
   }
 });
-var zeroEmailInboundContract = c8.router({
+var zeroEmailInboundContract = c9.router({
   post: {
     method: "POST",
     path: "/api/zero/email/inbound",
@@ -11168,8 +11034,8 @@ var zeroEmailInboundContract = c8.router({
 
 // ../../packages/api-contracts/src/contracts/auth.ts
 init_esm_shims();
-var c9 = initContract();
-var authContract = c9.router({
+var c10 = initContract();
+var authContract = c10.router({
   /**
    * GET /api/auth/me
    * Get current user information
@@ -11194,7 +11060,7 @@ var authContract = c9.router({
 
 // ../../packages/api-contracts/src/contracts/user-export.ts
 init_esm_shims();
-var c10 = initContract();
+var c11 = initContract();
 var exportJobStatusSchema = external_exports.enum([
   "pending",
   "running",
@@ -11219,7 +11085,7 @@ var userExportStartResponseSchema = external_exports.object({
   jobId: external_exports.string().uuid(),
   status: external_exports.enum(["pending", "running"])
 });
-var userExportContract = c10.router({
+var userExportContract = c11.router({
   get: {
     method: "GET",
     path: "/api/user/export",
@@ -11250,7 +11116,7 @@ var userExportContract = c10.router({
 
 // ../../packages/api-contracts/src/contracts/email-unsubscribe.ts
 init_esm_shims();
-var c11 = initContract();
+var c12 = initContract();
 var emailUnsubscribeQuerySchema = external_exports.object({
   token: external_exports.string().optional()
 });
@@ -11260,13 +11126,13 @@ var emailUnsubscribeResponseSchema = external_exports.object({
 var emailUnsubscribeErrorSchema = external_exports.object({
   error: external_exports.string()
 });
-var emailUnsubscribeContract = c11.router({
+var emailUnsubscribeContract = c12.router({
   get: {
     method: "GET",
     path: "/api/email/unsubscribe",
     query: emailUnsubscribeQuerySchema,
     responses: {
-      200: c11.otherResponse({
+      200: c12.otherResponse({
         contentType: "text/html",
         body: external_exports.unknown()
       }),
@@ -11287,10 +11153,73 @@ var emailUnsubscribeContract = c11.router({
   }
 });
 
+// ../../packages/api-contracts/src/contracts/zero-morning-brief.ts
+init_esm_shims();
+var c13 = initContract();
+var triggerMorningBriefResponseSchema = external_exports.object({
+  runId: external_exports.string(),
+  briefDate: external_exports.string()
+});
+var zeroMorningBriefContract = c13.router({
+  trigger: {
+    method: "POST",
+    path: "/api/zero/morning-brief/trigger",
+    headers: authHeadersSchema,
+    body: external_exports.object({}),
+    responses: {
+      200: triggerMorningBriefResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Trigger a morning brief immediately for the current user"
+  }
+});
+
+// ../../packages/api-contracts/src/contracts/email-morning-brief-unsubscribe.ts
+init_esm_shims();
+var c14 = initContract();
+var emailMorningBriefUnsubscribeQuerySchema = external_exports.object({
+  token: external_exports.string().optional()
+});
+var emailMorningBriefUnsubscribeResponseSchema = external_exports.object({
+  unsubscribed: external_exports.literal(true)
+});
+var emailMorningBriefUnsubscribeErrorSchema = external_exports.object({
+  error: external_exports.string()
+});
+var emailMorningBriefUnsubscribeContract = c14.router({
+  get: {
+    method: "GET",
+    path: "/api/email/morning-brief/unsubscribe",
+    query: emailMorningBriefUnsubscribeQuerySchema,
+    responses: {
+      200: c14.otherResponse({
+        contentType: "text/html",
+        body: external_exports.unknown()
+      }),
+      400: emailMorningBriefUnsubscribeErrorSchema
+    },
+    summary: "Turn off the Morning Brief from an email link"
+  },
+  unsubscribe: {
+    method: "POST",
+    path: "/api/email/morning-brief/unsubscribe",
+    query: emailMorningBriefUnsubscribeQuerySchema,
+    body: external_exports.undefined(),
+    responses: {
+      200: emailMorningBriefUnsubscribeResponseSchema,
+      400: emailMorningBriefUnsubscribeErrorSchema
+    },
+    summary: "One-click List-Unsubscribe for the Morning Brief"
+  }
+});
+
 // ../../packages/api-contracts/src/contracts/connectors-type-callback.ts
 init_esm_shims();
-var c12 = initContract();
-var connectorsTypeCallbackContract = c12.router({
+var c15 = initContract();
+var connectorsTypeCallbackContract = c15.router({
   callback: {
     method: "GET",
     path: "/api/connectors/:type/callback",
@@ -11316,7 +11245,7 @@ var connectorsTypeCallbackContract = c12.router({
       "openid.realm": external_exports.string().optional()
     }).catchall(external_exports.string()),
     responses: {
-      307: c12.noBody()
+      307: c15.noBody()
     },
     summary: "Complete connector browser authorization"
   }
@@ -11324,7 +11253,7 @@ var connectorsTypeCallbackContract = c12.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-authorize.ts
 init_esm_shims();
-var c13 = initContract();
+var c16 = initContract();
 var testOAuthProviderAuthorizeErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11336,13 +11265,13 @@ var testOAuthProviderAuthorizeQuerySchema = external_exports.object({
   scope: external_exports.string().optional(),
   state: external_exports.string().optional()
 });
-var testOAuthProviderAuthorizeContract = c13.router({
+var testOAuthProviderAuthorizeContract = c16.router({
   authorize: {
     method: "GET",
     path: "/api/test/oauth-provider/authorize",
     query: testOAuthProviderAuthorizeQuerySchema,
     responses: {
-      302: c13.noBody(),
+      302: c16.noBody(),
       400: testOAuthProviderAuthorizeErrorSchema,
       404: external_exports.string()
     },
@@ -11352,7 +11281,7 @@ var testOAuthProviderAuthorizeContract = c13.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-echo.ts
 init_esm_shims();
-var c14 = initContract();
+var c17 = initContract();
 var testOAuthProviderEchoErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11360,7 +11289,7 @@ var testOAuthProviderEchoResponseSchema = external_exports.object({
   authorization: external_exports.string(),
   receivedAt: external_exports.string()
 });
-var testOAuthProviderEchoContract = c14.router({
+var testOAuthProviderEchoContract = c17.router({
   echo: {
     method: "GET",
     path: "/api/test/oauth-provider/echo",
@@ -11375,7 +11304,7 @@ var testOAuthProviderEchoContract = c14.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-token.ts
 init_esm_shims();
-var c15 = initContract();
+var c18 = initContract();
 var testOAuthProviderTokenErrorSchema = external_exports.object({
   error: external_exports.string(),
   error_description: external_exports.string().optional()
@@ -11387,11 +11316,11 @@ var testOAuthProviderTokenResponseSchema = external_exports.object({
   expires_in: external_exports.number(),
   scope: external_exports.string()
 });
-var testOAuthProviderTokenContract = c15.router({
+var testOAuthProviderTokenContract = c18.router({
   token: {
     method: "POST",
     path: "/api/test/oauth-provider/token",
-    body: c15.type(),
+    body: c18.type(),
     responses: {
       200: testOAuthProviderTokenResponseSchema,
       400: testOAuthProviderTokenErrorSchema,
@@ -11404,7 +11333,7 @@ var testOAuthProviderTokenContract = c15.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-device-auth.ts
 init_esm_shims();
-var c16 = initContract();
+var c19 = initContract();
 var testOAuthProviderDeviceAuthErrorSchema = external_exports.object({
   error: external_exports.string(),
   error_description: external_exports.string().optional()
@@ -11417,11 +11346,11 @@ var testOAuthProviderDeviceAuthResponseSchema = external_exports.object({
   expires_in: external_exports.number(),
   interval: external_exports.number()
 });
-var testOAuthProviderDeviceAuthContract = c16.router({
+var testOAuthProviderDeviceAuthContract = c19.router({
   deviceAuth: {
     method: "POST",
     path: "/api/test/oauth-provider/device/code",
-    body: c16.type(),
+    body: c19.type(),
     responses: {
       200: testOAuthProviderDeviceAuthResponseSchema,
       400: testOAuthProviderDeviceAuthErrorSchema,
@@ -11434,7 +11363,7 @@ var testOAuthProviderDeviceAuthContract = c16.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-userinfo.ts
 init_esm_shims();
-var c17 = initContract();
+var c20 = initContract();
 var testOAuthProviderUserinfoErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11443,7 +11372,7 @@ var testOAuthProviderUserinfoResponseSchema = external_exports.object({
   id: external_exports.string(),
   username: external_exports.string()
 });
-var testOAuthProviderUserinfoContract = c17.router({
+var testOAuthProviderUserinfoContract = c20.router({
   userinfo: {
     method: "GET",
     path: "/api/test/oauth-provider/userinfo",
@@ -11458,7 +11387,7 @@ var testOAuthProviderUserinfoContract = c17.router({
 
 // ../../packages/api-contracts/src/contracts/test-computer-use-state.ts
 init_esm_shims();
-var c18 = initContract();
+var c21 = initContract();
 var testComputerUseStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11491,7 +11420,7 @@ var testComputerUseStateGetResponseSchema = external_exports.object({
 var testComputerUseStateDeleteResponseSchema = external_exports.object({
   ok: external_exports.literal(true)
 });
-var testComputerUseStateContract = c18.router({
+var testComputerUseStateContract = c21.router({
   post: {
     method: "POST",
     path: "/api/test/computer-use-state",
@@ -11533,7 +11462,7 @@ var testComputerUseStateContract = c18.router({
 
 // ../../packages/api-contracts/src/contracts/test-runtime-state.ts
 init_esm_shims();
-var c19 = initContract();
+var c22 = initContract();
 var testRuntimeStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11590,7 +11519,7 @@ var testRuntimeStateActionResponseSchema = external_exports.object({
   admission_lock_waiting: external_exports.boolean().optional(),
   uploaded_file_sources: external_exports.array(external_exports.string()).optional()
 });
-var testRuntimeStateContract = c19.router({
+var testRuntimeStateContract = c22.router({
   action: {
     method: "POST",
     path: "/api/test/runtime-state/action",
@@ -11606,7 +11535,7 @@ var testRuntimeStateContract = c19.router({
 
 // ../../packages/api-contracts/src/contracts/test-zero-agent-state.ts
 init_esm_shims();
-var c20 = initContract();
+var c23 = initContract();
 var testZeroAgentStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11628,7 +11557,7 @@ var testZeroAgentStateActionBodySchema = external_exports.discriminatedUnion(
 var testZeroAgentStateActionResponseSchema = external_exports.object({
   ok: external_exports.literal(true)
 });
-var testZeroAgentStateContract = c20.router({
+var testZeroAgentStateContract = c23.router({
   action: {
     method: "POST",
     path: "/api/test/zero-agent-state/action",
@@ -11644,7 +11573,7 @@ var testZeroAgentStateContract = c20.router({
 
 // ../../packages/api-contracts/src/contracts/test-model-provider-state.ts
 init_esm_shims();
-var c21 = initContract();
+var c24 = initContract();
 var testModelProviderStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11662,7 +11591,7 @@ var testModelProviderStateActionBodySchema = external_exports.discriminatedUnion
 var testModelProviderStateActionResponseSchema = external_exports.object({
   ok: external_exports.literal(true)
 });
-var testModelProviderStateContract = c21.router({
+var testModelProviderStateContract = c24.router({
   action: {
     method: "POST",
     path: "/api/test/model-provider-state/action",
@@ -11678,8 +11607,8 @@ var testModelProviderStateContract = c21.router({
 
 // ../../packages/api-contracts/src/contracts/test-mail-draft-state.ts
 init_esm_shims();
-var c22 = initContract();
-var testMailDraftStateContract = c22.router({
+var c25 = initContract();
+var testMailDraftStateContract = c25.router({
   get: {
     method: "GET",
     path: "/api/test/mail-draft-state/:mailDraftId",
@@ -11694,7 +11623,7 @@ var testMailDraftStateContract = c22.router({
 
 // ../../packages/api-contracts/src/contracts/test-usage-insight-state.ts
 init_esm_shims();
-var c23 = initContract();
+var c26 = initContract();
 var nullableDateStringSchema = external_exports.string().nullable();
 var optionalDateStringSchema = external_exports.string().optional();
 var testUsageInsightStateErrorSchema = external_exports.object({
@@ -11792,7 +11721,7 @@ var testUsageInsightStateActionResponseSchema = external_exports.object({
   chat_thread_id: external_exports.string().optional(),
   usage_event_id: external_exports.string().optional()
 });
-var testUsageInsightStateContract = c23.router({
+var testUsageInsightStateContract = c26.router({
   action: {
     method: "POST",
     path: "/api/test/usage-insight-state/action",
@@ -11808,7 +11737,7 @@ var testUsageInsightStateContract = c23.router({
 
 // ../../packages/api-contracts/src/contracts/test-cron-cleanup-sandboxes-state.ts
 init_esm_shims();
-var c24 = initContract();
+var c27 = initContract();
 var testCronCleanupSandboxesStateActionBodySchema = external_exports.object({
   action: external_exports.enum([
     "seed-run",
@@ -11833,7 +11762,7 @@ var testCronCleanupSandboxesStateActionResponseSchema = external_exports.object(
 var testCronCleanupSandboxesStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
-var testCronCleanupSandboxesStateContract = c24.router({
+var testCronCleanupSandboxesStateContract = c27.router({
   action: {
     method: "POST",
     path: "/api/test/cron-cleanup-sandboxes-state/action",
@@ -11849,7 +11778,7 @@ var testCronCleanupSandboxesStateContract = c24.router({
 
 // ../../packages/api-contracts/src/contracts/test-slack-dispatch-probe.ts
 init_esm_shims();
-var c25 = initContract();
+var c28 = initContract();
 var testSlackDispatchProbeBodySchema = external_exports.object({
   team_id: external_exports.string(),
   channel_id: external_exports.string(),
@@ -11877,7 +11806,7 @@ var testSlackDispatchProbeResponseSchema = external_exports.union([
   testSlackDispatchProbeSuccessResponseSchema,
   testSlackDispatchProbeFailureResponseSchema
 ]);
-var testSlackDispatchProbeContract = c25.router({
+var testSlackDispatchProbeContract = c28.router({
   post: {
     method: "POST",
     path: "/api/test/slack-dispatch-probe",
@@ -11893,7 +11822,7 @@ var testSlackDispatchProbeContract = c25.router({
 
 // ../../packages/api-contracts/src/contracts/test-slack-state.ts
 init_esm_shims();
-var c26 = initContract();
+var c29 = initContract();
 var testSlackStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11986,13 +11915,6 @@ var testSlackStateResponseSchema = external_exports.object({
       promptPreview: external_exports.string().nullable()
     })
   ),
-  artifact_storage: external_exports.object({
-    id: external_exports.string(),
-    headVersionId: external_exports.string().nullable(),
-    s3Prefix: external_exports.string(),
-    versionId: external_exports.string().nullable(),
-    versionS3Key: external_exports.string().nullable()
-  }).nullable(),
   org_metadata: external_exports.object({
     orgId: external_exports.string(),
     defaultAgentId: external_exports.string().nullable(),
@@ -12024,15 +11946,14 @@ var testSlackStateResponseSchema = external_exports.object({
     })
   )
 });
-var testSlackStateContract = c26.router({
+var testSlackStateContract = c29.router({
   get: {
     method: "GET",
     path: "/api/test/slack-state",
     query: external_exports.object({
       team_id: external_exports.string().optional(),
       empty_team_id: external_exports.literal("1").optional(),
-      org_id: external_exports.string().optional(),
-      user_id: external_exports.string().optional()
+      org_id: external_exports.string().optional()
     }),
     responses: {
       200: testSlackStateResponseSchema,
@@ -12070,7 +11991,7 @@ var testSlackStateContract = c26.router({
 
 // ../../packages/api-contracts/src/contracts/test-slack-mock.ts
 init_esm_shims();
-var c27 = initContract();
+var c30 = initContract();
 var slackMockRequestBodySchema = external_exports.record(external_exports.string(), external_exports.unknown()).optional();
 var slackMockNotFoundSchema = external_exports.string();
 var testSlackMockOkResponseSchema = external_exports.object({
@@ -12136,7 +12057,7 @@ var testSlackMockUsersInfoResponseSchema = testSlackMockOkResponseSchema.extend(
     })
   })
 });
-var testSlackMockContract = c27.router({
+var testSlackMockContract = c30.router({
   assistantThreadsSetStatus: {
     method: "POST",
     path: "/api/test/slack-mock/assistant.threads.setStatus",
@@ -12241,7 +12162,7 @@ var testSlackMockContract = c27.router({
 
 // ../../packages/api-contracts/src/contracts/test-telegram-mock.ts
 init_esm_shims();
-var c28 = initContract();
+var c31 = initContract();
 var testTelegramMockPathParamsSchema = external_exports.object({
   botToken: external_exports.string(),
   method: external_exports.string()
@@ -12254,7 +12175,7 @@ var testTelegramMockErrorResponseSchema = external_exports.object({
   ok: external_exports.literal(false),
   description: external_exports.string()
 });
-var testTelegramMockContract = c28.router({
+var testTelegramMockContract = c31.router({
   post: {
     method: "POST",
     path: "/api/test/telegram-mock/:botToken/:method",
@@ -12270,7 +12191,7 @@ var testTelegramMockContract = c28.router({
 
 // ../../packages/api-contracts/src/contracts/test-teams-mock.ts
 init_esm_shims();
-var c29 = initContract();
+var c32 = initContract();
 var teamsMockBodySchema = external_exports.record(external_exports.string(), external_exports.unknown()).optional();
 var teamsMockOkSchema = external_exports.object({ ok: external_exports.literal(true) });
 var teamsMockTokenResponseSchema = external_exports.object({
@@ -12306,7 +12227,7 @@ var testTeamsMockGraphMessagePathParamsSchema = testTeamsMockGraphMessagesPathPa
 var testTeamsMockGraphUserPathParamsSchema = external_exports.object({
   userId: external_exports.string()
 });
-var testTeamsMockContract = c29.router({
+var testTeamsMockContract = c32.router({
   token: {
     method: "POST",
     path: "/api/test/teams-mock/token",
@@ -12415,7 +12336,7 @@ var testTeamsMockContract = c29.router({
 
 // ../../packages/api-contracts/src/contracts/test-teams-state.ts
 init_esm_shims();
-var c30 = initContract();
+var c33 = initContract();
 var testTeamsStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -12536,7 +12457,7 @@ var testTeamsStateResponseSchema = external_exports.object({
     })
   )
 });
-var testTeamsStateContract = c30.router({
+var testTeamsStateContract = c33.router({
   get: {
     method: "GET",
     path: "/api/test/teams-state",
@@ -12580,7 +12501,7 @@ var testTeamsStateContract = c30.router({
 
 // ../../packages/api-contracts/src/contracts/test-telegram-state.ts
 init_esm_shims();
-var c31 = initContract();
+var c34 = initContract();
 var testTelegramStateQuerySchema = external_exports.object({
   bot_id: external_exports.string().optional()
 });
@@ -12656,7 +12577,7 @@ var testTelegramStateSeedResponseSchema = external_exports.object({
   user_link_id: external_exports.string().nullable(),
   default_agent_id: external_exports.string()
 });
-var testTelegramStateContract = c31.router({
+var testTelegramStateContract = c34.router({
   get: {
     method: "GET",
     path: "/api/test/telegram-state",
@@ -12705,7 +12626,7 @@ var testTelegramStateContract = c31.router({
 
 // ../../packages/api-contracts/src/contracts/cron.ts
 init_esm_shims();
-var c32 = initContract();
+var c35 = initContract();
 var cleanupResultSchema = external_exports.object({
   runId: external_exports.string(),
   sandboxId: external_exports.string().nullable(),
@@ -12720,7 +12641,7 @@ var cleanupResponseSchema = external_exports.object({
   exportJobsCleaned: external_exports.number(),
   exportJobsStuck: external_exports.number()
 });
-var cronCleanupSandboxesContract = c32.router({
+var cronCleanupSandboxesContract = c35.router({
   /**
    * GET /api/cron/cleanup-sandboxes
    * Cron job to cleanup sandboxes that have stopped sending heartbeats
@@ -12846,6 +12767,11 @@ var cronExecuteWorkflowAutomationsResponseSchema = external_exports.object({
   executed: external_exports.number(),
   skipped: external_exports.number()
 });
+var cronExecuteMorningBriefsResponseSchema = external_exports.object({
+  success: external_exports.literal(true),
+  executed: external_exports.number(),
+  skipped: external_exports.number()
+});
 var cronRenewGmailWatchesResponseSchema = external_exports.object({
   success: external_exports.literal(true),
   renewed: external_exports.number(),
@@ -12902,7 +12828,7 @@ var cronAggregateModelStatsResponseSchema = external_exports.object({
   windowEnd: external_exports.string(),
   aggregated: external_exports.number()
 });
-var cronAggregateUsageContract = c32.router({
+var cronAggregateUsageContract = c35.router({
   aggregate: {
     method: "GET",
     path: "/api/cron/aggregate-usage",
@@ -12914,7 +12840,7 @@ var cronAggregateUsageContract = c32.router({
     summary: "Aggregate daily usage cache"
   }
 });
-var cronProcessUsageEventsContract = c32.router({
+var cronProcessUsageEventsContract = c35.router({
   process: {
     method: "GET",
     path: "/api/cron/process-usage-events",
@@ -12926,7 +12852,7 @@ var cronProcessUsageEventsContract = c32.router({
     summary: "Process pending usage events"
   }
 });
-var cronCompactChatThreadSnapshotsContract = c32.router({
+var cronCompactChatThreadSnapshotsContract = c35.router({
   compact: {
     method: "GET",
     path: "/api/cron/compact-chat-thread-snapshots",
@@ -12938,7 +12864,7 @@ var cronCompactChatThreadSnapshotsContract = c32.router({
     summary: "Compact chat thread snapshots from lifecycle events"
   }
 });
-var cronMonitorChatMessageQueueContract = c32.router({
+var cronMonitorChatMessageQueueContract = c35.router({
   monitor: {
     method: "GET",
     path: "/api/cron/monitor-chat-message-queue",
@@ -12951,7 +12877,7 @@ var cronMonitorChatMessageQueueContract = c32.router({
     summary: "Monitor for orphaned queued chat messages"
   }
 });
-var cronReconcileBillingEntitlementsContract = c32.router({
+var cronReconcileBillingEntitlementsContract = c35.router({
   reconcile: {
     method: "GET",
     path: "/api/cron/reconcile-billing-entitlements",
@@ -12963,7 +12889,7 @@ var cronReconcileBillingEntitlementsContract = c32.router({
     summary: "Reconcile billing entitlements"
   }
 });
-var cronTelegramCleanupContract = c32.router({
+var cronTelegramCleanupContract = c35.router({
   cleanup: {
     method: "GET",
     path: "/api/cron/telegram-cleanup",
@@ -12975,7 +12901,7 @@ var cronTelegramCleanupContract = c32.router({
     summary: "Delete expired Telegram messages"
   }
 });
-var cronComputerUseScreenshotCleanupContract = c32.router({
+var cronComputerUseScreenshotCleanupContract = c35.router({
   cleanup: {
     method: "GET",
     path: "/api/cron/computer-use-screenshot-cleanup",
@@ -12987,7 +12913,7 @@ var cronComputerUseScreenshotCleanupContract = c32.router({
     summary: "Delete expired desktop computer-use screenshots"
   }
 });
-var cronArtifactPreviewContract = c32.router({
+var cronArtifactPreviewContract = c35.router({
   generate: {
     method: "GET",
     path: "/api/cron/artifact-preview",
@@ -12999,7 +12925,7 @@ var cronArtifactPreviewContract = c32.router({
     summary: "Render static preview images for HTML/website artifacts"
   }
 });
-var cronDrainEmailOutboxContract = c32.router({
+var cronDrainEmailOutboxContract = c35.router({
   drain: {
     method: "GET",
     path: "/api/cron/drain-email-outbox",
@@ -13011,7 +12937,7 @@ var cronDrainEmailOutboxContract = c32.router({
     summary: "Drain pending email outbox messages"
   }
 });
-var cronRenewGmailWatchesContract = c32.router({
+var cronRenewGmailWatchesContract = c35.router({
   renew: {
     method: "GET",
     path: "/api/cron/renew-gmail-watches",
@@ -13023,7 +12949,7 @@ var cronRenewGmailWatchesContract = c32.router({
     summary: "Renew Gmail push notification watches"
   }
 });
-var cronRenewGoogleCalendarWatchesContract = c32.router({
+var cronRenewGoogleCalendarWatchesContract = c35.router({
   renew: {
     method: "GET",
     path: "/api/cron/renew-google-calendar-watches",
@@ -13035,7 +12961,7 @@ var cronRenewGoogleCalendarWatchesContract = c32.router({
     summary: "Renew Google Calendar push notification watches"
   }
 });
-var cronRenewGoogleWorkspaceEventSubscriptionsContract = c32.router({
+var cronRenewGoogleWorkspaceEventSubscriptionsContract = c35.router({
   renew: {
     method: "GET",
     path: "/api/cron/renew-google-workspace-event-subscriptions",
@@ -13047,7 +12973,7 @@ var cronRenewGoogleWorkspaceEventSubscriptionsContract = c32.router({
     summary: "Renew Google Workspace Events subscriptions"
   }
 });
-var cronSyncSkillsContract = c32.router({
+var cronSyncSkillsContract = c35.router({
   sync: {
     method: "GET",
     path: "/api/cron/sync-skills",
@@ -13059,7 +12985,7 @@ var cronSyncSkillsContract = c32.router({
     summary: "Sync official skills from the skills repository"
   }
 });
-var cronConnectorCatalogContract = c32.router({
+var cronConnectorCatalogContract = c35.router({
   sync: {
     method: "GET",
     path: "/api/cron/sync-connector-catalog",
@@ -13081,7 +13007,7 @@ var cronConnectorCatalogContract = c32.router({
     summary: "Read connector catalog sync status"
   }
 });
-var cronExecuteWorkflowAutomationsContract = c32.router({
+var cronExecuteWorkflowAutomationsContract = c35.router({
   execute: {
     method: "GET",
     path: "/api/cron/execute-workflow-automations",
@@ -13093,7 +13019,19 @@ var cronExecuteWorkflowAutomationsContract = c32.router({
     summary: "Execute due workflow automations"
   }
 });
-var cronAggregateInsightsContract = c32.router({
+var cronExecuteMorningBriefsContract = c35.router({
+  execute: {
+    method: "GET",
+    path: "/api/cron/execute-morning-briefs",
+    headers: authHeadersSchema,
+    responses: {
+      200: cronExecuteMorningBriefsResponseSchema,
+      401: apiErrorSchema
+    },
+    summary: "Execute due morning briefs"
+  }
+});
+var cronAggregateInsightsContract = c35.router({
   aggregate: {
     method: "GET",
     path: "/api/cron/aggregate-insights",
@@ -13105,7 +13043,7 @@ var cronAggregateInsightsContract = c32.router({
     summary: "Aggregate daily usage insights"
   }
 });
-var cronAggregateModelStatsContract = c32.router({
+var cronAggregateModelStatsContract = c35.router({
   aggregate: {
     method: "GET",
     path: "/api/cron/aggregate-model-stats",
@@ -13120,7 +13058,7 @@ var cronAggregateModelStatsContract = c32.router({
     summary: "Aggregate hourly model usage statistics"
   }
 });
-var cronSummarizeMemoryContract = c32.router({
+var cronSummarizeMemoryContract = c35.router({
   summarize: {
     method: "GET",
     path: "/api/cron/summarize-memory",
@@ -13132,7 +13070,7 @@ var cronSummarizeMemoryContract = c32.router({
     summary: "Summarize daily memory changes per user"
   }
 });
-var cronRefreshStoragePresignedUrlsContract = c32.router({
+var cronRefreshStoragePresignedUrlsContract = c35.router({
   refresh: {
     method: "GET",
     path: "/api/cron/refresh-storage-presigned-urls",
@@ -13145,199 +13083,83 @@ var cronRefreshStoragePresignedUrlsContract = c32.router({
   }
 });
 
-// ../../packages/api-contracts/src/contracts/chat-threads-v1.ts
+// ../../packages/api-contracts/src/contracts/sessions.ts
 init_esm_shims();
-var c33 = initContract();
-var v1ThreadSchema = external_exports.object({
+var c36 = initContract();
+var sessionResponseSchema = external_exports.object({
   id: external_exports.string(),
-  title: external_exports.string().nullable(),
+  agentComposeId: external_exports.string(),
+  conversationId: external_exports.string().nullable(),
+  artifactNames: external_exports.array(external_exports.string()),
+  secretNames: external_exports.array(external_exports.string()).nullable(),
   createdAt: external_exports.string(),
   updatedAt: external_exports.string()
 });
-var v1MessageSchema = external_exports.object({
+var agentComposeSnapshotSchema = external_exports.object({
+  agentComposeVersionId: external_exports.string(),
+  vars: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  secretNames: external_exports.array(external_exports.string()).optional()
+});
+var volumeVersionsSnapshotSchema = external_exports.object({
+  versions: external_exports.record(external_exports.string(), external_exports.string())
+});
+var checkpointResponseSchema = external_exports.object({
   id: external_exports.string(),
-  role: external_exports.enum(["user", "assistant"]),
-  content: external_exports.string().nullable(),
-  error: external_exports.string().optional(),
+  runId: external_exports.string(),
+  conversationId: external_exports.string(),
+  agentComposeSnapshot: agentComposeSnapshotSchema,
+  // Checkpoints persist context-artifact arrays, while the GET handler
+  // projects them to this stable name-to-version response map.
+  artifactSnapshots: external_exports.record(external_exports.string(), external_exports.string()).nullable(),
+  volumeVersionsSnapshot: volumeVersionsSnapshotSchema.nullable(),
   createdAt: external_exports.string()
 });
-var chatThreadV1GetContract = c33.router({
-  get: {
+var sessionsByIdContract = c36.router({
+  /**
+   * GET /api/agent/sessions/:id
+   * Get session by ID
+   */
+  getById: {
     method: "GET",
-    path: "/api/v1/chat-threads/:threadId",
+    path: "/api/agent/sessions/:id",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ threadId: external_exports.string().uuid() }),
+    pathParams: external_exports.object({
+      id: external_exports.string().min(1, "Session ID is required")
+    }),
     responses: {
-      200: v1ThreadSchema,
+      200: sessionResponseSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
     },
-    summary: "Get a chat thread"
+    summary: "Get session by ID"
   }
 });
-var chatThreadV1MessagesContract = c33.router({
-  list: {
+var checkpointsByIdContract = c36.router({
+  /**
+   * GET /api/agent/checkpoints/:id
+   * Get checkpoint by ID
+   */
+  getById: {
     method: "GET",
-    path: "/api/v1/chat-threads/:threadId/messages",
+    path: "/api/agent/checkpoints/:id",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ threadId: external_exports.string().uuid() }),
-    query: external_exports.object({
-      sinceId: external_exports.string().uuid().optional(),
-      beforeId: external_exports.string().uuid().optional(),
-      limit: external_exports.coerce.number().min(1).max(100).default(50)
+    pathParams: external_exports.object({
+      id: external_exports.string().min(1, "Checkpoint ID is required")
     }),
     responses: {
-      200: external_exports.object({ messages: external_exports.array(v1MessageSchema) }),
+      200: checkpointResponseSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
     },
-    summary: "List messages in a chat thread"
-  }
-});
-var chatThreadV1SendContract = c33.router({
-  send: {
-    method: "POST",
-    path: "/api/v1/chat-threads/messages",
-    headers: authHeadersSchema,
-    body: external_exports.object({
-      prompt: external_exports.string().min(1),
-      threadId: external_exports.string().uuid()
-    }),
-    responses: {
-      201: external_exports.object({
-        threadId: external_exports.string(),
-        messageId: external_exports.string(),
-        runId: external_exports.string().nullable(),
-        createdAt: external_exports.string()
-      }),
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      402: apiErrorSchema,
-      403: apiErrorSchema,
-      404: apiErrorSchema,
-      409: apiErrorSchema,
-      422: apiErrorSchema,
-      429: apiErrorSchema,
-      503: apiErrorSchema
-    },
-    summary: "Send a chat message to an existing thread"
-  }
-});
-
-// ../../packages/api-contracts/src/contracts/device-token.ts
-init_esm_shims();
-var c34 = initContract();
-var bb0DeviceCodeSchema = external_exports.string().regex(/^[A-Z2-9]{4}-[A-Z2-9]{4}$/);
-var bleSessionNonceSchema = external_exports.string().min(16).max(128).regex(/^[A-Za-z0-9._:-]+$/);
-var pollTokenSchema = external_exports.string().min(32).max(256).regex(/^[A-Za-z0-9._-]+$/);
-var createDeviceTokenRequestSchema = external_exports.object({
-  device_type: external_exports.literal("bb0"),
-  ble_session_nonce: bleSessionNonceSchema.optional()
-});
-var createDeviceTokenResponseSchema = external_exports.object({
-  device_code: bb0DeviceCodeSchema,
-  expires_in: external_exports.number().int().positive(),
-  interval: external_exports.number().int().positive(),
-  poll_token: pollTokenSchema
-});
-var pollDeviceTokenRequestSchema = external_exports.object({
-  device_code: bb0DeviceCodeSchema,
-  poll_token: pollTokenSchema
-});
-var pollDeviceTokenPendingResponseSchema = external_exports.object({
-  status: external_exports.literal("pending"),
-  interval: external_exports.number().int().positive()
-});
-var pollDeviceTokenApprovedResponseSchema = external_exports.object({
-  status: external_exports.literal("approved"),
-  api_token: external_exports.string(),
-  thread_id: external_exports.string().uuid()
-});
-var pollDeviceTokenExpiredResponseSchema = external_exports.object({
-  status: external_exports.literal("expired")
-});
-var pollDeviceTokenInvalidResponseSchema = external_exports.object({
-  status: external_exports.literal("invalid")
-});
-var confirmBb0DeviceRequestSchema = external_exports.object({
-  device_code: bb0DeviceCodeSchema
-});
-var confirmBb0DeviceResponseSchema = external_exports.object({
-  status: external_exports.literal("approved")
-});
-var deviceTokenContract = c34.router({
-  create: {
-    method: "POST",
-    path: "/api/device-token",
-    body: createDeviceTokenRequestSchema,
-    responses: {
-      200: createDeviceTokenResponseSchema,
-      400: apiErrorSchema
-    },
-    summary: "Create a short-lived device code for embedded device onboarding"
-  },
-  poll: {
-    method: "POST",
-    path: "/api/device-token/poll",
-    body: pollDeviceTokenRequestSchema,
-    responses: {
-      200: pollDeviceTokenApprovedResponseSchema,
-      202: pollDeviceTokenPendingResponseSchema,
-      400: apiErrorSchema,
-      404: pollDeviceTokenInvalidResponseSchema,
-      410: pollDeviceTokenExpiredResponseSchema
-    },
-    summary: "Poll a bb0 device code for approval and final credentials"
-  }
-});
-var bb0DeviceConfirmContract = c34.router({
-  confirm: {
-    method: "POST",
-    path: "/api/zero/devices/bb0/confirm",
-    headers: authHeadersSchema,
-    body: confirmBb0DeviceRequestSchema,
-    responses: {
-      200: confirmBb0DeviceResponseSchema,
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      403: apiErrorSchema,
-      404: apiErrorSchema
-    },
-    summary: "Confirm a bb0 device code for the authenticated user"
-  }
-});
-
-// ../../packages/api-contracts/src/contracts/audio-transcriptions-v1.ts
-init_esm_shims();
-var c35 = initContract();
-var audioTranscriptionV1Schema = external_exports.object({
-  text: external_exports.string()
-});
-var audioTranscriptionsV1Contract = c35.router({
-  transcribe: {
-    method: "POST",
-    path: "/api/v1/audio/transcriptions",
-    headers: authHeadersSchema,
-    body: c35.type(),
-    responses: {
-      200: audioTranscriptionV1Schema,
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      402: apiErrorSchema,
-      403: apiErrorSchema,
-      413: apiErrorSchema,
-      429: apiErrorSchema,
-      500: apiErrorSchema
-    },
-    summary: "Transcribe raw 16 kHz mono signed 16-bit PCM audio using the existing voice input pipeline"
+    summary: "Get checkpoint by ID"
   }
 });
 
 // ../../packages/api-contracts/src/contracts/realtime.ts
 init_esm_shims();
-var c36 = initContract();
+var c37 = initContract();
 var ablyTokenRequestSchema = external_exports.object({
   keyName: external_exports.string(),
   ttl: external_exports.number().optional(),
@@ -13347,7 +13169,7 @@ var ablyTokenRequestSchema = external_exports.object({
   nonce: external_exports.string(),
   mac: external_exports.string()
 });
-var runnerRealtimeTokenContract = c36.router({
+var runnerRealtimeTokenContract = c37.router({
   /**
    * POST /api/runners/realtime/token
    * Get an Ably token to subscribe to a runner group's job notification channel
@@ -13369,7 +13191,7 @@ var runnerRealtimeTokenContract = c36.router({
     summary: "Get Ably token for runner group job notifications"
   }
 });
-var platformRealtimeTokenContract = c36.router({
+var platformRealtimeTokenContract = c37.router({
   /**
    * POST /api/zero/realtime/token
    * Get an Ably token to subscribe to the authenticated user's push channel
@@ -28824,7 +28646,7 @@ var HEX_DIGITS = new Set("0123456789abcdefABCDEF".split(""));
 
 // ../../packages/api-contracts/src/contracts/zero-feature-switches.ts
 init_esm_shims();
-var c37 = initContract();
+var c38 = initContract();
 var featureSwitchesResponseSchema = external_exports.object({
   switches: external_exports.record(external_exports.string(), external_exports.boolean()),
   effectiveSwitches: external_exports.record(external_exports.string(), external_exports.boolean())
@@ -28832,7 +28654,7 @@ var featureSwitchesResponseSchema = external_exports.object({
 var updateFeatureSwitchesRequestSchema = external_exports.object({
   switches: external_exports.record(external_exports.string(), external_exports.boolean())
 });
-var zeroFeatureSwitchesContract = c37.router({
+var zeroFeatureSwitchesContract = c38.router({
   get: {
     method: "GET",
     path: "/api/zero/feature-switches",
@@ -28861,7 +28683,7 @@ var zeroFeatureSwitchesContract = c37.router({
     method: "DELETE",
     path: "/api/zero/feature-switches",
     headers: authHeadersSchema,
-    body: c37.noBody(),
+    body: c38.noBody(),
     responses: {
       200: external_exports.object({ deleted: external_exports.literal(true) }),
       401: apiErrorSchema,
@@ -28873,7 +28695,7 @@ var zeroFeatureSwitchesContract = c37.router({
 
 // ../../packages/api-contracts/src/contracts/zero-memory.ts
 init_esm_shims();
-var c38 = initContract();
+var c39 = initContract();
 var memoryFileSchema = external_exports.object({
   path: external_exports.string(),
   size: external_exports.number()
@@ -28891,7 +28713,7 @@ var memoryDetailResponseSchema = external_exports.object({
   files: external_exports.array(memoryFileSchema),
   fileContents: external_exports.array(memoryFileContentSchema)
 });
-var zeroMemoryContract = c38.router({
+var zeroMemoryContract = c39.router({
   get: {
     method: "GET",
     path: "/api/zero/memory",
@@ -28907,7 +28729,7 @@ var zeroMemoryContract = c38.router({
 
 // ../../packages/api-contracts/src/contracts/onboarding.ts
 init_esm_shims();
-var c39 = initContract();
+var c40 = initContract();
 var onboardingStatusResponseSchema = external_exports.object({
   needsOnboarding: external_exports.boolean(),
   onboardingComplete: external_exports.boolean(),
@@ -28922,7 +28744,7 @@ var onboardingStatusResponseSchema = external_exports.object({
     avatarUrl: external_exports.string().optional()
   }).nullable()
 });
-var onboardingStatusContract = c39.router({
+var onboardingStatusContract = c40.router({
   getStatus: {
     method: "GET",
     path: "/api/zero/onboarding/status",
@@ -28934,7 +28756,7 @@ var onboardingStatusContract = c39.router({
     summary: "Get onboarding status for current user"
   }
 });
-var onboardingCompleteContract = c39.router({
+var onboardingCompleteContract = c40.router({
   complete: {
     method: "POST",
     path: "/api/zero/onboarding/complete",
@@ -28962,7 +28784,7 @@ var skillFrontmatterSchema = external_exports.object({
 
 // ../../packages/api-contracts/src/contracts/zero-codex-device-auth.ts
 init_esm_shims();
-var c40 = initContract();
+var c41 = initContract();
 var codexDeviceAuthScopeSchema = external_exports.enum(["org", "personal"]);
 var codexDeviceAuthStartResponseSchema = external_exports.object({
   sessionToken: external_exports.string(),
@@ -28988,7 +28810,7 @@ var codexDeviceAuthCompleteResponseSchema = external_exports.discriminatedUnion(
 var codexDeviceAuthCancelResponseSchema = external_exports.object({
   status: external_exports.literal("cancelled")
 });
-var zeroCodexDeviceAuthContract = c40.router({
+var zeroCodexDeviceAuthContract = c41.router({
   start: {
     method: "POST",
     path: "/api/zero/model-providers/codex/device-auth/sessions",
@@ -29036,7 +28858,7 @@ var zeroCodexDeviceAuthContract = c40.router({
 
 // ../../packages/api-contracts/src/contracts/zero-claude-code-device-auth.ts
 init_esm_shims();
-var c41 = initContract();
+var c42 = initContract();
 var claudeCodeDeviceAuthScopeSchema = external_exports.enum(["org", "personal"]);
 var claudeCodeDeviceAuthStartResponseSchema = external_exports.object({
   sessionToken: external_exports.string(),
@@ -29054,7 +28876,7 @@ var claudeCodeDeviceAuthCompleteResponseSchema = external_exports.object({
 var claudeCodeDeviceAuthCancelResponseSchema = external_exports.object({
   status: external_exports.literal("cancelled")
 });
-var zeroClaudeCodeDeviceAuthContract = c41.router({
+var zeroClaudeCodeDeviceAuthContract = c42.router({
   start: {
     method: "POST",
     path: "/api/zero/model-providers/claude-code/device-auth/sessions",
@@ -29105,12 +28927,12 @@ var zeroClaudeCodeDeviceAuthContract = c41.router({
 
 // ../../packages/api-contracts/src/contracts/zero-org-logo.ts
 init_esm_shims();
-var c42 = initContract();
+var c43 = initContract();
 var zeroOrgLogoResponseSchema = external_exports.object({
   logoUrl: external_exports.string().nullable(),
   hasImage: external_exports.boolean()
 });
-var zeroOrgLogoContract = c42.router({
+var zeroOrgLogoContract = c43.router({
   get: {
     method: "GET",
     path: "/api/zero/org/logo",
@@ -29128,7 +28950,7 @@ var zeroOrgLogoContract = c42.router({
     path: "/api/zero/org/logo",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c42.type(),
+    body: c43.type(),
     responses: {
       200: zeroOrgLogoResponseSchema,
       400: apiErrorSchema,
@@ -29155,8 +28977,8 @@ var zeroOrgLogoContract = c42.router({
 
 // ../../packages/api-contracts/src/contracts/zero-composes.ts
 init_esm_shims();
-var c43 = initContract();
-var zeroComposesListContract = c43.router({
+var c44 = initContract();
+var zeroComposesListContract = c44.router({
   list: {
     method: "GET",
     path: "/api/zero/composes/list",
@@ -29176,14 +28998,14 @@ var zeroComposesListContract = c43.router({
 
 // ../../packages/api-contracts/src/contracts/zero-personal-model-providers.ts
 init_esm_shims();
-var c44 = initContract();
+var c45 = initContract();
 var resetPersonalModelProviderSubscriptionUsageRequestSchema = external_exports.object({
   idempotencyKey: external_exports.uuid()
 });
 var resetPersonalModelProviderSubscriptionUsageResponseSchema = external_exports.object({
   outcome: external_exports.enum(["reset", "nothingToReset", "noCredit", "alreadyRedeemed"])
 });
-var zeroPersonalModelProvidersMainContract = c44.router({
+var zeroPersonalModelProvidersMainContract = c45.router({
   list: {
     method: "GET",
     path: "/api/zero/me/model-providers",
@@ -29212,7 +29034,7 @@ var zeroPersonalModelProvidersMainContract = c44.router({
     summary: "Create or update a personal model provider for the requesting user"
   }
 });
-var zeroPersonalModelProvidersByTypeContract = c44.router({
+var zeroPersonalModelProvidersByTypeContract = c45.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/me/model-providers/:type",
@@ -29221,7 +29043,7 @@ var zeroPersonalModelProvidersByTypeContract = c44.router({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c44.noBody(),
+      204: c45.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -29249,7 +29071,7 @@ var zeroPersonalModelProvidersByTypeContract = c44.router({
 
 // ../../packages/api-contracts/src/contracts/zero-memory-dev-refresh.ts
 init_esm_shims();
-var c45 = initContract();
+var c46 = initContract();
 var memoryDevRefreshSkippedResponseSchema = external_exports.object({
   skipped: external_exports.literal(true)
 });
@@ -29260,12 +29082,12 @@ var memoryDevRefreshResponseSchema = external_exports.union([
   memoryDevRefreshSkippedResponseSchema,
   memoryDevRefreshSummarizedResponseSchema
 ]);
-var zeroMemoryDevRefreshContract = c45.router({
+var zeroMemoryDevRefreshContract = c46.router({
   refresh: {
     method: "POST",
     path: "/api/zero/memory/dev-refresh",
     headers: authHeadersSchema,
-    body: c45.noBody(),
+    body: c46.noBody(),
     responses: {
       200: memoryDevRefreshResponseSchema,
       401: apiErrorSchema,
@@ -29276,69 +29098,6 @@ var zeroMemoryDevRefreshContract = c45.router({
   }
 });
 
-// ../../packages/api-contracts/src/contracts/api-keys.ts
-init_esm_shims();
-var c46 = initContract();
-var apiKeyItemSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  name: external_exports.string(),
-  tokenPrefix: external_exports.string(),
-  createdAt: external_exports.string(),
-  expiresAt: external_exports.string(),
-  lastUsedAt: external_exports.string().nullable()
-});
-var apiKeyListResponseSchema = external_exports.object({
-  apiKeys: external_exports.array(apiKeyItemSchema)
-});
-var createApiKeyRequestSchema = external_exports.object({
-  name: external_exports.string().min(1).max(100),
-  expiresInDays: external_exports.number().int().positive().max(3650)
-});
-var createApiKeyResponseSchema = apiKeyItemSchema.extend({
-  token: external_exports.string()
-});
-var apiKeysContract = c46.router({
-  list: {
-    method: "GET",
-    path: "/api/zero/api-keys",
-    headers: authHeadersSchema,
-    responses: {
-      200: apiKeyListResponseSchema,
-      401: apiErrorSchema,
-      500: apiErrorSchema
-    },
-    summary: "List caller's API keys (metadata only)"
-  },
-  create: {
-    method: "POST",
-    path: "/api/zero/api-keys",
-    headers: authHeadersSchema,
-    body: createApiKeyRequestSchema,
-    responses: {
-      201: createApiKeyResponseSchema,
-      400: apiErrorSchema,
-      401: apiErrorSchema,
-      500: apiErrorSchema
-    },
-    summary: "Create a new API key (token returned once)"
-  }
-});
-var apiKeysByIdContract = c46.router({
-  delete: {
-    method: "DELETE",
-    path: "/api/zero/api-keys/:id",
-    headers: authHeadersSchema,
-    pathParams: external_exports.object({ id: external_exports.string().uuid() }),
-    responses: {
-      204: c46.noBody(),
-      401: apiErrorSchema,
-      404: apiErrorSchema,
-      500: apiErrorSchema
-    },
-    summary: "Revoke (delete) an API key"
-  }
-});
-
 // ../../packages/api-contracts/src/contracts/integrations-github.ts
 init_esm_shims();
 var c47 = initContract();
@@ -31925,6 +31684,20 @@ var FEATURE_SWITCHES = {
     enabled: false,
     enabledOrgIdHashes: STAFF_ORG_ID_HASHES
   },
+  ["morningBrief" /* MorningBrief */]: {
+    maintainer: "ethan@vm0.ai",
+    description: "Enable the daily 7:00 local-time Morning Brief email built from GitHub, Gmail, and Google Calendar.",
+    enabled: false,
+    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,
+    userOverridable: true
+  },
+  ["manualMorningBrief" /* ManualMorningBrief */]: {
+    maintainer: "ethan@vm0.ai",
+    description: "Show a Send now button in Settings that triggers a Morning Brief immediately for testing.",
+    enabled: false,
+    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,
+    userOverridable: true
+  },
   ["notionWorkflowAutomations" /* NotionWorkflowAutomations */]: {
     maintainer: "lancy@vm0.ai",
     description: "Enable Notion event workflow automations, starting with child pages created under a configured parent page.",
@@ -31956,12 +31729,6 @@ var FEATURE_SWITCHES = {
     description: "Enable the Workday HCM and finance connector",
     enabled: false
   },
-  ["apiKeys" /* ApiKeys */]: {
-    maintainer: "ethan@vm0.ai",
-    description: "Gate the custom /settings/api-keys UI for issuing personal access tokens used by the /api/v1 public surface. When disabled, the settings page redirects to / and the sidebar menu item is hidden. The backend /api/v1 verification does NOT consult this flag \u2014 previously issued PATs continue to work.",
-    enabled: false,
-    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
-  },
   ["codexFastMode" /* CodexFastMode */]: {
     maintainer: "lancy@vm0.ai",
     description: "Enable Codex fast mode for ChatGPT subscription GPT 5.5 and GPT 5.6 web chat runs.",
@@ -31984,6 +31751,12 @@ var FEATURE_SWITCHES = {
     enabled: false,
     userOverridable: false
   },
+  ["structuredPrompt" /* StructuredPrompt */]: {
+    maintainer: "bingjie@vm0.ai",
+    description: "Enable structured user prompt rendering, sends, and drafts while preserving the legacy content fallback.",
+    enabled: false,
+    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
+  },
   ["zapierConnector" /* ZapierConnector */]: {
     maintainer: "yuma@vm0.ai",
     description: "Enable the Zapier connector. When disabled, Zapier is hidden from the connectors list and cannot be connected.",
@@ -33929,454 +33702,231 @@ var EventRenderer = class _EventRenderer {
   }
 };
 
-// src/commands/run/shared.ts
+// src/lib/utils/log-pagination.ts
 init_esm_shims();
-var import_dotenv = __toESM(require_main(), 1);
-import * as fs from "fs";
-function collectKeyValue(value, previous) {
-  const [key, ...valueParts] = value.split("=");
-  const val = valueParts.join("=");
-  if (!key || val === void 0 || val === "") {
-    throw new Error(`Invalid format: ${value} (expected KEY=value)`);
+function parsePositiveLogCount(value, optionName) {
+  const trimmed = value.trim();
+  if (!/^0*[1-9]\d*$/.test(trimmed)) {
+    throw new Error(`Option ${optionName} must be a positive integer`);
   }
-  return { ...previous, [key]: val };
-}
-function collectVolumeVersions(value, previous) {
-  const [volumeName, ...versionParts] = value.split("=");
-  const version = versionParts.join("=");
-  if (!volumeName || version === void 0 || version === "") {
-    throw new Error(
-      `Invalid volume-version format: ${value} (expected volumeName=version)`
-    );
+  const count = Number(trimmed);
+  if (!Number.isSafeInteger(count)) {
+    throw new Error(`Option ${optionName} must be a positive integer`);
   }
-  return { ...previous, [volumeName]: version };
+  return count;
 }
-function parseMount(value, flagLabel) {
-  const parts = value.split(":");
-  if (parts.length < 2 || parts.length > 3) {
-    throw new Error(
-      `Invalid ${flagLabel} format: ${value} (expected name:/path or name:version:/path)`
-    );
+function parseBoundedLogCount(value, optionName, min, max) {
+  const trimmed = value.trim();
+  if (!/^\d+$/.test(trimmed)) {
+    throw new Error(`${optionName} must be between ${min} and ${max}`);
   }
-  const name = parts[0];
-  const mountPath = parts.length === 3 ? parts[2] : parts[1];
-  if (!name) {
-    throw new Error(
-      `Invalid ${flagLabel} format: ${value} (name cannot be empty)`
-    );
-  }
-  if (!mountPath.startsWith("/")) {
-    throw new Error(
-      `Invalid ${flagLabel} mount path: ${mountPath} (must start with /)`
-    );
-  }
-  if (parts.length === 2) {
-    return { name, mountPath };
-  }
-  const version = parts[1];
-  if (!version) {
-    throw new Error(
-      `Invalid ${flagLabel} format: ${value} (version cannot be empty)`
-    );
+  const count = Number(trimmed);
+  if (!Number.isSafeInteger(count) || count < min || count > max) {
+    throw new Error(`${optionName} must be between ${min} and ${max}`);
   }
-  return { name, version, mountPath };
-}
-function collectMounts(value, previous) {
-  return [...previous, parseMount(value, "volume")];
+  return count;
 }
-function collectArtifacts(value, previous) {
-  return [...previous, parseMount(value, "artifact")];
-}
-function parsePermissionPolicies(json) {
-  if (!json) return void 0;
-  let parsed;
-  try {
-    parsed = JSON.parse(json);
-  } catch {
-    throw new Error(
-      `Invalid --permission-policies JSON: ${json}
-Expected format: '{"ref": {"permissions": {"perm": "allow|deny|ask"}}}'`
-    );
-  }
-  const result = firewallPoliciesSchema.safeParse(parsed);
-  if (!result.success) {
-    throw new Error(
-      `Invalid --permission-policies: ${result.error.issues.map((i) => {
-        return i.message;
-      }).join(", ")}`
-    );
+async function collectLogItems(options) {
+  const collected = [];
+  const seenCursors = /* @__PURE__ */ new Set();
+  let cursor2;
+  while (true) {
+    const requestLimit = options.targetCount === "all" ? options.pageLimit : Math.min(options.pageLimit, options.targetCount - collected.length);
+    const page = await options.fetchPage({
+      sinceTime: options.sinceTime,
+      cursor: cursor2,
+      limit: requestLimit,
+      order: options.order
+    });
+    collected.push(...page.items);
+    if (options.targetCount !== "all" && collected.length >= options.targetCount) {
+      break;
+    }
+    const nextCursor = page.nextCursor ?? null;
+    if (!page.hasMore || !nextCursor || seenCursors.has(nextCursor)) {
+      break;
+    }
+    seenCursors.add(nextCursor);
+    cursor2 = nextCursor;
   }
-  return result.data;
+  const entries = options.targetCount === "all" ? collected : collected.slice(0, options.targetCount);
+  return options.order === "desc" ? entries.reverse() : entries;
 }
+
+// src/lib/utils/uuid.ts
+init_esm_shims();
 var UUID_PATTERN = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000)$/i;
-function isUUID(str) {
-  return UUID_PATTERN.test(str);
-}
-function extractVarNames(composeContent) {
-  const grouped = extractAndGroupVariables(composeContent);
-  return grouped.vars.map((r) => {
-    return r.name;
-  });
-}
-function extractSecretNames(composeContent) {
-  const grouped = extractAndGroupVariables(composeContent);
-  return grouped.secrets.map((r) => {
-    return r.name;
-  });
+function isUuid(value) {
+  return UUID_PATTERN.test(value);
 }
-function loadValues(cliValues, configNames, envFilePath) {
-  const result = { ...cliValues };
-  const missingNames = configNames.filter((name) => {
-    return !(name in result);
-  });
-  if (missingNames.length > 0) {
-    const envValues = {};
-    for (const name of missingNames) {
-      const envValue = process.env[name];
-      if (envValue !== void 0) {
-        envValues[name] = envValue;
-      }
-    }
-    let fileValues = {};
-    if (envFilePath) {
-      if (!fs.existsSync(envFilePath)) {
-        throw new Error(`Environment file not found: ${envFilePath}`);
-      }
-      const dotenvResult = (0, import_dotenv.config)({ path: envFilePath, quiet: true });
-      if (dotenvResult.parsed) {
-        fileValues = Object.fromEntries(
-          Object.entries(dotenvResult.parsed).filter(([key]) => {
-            return missingNames.includes(key);
-          })
-        );
-      }
-    }
-    Object.assign(result, envValues, fileValues);
+
+// src/lib/utils/search-query.ts
+init_esm_shims();
+function parseSearchQuery(value, label) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    throw new Error(`${label} cannot be empty.`);
   }
-  return Object.keys(result).length > 0 ? result : void 0;
+  return trimmed;
 }
-function parseIdentifier(identifier) {
-  if (isUUID(identifier)) {
-    return { name: identifier };
-  }
-  const colonIndex = identifier.indexOf(":");
-  if (colonIndex > 0 && colonIndex < identifier.length - 1) {
-    return {
-      name: identifier.slice(0, colonIndex),
-      version: identifier.slice(colonIndex + 1)
-    };
-  }
-  return { name: identifier };
+
+// src/commands/zero/logs/search.ts
+init_esm_shims();
+var SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3;
+function supportedSearchFramework(framework) {
+  const normalized = framework ?? void 0;
+  return isSupportedFramework(normalized) ? normalized : void 0;
 }
-function renderRunCreated(response) {
-  if (response.status === "queued") {
-    console.log(source_default.yellow("\u26A0 Run queued \u2014 concurrency limit reached"));
-    console.log(`  Run ID:  ${source_default.dim(response.runId)}`);
-    console.log(
-      source_default.dim("  Will start automatically when a slot is available")
-    );
-    console.log();
-  } else {
-    EventRenderer.renderRunStarted({
-      runId: response.runId,
-      sandboxId: response.sandboxId
-    });
+function renderSearchEvent(event, framework, renderer, normalizer) {
+  const parsedEvents = normalizer.process(
+    event.eventData,
+    supportedSearchFramework(framework),
+    new Date(event.createdAt)
+  );
+  for (const parsed of parsedEvents) {
+    renderer.render(parsed);
   }
 }
-var TERMINAL_RUN_STATUSES = [
-  "completed",
-  "failed",
-  "timeout",
-  "cancelled"
-];
-var POLL_INTERVAL_MS = 1e3;
-var TERMINAL_DRAIN_POLL_INTERVAL_MS = 500;
-var TERMINAL_DRAIN_IDLE_MS = 1e3;
-var TERMINAL_DRAIN_MAX_MS = 3e3;
-function supportedEventFramework(framework) {
-  return isSupportedFramework(framework) ? framework : void 0;
-}
-function isTerminalRunState(run) {
-  return TERMINAL_RUN_STATUSES.includes(run.status);
-}
-function shouldDrainNextEventPage(response, madeSequenceProgress) {
-  return response.hasMore && response.events.length > 0 && madeSequenceProgress;
-}
-function isBlockedBySequenceGap(response, madeSequenceProgress) {
-  return response.hasMore && !madeSequenceProgress;
-}
-function hasTerminalWatermark(run) {
-  return run.lastEventSequence !== void 0;
-}
-function hasReachedTerminalWatermark(run, nextSequence) {
-  return run.lastEventSequence !== void 0 && nextSequence >= run.lastEventSequence;
-}
-function shouldCompleteTerminalDrain(terminalSeenAt, lastTerminalProgressAt, blockedByGap) {
-  const now = Date.now();
-  const terminalElapsedMs = now - terminalSeenAt;
-  const terminalIdleMs = now - lastTerminalProgressAt;
-  return terminalElapsedMs >= TERMINAL_DRAIN_MAX_MS || !blockedByGap && terminalIdleMs >= TERMINAL_DRAIN_IDLE_MS;
-}
-function updateTerminalDrainState(state, run, madeSequenceProgress, now) {
-  if (isTerminalRunState(run)) {
-    if (!state.runState) {
-      state.seenAt = now;
-      state.lastProgressAt = now;
-    } else if (madeSequenceProgress) {
-      state.lastProgressAt = now;
-    }
-    state.runState = run;
-    return;
-  }
-  if (state.runState && madeSequenceProgress) {
-    state.lastProgressAt = now;
+function flushSearchRenderer(renderer, normalizer) {
+  for (const parsed of normalizer.flush()) {
+    renderer.render(parsed);
   }
+  renderer.flush();
 }
-function isBlockedByTerminalWatermark(run, nextSequence) {
-  return hasTerminalWatermark(run) && !hasReachedTerminalWatermark(run, nextSequence);
-}
-function shouldReturnTerminalRunResult(state, response, nextSequence, madeSequenceProgress, seenResultEvent) {
-  const run = state.runState;
-  if (!run) {
-    return false;
-  }
-  if (!hasTerminalWatermark(run) && run.status !== "completed") {
-    if (run.status === "timeout" && shouldDrainNextEventPage(response, madeSequenceProgress)) {
-      return false;
-    }
-    return true;
-  }
-  if (!hasTerminalWatermark(run) && seenResultEvent) {
-    return true;
-  }
-  return shouldCompleteTerminalDrain(
-    state.seenAt,
-    state.lastProgressAt,
-    isBlockedBySequenceGap(response, madeSequenceProgress) || isBlockedByTerminalWatermark(run, nextSequence)
-  );
+function formatRunHeader(runId, agentName, timestamp) {
+  const time = formatIsoTimestamp(timestamp);
+  return `\u2500\u2500 Run ${runId} (${agentName}, ${time}) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`;
 }
-function renderTerminalRunResult(runId, run) {
-  if (run.status === "completed") {
-    EventRenderer.renderRunCompleted(run.result);
-    return {
-      succeeded: true,
-      runId,
-      sessionId: run.result?.agentSessionId,
-      checkpointId: run.result?.checkpointId
-    };
-  }
-  if (run.status === "failed") {
-    EventRenderer.renderRunFailed(run.error, runId);
-    return { succeeded: false, runId };
-  }
-  if (run.status === "timeout") {
-    console.error(source_default.red("\n\u2717 Run timed out"));
-    console.error(source_default.dim(`  (use "zero logs ${runId}" to view logs)`));
-    return { succeeded: false, runId };
-  }
-  console.error(source_default.yellow("\n\u2717 Run cancelled"));
-  return { succeeded: false, runId };
+function parseContextOptions(options) {
+  const contextN = options.context !== void 0 ? parseBoundedLogCount(options.context, "--context", 0, 10) : 0;
+  const before = options.beforeContext !== void 0 ? parseBoundedLogCount(options.beforeContext, "--before-context", 0, 10) : contextN;
+  const after = options.afterContext !== void 0 ? parseBoundedLogCount(options.afterContext, "--after-context", 0, 10) : contextN;
+  return { before, after };
 }
-function sleep(ms) {
-  return new Promise((resolve) => {
-    return setTimeout(resolve, ms);
-  });
+function parseLimit(value) {
+  if (value === void 0) return void 0;
+  return parseBoundedLogCount(value, "--limit", 1, 50);
 }
-async function pollEvents(runId, options) {
-  const renderer = new EventRenderer({ verbose: options?.verbose });
-  const normalizer = new EventStreamNormalizer();
-  let nextSequence = -1;
-  const terminalDrain = {
-    seenAt: 0,
-    lastProgressAt: 0
-  };
-  let seenResultEvent = false;
-  const flushPendingEvents = () => {
-    for (const parsed of normalizer.flush()) {
-      renderer.render(parsed);
-    }
-    renderer.flush();
-  };
-  for (; ; ) {
-    const previousSequence = nextSequence;
-    const response = await getEvents(runId, {
-      since: nextSequence
-    });
-    const now = Date.now();
-    const madeSequenceProgress = response.nextSequence > previousSequence;
-    let pageHasResultEvent = false;
-    if (madeSequenceProgress) {
-      for (const event of response.events) {
-        const parsedEvents = normalizer.process(
-          event.eventData,
-          supportedEventFramework(response.framework)
-        );
-        for (const parsed of parsedEvents) {
-          renderer.render(parsed);
-          if (parsed.type === "result") {
-            pageHasResultEvent = true;
-          }
-        }
-      }
+function renderResults(response) {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const result of response.results) {
+    const existing = grouped.get(result.runId);
+    if (existing) {
+      existing.results.push(result);
+    } else {
+      grouped.set(result.runId, {
+        agentName: result.agentName,
+        results: [result]
+      });
     }
-    if (madeSequenceProgress) {
-      if (pageHasResultEvent) {
-        seenResultEvent = true;
-      }
-      nextSequence = response.nextSequence;
+  }
+  let isFirstGroup = true;
+  for (const [runId, group] of grouped) {
+    if (!isFirstGroup) {
+      console.log();
     }
-    updateTerminalDrainState(
-      terminalDrain,
-      response.run,
-      madeSequenceProgress,
-      now
+    isFirstGroup = false;
+    const firstTimestamp = group.results[0].matchedEvent.createdAt;
+    console.log(
+      source_default.bold(formatRunHeader(runId, group.agentName, firstTimestamp))
     );
-    if (terminalDrain.runState && hasReachedTerminalWatermark(terminalDrain.runState, nextSequence)) {
-      flushPendingEvents();
-      return renderTerminalRunResult(runId, terminalDrain.runState);
-    }
-    const terminalRunState = terminalDrain.runState;
-    if (terminalRunState && shouldReturnTerminalRunResult(
-      terminalDrain,
-      response,
-      nextSequence,
-      madeSequenceProgress,
-      seenResultEvent
-    )) {
-      flushPendingEvents();
-      return renderTerminalRunResult(runId, terminalRunState);
-    }
-    if (shouldDrainNextEventPage(response, madeSequenceProgress)) {
-      continue;
+    for (const result of group.results) {
+      const renderer = new EventRenderer({
+        showTimestamp: true,
+        verbose: false
+      });
+      const normalizer = new EventStreamNormalizer();
+      for (const event of result.contextBefore) {
+        renderSearchEvent(event, result.framework, renderer, normalizer);
+      }
+      renderSearchEvent(
+        result.matchedEvent,
+        result.framework,
+        renderer,
+        normalizer
+      );
+      for (const event of result.contextAfter) {
+        renderSearchEvent(event, result.framework, renderer, normalizer);
+      }
+      flushSearchRenderer(renderer, normalizer);
     }
-    await sleep(
-      terminalDrain.runState ? TERMINAL_DRAIN_POLL_INTERVAL_MS : POLL_INTERVAL_MS
+  }
+  if (response.hasMore) {
+    console.log();
+    console.log(
+      source_default.dim(
+        `  Showing first ${response.results.length} matches. Use --limit to see more.`
+      )
     );
   }
 }
-function showNextSteps(result) {
-  const { runId, sessionId, checkpointId } = result;
-  console.log();
-  console.log("  View agent logs:");
-  console.log(source_default.cyan(`    zero logs ${runId}`));
-  if (sessionId) {
-    console.log("  Continue with session (latest conversation and artifact):");
-    console.log(
-      source_default.cyan(`    vm0 run continue ${sessionId} "your next prompt"`)
+async function runLogsSearch(keyword, options) {
+  const searchKeyword = parseSearchQuery(keyword, "Keyword");
+  const { before, after } = parseContextOptions(options);
+  if (options.agentId !== void 0 && !isUuid(options.agentId)) {
+    console.error(
+      source_default.red(`\u2717 Invalid agent ID "${options.agentId}" \u2014 expected a UUID`)
     );
+    console.error(source_default.dim("  Run: zero logs list    to find agent IDs"));
+    process.exit(1);
   }
-  if (checkpointId) {
-    console.log(
-      "  Resume from checkpoint (snapshotted conversation and artifact):"
+  if (options.run !== void 0 && !isUuid(options.run)) {
+    console.error(
+      source_default.red(`\u2717 Invalid run ID "${options.run}" \u2014 expected a UUID`)
     );
+    console.error(source_default.dim("  Run: zero logs list    to find run IDs"));
+    process.exit(1);
+  }
+  const since = options.since !== void 0 ? parseTime(options.since) : Date.now() - SEVEN_DAYS_MS;
+  const limit = parseLimit(options.limit);
+  const response = await searchZeroLogs({
+    keyword: searchKeyword,
+    agentId: options.agentId,
+    runId: options.run,
+    since,
+    limit,
+    before,
+    after
+  });
+  if (response.results.length === 0) {
+    console.log(source_default.dim("No matches found"));
     console.log(
-      source_default.cyan(`    vm0 run resume ${checkpointId} "your next prompt"`)
+      source_default.dim(
+        "  Try a broader search with --since 30d or a different keyword"
+      )
     );
+    return;
   }
+  renderResults(response);
 }
-
-// src/lib/utils/time-parser.ts
-init_esm_shims();
-var ISO_8601_PATTERN = /^(\d{4})-(\d{2})-(\d{2})(?:[Tt](\d{2}):(\d{2})(?::(\d{2})(?:\.\d{1,9})?)?(?:[Zz]|[+-]\d{2}:?\d{2})?)?$/;
-var DAYS_BY_MONTH = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-var MAX_DATE_TIMESTAMP_MS = 864e13;
-function parseTime(timeStr) {
-  const relativeMatch = timeStr.match(/^(\d+)([smhdw])$/);
-  if (relativeMatch) {
-    const value = Number(relativeMatch[1]);
-    const unit = relativeMatch[2];
-    const timestamp2 = parseRelativeTime(value, unit);
-    if (timestamp2 !== void 0) {
-      return timestamp2;
-    }
-  }
-  if (/^\d+$/.test(timeStr)) {
-    const rawTimestamp = Number(timeStr);
-    const timestamp2 = rawTimestamp < 1e10 ? rawTimestamp * 1e3 : rawTimestamp;
-    if (isValidTimestamp(timestamp2)) {
-      return timestamp2;
+var searchCommand = new Command().name("search").description("Search agent events across runs").argument("<keyword>", "Search keyword").option("-A, --after-context <n>", "Show n events after each match").option("-B, --before-context <n>", "Show n events before each match").option("-C, --context <n>", "Show n events before and after each match").option("--agent <id>", "Filter by Zero agent ID").option("--run <id>", "Filter by specific run ID").option("--since <time>", "Search logs since (default: 7d)").option("--limit <n>", "Maximum number of matches (default: 20)").addHelpText(
+  "after",
+  `
+Examples:
+  zero logs search "error"
+  zero logs search "timeout" --agent 123e4567-e89b-12d3-a456-426614174000 -C 2
+  zero logs search "failed" --since 30d --limit 50`
+).action(
+  withErrorHandler(
+    async (keyword, options) => {
+      const { agent, ...searchOptions } = options;
+      await runLogsSearch(keyword, { ...searchOptions, agentId: agent });
     }
-  }
-  const timestamp = parseIsoTime(timeStr);
-  if (timestamp !== void 0) {
-    return timestamp;
-  }
-  throw new Error(
-    `Invalid time format: "${timeStr}". Supported formats: relative (5m, 2h, 1d), ISO 8601 (2024-01-15T10:30:00Z), Unix timestamp`
-  );
-}
-function parseIsoTime(timeStr) {
-  const match = ISO_8601_PATTERN.exec(timeStr);
-  if (!match) {
-    return void 0;
-  }
-  const year = Number(match[1]);
-  const month = Number(match[2]);
-  const day = Number(match[3]);
-  const hour = match[4] ? Number(match[4]) : 0;
-  const minute = match[5] ? Number(match[5]) : 0;
-  const second = match[6] ? Number(match[6]) : 0;
-  if (!Number.isInteger(year) || !Number.isInteger(month) || !Number.isInteger(day) || !Number.isInteger(hour) || !Number.isInteger(minute) || !Number.isInteger(second) || month < 1 || month > 12 || day < 1 || day > daysInMonth(year, month) || hour > 23 || minute > 59 || second > 59) {
-    return void 0;
-  }
-  const timestamp = new Date(timeStr).getTime();
-  return isValidTimestamp(timestamp) ? timestamp : void 0;
-}
-function daysInMonth(year, month) {
-  if (month === 2) {
-    return isLeapYear(year) ? 29 : 28;
-  }
-  return DAYS_BY_MONTH[month - 1] ?? 0;
-}
-function isLeapYear(year) {
-  return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
-}
-function parseRelativeTime(value, unit) {
-  if (!Number.isSafeInteger(value)) {
-    return void 0;
-  }
-  const now = Date.now();
-  const multipliers = {
-    s: 1e3,
-    // seconds
-    m: 60 * 1e3,
-    // minutes
-    h: 60 * 60 * 1e3,
-    // hours
-    d: 24 * 60 * 60 * 1e3,
-    // days
-    w: 7 * 24 * 60 * 60 * 1e3
-    // weeks
-  };
-  const multiplier = multipliers[unit];
-  if (!multiplier) {
-    throw new Error(`Unknown time unit: ${unit}`);
-  }
-  const timestamp = now - value * multiplier;
-  return isValidTimestamp(timestamp) ? timestamp : void 0;
-}
-function isValidTimestamp(timestamp) {
-  return Number.isSafeInteger(timestamp) && Math.abs(timestamp) <= MAX_DATE_TIMESTAMP_MS;
-}
+  )
+);
 
 export {
+  parseTime,
   isSupportedFramework,
   EventStreamNormalizer,
   formatIsoTimestamp,
   EventRenderer,
-  collectKeyValue,
-  collectVolumeVersions,
-  collectMounts,
-  collectArtifacts,
-  parsePermissionPolicies,
-  isUUID,
-  extractVarNames,
-  extractSecretNames,
-  loadValues,
-  parseIdentifier,
-  renderRunCreated,
-  pollEvents,
-  showNextSteps,
-  parseTime
-};
-//# sourceMappingURL=chunk-65MTNZ44.js.map
+  parsePositiveLogCount,
+  parseBoundedLogCount,
+  collectLogItems,
+  isUuid,
+  parseSearchQuery,
+  runLogsSearch,
+  searchCommand
+};
+//# sourceMappingURL=chunk-6P7XBY46.js.map