@vm0/cli 9.264.0 → 9.264.1

package/{agent-KRVTXAOE.js → agent-E2BPFAL6.js}

@@ -4,14 +4,14 @@ const require = __createRequire(import.meta.url);
 import {
   loadConnectorPermissionInfos,
   policyIcon
-} from "./chunk-HZ4TCSCL.js";
+} from "./chunk-HZXJAGKW.js";
 import {
   isInteractive,
   promptConfirm
 } from "./chunk-NU6ECB2E.js";
 import {
   permissionGrantsToFirewallPolicies
-} from "./chunk-XX7HZFVS.js";
+} from "./chunk-ULPX3TWL.js";
 import {
   createZeroAgent,
   deleteZeroAgent,
@@ -23,13 +23,13 @@ import {
   listZeroUserPermissionGrants,
   updateZeroAgent,
   updateZeroAgentInstructions
-} from "./chunk-52KFOVUA.js";
-import "./chunk-LPA5CSUN.js";
+} from "./chunk-4IYCDMRE.js";
+import "./chunk-XLEUQPCM.js";
 import "./chunk-MA22KQYU.js";
 import {
   source_default,
   withErrorHandler
-} from "./chunk-4FZPFRJH.js";
+} from "./chunk-CIJTPQ5G.js";
 import "./chunk-MD3YWUKO.js";
 import {
   Command
@@ -594,4 +594,4 @@ Notes:
 export {
   zeroAgentCommand
 };
-//# sourceMappingURL=agent-KRVTXAOE.js.map
+//# sourceMappingURL=agent-E2BPFAL6.js.map

package/{banking-QBRETSHD.js → banking-V23G5LOK.js}

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   callZeroBanking
-} from "./chunk-52KFOVUA.js";
-import "./chunk-LPA5CSUN.js";
+} from "./chunk-4IYCDMRE.js";
+import "./chunk-XLEUQPCM.js";
 import "./chunk-MA22KQYU.js";
 import {
   source_default,
   withErrorHandler
-} from "./chunk-4FZPFRJH.js";
+} from "./chunk-CIJTPQ5G.js";
 import "./chunk-MD3YWUKO.js";
 import {
   Command,
@@ -114,4 +114,4 @@ Notes:
 export {
   zeroBankingCommand
 };
-//# sourceMappingURL=banking-QBRETSHD.js.map
+//# sourceMappingURL=banking-V23G5LOK.js.map

package/{browser-MQ3GQJ5U.js → browser-52OL5JV4.js}

@@ -10,13 +10,13 @@ import {
   leaseZeroBrowser,
   useZeroBrowser,
   zeroBrowserCreateRequestSchema
-} from "./chunk-52KFOVUA.js";
-import "./chunk-LPA5CSUN.js";
+} from "./chunk-4IYCDMRE.js";
+import "./chunk-XLEUQPCM.js";
 import "./chunk-MA22KQYU.js";
 import {
   source_default,
   withErrorHandler
-} from "./chunk-4FZPFRJH.js";
+} from "./chunk-CIJTPQ5G.js";
 import "./chunk-MD3YWUKO.js";
 import {
   Command,
@@ -209,4 +209,4 @@ Notes:
 export {
   zeroBrowserCommand
 };
-//# sourceMappingURL=browser-MQ3GQJ5U.js.map
+//# sourceMappingURL=browser-52OL5JV4.js.map

package/{chat-AVYE5DM6.js → chat-4QKOKXPH.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-LN2ATWKS.js";
 import {
   formatModelProviderRoute
-} from "./chunk-GXNS5T7H.js";
+} from "./chunk-I3ZM26CK.js";
 import {
   chatThreadEventSchema,
   chatThreadSnapshotProjectionSchema,
@@ -21,14 +21,14 @@ import {
   listZeroModelPolicies,
   renameZeroChatThread,
   updateZeroChatThreadModelSelection
-} from "./chunk-52KFOVUA.js";
-import "./chunk-LPA5CSUN.js";
+} from "./chunk-4IYCDMRE.js";
+import "./chunk-XLEUQPCM.js";
 import "./chunk-MA22KQYU.js";
 import {
   getApiUrl,
   source_default,
   withErrorHandler
-} from "./chunk-4FZPFRJH.js";
+} from "./chunk-CIJTPQ5G.js";
 import {
   decodeZeroTokenPayload
 } from "./chunk-MD3YWUKO.js";
@@ -669,4 +669,4 @@ Examples:
 export {
   zeroChatCommand
 };
-//# sourceMappingURL=chat-AVYE5DM6.js.map
+//# sourceMappingURL=chat-4QKOKXPH.js.map

package/{chunk-52KFOVUA.js → chunk-4IYCDMRE.js}

@@ -21,7 +21,7 @@ import {
   updateOrgModelPoliciesRequestSchema,
   upsertModelProviderRequestSchema,
   upsertModelProviderResponseSchema
-} from "./chunk-4FZPFRJH.js";
+} from "./chunk-CIJTPQ5G.js";
 import {
   __commonJS,
   __esm,
@@ -1967,6 +1967,19 @@ init_esm_shims();
 // ../../packages/api-contracts/src/contracts/zero-agents.ts
 init_esm_shims();
 
+// ../../packages/api-contracts/src/contracts/draft-user-message.ts
+init_esm_shims();
+function requireUserMessageForNonEmptyDraft(draft, context) {
+  const hasLegacyDraft = (draft.draftContent?.length ?? 0) > 0 || (draft.draftAttachments?.length ?? 0) > 0;
+  if (hasLegacyDraft && draft.draftUserMessage === null) {
+    context.addIssue({
+      code: "custom",
+      message: "draftUserMessage is required for a non-empty draft",
+      path: ["draftUserMessage"]
+    });
+  }
+}
+
 // ../../packages/api-contracts/src/contracts/chat-threads.ts
 init_esm_shims();
 
@@ -3685,7 +3698,7 @@ var chatMessageRecommendedFollowupsSchema = external_exports.preprocess((value)
 }, external_exports.array(chatMessageRecommendedFollowupSchema));
 var inputPromptEventSchema = chatEventBaseSchema.extend({
   eventType: external_exports.literal("input.prompt"),
-  userMessage: userMessageDocumentSchema.optional(),
+  userMessage: userMessageDocumentSchema,
   attachFiles: external_exports.array(resolvedAttachFileSchema).optional(),
   generationTemplate: generationTemplateRequestSchema.optional()
 }).strict();
@@ -3698,7 +3711,7 @@ var inputAutomationEventSchema = chatEventBaseSchema.extend({
 }).strict();
 var inputRejectedEventSchema = chatEventBaseSchema.extend({
   eventType: external_exports.literal("input.rejected"),
-  userMessage: userMessageDocumentSchema.optional(),
+  userMessage: userMessageDocumentSchema,
   error: external_exports.string(),
   automationId: external_exports.string().uuid().optional(),
   triggerBrief: external_exports.string().nullable().optional(),
@@ -3825,9 +3838,9 @@ var chatThreadDraftSchema = external_exports.preprocess(
   normalizePrecedingDraftStructuredPrompt,
   external_exports.object({
     draftContent: external_exports.string().nullable(),
-    draftUserMessage: userMessageDocumentSchema.nullable().optional(),
+    draftUserMessage: userMessageDocumentSchema.nullable(),
     draftAttachments: external_exports.array(persistedAttachmentSchema).nullable()
-  })
+  }).superRefine(requireUserMessageForNonEmptyDraft)
 );
 var selectedModelRequestSchema = requestedRunModelSchema;
 function isRecord2(value) {
@@ -3902,7 +3915,7 @@ var chatNormalSendBodyShape = {
    */
   model: selectedModelRequestSchema.optional(),
   runOptions: chatRunOptionsRequestSchema.optional(),
-  userMessage: userMessageDocumentSchema.optional(),
+  userMessage: userMessageDocumentSchema,
   generationTemplate: generationTemplateRequestSchema.optional(),
   computerUseHostId: external_exports.string().uuid().nullable().optional(),
   cloudBrowserEnabled: external_exports.boolean().optional(),
@@ -4076,9 +4089,9 @@ var chatThreadByIdContract = c13.router({
     pathParams: chatThreadIdPathParamsSchema,
     body: external_exports.object({
       draftContent: external_exports.string().nullable().optional(),
-      draftUserMessage: userMessageDocumentSchema.nullable().optional(),
+      draftUserMessage: userMessageDocumentSchema.nullable(),
       draftAttachments: external_exports.array(persistedAttachmentSchema).nullable().optional()
-    }),
+    }).superRefine(requireUserMessageForNonEmptyDraft),
     responses: {
       204: c13.noBody(),
       400: apiErrorSchema,
@@ -4560,15 +4573,15 @@ var zeroAgentDraftResponseSchema = external_exports.preprocess(
   normalizePrecedingDraftStructuredPrompt,
   external_exports.object({
     draftContent: external_exports.string().nullable(),
-    draftUserMessage: userMessageDocumentSchema.nullable().optional(),
+    draftUserMessage: userMessageDocumentSchema.nullable(),
     draftAttachments: external_exports.array(persistedAttachmentSchema).nullable()
-  })
+  }).superRefine(requireUserMessageForNonEmptyDraft)
 );
 var zeroAgentDraftRequestSchema = external_exports.object({
   draftContent: external_exports.string().nullable().optional(),
-  draftUserMessage: userMessageDocumentSchema.nullable().optional(),
+  draftUserMessage: userMessageDocumentSchema.nullable(),
   draftAttachments: external_exports.array(persistedAttachmentSchema).nullable().optional()
-});
+}).superRefine(requireUserMessageForNonEmptyDraft);
 var zeroAgentsMainContract = c14.router({
   create: {
     method: "POST",
@@ -6284,6 +6297,69 @@ var networkPolicyRefreshesSchema = external_exports.record(
   external_exports.string(),
   networkPolicyRefreshSchema
 );
+var connectorPermissionNameListSchema = external_exports.array(external_exports.string().min(1)).superRefine((names, context) => {
+  if (new Set(names).size !== names.length) {
+    context.addIssue({
+      code: "custom",
+      message: "Connector permission names must be unique"
+    });
+  }
+});
+var connectorPermissionDefaultOverridesSchema = external_exports.object({
+  allow: connectorPermissionNameListSchema.optional(),
+  deny: connectorPermissionNameListSchema.optional(),
+  ask: connectorPermissionNameListSchema.optional()
+}).strict();
+var connectorPermissionBaselineEntrySchema = external_exports.object({
+  permissionNames: connectorPermissionNameListSchema,
+  defaultPolicy: external_exports.object({
+    permissionDefault: firewallPolicyValueSchema,
+    permissionOverrides: connectorPermissionDefaultOverridesSchema.optional(),
+    unknownPolicy: firewallPolicyValueSchema
+  }).strict()
+}).strict().superRefine((entry, context) => {
+  const permissionNames = new Set(entry.permissionNames);
+  const overrideNames = Object.values(
+    entry.defaultPolicy.permissionOverrides ?? {}
+  ).flat();
+  if (new Set(overrideNames).size !== overrideNames.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["defaultPolicy", "permissionOverrides"],
+      message: "Connector permission overrides must not overlap"
+    });
+  }
+  for (const permissionName of overrideNames) {
+    if (!permissionNames.has(permissionName)) {
+      context.addIssue({
+        code: "custom",
+        path: ["defaultPolicy", "permissionOverrides"],
+        message: "Connector permission override must name a permission"
+      });
+    }
+  }
+});
+var connectorCatalogDigestSchema = external_exports.string().regex(/^sha256:[a-f0-9]{64}$/u);
+var connectorCatalogBackendVersionSchema = external_exports.string().regex(/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u);
+var connectorCatalogBuildCommitShaSchema = external_exports.string().regex(/^[a-f0-9]{40}$/u);
+var storedConnectorPermissionBaselineSchema = external_exports.object({
+  version: external_exports.literal(1),
+  catalogIdentity: external_exports.object({
+    sourceId: external_exports.string().min(1),
+    schemaVersion: external_exports.number().int().positive(),
+    catalogVersion: external_exports.string().min(1),
+    catalogDigest: connectorCatalogDigestSchema,
+    capabilityDigest: connectorCatalogDigestSchema
+  }).strict(),
+  validationAuthority: external_exports.object({
+    backendVersion: connectorCatalogBackendVersionSchema,
+    buildCommitSha: connectorCatalogBuildCommitShaSchema.nullable()
+  }).strict(),
+  connectors: external_exports.record(
+    connectorRefSchema,
+    connectorPermissionBaselineEntrySchema
+  )
+}).strict();
 var runnerBuiltinFirewallNameSchema = external_exports.string().min(1).max(128).regex(/^(?:[a-z0-9][a-z0-9-]*|model-provider:[a-z0-9][a-z0-9-]*)$/);
 var runnerBuiltinFirewallsResolveBodySchema = external_exports.object({
   names: external_exports.array(runnerBuiltinFirewallNameSchema).min(1).max(RUNNER_BUILTIN_FIREWALL_RESOLVE_NAMES_MAX).optional()
@@ -6446,26 +6522,9 @@ function uniqueStorageMountPaths(mounts, ctx) {
     mountPaths.add(mount.mountPath);
   }
 }
-var canonicalStorageManifestSchema = external_exports.object({
+var storageManifestSchema = external_exports.object({
   storageMounts: external_exports.array(storageMountEntrySchema).superRefine(uniqueStorageMountPaths)
 });
-var storageManifestSchema = external_exports.unknown().superRefine((manifest, ctx) => {
-  if (typeof manifest !== "object" || manifest === null) {
-    return;
-  }
-  const value = manifest;
-  const hasStorageMounts = Object.hasOwn(value, "storageMounts");
-  const hasStorages = Object.hasOwn(value, "storages");
-  const hasArtifacts = Object.hasOwn(value, "artifacts");
-  const hasCanonical = hasStorageMounts && !hasStorages && !hasArtifacts;
-  const hasLegacy = !hasStorageMounts && hasStorages && hasArtifacts;
-  if (!hasCanonical && !hasLegacy) {
-    ctx.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      message: "storage manifest must contain exactly storageMounts or both storages and artifacts"
-    });
-  }
-}).pipe(external_exports.union([legacyStorageManifestSchema, canonicalStorageManifestSchema]));
 var inlineResumeSessionSchema = external_exports.object({
   sessionId: external_exports.string(),
   sessionHistory: external_exports.string()
@@ -6578,6 +6637,8 @@ var storedExecutionContextSchema = external_exports.object({
   // Per-connector runtime network policy refresh deadlines. Used by runners to refresh
   // active sandbox policy when temporary allow grants expire.
   networkPolicyRefreshes: networkPolicyRefreshesSchema.optional(),
+  // API-only catalog-derived permission defaults for claim-time grant refresh.
+  connectorPermissionBaseline: storedConnectorPermissionBaselineSchema.optional(),
   // Tools to disable in Claude CLI (passed as --disallowed-tools)
   disallowedTools: external_exports.array(external_exports.string()).optional(),
   // Tools to make available in Claude CLI (passed as --tools)
@@ -6594,6 +6655,9 @@ var storedExecutionContextSchema = external_exports.object({
   // API-owned Codex provider/runtime metadata forwarded through the runner.
   codexRuntimeConfig: modelProviderCodexRuntimeConfigSchema.nullable().optional()
 });
+var compatibleStoredExecutionContextSchema = storedExecutionContextSchema.extend({
+  connectorPermissionBaseline: external_exports.unknown().optional()
+});
 var executionContextSchema = external_exports.object({
   runId: external_exports.uuid(),
   prompt: external_exports.string(),
@@ -13082,4 +13146,4 @@ export {
   getHostedSiteFiles,
   getHostedSiteDeployments
 };
-//# sourceMappingURL=chunk-52KFOVUA.js.map
+//# sourceMappingURL=chunk-4IYCDMRE.js.map