@vm0/cli 9.264.6 → 9.264.8

package/{chunk-BT3ABTGZ.js → chunk-B5VQCVCY.js}

@@ -3,13 +3,13 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   resolveFirewallMetadataPolicies
-} from "./chunk-PS37YIUV.js";
+} from "./chunk-7WMNSSBC.js";
 import {
   getZeroConnectorCatalogPermissions
-} from "./chunk-TJCLIDBB.js";
+} from "./chunk-KCVBW7AC.js";
 import {
   source_default
-} from "./chunk-TLQL2AEZ.js";
+} from "./chunk-2KEUNCZT.js";
 import {
   init_esm_shims
 } from "./chunk-GPYQ24DR.js";
@@ -24,11 +24,14 @@ function policyIcon(policy) {
 
 // src/commands/zero/shared/firewall-permissions.ts
 init_esm_shims();
-async function loadPermissionMetadataByType(types) {
-  const uniqueTypes = [...new Set(types)];
+async function loadPermissionMetadataBySlug(connectorSlugs) {
+  const uniqueConnectorSlugs = [...new Set(connectorSlugs)];
   const entries = await Promise.all(
-    uniqueTypes.map(async (type) => {
-      return [type, await getZeroConnectorCatalogPermissions(type)];
+    uniqueConnectorSlugs.map(async (connectorSlug) => {
+      return [
+        connectorSlug,
+        await getZeroConnectorCatalogPermissions(connectorSlug)
+      ];
     })
   );
   return new Map(entries);
@@ -36,7 +39,7 @@ async function loadPermissionMetadataByType(types) {
 function connectorPermissionInfo(args) {
   if (!args.metadata) {
     return {
-      type: args.type,
+      connectorSlug: args.connectorSlug,
       hasPermissions: false,
       hasPolicyEntry: false,
       permissions: [],
@@ -46,40 +49,42 @@ function connectorPermissionInfo(args) {
       total: 0
     };
   }
-  const refPolicy = args.resolvedPolicies?.[args.metadata.connectorRef];
-  const policies = refPolicy && Object.keys(refPolicy.policies).length > 0 ? refPolicy.policies : null;
+  const connectorPolicy = args.resolvedPolicies?.[args.metadata.connectorRef];
+  const policies = connectorPolicy && Object.keys(connectorPolicy.policies).length > 0 ? connectorPolicy.policies : null;
   const total = args.metadata.permissions.length;
   const allowed = policies ? args.metadata.permissions.filter((permission) => {
     return policies[permission.name] === "allow";
   }).length : 0;
   return {
-    type: args.type,
+    connectorSlug: args.connectorSlug,
     hasPermissions: true,
-    hasPolicyEntry: refPolicy !== void 0,
+    hasPolicyEntry: connectorPolicy !== void 0,
     permissions: args.metadata.permissions,
     policies,
-    unknownPolicy: refPolicy?.unknownPolicy ?? "allow",
+    unknownPolicy: connectorPolicy?.unknownPolicy ?? "allow",
     allowed,
     total
   };
 }
 async function loadConnectorPermissionInfos(args) {
-  const metadataByType = await loadPermissionMetadataByType([
-    ...args.displayTypes,
-    ...args.defaultPolicyTypes
+  const metadataBySlug = await loadPermissionMetadataBySlug([
+    ...args.displayConnectorSlugs,
+    ...args.defaultPolicyConnectorSlugs
   ]);
-  const defaultPolicyMetadata = args.defaultPolicyTypes.flatMap((type) => {
-    const metadata = metadataByType.get(type);
-    return metadata ? [metadata] : [];
-  });
+  const defaultPolicyMetadata = args.defaultPolicyConnectorSlugs.flatMap(
+    (connectorSlug) => {
+      const metadata = metadataBySlug.get(connectorSlug);
+      return metadata ? [metadata] : [];
+    }
+  );
   const resolvedPolicies = resolveFirewallMetadataPolicies(
     args.storedPolicies,
     defaultPolicyMetadata
   );
-  return args.displayTypes.map((type) => {
+  return args.displayConnectorSlugs.map((connectorSlug) => {
     return connectorPermissionInfo({
-      type,
-      metadata: metadataByType.get(type) ?? null,
+      connectorSlug,
+      metadata: metadataBySlug.get(connectorSlug) ?? null,
       resolvedPolicies
     });
   });
@@ -89,4 +94,4 @@ export {
   policyIcon,
   loadConnectorPermissionInfos
 };
-//# sourceMappingURL=chunk-BT3ABTGZ.js.map
+//# sourceMappingURL=chunk-B5VQCVCY.js.map

package/chunk-B5VQCVCY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/utils/format-utils.ts","../src/commands/zero/shared/firewall-permissions.ts"],"sourcesContent":["import chalk from \"chalk\";\nimport type { FirewallPolicyValue } from \"@vm0/connectors/firewall-types\";\n\nexport function policyIcon(policy: FirewallPolicyValue): string {\n  if (policy === \"allow\") return chalk.green(\"✓\");\n  if (policy === \"ask\") return chalk.yellow(\"?\");\n  return chalk.dim(\"✗\");\n}\n","import type { PublicConnectorCatalogPermissionDetail } from \"@vm0/api-contracts/contracts/zero-connector-catalog\";\nimport { resolveFirewallMetadataPolicies } from \"@vm0/connectors/firewall-metadata/policy\";\nimport type {\n  FirewallPolicies,\n  FirewallPolicyValue,\n} from \"@vm0/connectors/firewall-types\";\nimport { getZeroConnectorCatalogPermissions } from \"../../../lib/api\";\n\nexport interface ConnectorPermissionInfo {\n  readonly connectorSlug: string;\n  readonly hasPermissions: boolean;\n  readonly hasPolicyEntry: boolean;\n  readonly permissions: readonly PublicConnectorCatalogPermissionDetail[\"permissions\"][number][];\n  readonly policies: Readonly<Record<string, FirewallPolicyValue>> | null;\n  readonly unknownPolicy: FirewallPolicyValue;\n  readonly allowed: number;\n  readonly total: number;\n}\n\ntype PermissionMetadataBySlug = Map<\n  string,\n  PublicConnectorCatalogPermissionDetail | null\n>;\n\nasync function loadPermissionMetadataBySlug(\n  connectorSlugs: readonly string[],\n): Promise<PermissionMetadataBySlug> {\n  const uniqueConnectorSlugs = [...new Set(connectorSlugs)];\n  const entries = await Promise.all(\n    uniqueConnectorSlugs.map(async (connectorSlug) => {\n      return [\n        connectorSlug,\n        await getZeroConnectorCatalogPermissions(connectorSlug),\n      ] as const;\n    }),\n  );\n  return new Map(entries);\n}\n\nfunction connectorPermissionInfo(args: {\n  readonly connectorSlug: string;\n  readonly metadata: PublicConnectorCatalogPermissionDetail | null;\n  readonly resolvedPolicies: FirewallPolicies | null;\n}): ConnectorPermissionInfo {\n  if (!args.metadata) {\n    return {\n      connectorSlug: args.connectorSlug,\n      hasPermissions: false,\n      hasPolicyEntry: false,\n      permissions: [],\n      policies: null,\n      unknownPolicy: \"allow\",\n      allowed: 0,\n      total: 0,\n    };\n  }\n\n  const connectorPolicy = args.resolvedPolicies?.[args.metadata.connectorRef];\n  const policies =\n    connectorPolicy && Object.keys(connectorPolicy.policies).length > 0\n      ? connectorPolicy.policies\n      : null;\n  const total = args.metadata.permissions.length;\n  const allowed = policies\n    ? args.metadata.permissions.filter((permission) => {\n        return policies[permission.name] === \"allow\";\n      }).length\n    : 0;\n\n  return {\n    connectorSlug: args.connectorSlug,\n    hasPermissions: true,\n    hasPolicyEntry: connectorPolicy !== undefined,\n    permissions: args.metadata.permissions,\n    policies,\n    unknownPolicy: connectorPolicy?.unknownPolicy ?? \"allow\",\n    allowed,\n    total,\n  };\n}\n\nexport async function loadConnectorPermissionInfos(args: {\n  readonly displayConnectorSlugs: readonly string[];\n  readonly defaultPolicyConnectorSlugs: readonly string[];\n  readonly storedPolicies: FirewallPolicies | null;\n}): Promise<ConnectorPermissionInfo[]> {\n  const metadataBySlug = await loadPermissionMetadataBySlug([\n    ...args.displayConnectorSlugs,\n    ...args.defaultPolicyConnectorSlugs,\n  ]);\n  const defaultPolicyMetadata = args.defaultPolicyConnectorSlugs.flatMap(\n    (connectorSlug) => {\n      const metadata = metadataBySlug.get(connectorSlug);\n      return metadata ? [metadata] : [];\n    },\n  );\n  const resolvedPolicies = resolveFirewallMetadataPolicies(\n    args.storedPolicies,\n    defaultPolicyMetadata,\n  );\n\n  return args.displayConnectorSlugs.map((connectorSlug) => {\n    return connectorPermissionInfo({\n      connectorSlug,\n      metadata: metadataBySlug.get(connectorSlug) ?? null,\n      resolvedPolicies,\n    });\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA;AAGO,SAAS,WAAW,QAAqC;AAC9D,MAAI,WAAW,QAAS,QAAO,eAAM,MAAM,QAAG;AAC9C,MAAI,WAAW,MAAO,QAAO,eAAM,OAAO,GAAG;AAC7C,SAAO,eAAM,IAAI,QAAG;AACtB;;;ACPA;AAwBA,eAAe,6BACb,gBACmC;AACnC,QAAM,uBAAuB,CAAC,GAAG,IAAI,IAAI,cAAc,CAAC;AACxD,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,qBAAqB,IAAI,OAAO,kBAAkB;AAChD,aAAO;AAAA,QACL;AAAA,QACA,MAAM,mCAAmC,aAAa;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,IAAI,IAAI,OAAO;AACxB;AAEA,SAAS,wBAAwB,MAIL;AAC1B,MAAI,CAAC,KAAK,UAAU;AAClB,WAAO;AAAA,MACL,eAAe,KAAK;AAAA,MACpB,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,MAChB,aAAa,CAAC;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,MACf,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,kBAAkB,KAAK,mBAAmB,KAAK,SAAS,YAAY;AAC1E,QAAM,WACJ,mBAAmB,OAAO,KAAK,gBAAgB,QAAQ,EAAE,SAAS,IAC9D,gBAAgB,WAChB;AACN,QAAM,QAAQ,KAAK,SAAS,YAAY;AACxC,QAAM,UAAU,WACZ,KAAK,SAAS,YAAY,OAAO,CAAC,eAAe;AAC/C,WAAO,SAAS,WAAW,IAAI,MAAM;AAAA,EACvC,CAAC,EAAE,SACH;AAEJ,SAAO;AAAA,IACL,eAAe,KAAK;AAAA,IACpB,gBAAgB;AAAA,IAChB,gBAAgB,oBAAoB;AAAA,IACpC,aAAa,KAAK,SAAS;AAAA,IAC3B;AAAA,IACA,eAAe,iBAAiB,iBAAiB;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,6BAA6B,MAIZ;AACrC,QAAM,iBAAiB,MAAM,6BAA6B;AAAA,IACxD,GAAG,KAAK;AAAA,IACR,GAAG,KAAK;AAAA,EACV,CAAC;AACD,QAAM,wBAAwB,KAAK,4BAA4B;AAAA,IAC7D,CAAC,kBAAkB;AACjB,YAAM,WAAW,eAAe,IAAI,aAAa;AACjD,aAAO,WAAW,CAAC,QAAQ,IAAI,CAAC;AAAA,IAClC;AAAA,EACF;AACA,QAAM,mBAAmB;AAAA,IACvB,KAAK;AAAA,IACL;AAAA,EACF;AAEA,SAAO,KAAK,sBAAsB,IAAI,CAAC,kBAAkB;AACvD,WAAO,wBAAwB;AAAA,MAC7B;AAAA,MACA,UAAU,eAAe,IAAI,aAAa,KAAK;AAAA,MAC/C;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;","names":[]}

package/{chunk-SZKJGQN3.js → chunk-IYS3T6IA.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   getApiUrl
-} from "./chunk-TLQL2AEZ.js";
+} from "./chunk-2KEUNCZT.js";
 import {
   init_esm_shims
 } from "./chunk-GPYQ24DR.js";
@@ -42,4 +42,4 @@ export {
   toPlatformUrl,
   getPlatformOrigin
 };
-//# sourceMappingURL=chunk-SZKJGQN3.js.map
+//# sourceMappingURL=chunk-IYS3T6IA.js.map

package/{chunk-TJCLIDBB.js → chunk-KCVBW7AC.js}

@@ -21,7 +21,7 @@ import {
   updateOrgModelPoliciesRequestSchema,
   upsertModelProviderRequestSchema,
   upsertModelProviderResponseSchema
-} from "./chunk-TLQL2AEZ.js";
+} from "./chunk-2KEUNCZT.js";
 import {
   __commonJS,
   __esm,
@@ -1997,6 +1997,7 @@ init_esm_shims();
 var CHAT_EVENT_TYPES = [
   "input.prompt",
   "input.automation",
+  "input.goal",
   "input.rejected",
   "output.message",
   "output.error",
@@ -2015,6 +2016,11 @@ var CHAT_EVENT_TYPES = [
   "usage.recorded"
 ];
 var chatEventTypeSchema = external_exports.enum(CHAT_EVENT_TYPES);
+var MATERIALIZED_CHAT_EVENT_TYPES = CHAT_EVENT_TYPES.filter(
+  (eventType) => {
+    return eventType !== "input.goal";
+  }
+);
 
 // ../../packages/api-contracts/src/contracts/runs.ts
 init_esm_shims();
@@ -3799,8 +3805,10 @@ var chatEventSchema = external_exports.discriminatedUnion("eventType", [
   usageRecordedEventSchema
 ]);
 var chatEventResponseSchema = chatEventSchema;
-if (chatEventTypeSchema.options.length !== chatEventSchema.options.length) {
-  throw new Error("ChatEvent schema must cover the complete event catalog");
+if (MATERIALIZED_CHAT_EVENT_TYPES.length !== chatEventSchema.options.length || !chatEventTypeSchema.options.includes("input.goal")) {
+  throw new Error(
+    "ChatEvent schema must cover every materialized event catalog leaf"
+  );
 }
 var chatThreadDetailSchema = external_exports.object({
   /**
@@ -4718,10 +4726,10 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/connector-identity.ts
 init_esm_shims();
-var CONNECTOR_REF_MAX_LENGTH = 64;
+var CONNECTOR_SLUG_MAX_LENGTH = 64;
 var CONNECTOR_AUTH_METHOD_ID_MAX_LENGTH = 50;
 var connectorIdentityPattern = /^[a-z0-9][a-z0-9-]*$/u;
-var connectorRefSchema = external_exports.string().min(1).max(CONNECTOR_REF_MAX_LENGTH).regex(connectorIdentityPattern);
+var connectorSlugSchema = external_exports.string().min(1).max(CONNECTOR_SLUG_MAX_LENGTH).regex(connectorIdentityPattern);
 var connectorAuthMethodIdSchema = external_exports.string().min(1).max(CONNECTOR_AUTH_METHOD_ID_MAX_LENGTH).regex(connectorIdentityPattern);
 
 // ../../packages/api-contracts/src/contracts/zero-user-permission-grants.ts
@@ -4741,7 +4749,8 @@ var agentPermissionGrantScopeSchema = external_exports.object({
 });
 var userPermissionGrantScopeSchema = agentPermissionGrantScopeSchema;
 var userPermissionGrantResponseBaseSchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename permission-grant wire fields with the DB migration.
+  connectorRef: connectorSlugSchema,
   permission: permissionSchema,
   action: userPermissionGrantActionSchema,
   expiresAt: external_exports.string().nullable(),
@@ -4767,7 +4776,8 @@ var applyUserPermissionGrantSchema = external_exports.discriminatedUnion("action
 ]);
 var applyUserPermissionGrantsRequestSchema = userPermissionGrantScopeSchema.and(
   external_exports.object({
-    connectorRef: connectorRefSchema,
+    // TODO(#23619): Rename with the response and persisted grant field.
+    connectorRef: connectorSlugSchema,
     mode: userPermissionGrantApplyModeSchema,
     grants: external_exports.array(applyUserPermissionGrantSchema)
   })
@@ -4807,10 +4817,11 @@ var zeroUserPermissionGrantsContract = c15.router({
 // ../../packages/api-contracts/src/contracts/user-connectors.ts
 init_esm_shims();
 var c16 = initContract();
-var userConnectorEnabledTypesSchema = external_exports.object({
-  enabledTypes: external_exports.array(connectorRefSchema)
+var userConnectorEnabledSlugsSchema = external_exports.object({
+  // TODO(#23619): Rename this user-connector wire field after clients migrate.
+  enabledTypes: external_exports.array(connectorSlugSchema)
 });
-var userConnectorUpdateSchema = userConnectorEnabledTypesSchema.extend(
+var userConnectorUpdateSchema = userConnectorEnabledSlugsSchema.extend(
   {
     operation: external_exports.enum(["replace", "add", "remove"]).optional()
   }
@@ -4822,7 +4833,7 @@ var zeroUserConnectorsContract = c16.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     responses: {
-      200: userConnectorEnabledTypesSchema,
+      200: userConnectorEnabledSlugsSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -4836,7 +4847,7 @@ var zeroUserConnectorsContract = c16.router({
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     body: userConnectorUpdateSchema,
     responses: {
-      200: userConnectorEnabledTypesSchema,
+      200: userConnectorEnabledSlugsSchema,
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -5048,7 +5059,8 @@ var connectorReconnectReasonSchema = external_exports.enum([
 ]);
 var connectorResponseSchema = external_exports.object({
   id: external_exports.uuid(),
-  type: connectorRefSchema,
+  // TODO(#23619): Rename this legacy wire field after API clients migrate.
+  type: connectorSlugSchema,
   authMethod: connectorAuthMethodIdSchema,
   externalId: external_exports.string().nullable(),
   externalUsername: external_exports.string().nullable(),
@@ -5078,7 +5090,8 @@ var connectorProvidedBindingSourceSchema = external_exports.discriminatedUnion(
   ]
 );
 var connectorProvidedBindingSchema = external_exports.object({
-  connectorType: connectorRefSchema,
+  // TODO(#23619): Rename this legacy wire field after API clients migrate.
+  connectorType: connectorSlugSchema,
   authMethod: connectorAuthMethodIdSchema,
   namespace: connectorProvidedBindingNamespaceSchema,
   name: external_exports.string(),
@@ -5087,7 +5100,8 @@ var connectorProvidedBindingSchema = external_exports.object({
 });
 var connectorListResponseSchema = external_exports.object({
   connectors: external_exports.array(connectorResponseSchema),
-  configuredTypes: external_exports.array(connectorRefSchema),
+  // TODO(#23619): Rename this legacy wire field after API clients migrate.
+  configuredTypes: external_exports.array(connectorSlugSchema),
   connectorProvidedBindings: external_exports.array(connectorProvidedBindingSchema).default([])
 });
 var scopeDiffResponseSchema = external_exports.object({
@@ -5102,7 +5116,8 @@ var connectorOauthStartResponseSchema = external_exports.object({
 var connectorOauthDeviceAuthSessionStartResponseSchema = external_exports.object({
   sessionId: external_exports.uuid(),
   sessionToken: external_exports.string(),
-  type: connectorRefSchema,
+  // TODO(#23619): Rename this legacy wire field after API clients migrate.
+  type: connectorSlugSchema,
   status: external_exports.literal("pending"),
   userCode: external_exports.string(),
   verificationUri: external_exports.string(),
@@ -5141,7 +5156,8 @@ var connectorOauthDeviceAuthSessionPollResponseSchema = external_exports.discrim
 var connectorExternalCodeSessionStartResponseSchema = external_exports.object({
   sessionId: external_exports.uuid(),
   sessionToken: external_exports.string(),
-  type: connectorRefSchema,
+  // TODO(#23619): Rename this legacy wire field after API clients migrate.
+  type: connectorSlugSchema,
   status: external_exports.literal("pending"),
   authorizationUrl: external_exports.string(),
   expiresIn: external_exports.number()
@@ -5171,12 +5187,12 @@ var zeroConnectorsMainContract = c18.router({
     summary: "List all connectors (zero proxy)"
   }
 });
-var zeroConnectorsByTypeContract = c18.router({
+var zeroConnectorsBySlugContract = c18.router({
   get: {
     method: "GET",
     path: "/api/zero/connectors/:type",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     responses: {
       200: connectorResponseSchema,
       401: apiErrorSchema,
@@ -5189,7 +5205,7 @@ var zeroConnectorsByTypeContract = c18.router({
     method: "DELETE",
     path: "/api/zero/connectors/:type",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     responses: {
       204: c18.noBody(),
       401: apiErrorSchema,
@@ -5203,7 +5219,7 @@ var zeroConnectorScopeDiffContract = c18.router({
     method: "GET",
     path: "/api/zero/connectors/:type/scope-diff",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     responses: {
       200: scopeDiffResponseSchema,
       401: apiErrorSchema,
@@ -5218,7 +5234,7 @@ var zeroConnectorOauthStartContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/oauth/start",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5239,7 +5255,7 @@ var zeroConnectorOauthContinueContract = c18.router({
   continue: {
     method: "GET",
     path: "/api/zero/connectors/:type/oauth/continue",
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     query: external_exports.object({ state: external_exports.string().regex(/^[0-9a-f]{64}$/) }),
     responses: {
       307: c18.noBody(),
@@ -5254,7 +5270,7 @@ var zeroConnectorOpenIdStartContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/openid/start",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5275,7 +5291,7 @@ var zeroConnectorManualGrantContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/manual-grant",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5298,7 +5314,7 @@ var zeroConnectorNoAuthGrantContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/no-auth",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5320,7 +5336,7 @@ var zeroConnectorOauthDeviceAuthSessionContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/oauth/device/sessions",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5341,7 +5357,7 @@ var zeroConnectorOauthDeviceAuthSessionContract = c18.router({
     path: "/api/zero/connectors/:type/oauth/device/sessions/:sessionId/poll",
     headers: authHeadersSchema,
     pathParams: external_exports.object({
-      type: connectorRefSchema,
+      type: connectorSlugSchema,
       sessionId: external_exports.uuid()
     }),
     body: connectorOauthDeviceAuthSessionPollRequestSchema,
@@ -5361,7 +5377,7 @@ var zeroConnectorExternalCodeSessionContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/external-code/sessions",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5381,7 +5397,7 @@ var zeroConnectorExternalCodeSessionContract = c18.router({
     path: "/api/zero/connectors/:type/external-code/sessions/:sessionId/complete",
     headers: authHeadersSchema,
     pathParams: external_exports.object({
-      type: connectorRefSchema,
+      type: connectorSlugSchema,
       sessionId: external_exports.uuid()
     }),
     body: connectorExternalCodeSessionCompleteRequestSchema,
@@ -5397,7 +5413,7 @@ var zeroConnectorExternalCodeSessionContract = c18.router({
   }
 });
 var connectorSearchItemSchema = external_exports.object({
-  id: connectorRefSchema,
+  id: connectorSlugSchema,
   label: external_exports.string(),
   description: external_exports.string(),
   authMethods: external_exports.array(connectorAuthMethodIdSchema)
@@ -5447,7 +5463,8 @@ var connectorCatalogCompatibilityReasonSchema = external_exports.enum([
   "missing-platform-configuration"
 ]);
 var connectorCatalogFilteredAuthMethodSchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename this diagnostics wire field after clients migrate.
+  connectorRef: connectorSlugSchema,
   authMethodId: connectorAuthMethodIdSchema,
   reasons: external_exports.array(connectorCatalogCompatibilityReasonSchema).min(1)
 });
@@ -5533,7 +5550,8 @@ var publicConnectorCatalogCategoryMetadataSchema = external_exports.object({
   groups: external_exports.array(publicConnectorCatalogCategoryGroupSchema)
 });
 var publicConnectorCatalogItemSchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename catalog API fields after independent clients migrate.
+  connectorRef: connectorSlugSchema,
   label: external_exports.string(),
   description: external_exports.string(),
   icon: publicConnectorCatalogIconSchema,
@@ -5617,7 +5635,8 @@ var publicConnectorCatalogDefaultPolicySchema = external_exports.object({
   unknownPolicy: publicFirewallPolicyValueSchema
 });
 var publicConnectorCatalogPermissionDetailSchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename this catalog API field after clients migrate.
+  connectorRef: connectorSlugSchema,
   label: external_exports.string(),
   icon: publicConnectorCatalogIconSchema,
   permissionCount: external_exports.number().int().nonnegative(),
@@ -5629,7 +5648,8 @@ var publicConnectorCatalogPermissionDetailResponseSchema = external_exports.obje
   permissions: publicConnectorCatalogPermissionDetailSchema
 });
 var connectorCatalogPathParamsSchema = external_exports.object({
-  connectorRef: connectorRefSchema
+  // TODO(#23619): Rename this path parameter and route in a compatible rollout.
+  connectorRef: connectorSlugSchema
 });
 var zeroConnectorCatalogContract = c19.router({
   list: {
@@ -5708,7 +5728,8 @@ var connectorCheckUrlRequestSchema = external_exports.object({
   mode: external_exports.literal("url"),
   method: external_exports.string().min(1).max(16),
   url: external_exports.string().min(1).max(8192),
-  connectorRef: connectorRefSchema.optional(),
+  // TODO(#23619): Rename connector-check wire fields after clients migrate.
+  connectorRef: connectorSlugSchema.optional(),
   environmentName: boundedNameSchema.optional()
 }).strict();
 var connectorCheckEnvironmentRequestSchema = external_exports.object({
@@ -5721,13 +5742,15 @@ var connectorCheckRequestSchema = external_exports.discriminatedUnion("mode", [
   connectorCheckEnvironmentRequestSchema
 ]);
 var connectorCheckIdentitySchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename with the connector-check response contract.
+  connectorRef: connectorSlugSchema,
   label: external_exports.string().min(1),
   visibility: external_exports.enum(["available", "unavailable"]),
   credentialResolution: external_exports.enum(["network-boundary", "none"])
 }).strict();
 var connectorCheckCandidateSchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename with the connector-check response contract.
+  connectorRef: connectorSlugSchema,
   label: external_exports.string().min(1)
 }).strict();
 var connectorCheckNotScopedRunSchema = external_exports.object({ status: external_exports.literal("not-scoped") }).strict();
@@ -6103,16 +6126,16 @@ async function listZeroConnectorCatalogStatus() {
   }
   handleError(result, "Failed to list connector catalog status");
 }
-async function getZeroConnectorCatalogPermissions(connectorRef) {
+async function getZeroConnectorCatalogPermissions(connectorSlug) {
   const config = await getClientConfig();
   const client2 = initClient(zeroConnectorCatalogContract, config);
   const result = await client2.permissions({
-    params: { connectorRef }
+    params: { connectorRef: connectorSlug }
   });
   if (result.status === 200) {
-    if (result.body.permissions.connectorRef !== connectorRef) {
+    if (result.body.permissions.connectorRef !== connectorSlug) {
       throw new Error(
-        `Permission metadata connectorRef mismatch: expected ${connectorRef}, got ${result.body.permissions.connectorRef}`
+        `Permission metadata connectorRef mismatch: expected ${connectorSlug}, got ${result.body.permissions.connectorRef}`
       );
     }
     return result.body.permissions;
@@ -6122,7 +6145,7 @@ async function getZeroConnectorCatalogPermissions(connectorRef) {
   }
   handleError(
     result,
-    `Failed to get connector permission metadata for "${connectorRef}"`
+    `Failed to get connector permission metadata for "${connectorSlug}"`
   );
 }
 async function diagnoseZeroConnectorCheck(request) {
@@ -6137,11 +6160,11 @@ async function diagnoseZeroConnectorCheck(request) {
   }
   handleError(result, "Failed to diagnose connector");
 }
-async function getZeroConnector(type) {
+async function getZeroConnector(connectorSlug) {
   const config = await getClientConfig();
-  const client2 = initClient(zeroConnectorsByTypeContract, config);
+  const client2 = initClient(zeroConnectorsBySlugContract, config);
   const result = await client2.get({
-    params: { type }
+    params: { type: connectorSlug }
   });
   if (result.status === 200) {
     return result.body;
@@ -6149,19 +6172,19 @@ async function getZeroConnector(type) {
   if (result.status === 404) {
     return null;
   }
-  handleError(result, `Failed to get connector "${type}"`);
+  handleError(result, `Failed to get connector "${connectorSlug}"`);
 }
-async function connectZeroConnectorManualGrant(type, authMethod, values) {
+async function connectZeroConnectorManualGrant(connectorSlug, authMethod, values) {
   const config = await getClientConfig();
   const client2 = initClient(zeroConnectorManualGrantContract, config);
   const result = await client2.connect({
-    params: { type },
+    params: { type: connectorSlug },
     body: { authMethod, values }
   });
   if (result.status === 200) {
     return result.body;
   }
-  handleError(result, `Failed to connect connector "${type}"`);
+  handleError(result, `Failed to connect connector "${connectorSlug}"`);
 }
 async function listZeroCustomConnectors() {
   const config = await getClientConfig();
@@ -6330,7 +6353,7 @@ var storedConnectorPermissionBaselineSchema = external_exports.object({
     buildCommitSha: connectorCatalogBuildCommitShaSchema.nullable()
   }).strict(),
   connectors: external_exports.record(
-    connectorRefSchema,
+    connectorSlugSchema,
     connectorPermissionBaselineEntrySchema
   )
 }).strict();
@@ -6552,6 +6575,8 @@ var storedExecutionContextSchema = external_exports.object({
   encryptedSecrets: external_exports.string().nullable(),
   // Maps firewall auth secret env aliases (the `NAME` in `${{ secrets.NAME }}`) to
   // their connector or provider owner. Keys are env aliases, not storage secret names.
+  // TODO(#23619): Split connector slugs from provider keys before renaming this
+  // persisted runner field.
   secretConnectorMap: external_exports.record(external_exports.string(), external_exports.string()).nullable().optional(),
   // Same keys as secretConnectorMap; adds source details when the owner alone
   // is not enough to locate access storage (for example, personal model providers).
@@ -6616,6 +6641,8 @@ var executionContextSchema = external_exports.object({
   encryptedSecrets: external_exports.string().nullable(),
   // Maps firewall auth secret env aliases (the `NAME` in `${{ secrets.NAME }}`) to
   // their connector or provider owner. Keys are env aliases, not storage secret names.
+  // TODO(#23619): Split connector slugs from provider keys before renaming this
+  // runner wire field.
   secretConnectorMap: external_exports.record(external_exports.string(), external_exports.string()).nullable().optional(),
   // Same keys as secretConnectorMap; adds source details when the owner alone
   // is not enough to locate access storage (for example, personal model providers).
@@ -6688,13 +6715,15 @@ var runnersNetworkPolicyRefreshContract = c22.router({
       runId: external_exports.uuid()
     }),
     body: external_exports.object({
-      connectorRefs: external_exports.array(connectorRefSchema).min(1).max(NETWORK_POLICY_REFRESH_CONNECTOR_REFS_MAX)
+      // TODO(#23619): Rename runner wire fields in a compatibility-safe rollout.
+      connectorRefs: external_exports.array(connectorSlugSchema).min(1).max(NETWORK_POLICY_REFRESH_CONNECTOR_REFS_MAX)
     }),
     responses: {
       200: external_exports.object({
         refreshes: external_exports.array(
           external_exports.object({
-            connectorRef: connectorRefSchema,
+            // TODO(#23619): Keep the response aligned with the request rollout.
+            connectorRef: connectorSlugSchema,
             networkPolicy: networkPolicySchema,
             nextRefreshAt: external_exports.string().datetime({ offset: true }).nullable()
           })
@@ -7062,6 +7091,8 @@ var webhookFirewallAuthContract = c23.router({
       authAwsSigv4: firewallAwsSigv4AuthSchema2.optional(),
       // Maps firewall auth secret env aliases (the `NAME` in `${{ secrets.NAME }}`)
       // to the connector or provider owner that can refresh/resolve access.
+      // TODO(#23619): Split connector slugs from provider keys before renaming
+      // this firewall-auth wire field.
       secretConnectorMap: external_exports.record(external_exports.string(), external_exports.string()).optional(),
       // Same keys as secretConnectorMap; adds source details when the owner
       // alone is not enough to locate access storage.
@@ -10899,7 +10930,8 @@ var zeroWorkflowConnectorReadinessStatusSchema = external_exports.enum([
   "unavailable"
 ]);
 var zeroWorkflowConnectorReadinessEntrySchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename this workflow readiness response field with clients.
+  connectorRef: connectorSlugSchema,
   label: external_exports.string().min(1),
   icon: publicConnectorCatalogIconSchema,
   reason: external_exports.string().min(1),
@@ -12947,7 +12979,7 @@ export {
   chatThreadSnapshotProjectionSchema,
   chatThreadEventSchema,
   zeroAgentVisibilitySchema,
-  connectorRefSchema,
+  connectorSlugSchema,
   createZeroAgent,
   listZeroAgents,
   getZeroAgent,
@@ -13084,4 +13116,4 @@ export {
   getHostedSiteFiles,
   getHostedSiteDeployments
 };
-//# sourceMappingURL=chunk-TJCLIDBB.js.map
+//# sourceMappingURL=chunk-KCVBW7AC.js.map