@vm0/cli 9.264.7 → 9.264.9

package/{chunk-O2ZRRF6W.js → chunk-A3GE6ETZ.js}

@@ -6,7 +6,7 @@ import {
   getActiveToken,
   getBaseUrl,
   headersWithCliClientHeaders
-} from "./chunk-MIVNAXCC.js";
+} from "./chunk-DOYP2C2B.js";
 import {
   init_esm_shims
 } from "./chunk-GPYQ24DR.js";
@@ -648,4 +648,4 @@ export {
   generateWebVideo,
   transcribeAudio
 };
-//# sourceMappingURL=chunk-O2ZRRF6W.js.map
+//# sourceMappingURL=chunk-A3GE6ETZ.js.map

package/{chunk-KD6CU6C6.js → chunk-AOHVC7EW.js}

@@ -228,8 +228,7 @@ var FEATURE_SWITCHES = {
   ["zeroFinance" /* ZeroFinance */]: {
     maintainer: "ethan@vm0.ai",
     description: "Enable the managed APIDojo-backed Zero Finance API and finance:read ZERO_TOKEN capability.",
-    enabled: false,
-    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
+    enabled: true
   },
   ["banking" /* Banking */]: {
     maintainer: "linghan@vm0.ai",
@@ -473,4 +472,4 @@ function isFeatureEnabled(key, ctx) {
 export {
   isFeatureEnabled
 };
-//# sourceMappingURL=chunk-KD6CU6C6.js.map
+//# sourceMappingURL=chunk-AOHVC7EW.js.map

package/chunk-AOHVC7EW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../packages/core/src/feature-switch-key.ts","../../../packages/core/src/feature-switch.ts","../../../packages/core/src/identity-hash.ts"],"sourcesContent":["/**\n * Feature switch keys\n *\n * Defines all available feature switch identifiers.\n */\nexport enum FeatureSwitchKey {\n  Dummy = \"dummy\",\n  AhrefsConnector = \"ahrefsConnector\",\n  BillConnector = \"billConnector\",\n  BentomlConnector = \"bentomlConnector\",\n  BoxConnector = \"boxConnector\",\n  CanvaConnector = \"canvaConnector\",\n  CalComConnector = \"calComConnector\",\n  CopperConnector = \"copperConnector\",\n  DatadogConnector = \"datadogConnector\",\n  DeelConnector = \"deelConnector\",\n  DocuSignConnector = \"docusignConnector\",\n  DropboxConnector = \"dropboxConnector\",\n  FigmaConnector = \"figmaConnector\",\n  ExpensifyConnector = \"expensifyConnector\",\n  GoogleContactsConnector = \"googleContactsConnector\",\n  GoogleFormsConnector = \"googleFormsConnector\",\n  JoggAiConnector = \"joggAiConnector\",\n  MercuryConnector = \"mercuryConnector\",\n  NeonConnector = \"neonConnector\",\n  NetSuiteConnector = \"netSuiteConnector\",\n  GarminConnectConnector = \"garminConnectConnector\",\n  QuickBooksConnector = \"quickbooksConnector\",\n  RedditConnector = \"redditConnector\",\n  SupabaseConnector = \"supabaseConnector\",\n  WebflowConnector = \"webflowConnector\",\n  CloseConnector = \"closeConnector\",\n  MetaAdsConnector = \"metaAdsConnector\",\n  TikTokAdsConnector = \"tiktokAdsConnector\",\n  AwsConnector = \"awsConnector\",\n  PosthogConnector = \"posthogConnector\",\n  PayPalConnector = \"payPalConnector\",\n  RampConnector = \"rampConnector\",\n  MailchimpConnector = \"mailchimpConnector\",\n  ResendConnector = \"resendConnector\",\n  PexelsConnector = \"pexelsConnector\",\n  SpotifyConnector = \"spotifyConnector\",\n  ZeroDebug = \"zeroDebug\",\n  LanguagePreference = \"languagePreference\",\n  BrazilianPortugueseLocale = \"brazilianPortugueseLocale\",\n  ZeroFinance = \"zeroFinance\",\n  ZeroBrowser = \"zeroBrowser\",\n  ZeroMailReplyFollowUp = \"zeroMailReplyFollowUp\",\n  Banking = \"banking\",\n  Lab = \"lab\",\n  NotionWorkflowAutomations = \"notionWorkflowAutomations\",\n  GithubWebhookAutomations = \"githubWebhookAutomations\",\n  MorningBrief = \"morningBrief\",\n  ManualMorningBrief = \"manualMorningBrief\",\n  TestOauthConnector = \"testOauthConnector\",\n  FreshdeskConnector = \"freshdeskConnector\",\n  StabilityAiConnector = \"stabilityAiConnector\",\n  ZoomConnector = \"zoomConnector\",\n  WorkdayConnector = \"workdayConnector\",\n  CodexFastMode = \"codexFastMode\",\n  CodexSessionPruning = \"codexSessionPruning\",\n  ClaudeSessionPruning = \"claudeSessionPruning\",\n  RealAgentInPreview = \"realAgentInPreview\",\n  ComposerUploadPopover = \"composerUploadPopover\",\n  StructuredPromptInlineTemplates = \"structuredPromptInlineTemplates\",\n\n  ZapierConnector = \"zapierConnector\",\n  ComputerUseDesktopPlugins = \"computerUseDesktopPlugins\",\n  ChatThreadUnifiedSearch = \"chatThreadUnifiedSearch\",\n  ComposerSkillSubstringSearch = \"composerSkillSubstringSearch\",\n  SidebarSubscriptionUsage = \"sidebarSubscriptionUsage\",\n  SlackDmSessionRouting = \"slackDmSessionRouting\",\n  TeamsIntegration = \"teamsIntegration\",\n  FeishuIntegration = \"feishuIntegration\",\n  StrapiIntegration = \"strapiIntegration\",\n  Artifacts = \"artifacts\",\n  HostedArtifactVersions = \"hostedArtifactVersions\",\n  VideoArtifactPosters = \"videoArtifactPosters\",\n  ImageStyleR2 = \"imageStyleR2\",\n  WorkflowConnectorReadiness = \"workflowConnectorReadiness\",\n  ComposerConnectorPermissions = \"composerConnectorPermissions\",\n  ThreeColumnNav = \"threeColumnNav\",\n  ChatThreadSidebarAutoOpen = \"chatThreadSidebarAutoOpen\",\n}\n","/**\n * Feature switch system\n *\n * Provides centralized feature flag management with user-identity based overrides.\n * User IDs are stored as FNV-1a hashes to avoid exposing plain-text identifiers in source code.\n *\n * NOT AN AUTHORIZATION BOUNDARY. User-overridable switches can be self-enabled\n * through `POST /api/zero/feature-switches`, and `userOverridable: false` only\n * excludes a switch from that API. For money-granting, credential, or\n * privilege-escalation endpoints, gate with a hard identity check (e.g.\n * `isStaffOrg()` from `./staff-org`) instead of this system.\n */\n\nimport { FeatureSwitchKey } from \"./feature-switch-key\";\nimport { STAFF_ORG_ID_HASHES, fnv1a } from \"./identity-hash\";\n\nexport interface FeatureSwitch {\n  readonly maintainer: string;\n  readonly description?: string;\n  readonly enabled: boolean;\n  readonly enabledUserHashes?: readonly string[];\n  readonly enabledEmailHashes?: readonly string[];\n  readonly enabledOrgIdHashes?: readonly string[];\n  readonly userOverridable?: boolean;\n}\n\nexport interface FeatureSwitchMetadata {\n  readonly maintainer: string;\n  readonly description?: string;\n  readonly userOverridable: boolean;\n}\n\nexport interface FeatureSwitchContext {\n  readonly userId?: string;\n  readonly email?: string;\n  readonly orgId?: string;\n  readonly overrides?: Partial<Record<FeatureSwitchKey, boolean>>;\n}\n\n/**\n * Registry of all feature switches\n */\nconst FEATURE_SWITCHES: Record<FeatureSwitchKey, FeatureSwitch> = {\n  [FeatureSwitchKey.Dummy]: {\n    maintainer: \"ethan@vm0.ai\",\n    description: \"Test-only feature switch for flag system validation\",\n    enabled: true,\n  },\n  [FeatureSwitchKey.AhrefsConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Ahrefs SEO connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.BillConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the BILL Spend & Expense connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.BentomlConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the BentoML model serving connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.BoxConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Box file storage connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.CanvaConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Canva design connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.CalComConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Cal.com scheduling connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.CopperConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Copper CRM connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.DatadogConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Datadog observability connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.DeelConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Deel HR connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.DocuSignConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the DocuSign e-signature connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.DropboxConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Dropbox file storage connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.FigmaConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Figma design connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ExpensifyConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Expensify accounting connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.GoogleContactsConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Google Contacts connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.GoogleFormsConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Google Forms connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.JoggAiConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the JoggAI video generation connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.MercuryConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Mercury banking connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.NeonConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Neon serverless Postgres connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.NetSuiteConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Oracle NetSuite ERP connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.GarminConnectConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Garmin Connect wellness connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.QuickBooksConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the QuickBooks accounting connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.RedditConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Reddit connector integration\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.SupabaseConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Supabase database connector integration\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.CloseConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Close CRM connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.WebflowConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Webflow site management connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.MetaAdsConnector]: {\n    maintainer: \"ethan@vm0.ai\",\n    description: \"Enable the Meta Ads Manager connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.TikTokAdsConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the TikTok Ads Manager connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.AwsConnector]: {\n    maintainer: \"liangyou@vm0.ai\",\n    description: \"Enable the temporary AWS remote login connector\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.PosthogConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the PostHog analytics connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.PayPalConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the PayPal payments connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.RampConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Ramp spend management connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.MailchimpConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Mailchimp email marketing connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ResendConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Resend email service connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.PexelsConnector]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description: \"Enable the Pexels stock photo and video connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.SpotifyConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Spotify connector integration\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ZeroDebug]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Reveal activity debug surfaces, activity log navigation, appended system prompts, and Debug preferences\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.LanguagePreference]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Enable workspace language bootstrap, persistence, and the Settings preference entry.\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.BrazilianPortugueseLocale]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Allow pt-BR preference writes after incompatible API readers and rollback candidates have drained.\",\n    enabled: false,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.ZeroFinance]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Enable the managed APIDojo-backed Zero Finance API and finance:read ZERO_TOKEN capability.\",\n    enabled: true,\n  },\n  [FeatureSwitchKey.Banking]: {\n    maintainer: \"linghan@vm0.ai\",\n    description:\n      \"Enable the managed Zero Banking gateway and banking:read ZERO_TOKEN capability for Finicity-backed accounts, balances, and transactions.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.Lab]: {\n    maintainer: \"ethan@vm0.ai\",\n    description: \"Show the Lab page for toggling experimental features\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.MorningBrief]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Enable the daily 7:00 local-time Morning Brief email built from GitHub, Gmail, and Google Calendar.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: true,\n  },\n  [FeatureSwitchKey.ManualMorningBrief]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Show a Send now button in Settings that triggers a Morning Brief immediately for testing.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: true,\n  },\n  [FeatureSwitchKey.NotionWorkflowAutomations]: {\n    maintainer: \"lancy@vm0.ai\",\n    description:\n      \"Enable Notion event workflow automations, starting with child pages created under a configured parent page.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.GithubWebhookAutomations]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Show creation entry points for GitHub workflow job, pull request review, deployment status, and issue comment automations.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.TestOauthConnector]: {\n    maintainer: \"liangyou@vm0.ai\",\n    description:\n      \"Enable the test-oauth connector, a synthetic OAuth 2.0 provider used only for automated tests. Off in prod.\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.FreshdeskConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Freshdesk helpdesk connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.StabilityAiConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Stability AI image generation connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ZoomConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Enable the Zoom connector (OAuth 2.0) for meetings, past participants, and cloud recordings access\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.WorkdayConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Workday HCM and finance connector\",\n    enabled: false,\n  },\n\n  [FeatureSwitchKey.CodexFastMode]: {\n    maintainer: \"lancy@vm0.ai\",\n    description:\n      \"Enable Codex fast mode for ChatGPT subscription GPT 5.5 and GPT 5.6 web chat runs.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.CodexSessionPruning]: {\n    maintainer: \"liangyou@vm0.ai\",\n    description:\n      \"Prune oversized Codex checkpoint histories to the latest native compact generation.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ClaudeSessionPruning]: {\n    maintainer: \"liangyou@vm0.ai\",\n    description:\n      \"Prune oversized Claude Code checkpoint histories to the latest native compact generation.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.RealAgentInPreview]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Send preview chat runs through real agent CLIs instead of preview mock runners.\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ComposerUploadPopover]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description:\n      \"Use the Upload popover in the chat composer instead of the legacy paperclip attachment button.\",\n    enabled: false,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.StructuredPromptInlineTemplates]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description:\n      \"Enable multiple inline artifact templates in structured chat prompts.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: true,\n  },\n  [FeatureSwitchKey.ZapierConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Enable the Zapier connector. When disabled, Zapier is hidden from the connectors list and cannot be connected.\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ComputerUseDesktopPlugins]: {\n    maintainer: \"lancy@vm0.ai\",\n    description:\n      \"Enable Zero Desktop Computer Use plugins for local resources, starting with the bundled filesystem plugin gateway.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ChatThreadUnifiedSearch]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Show chat thread title results from the local event-driven thread cache in the command-shift-a conversation picker.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ChatThreadSidebarAutoOpen]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Automatically open the latest sidebar-capable card from a running or successfully completed chat run when the utility sidebar is closed and split view is available.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ComposerSkillSubstringSearch]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Match chat composer slash skill suggestions by any slug substring instead of only prefixes.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ThreeColumnNav]: {\n    maintainer: \"ming@vm0.ai\",\n    description:\n      \"Slack-style three-column navigation: a labeled icon rail, a pinned-agents and chat-threads list column, and the conversation pane.\",\n    enabled: false,\n    // Ming only for the first pass; widen to staff once it settles.\n    enabledEmailHashes: [\"54757055\"], // fnv1a(\"ming@vm0.ai\")\n  },\n  [FeatureSwitchKey.SidebarSubscriptionUsage]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Show Codex and Claude Code personal subscription usage in the Zero sidebar footer.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.SlackDmSessionRouting]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Reuse agent/model-scoped sessions for top-level Slack direct messages after compatible callback readers are deployed.\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.TeamsIntegration]: {\n    maintainer: \"linghan@vm0.ai\",\n    description:\n      \"Show standalone Microsoft Teams integration settings, connect flows, and Works page entry points.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.FeishuIntegration]: {\n    maintainer: \"linghan@vm0.ai\",\n    description:\n      \"Show the Feishu direct-message integration and Works page entry point.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.StrapiIntegration]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Enable Strapi integration settings and Strapi entry-published workflow automations.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.Artifacts]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description:\n      \"Show the Artifacts manage page for generated artifacts in the current organization.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.HostedArtifactVersions]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Create immutable hosted artifact versions behind stable site aliases.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.VideoArtifactPosters]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description:\n      \"Generate poster images asynchronously when video artifacts are recorded.\",\n    enabled: true,\n  },\n  [FeatureSwitchKey.ImageStyleR2]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description:\n      \"Resolve archive-enabled image styles from private R2 packages. When off, image style authoring continues reading vm0-skills from GitHub.\",\n    enabled: true,\n  },\n  [FeatureSwitchKey.WorkflowConnectorReadiness]: {\n    maintainer: \"lancy@vm0.ai\",\n    description:\n      \"Show the manual connector readiness check on workflow settings pages.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.ZeroMailReplyFollowUp]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Enable Zero Mail reply follow-up after all API deployments can read Gmail event configurations with threadId.\",\n    enabled: false,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.ZeroBrowser]: {\n    maintainer: \"liangyou@vm0.ai\",\n    description:\n      \"Enable thread-scoped Cloud browser access in chat and the Zero CLI.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ComposerConnectorPermissions]: {\n    maintainer: \"ming@vm0.ai\",\n    description:\n      \"Show the configure-permissions entry in the chat composer connector popover, opening the agent×connector firewall dialog inline.\",\n    enabled: false,\n    userOverridable: true,\n  },\n};\n\ninterface ResolvedHashes {\n  readonly userHash?: string;\n  readonly emailHash?: string;\n  readonly orgIdHash?: string;\n}\n\nfunction evaluateSwitch(fs: FeatureSwitch, hashes: ResolvedHashes): boolean {\n  if (fs.enabled) return true;\n  if (hashes.userHash && fs.enabledUserHashes?.includes(hashes.userHash))\n    return true;\n  if (hashes.emailHash && fs.enabledEmailHashes?.includes(hashes.emailHash))\n    return true;\n  if (hashes.orgIdHash && fs.enabledOrgIdHashes?.includes(hashes.orgIdHash))\n    return true;\n  return false;\n}\n\n/**\n * Evaluate all feature switches at once for the given context.\n *\n * Computes identity hashes once and checks all switches synchronously.\n */\nexport function getAllFeatureStates(\n  ctx?: FeatureSwitchContext,\n): Record<FeatureSwitchKey, boolean> {\n  const switches = Object.values(FEATURE_SWITCHES);\n  const hashes: ResolvedHashes = {\n    userHash:\n      ctx?.userId &&\n      switches.some((s) => {\n        return s.enabledUserHashes?.length;\n      })\n        ? fnv1a(ctx.userId)\n        : undefined,\n    emailHash:\n      ctx?.email &&\n      switches.some((s) => {\n        return s.enabledEmailHashes?.length;\n      })\n        ? fnv1a(ctx.email.toLowerCase())\n        : undefined,\n    orgIdHash:\n      ctx?.orgId &&\n      switches.some((s) => {\n        return s.enabledOrgIdHashes?.length;\n      })\n        ? fnv1a(ctx.orgId)\n        : undefined,\n  };\n\n  const result = {} as Record<FeatureSwitchKey, boolean>;\n  for (const key of Object.values(FeatureSwitchKey)) {\n    result[key] = evaluateSwitch(FEATURE_SWITCHES[key], hashes);\n  }\n\n  if (ctx?.overrides) {\n    for (const [key, value] of Object.entries(ctx.overrides)) {\n      if (key in FEATURE_SWITCHES && value !== undefined) {\n        result[key as FeatureSwitchKey] = value;\n      }\n    }\n  }\n\n  return result;\n}\n\n/**\n * Return the description for every feature switch.\n */\nexport function getFeatureSwitchDescriptions(): Record<\n  FeatureSwitchKey,\n  string | undefined\n> {\n  const result = {} as Record<FeatureSwitchKey, string | undefined>;\n  for (const key of Object.values(FeatureSwitchKey)) {\n    result[key] = FEATURE_SWITCHES[key].description;\n  }\n  return result;\n}\n\n/**\n * Return display metadata for every feature switch.\n */\nexport function getFeatureSwitchMetadata(): Record<\n  FeatureSwitchKey,\n  FeatureSwitchMetadata\n> {\n  const result = {} as Record<FeatureSwitchKey, FeatureSwitchMetadata>;\n  for (const key of Object.values(FeatureSwitchKey)) {\n    const featureSwitch = FEATURE_SWITCHES[key];\n    result[key] = {\n      maintainer: featureSwitch.maintainer,\n      description: featureSwitch.description,\n      userOverridable: featureSwitch.userOverridable !== false,\n    };\n  }\n  return result;\n}\n\nexport function isUserOverridableFeatureSwitch(\n  key: string,\n): key is FeatureSwitchKey {\n  if (!(key in FEATURE_SWITCHES)) {\n    return false;\n  }\n  return FEATURE_SWITCHES[key as FeatureSwitchKey].userOverridable !== false;\n}\n\nexport function getUserOverridableFeatureSwitchKeys(): readonly FeatureSwitchKey[] {\n  return Object.values(FeatureSwitchKey).filter(isUserOverridableFeatureSwitch);\n}\n\nexport function filterUserOverridableFeatureSwitchOverrides(\n  switches: Record<string, boolean>,\n): Record<string, boolean> {\n  const filtered: Record<string, boolean> = {};\n  for (const [key, value] of Object.entries(switches)) {\n    if (isUserOverridableFeatureSwitch(key)) {\n      filtered[key] = value;\n    }\n  }\n  return filtered;\n}\n\n/**\n * Check if a feature is enabled for the given context.\n *\n * `ctx` is required so callers must pass identity (userId/orgId/email) or an\n * explicit `{}`. A switch gated by `enabledUserHashes` / `enabledOrgIdHashes`\n * silently returns `false` when ctx omits identity, which has caused bugs.\n * Client-side callers should usually read the platform `featureSwitch$` signal\n * instead — it also merges DB overrides on top of identity context.\n */\nexport function isFeatureEnabled(\n  key: FeatureSwitchKey,\n  ctx: FeatureSwitchContext,\n): boolean {\n  const override = ctx.overrides?.[key];\n  if (override !== undefined) {\n    return override;\n  }\n\n  const featureSwitch = FEATURE_SWITCHES[key];\n  if (featureSwitch.enabled) {\n    return true;\n  }\n  if (ctx.userId && featureSwitch.enabledUserHashes?.length) {\n    if (featureSwitch.enabledUserHashes.includes(fnv1a(ctx.userId)))\n      return true;\n  }\n  if (ctx.email && featureSwitch.enabledEmailHashes?.length) {\n    if (\n      featureSwitch.enabledEmailHashes.includes(fnv1a(ctx.email.toLowerCase()))\n    )\n      return true;\n  }\n  if (ctx.orgId && featureSwitch.enabledOrgIdHashes?.length) {\n    if (featureSwitch.enabledOrgIdHashes.includes(fnv1a(ctx.orgId)))\n      return true;\n  }\n  return false;\n}\n","/**\n * Identity hashing — FNV-1a 32-bit hash used to reference users / orgs / emails\n * without embedding plain-text identifiers in source code.\n *\n * Shared between the feature-switch registry (UI rollout targeting) and\n * `staff-org.ts` (authorization primitive). The hash is deterministic and\n * synchronous; no crypto API needed.\n */\n\nexport function fnv1a(input: string): string {\n  let h = 2166136261 >>> 0;\n  for (let i = 0; i < input.length; i++) {\n    h ^= input.charCodeAt(i);\n    h = Math.imul(h, 16777619) >>> 0;\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\n/**\n * Hashes of internal staff org IDs.\n *\n * This list is the source of truth for `isStaffOrg()` — adding an entry here\n * grants that org access to every endpoint that uses `isStaffOrg` as an\n * authorization check. Treat changes with the same care as role grants.\n */\nexport const STAFF_ORG_ID_HASHES: readonly string[] = [\n  \"afce210e\", // org_3ANttyrbWYJk6JKRSTRLEsbsDLe\n];\n"],"mappings":";;;;;;;;AAAA;;;ACAA;;;ACAA;AASO,SAAS,MAAM,OAAuB;AAC3C,MAAI,IAAI,eAAe;AACvB,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,SAAK,MAAM,WAAW,CAAC;AACvB,QAAI,KAAK,KAAK,GAAG,QAAQ,MAAM;AAAA,EACjC;AACA,SAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACvC;AASO,IAAM,sBAAyC;AAAA,EACpD;AAAA;AACF;;;ADeA,IAAM,mBAA4D;AAAA,EAChE,oBAAuB,GAAG;AAAA,IACxB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,kCAA8B,GAAG;AAAA,IAC/B,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,sCAAgC,GAAG;AAAA,IACjC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,4CAAmC,GAAG;AAAA,IACpC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,sCAAgC,GAAG;AAAA,IACjC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wDAAyC,GAAG;AAAA,IAC1C,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,kDAAsC,GAAG;AAAA,IACvC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,4CAAmC,GAAG;AAAA,IACpC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,sDAAwC,GAAG;AAAA,IACzC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,gDAAqC,GAAG;AAAA,IACtC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,4CAAmC,GAAG;AAAA,IACpC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,sCAAgC,GAAG;AAAA,IACjC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,kCAA8B,GAAG;AAAA,IAC/B,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,4BAA2B,GAAG;AAAA,IAC5B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,4DAA2C,GAAG;AAAA,IAC5C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,iBAAiB;AAAA,EACnB;AAAA,EACA,gCAA6B,GAAG;AAAA,IAC9B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,wBAAyB,GAAG;AAAA,IAC1B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,gBAAqB,GAAG;AAAA,IACtB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,kCAA8B,GAAG;AAAA,IAC/B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,4DAA2C,GAAG;AAAA,IAC5C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,0DAA0C,GAAG;AAAA,IAC3C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,kDAAsC,GAAG;AAAA,IACvC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EAEA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,gDAAqC,GAAG;AAAA,IACtC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,kDAAsC,GAAG;AAAA,IACvC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,oDAAuC,GAAG;AAAA,IACxC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,iBAAiB;AAAA,EACnB;AAAA,EACA,wEAAiD,GAAG;AAAA,IAClD,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,4DAA2C,GAAG;AAAA,IAC5C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,wDAAyC,GAAG;AAAA,IAC1C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,4DAA2C,GAAG;AAAA,IAC5C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,kEAA8C,GAAG;AAAA,IAC/C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,sCAAgC,GAAG;AAAA,IACjC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA;AAAA,IAET,oBAAoB,CAAC,UAAU;AAAA;AAAA,EACjC;AAAA,EACA,0DAA0C,GAAG;AAAA,IAC3C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,oDAAuC,GAAG;AAAA,IACxC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,4CAAmC,GAAG;AAAA,IACpC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,4CAAmC,GAAG;AAAA,IACpC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,4BAA2B,GAAG;AAAA,IAC5B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,sDAAwC,GAAG;AAAA,IACzC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,kDAAsC,GAAG;AAAA,IACvC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,kCAA8B,GAAG;AAAA,IAC/B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,8DAA4C,GAAG;AAAA,IAC7C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,oDAAuC,GAAG;AAAA,IACxC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,iBAAiB;AAAA,EACnB;AAAA,EACA,gCAA6B,GAAG;AAAA,IAC9B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,kEAA8C,GAAG;AAAA,IAC/C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,iBAAiB;AAAA,EACnB;AACF;AAuIO,SAAS,iBACd,KACA,KACS;AACT,QAAM,WAAW,IAAI,YAAY,GAAG;AACpC,MAAI,aAAa,QAAW;AAC1B,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,iBAAiB,GAAG;AAC1C,MAAI,cAAc,SAAS;AACzB,WAAO;AAAA,EACT;AACA,MAAI,IAAI,UAAU,cAAc,mBAAmB,QAAQ;AACzD,QAAI,cAAc,kBAAkB,SAAS,MAAM,IAAI,MAAM,CAAC;AAC5D,aAAO;AAAA,EACX;AACA,MAAI,IAAI,SAAS,cAAc,oBAAoB,QAAQ;AACzD,QACE,cAAc,mBAAmB,SAAS,MAAM,IAAI,MAAM,YAAY,CAAC,CAAC;AAExE,aAAO;AAAA,EACX;AACA,MAAI,IAAI,SAAS,cAAc,oBAAoB,QAAQ;AACzD,QAAI,cAAc,mBAAmB,SAAS,MAAM,IAAI,KAAK,CAAC;AAC5D,aAAO;AAAA,EACX;AACA,SAAO;AACT;","names":[]}

package/{chunk-DHADLTRS.js → chunk-CPLEJWQT.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   MODEL_PROVIDER_TYPES
-} from "./chunk-MIVNAXCC.js";
+} from "./chunk-DOYP2C2B.js";
 import {
   init_esm_shims
 } from "./chunk-GPYQ24DR.js";
@@ -40,4 +40,4 @@ export {
   formatModelProviderRoute,
   formatModelPolicyStatus
 };
-//# sourceMappingURL=chunk-DHADLTRS.js.map
+//# sourceMappingURL=chunk-CPLEJWQT.js.map

package/{chunk-MIVNAXCC.js → chunk-DOYP2C2B.js}

@@ -15385,7 +15385,7 @@ function createCliClientHeaderInjector(options) {
   };
 }
 var addDefaultCliClientHeaders = createCliClientHeaderInjector({
-  clientVersion: "9.264.7"
+  clientVersion: "9.264.9"
 });
 function addCliClientHeaders(headers) {
   addDefaultCliClientHeaders(headers);
@@ -16776,4 +16776,4 @@ export {
   apiErrorSchema,
   withErrorHandler
 };
-//# sourceMappingURL=chunk-MIVNAXCC.js.map
+//# sourceMappingURL=chunk-DOYP2C2B.js.map

package/{chunk-JQSR2FQW.js → chunk-FLWE2Q4D.js}

@@ -21,7 +21,7 @@ import {
   updateOrgModelPoliciesRequestSchema,
   upsertModelProviderRequestSchema,
   upsertModelProviderResponseSchema
-} from "./chunk-MIVNAXCC.js";
+} from "./chunk-DOYP2C2B.js";
 import {
   __commonJS,
   __esm,
@@ -1997,6 +1997,7 @@ init_esm_shims();
 var CHAT_EVENT_TYPES = [
   "input.prompt",
   "input.automation",
+  "input.goal",
   "input.rejected",
   "output.message",
   "output.error",
@@ -2015,6 +2016,11 @@ var CHAT_EVENT_TYPES = [
   "usage.recorded"
 ];
 var chatEventTypeSchema = external_exports.enum(CHAT_EVENT_TYPES);
+var MATERIALIZED_CHAT_EVENT_TYPES = CHAT_EVENT_TYPES.filter(
+  (eventType) => {
+    return eventType !== "input.goal";
+  }
+);
 
 // ../../packages/api-contracts/src/contracts/runs.ts
 init_esm_shims();
@@ -3799,8 +3805,10 @@ var chatEventSchema = external_exports.discriminatedUnion("eventType", [
   usageRecordedEventSchema
 ]);
 var chatEventResponseSchema = chatEventSchema;
-if (chatEventTypeSchema.options.length !== chatEventSchema.options.length) {
-  throw new Error("ChatEvent schema must cover the complete event catalog");
+if (MATERIALIZED_CHAT_EVENT_TYPES.length !== chatEventSchema.options.length || !chatEventTypeSchema.options.includes("input.goal")) {
+  throw new Error(
+    "ChatEvent schema must cover every materialized event catalog leaf"
+  );
 }
 var chatThreadDetailSchema = external_exports.object({
   /**
@@ -4718,10 +4726,10 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/connector-identity.ts
 init_esm_shims();
-var CONNECTOR_REF_MAX_LENGTH = 64;
+var CONNECTOR_SLUG_MAX_LENGTH = 64;
 var CONNECTOR_AUTH_METHOD_ID_MAX_LENGTH = 50;
 var connectorIdentityPattern = /^[a-z0-9][a-z0-9-]*$/u;
-var connectorRefSchema = external_exports.string().min(1).max(CONNECTOR_REF_MAX_LENGTH).regex(connectorIdentityPattern);
+var connectorSlugSchema = external_exports.string().min(1).max(CONNECTOR_SLUG_MAX_LENGTH).regex(connectorIdentityPattern);
 var connectorAuthMethodIdSchema = external_exports.string().min(1).max(CONNECTOR_AUTH_METHOD_ID_MAX_LENGTH).regex(connectorIdentityPattern);
 
 // ../../packages/api-contracts/src/contracts/zero-user-permission-grants.ts
@@ -4741,7 +4749,8 @@ var agentPermissionGrantScopeSchema = external_exports.object({
 });
 var userPermissionGrantScopeSchema = agentPermissionGrantScopeSchema;
 var userPermissionGrantResponseBaseSchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename permission-grant wire fields with the DB migration.
+  connectorRef: connectorSlugSchema,
   permission: permissionSchema,
   action: userPermissionGrantActionSchema,
   expiresAt: external_exports.string().nullable(),
@@ -4767,7 +4776,8 @@ var applyUserPermissionGrantSchema = external_exports.discriminatedUnion("action
 ]);
 var applyUserPermissionGrantsRequestSchema = userPermissionGrantScopeSchema.and(
   external_exports.object({
-    connectorRef: connectorRefSchema,
+    // TODO(#23619): Rename with the response and persisted grant field.
+    connectorRef: connectorSlugSchema,
     mode: userPermissionGrantApplyModeSchema,
     grants: external_exports.array(applyUserPermissionGrantSchema)
   })
@@ -4807,10 +4817,11 @@ var zeroUserPermissionGrantsContract = c15.router({
 // ../../packages/api-contracts/src/contracts/user-connectors.ts
 init_esm_shims();
 var c16 = initContract();
-var userConnectorEnabledTypesSchema = external_exports.object({
-  enabledTypes: external_exports.array(connectorRefSchema)
+var userConnectorEnabledSlugsSchema = external_exports.object({
+  // TODO(#23619): Rename this user-connector wire field after clients migrate.
+  enabledTypes: external_exports.array(connectorSlugSchema)
 });
-var userConnectorUpdateSchema = userConnectorEnabledTypesSchema.extend(
+var userConnectorUpdateSchema = userConnectorEnabledSlugsSchema.extend(
   {
     operation: external_exports.enum(["replace", "add", "remove"]).optional()
   }
@@ -4822,7 +4833,7 @@ var zeroUserConnectorsContract = c16.router({
     headers: authHeadersSchema,
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     responses: {
-      200: userConnectorEnabledTypesSchema,
+      200: userConnectorEnabledSlugsSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -4836,7 +4847,7 @@ var zeroUserConnectorsContract = c16.router({
     pathParams: external_exports.object({ id: external_exports.string().uuid() }),
     body: userConnectorUpdateSchema,
     responses: {
-      200: userConnectorEnabledTypesSchema,
+      200: userConnectorEnabledSlugsSchema,
       400: apiErrorSchema,
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -5048,7 +5059,8 @@ var connectorReconnectReasonSchema = external_exports.enum([
 ]);
 var connectorResponseSchema = external_exports.object({
   id: external_exports.uuid(),
-  type: connectorRefSchema,
+  // TODO(#23619): Rename this legacy wire field after API clients migrate.
+  type: connectorSlugSchema,
   authMethod: connectorAuthMethodIdSchema,
   externalId: external_exports.string().nullable(),
   externalUsername: external_exports.string().nullable(),
@@ -5078,7 +5090,8 @@ var connectorProvidedBindingSourceSchema = external_exports.discriminatedUnion(
   ]
 );
 var connectorProvidedBindingSchema = external_exports.object({
-  connectorType: connectorRefSchema,
+  // TODO(#23619): Rename this legacy wire field after API clients migrate.
+  connectorType: connectorSlugSchema,
   authMethod: connectorAuthMethodIdSchema,
   namespace: connectorProvidedBindingNamespaceSchema,
   name: external_exports.string(),
@@ -5087,7 +5100,8 @@ var connectorProvidedBindingSchema = external_exports.object({
 });
 var connectorListResponseSchema = external_exports.object({
   connectors: external_exports.array(connectorResponseSchema),
-  configuredTypes: external_exports.array(connectorRefSchema),
+  // TODO(#23619): Rename this legacy wire field after API clients migrate.
+  configuredTypes: external_exports.array(connectorSlugSchema),
   connectorProvidedBindings: external_exports.array(connectorProvidedBindingSchema).default([])
 });
 var scopeDiffResponseSchema = external_exports.object({
@@ -5102,7 +5116,8 @@ var connectorOauthStartResponseSchema = external_exports.object({
 var connectorOauthDeviceAuthSessionStartResponseSchema = external_exports.object({
   sessionId: external_exports.uuid(),
   sessionToken: external_exports.string(),
-  type: connectorRefSchema,
+  // TODO(#23619): Rename this legacy wire field after API clients migrate.
+  type: connectorSlugSchema,
   status: external_exports.literal("pending"),
   userCode: external_exports.string(),
   verificationUri: external_exports.string(),
@@ -5141,7 +5156,8 @@ var connectorOauthDeviceAuthSessionPollResponseSchema = external_exports.discrim
 var connectorExternalCodeSessionStartResponseSchema = external_exports.object({
   sessionId: external_exports.uuid(),
   sessionToken: external_exports.string(),
-  type: connectorRefSchema,
+  // TODO(#23619): Rename this legacy wire field after API clients migrate.
+  type: connectorSlugSchema,
   status: external_exports.literal("pending"),
   authorizationUrl: external_exports.string(),
   expiresIn: external_exports.number()
@@ -5171,12 +5187,12 @@ var zeroConnectorsMainContract = c18.router({
     summary: "List all connectors (zero proxy)"
   }
 });
-var zeroConnectorsByTypeContract = c18.router({
+var zeroConnectorsBySlugContract = c18.router({
   get: {
     method: "GET",
     path: "/api/zero/connectors/:type",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     responses: {
       200: connectorResponseSchema,
       401: apiErrorSchema,
@@ -5189,7 +5205,7 @@ var zeroConnectorsByTypeContract = c18.router({
     method: "DELETE",
     path: "/api/zero/connectors/:type",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     responses: {
       204: c18.noBody(),
       401: apiErrorSchema,
@@ -5203,7 +5219,7 @@ var zeroConnectorScopeDiffContract = c18.router({
     method: "GET",
     path: "/api/zero/connectors/:type/scope-diff",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     responses: {
       200: scopeDiffResponseSchema,
       401: apiErrorSchema,
@@ -5218,7 +5234,7 @@ var zeroConnectorOauthStartContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/oauth/start",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5239,7 +5255,7 @@ var zeroConnectorOauthContinueContract = c18.router({
   continue: {
     method: "GET",
     path: "/api/zero/connectors/:type/oauth/continue",
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     query: external_exports.object({ state: external_exports.string().regex(/^[0-9a-f]{64}$/) }),
     responses: {
       307: c18.noBody(),
@@ -5254,7 +5270,7 @@ var zeroConnectorOpenIdStartContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/openid/start",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5275,7 +5291,7 @@ var zeroConnectorManualGrantContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/manual-grant",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5298,7 +5314,7 @@ var zeroConnectorNoAuthGrantContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/no-auth",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5320,7 +5336,7 @@ var zeroConnectorOauthDeviceAuthSessionContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/oauth/device/sessions",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5341,7 +5357,7 @@ var zeroConnectorOauthDeviceAuthSessionContract = c18.router({
     path: "/api/zero/connectors/:type/oauth/device/sessions/:sessionId/poll",
     headers: authHeadersSchema,
     pathParams: external_exports.object({
-      type: connectorRefSchema,
+      type: connectorSlugSchema,
       sessionId: external_exports.uuid()
     }),
     body: connectorOauthDeviceAuthSessionPollRequestSchema,
@@ -5361,7 +5377,7 @@ var zeroConnectorExternalCodeSessionContract = c18.router({
     method: "POST",
     path: "/api/zero/connectors/:type/external-code/sessions",
     headers: authHeadersSchema,
-    pathParams: external_exports.object({ type: connectorRefSchema }),
+    pathParams: external_exports.object({ type: connectorSlugSchema }),
     body: external_exports.object({
       authMethod: connectorAuthMethodIdSchema,
       agentId: external_exports.uuid().optional(),
@@ -5381,7 +5397,7 @@ var zeroConnectorExternalCodeSessionContract = c18.router({
     path: "/api/zero/connectors/:type/external-code/sessions/:sessionId/complete",
     headers: authHeadersSchema,
     pathParams: external_exports.object({
-      type: connectorRefSchema,
+      type: connectorSlugSchema,
       sessionId: external_exports.uuid()
     }),
     body: connectorExternalCodeSessionCompleteRequestSchema,
@@ -5397,7 +5413,7 @@ var zeroConnectorExternalCodeSessionContract = c18.router({
   }
 });
 var connectorSearchItemSchema = external_exports.object({
-  id: connectorRefSchema,
+  id: connectorSlugSchema,
   label: external_exports.string(),
   description: external_exports.string(),
   authMethods: external_exports.array(connectorAuthMethodIdSchema)
@@ -5447,7 +5463,8 @@ var connectorCatalogCompatibilityReasonSchema = external_exports.enum([
   "missing-platform-configuration"
 ]);
 var connectorCatalogFilteredAuthMethodSchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename this diagnostics wire field after clients migrate.
+  connectorRef: connectorSlugSchema,
   authMethodId: connectorAuthMethodIdSchema,
   reasons: external_exports.array(connectorCatalogCompatibilityReasonSchema).min(1)
 });
@@ -5533,7 +5550,8 @@ var publicConnectorCatalogCategoryMetadataSchema = external_exports.object({
   groups: external_exports.array(publicConnectorCatalogCategoryGroupSchema)
 });
 var publicConnectorCatalogItemSchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename catalog API fields after independent clients migrate.
+  connectorRef: connectorSlugSchema,
   label: external_exports.string(),
   description: external_exports.string(),
   icon: publicConnectorCatalogIconSchema,
@@ -5617,7 +5635,8 @@ var publicConnectorCatalogDefaultPolicySchema = external_exports.object({
   unknownPolicy: publicFirewallPolicyValueSchema
 });
 var publicConnectorCatalogPermissionDetailSchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename this catalog API field after clients migrate.
+  connectorRef: connectorSlugSchema,
   label: external_exports.string(),
   icon: publicConnectorCatalogIconSchema,
   permissionCount: external_exports.number().int().nonnegative(),
@@ -5629,7 +5648,8 @@ var publicConnectorCatalogPermissionDetailResponseSchema = external_exports.obje
   permissions: publicConnectorCatalogPermissionDetailSchema
 });
 var connectorCatalogPathParamsSchema = external_exports.object({
-  connectorRef: connectorRefSchema
+  // TODO(#23619): Rename this path parameter and route in a compatible rollout.
+  connectorRef: connectorSlugSchema
 });
 var zeroConnectorCatalogContract = c19.router({
   list: {
@@ -5708,7 +5728,8 @@ var connectorCheckUrlRequestSchema = external_exports.object({
   mode: external_exports.literal("url"),
   method: external_exports.string().min(1).max(16),
   url: external_exports.string().min(1).max(8192),
-  connectorRef: connectorRefSchema.optional(),
+  // TODO(#23619): Rename connector-check wire fields after clients migrate.
+  connectorRef: connectorSlugSchema.optional(),
   environmentName: boundedNameSchema.optional()
 }).strict();
 var connectorCheckEnvironmentRequestSchema = external_exports.object({
@@ -5721,13 +5742,15 @@ var connectorCheckRequestSchema = external_exports.discriminatedUnion("mode", [
   connectorCheckEnvironmentRequestSchema
 ]);
 var connectorCheckIdentitySchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename with the connector-check response contract.
+  connectorRef: connectorSlugSchema,
   label: external_exports.string().min(1),
   visibility: external_exports.enum(["available", "unavailable"]),
   credentialResolution: external_exports.enum(["network-boundary", "none"])
 }).strict();
 var connectorCheckCandidateSchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename with the connector-check response contract.
+  connectorRef: connectorSlugSchema,
   label: external_exports.string().min(1)
 }).strict();
 var connectorCheckNotScopedRunSchema = external_exports.object({ status: external_exports.literal("not-scoped") }).strict();
@@ -6103,16 +6126,16 @@ async function listZeroConnectorCatalogStatus() {
   }
   handleError(result, "Failed to list connector catalog status");
 }
-async function getZeroConnectorCatalogPermissions(connectorRef) {
+async function getZeroConnectorCatalogPermissions(connectorSlug) {
   const config = await getClientConfig();
   const client2 = initClient(zeroConnectorCatalogContract, config);
   const result = await client2.permissions({
-    params: { connectorRef }
+    params: { connectorRef: connectorSlug }
   });
   if (result.status === 200) {
-    if (result.body.permissions.connectorRef !== connectorRef) {
+    if (result.body.permissions.connectorRef !== connectorSlug) {
       throw new Error(
-        `Permission metadata connectorRef mismatch: expected ${connectorRef}, got ${result.body.permissions.connectorRef}`
+        `Permission metadata connectorRef mismatch: expected ${connectorSlug}, got ${result.body.permissions.connectorRef}`
       );
     }
     return result.body.permissions;
@@ -6122,7 +6145,7 @@ async function getZeroConnectorCatalogPermissions(connectorRef) {
   }
   handleError(
     result,
-    `Failed to get connector permission metadata for "${connectorRef}"`
+    `Failed to get connector permission metadata for "${connectorSlug}"`
   );
 }
 async function diagnoseZeroConnectorCheck(request) {
@@ -6137,11 +6160,11 @@ async function diagnoseZeroConnectorCheck(request) {
   }
   handleError(result, "Failed to diagnose connector");
 }
-async function getZeroConnector(type) {
+async function getZeroConnector(connectorSlug) {
   const config = await getClientConfig();
-  const client2 = initClient(zeroConnectorsByTypeContract, config);
+  const client2 = initClient(zeroConnectorsBySlugContract, config);
   const result = await client2.get({
-    params: { type }
+    params: { type: connectorSlug }
   });
   if (result.status === 200) {
     return result.body;
@@ -6149,19 +6172,19 @@ async function getZeroConnector(type) {
   if (result.status === 404) {
     return null;
   }
-  handleError(result, `Failed to get connector "${type}"`);
+  handleError(result, `Failed to get connector "${connectorSlug}"`);
 }
-async function connectZeroConnectorManualGrant(type, authMethod, values) {
+async function connectZeroConnectorManualGrant(connectorSlug, authMethod, values) {
   const config = await getClientConfig();
   const client2 = initClient(zeroConnectorManualGrantContract, config);
   const result = await client2.connect({
-    params: { type },
+    params: { type: connectorSlug },
     body: { authMethod, values }
   });
   if (result.status === 200) {
     return result.body;
   }
-  handleError(result, `Failed to connect connector "${type}"`);
+  handleError(result, `Failed to connect connector "${connectorSlug}"`);
 }
 async function listZeroCustomConnectors() {
   const config = await getClientConfig();
@@ -6330,7 +6353,7 @@ var storedConnectorPermissionBaselineSchema = external_exports.object({
     buildCommitSha: connectorCatalogBuildCommitShaSchema.nullable()
   }).strict(),
   connectors: external_exports.record(
-    connectorRefSchema,
+    connectorSlugSchema,
     connectorPermissionBaselineEntrySchema
   )
 }).strict();
@@ -6552,6 +6575,8 @@ var storedExecutionContextSchema = external_exports.object({
   encryptedSecrets: external_exports.string().nullable(),
   // Maps firewall auth secret env aliases (the `NAME` in `${{ secrets.NAME }}`) to
   // their connector or provider owner. Keys are env aliases, not storage secret names.
+  // TODO(#23619): Split connector slugs from provider keys before renaming this
+  // persisted runner field.
   secretConnectorMap: external_exports.record(external_exports.string(), external_exports.string()).nullable().optional(),
   // Same keys as secretConnectorMap; adds source details when the owner alone
   // is not enough to locate access storage (for example, personal model providers).
@@ -6616,6 +6641,8 @@ var executionContextSchema = external_exports.object({
   encryptedSecrets: external_exports.string().nullable(),
   // Maps firewall auth secret env aliases (the `NAME` in `${{ secrets.NAME }}`) to
   // their connector or provider owner. Keys are env aliases, not storage secret names.
+  // TODO(#23619): Split connector slugs from provider keys before renaming this
+  // runner wire field.
   secretConnectorMap: external_exports.record(external_exports.string(), external_exports.string()).nullable().optional(),
   // Same keys as secretConnectorMap; adds source details when the owner alone
   // is not enough to locate access storage (for example, personal model providers).
@@ -6688,13 +6715,15 @@ var runnersNetworkPolicyRefreshContract = c22.router({
       runId: external_exports.uuid()
     }),
     body: external_exports.object({
-      connectorRefs: external_exports.array(connectorRefSchema).min(1).max(NETWORK_POLICY_REFRESH_CONNECTOR_REFS_MAX)
+      // TODO(#23619): Rename runner wire fields in a compatibility-safe rollout.
+      connectorRefs: external_exports.array(connectorSlugSchema).min(1).max(NETWORK_POLICY_REFRESH_CONNECTOR_REFS_MAX)
     }),
     responses: {
       200: external_exports.object({
         refreshes: external_exports.array(
           external_exports.object({
-            connectorRef: connectorRefSchema,
+            // TODO(#23619): Keep the response aligned with the request rollout.
+            connectorRef: connectorSlugSchema,
             networkPolicy: networkPolicySchema,
             nextRefreshAt: external_exports.string().datetime({ offset: true }).nullable()
           })
@@ -7062,6 +7091,8 @@ var webhookFirewallAuthContract = c23.router({
       authAwsSigv4: firewallAwsSigv4AuthSchema2.optional(),
       // Maps firewall auth secret env aliases (the `NAME` in `${{ secrets.NAME }}`)
       // to the connector or provider owner that can refresh/resolve access.
+      // TODO(#23619): Split connector slugs from provider keys before renaming
+      // this firewall-auth wire field.
       secretConnectorMap: external_exports.record(external_exports.string(), external_exports.string()).optional(),
       // Same keys as secretConnectorMap; adds source details when the owner
       // alone is not enough to locate access storage.
@@ -10899,7 +10930,8 @@ var zeroWorkflowConnectorReadinessStatusSchema = external_exports.enum([
   "unavailable"
 ]);
 var zeroWorkflowConnectorReadinessEntrySchema = external_exports.object({
-  connectorRef: connectorRefSchema,
+  // TODO(#23619): Rename this workflow readiness response field with clients.
+  connectorRef: connectorSlugSchema,
   label: external_exports.string().min(1),
   icon: publicConnectorCatalogIconSchema,
   reason: external_exports.string().min(1),
@@ -12947,7 +12979,7 @@ export {
   chatThreadSnapshotProjectionSchema,
   chatThreadEventSchema,
   zeroAgentVisibilitySchema,
-  connectorRefSchema,
+  connectorSlugSchema,
   createZeroAgent,
   listZeroAgents,
   getZeroAgent,
@@ -13084,4 +13116,4 @@ export {
   getHostedSiteFiles,
   getHostedSiteDeployments
 };
-//# sourceMappingURL=chunk-JQSR2FQW.js.map
+//# sourceMappingURL=chunk-FLWE2Q4D.js.map