@vm0/cli 9.268.0 → 9.269.1

package/{chunk-7I3P4REZ.js → chunk-UW4J57OZ.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   getApiUrl
-} from "./chunk-DTZW7RES.js";
+} from "./chunk-AHGVNDOM.js";
 import {
   init_esm_shims
 } from "./chunk-GPYQ24DR.js";
@@ -42,4 +42,4 @@ export {
   toPlatformUrl,
   getPlatformOrigin
 };
-//# sourceMappingURL=chunk-7I3P4REZ.js.map
+//# sourceMappingURL=chunk-UW4J57OZ.js.map

package/{chunk-4JA54Z75.js → chunk-VMZYIB6X.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   MODEL_PROVIDER_TYPES
-} from "./chunk-DTZW7RES.js";
+} from "./chunk-AHGVNDOM.js";
 import {
   init_esm_shims
 } from "./chunk-GPYQ24DR.js";
@@ -40,4 +40,4 @@ export {
   formatModelProviderRoute,
   formatModelPolicyStatus
 };
-//# sourceMappingURL=chunk-4JA54Z75.js.map
+//# sourceMappingURL=chunk-VMZYIB6X.js.map

package/{chunk-MD3YWUKO.js → chunk-ZUHSC7WF.js}

@@ -7,6 +7,19 @@ import {
 
 // src/lib/api/zero-token.ts
 init_esm_shims();
+function normalizeZeroCapability(capability) {
+  switch (capability) {
+    case "chat-message:read": {
+      return "chat-event:read";
+    }
+    case "chat-message:write": {
+      return "chat-event:write";
+    }
+    default: {
+      return capability;
+    }
+  }
+}
 function decodeZeroTokenPayload(token) {
   const raw = token ?? process.env.ZERO_TOKEN;
   if (!raw) return void 0;
@@ -20,7 +33,10 @@ function decodeZeroTokenPayload(token) {
       Buffer.from(parts[1], "base64url").toString()
     );
     if (payload.scope === "zero" && Array.isArray(payload.capabilities)) {
-      return payload;
+      return {
+        ...payload,
+        capabilities: payload.capabilities.map(normalizeZeroCapability)
+      };
     }
   } catch {
   }
@@ -30,4 +46,4 @@ function decodeZeroTokenPayload(token) {
 export {
   decodeZeroTokenPayload
 };
-//# sourceMappingURL=chunk-MD3YWUKO.js.map
+//# sourceMappingURL=chunk-ZUHSC7WF.js.map

package/chunk-ZUHSC7WF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/api/zero-token.ts"],"sourcesContent":["import type { FeatureSwitchKey } from \"@vm0/core/feature-switch-key\";\n\nexport interface ZeroTokenPayload {\n  userId: string;\n  runId: string;\n  orgId: string;\n  scope: string;\n  capabilities: string[];\n  featureSwitchOverrides?: Partial<Record<FeatureSwitchKey, boolean>>;\n  iat: number;\n  exp: number;\n}\n\nfunction normalizeZeroCapability(capability: string): string {\n  switch (capability) {\n    case \"chat-message:read\": {\n      return \"chat-event:read\";\n    }\n    case \"chat-message:write\": {\n      return \"chat-event:write\";\n    }\n    default: {\n      return capability;\n    }\n  }\n}\n\n/**\n * Decode a ZERO_TOKEN JWT payload.\n * Only decodes — does NOT verify signature (server does that).\n * If no token is provided, reads from process.env.ZERO_TOKEN.\n * Returns undefined if token is missing, malformed, or not a zero-scoped token.\n */\nexport function decodeZeroTokenPayload(\n  token?: string,\n): ZeroTokenPayload | undefined {\n  const raw = token ?? process.env.ZERO_TOKEN;\n  if (!raw) return undefined;\n\n  const prefix = \"vm0_sandbox_\";\n  if (!raw.startsWith(prefix)) return undefined;\n  const jwt = raw.slice(prefix.length);\n\n  const parts = jwt.split(\".\");\n  if (parts.length !== 3) return undefined;\n\n  try {\n    const payload = JSON.parse(\n      Buffer.from(parts[1]!, \"base64url\").toString(),\n    ) as ZeroTokenPayload;\n    if (payload.scope === \"zero\" && Array.isArray(payload.capabilities)) {\n      return {\n        ...payload,\n        capabilities: payload.capabilities.map(normalizeZeroCapability),\n      };\n    }\n  } catch {\n    // Malformed token — fall through\n  }\n  return undefined;\n}\n"],"mappings":";;;;;;;;AAAA;AAaA,SAAS,wBAAwB,YAA4B;AAC3D,UAAQ,YAAY;AAAA,IAClB,KAAK,qBAAqB;AACxB,aAAO;AAAA,IACT;AAAA,IACA,KAAK,sBAAsB;AACzB,aAAO;AAAA,IACT;AAAA,IACA,SAAS;AACP,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAQO,SAAS,uBACd,OAC8B;AAC9B,QAAM,MAAM,SAAS,QAAQ,IAAI;AACjC,MAAI,CAAC,IAAK,QAAO;AAEjB,QAAM,SAAS;AACf,MAAI,CAAC,IAAI,WAAW,MAAM,EAAG,QAAO;AACpC,QAAM,MAAM,IAAI,MAAM,OAAO,MAAM;AAEnC,QAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,MAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,MAAI;AACF,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAI,WAAW,EAAE,SAAS;AAAA,IAC/C;AACA,QAAI,QAAQ,UAAU,UAAU,MAAM,QAAQ,QAAQ,YAAY,GAAG;AACnE,aAAO;AAAA,QACL,GAAG;AAAA,QACH,cAAc,QAAQ,aAAa,IAAI,uBAAuB;AAAA,MAChE;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;","names":[]}

package/{computer-use-LTZEVHCS.js → computer-use-5SW6CWAY.js}

@@ -12,13 +12,13 @@ import {
   fetchComputerUseScreenshot,
   getComputerUseCommand,
   listComputerUseHosts
-} from "./chunk-VGPSGL5S.js";
-import "./chunk-ISZ5CKJ3.js";
+} from "./chunk-H6AOCKEL.js";
+import "./chunk-KRUM5LAL.js";
 import {
   ApiRequestError,
   withErrorHandler
-} from "./chunk-DTZW7RES.js";
-import "./chunk-MD3YWUKO.js";
+} from "./chunk-AHGVNDOM.js";
+import "./chunk-ZUHSC7WF.js";
 import {
   Command
 } from "./chunk-CCWPKGTB.js";
@@ -970,4 +970,4 @@ export {
   formatComputerUseResultForConsole,
   zeroComputerUseCommand
 };
-//# sourceMappingURL=computer-use-LTZEVHCS.js.map
+//# sourceMappingURL=computer-use-5SW6CWAY.js.map

package/{connector-MY7K7RJN.js → connector-6YIH3K55.js}

@@ -2,8 +2,8 @@
 import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
-  findFirewallMetadataPermission
-} from "./chunk-QSWNNYV4.js";
+  hasConnectorFirewallMetadataPermission
+} from "./chunk-LCUAACWT.js";
 import {
   CALLBACK_PROMPT_PLACEHOLDER,
   addRequestedCallbackSearchParams,
@@ -18,7 +18,7 @@ import {
   resolveConnectorDiscoveryAgentContext,
   resolveManualGrantAuthMethod,
   searchConnectorCatalog
-} from "./chunk-CZA5MW3N.js";
+} from "./chunk-46IAE7OE.js";
 import {
   UNKNOWN_PERMISSION_GRANT,
   connectZeroConnectorManualGrant,
@@ -34,20 +34,20 @@ import {
   getZeroCustomConnector,
   listZeroConnectorCatalogStatus,
   listZeroCustomConnectors
-} from "./chunk-VGPSGL5S.js";
-import "./chunk-ISZ5CKJ3.js";
+} from "./chunk-H6AOCKEL.js";
+import "./chunk-KRUM5LAL.js";
 import {
   getPlatformOrigin,
   toPlatformUrl
-} from "./chunk-7I3P4REZ.js";
+} from "./chunk-UW4J57OZ.js";
 import "./chunk-MA22KQYU.js";
 import {
   ApiRequestError,
   getApiUrl,
   source_default,
   withErrorHandler
-} from "./chunk-DTZW7RES.js";
-import "./chunk-MD3YWUKO.js";
+} from "./chunk-AHGVNDOM.js";
+import "./chunk-ZUHSC7WF.js";
 import {
   Command,
   Option
@@ -168,7 +168,7 @@ function buildDiagnosticRequest(opts, method) {
       mode: "url",
       method,
       url: stripUrlQueryAndFragment(opts.url),
-      ...opts.connector !== void 0 ? { connectorRef: opts.connector } : {},
+      ...opts.connector !== void 0 ? { connectorSlug: opts.connector } : {},
       ...opts.envName !== void 0 ? { environmentName: opts.envName } : {}
     };
   }
@@ -212,24 +212,24 @@ function unsafeInputError(reason) {
 }
 function ambiguousConnectorError(request, result) {
   const candidates = [...result.candidates].sort((left, right) => {
-    return left.connectorRef.localeCompare(right.connectorRef);
+    return left.connectorSlug.localeCompare(right.connectorSlug);
   });
   const commands = candidates.map((candidate) => {
-    return `  ${connectorSelectionCommand(request.url, request.method, candidate.connectorRef)}`;
+    return `  ${connectorSelectionCommand(request.url, request.method, candidate.connectorSlug)}`;
   });
   return new Error(
     `Multiple connectors match ${request.method} ${request.url}: ${candidates.map((candidate) => {
-      return candidate.connectorRef;
+      return candidate.connectorSlug;
     }).join(", ")}
 Select one explicitly:
 ${commands.join("\n")}`
   );
 }
 function unknownConnectorError(request) {
-  if (request.mode === "url" && request.connectorRef !== void 0) {
+  if (request.mode === "url" && request.connectorSlug !== void 0) {
     return new Error(
-      `Unknown connector type: ${request.connectorRef}
-Run: zero connector search ${shellQuoteArg(request.connectorRef)}`
+      `Unknown connector slug: ${request.connectorSlug}
+Run: zero connector search ${shellQuoteArg(request.connectorSlug)}`
     );
   }
   return new Error("The requested connector is unknown.");
@@ -240,10 +240,10 @@ function noMatchError(result) {
   );
 }
 function connectorMismatchError(request, result) {
-  const requestedSlug = request.connectorRef ?? "the requested connector";
+  const requestedSlug = request.connectorSlug ?? "the requested connector";
   return new Error(
-    `Connector ${requestedSlug} does not own ${request.method} ${request.url}; the matching connector is ${result.connector.connectorRef}
-Run: ${connectorSelectionCommand(request.url, request.method, result.connector.connectorRef)}`
+    `Connector ${requestedSlug} does not own ${request.method} ${request.url}; the matching connector is ${result.connector.connectorSlug}
+Run: ${connectorSelectionCommand(request.url, request.method, result.connector.connectorSlug)}`
   );
 }
 function environmentNotOwnedError(request, result) {
@@ -282,7 +282,7 @@ function resolvedDiagnostic(request, result) {
       throw environmentNotUsedError(request, result);
     case "unresolved-dynamic-base":
       throw new Error(
-        `No authoritative ${result.connector.label} base URL is available for this diagnostic. Verify the ${result.connector.connectorRef} connector configuration for the affected context and retry.`
+        `No authoritative ${result.connector.label} base URL is available for this diagnostic. Verify the ${result.connector.connectorSlug} connector configuration for the affected context and retry.`
       );
     case "run-context-unavailable":
       throw new Error(
@@ -294,7 +294,7 @@ function printDiagnosticSummary(request, result) {
   if (result.mode === "url") {
     const urlRequest = requireUrlRequest(request);
     console.log(
-      `URL ${urlRequest.url} matches the ${result.connector.label} connector (type: ${result.connector.connectorRef}).`
+      `URL ${urlRequest.url} matches the ${result.connector.label} connector (slug: ${result.connector.connectorSlug}).`
     );
     console.log(`  Matched base URL: ${result.base}`);
     console.log(`  Relative path:    ${result.relativePath}`);
@@ -308,7 +308,7 @@ function printDiagnosticSummary(request, result) {
     return;
   }
   console.log(
-    `${result.environmentName} is managed by the ${result.connector.label} connector (type: ${result.connector.connectorRef}).`
+    `${result.environmentName} is managed by the ${result.connector.label} connector (slug: ${result.connector.connectorSlug}).`
   );
 }
 function diagnosticEnvironmentNames(result) {
@@ -627,7 +627,7 @@ function printUrlPermissionDiagnostic(result, agentId) {
     console.log("");
     for (const permission of result.permission.permissions) {
       printNamedPolicyResult(
-        result.connector.connectorRef,
+        result.connector.connectorSlug,
         permission.name,
         permission.policy,
         agentId
@@ -639,7 +639,7 @@ function printUrlPermissionDiagnostic(result, agentId) {
     );
     console.log("");
     printUnknownEndpointPolicy(
-      result.connector.connectorRef,
+      result.connector.connectorSlug,
       result.permission.policy,
       agentId
     );
@@ -662,7 +662,7 @@ function printEnvironmentPermissionDiagnostic(result, permissionName, agentId) {
   );
   console.log("");
   printNamedPolicyResult(
-    result.connector.connectorRef,
+    result.connector.connectorSlug,
     permissionName,
     result.permission,
     agentId
@@ -705,9 +705,8 @@ var checkConnectorCommand = new Command().name("check").description(
     "A full URL to diagnose \u2014 matches connector ownership, route environment names, and permission (e.g. https://api.github.com/repos/owner/repo)"
   )
 ).addOption(
-  // TODO(#23619): Rename this stable CLI option value label in the CLI rollout.
   new Option(
-    "--connector <type>",
+    "--connector <slug>",
     "Select the connector when multiple connectors own the same URL route"
   )
 ).addOption(
@@ -753,7 +752,7 @@ How connectors work:
     const platformUrl = toPlatformUrl(await getApiUrl());
     const ctx = {
       environmentNames: diagnosticEnvironmentNames(result),
-      connectorSlug: result.connector.connectorRef,
+      connectorSlug: result.connector.connectorSlug,
       label: result.connector.label,
       connectorAvailable: result.connector.visibility === "available",
       credentialResolution: result.connector.credentialResolution,
@@ -818,7 +817,7 @@ function parseConnectorValues(rawValues) {
   }
   return values;
 }
-var connectCommand = new Command().name("connect").description("Connect a connector with manual grant values").argument("<type>", "Connector type (e.g., zendesk)").option("--auth-method <method>", "Connector auth method to use").option(
+var connectCommand = new Command().name("connect").description("Connect a connector with manual grant values").argument("<slug>", "Connector slug (e.g., zendesk)").option("--auth-method <method>", "Connector auth method to use").option(
   "--value <name=value>",
   "Connector field value; repeat for multiple fields",
   collectValue,
@@ -843,7 +842,7 @@ var connectCommand = new Command().name("connect").description("Connect a connec
       options.authMethod
     );
     const connector = await connectZeroConnectorManualGrant(
-      connectorMetadata.connectorRef,
+      connectorMetadata.slug,
       authMethod.id,
       values
     );
@@ -852,9 +851,9 @@ var connectCommand = new Command().name("connect").description("Connect a connec
       return;
     }
     console.log(source_default.green(`\u2713 ${connectorMetadata.label} connected`));
-    console.log(source_default.dim(`  Type: ${connector.type}`));
+    console.log(source_default.dim(`  Slug: ${connector.slug}`));
     console.log(source_default.dim(`  Auth Method: ${connector.authMethod}`));
-    console.log(source_default.dim(`  Run: zero connector status ${connector.type}`));
+    console.log(source_default.dim(`  Run: zero connector status ${connector.slug}`));
   })
 );
 
@@ -901,7 +900,7 @@ function connectorDiscoveryItems(catalogConnectors, customConnectors) {
     ...catalogConnectors.map((connector) => {
       return {
         kind: "catalog",
-        connectorRef: connector.connectorRef,
+        slug: connector.slug,
         label: connector.label,
         description: connector.description,
         category: connector.category,
@@ -914,7 +913,7 @@ function connectorDiscoveryItems(catalogConnectors, customConnectors) {
     ...customConnectors.map((connector) => {
       return {
         kind: "custom",
-        connectorRef: connector.slug,
+        slug: connector.slug,
         label: connector.displayName,
         description: "",
         category: "custom",
@@ -942,7 +941,7 @@ function renderConnectorDiscoveryConnectedAsCell(connector) {
 }
 function isConnectorDiscoveryAuthorized(connector, agentContext) {
   if (connector.kind === "catalog") {
-    return agentContext.authorizedConnectorSlugs.has(connector.connectorRef);
+    return agentContext.authorizedConnectorSlugs.has(connector.slug);
   }
   return agentContext.authorizedCustomConnectorIds.has(
     connector.customConnector.id
@@ -962,7 +961,7 @@ var listCommand = new Command().name("list").alias("ls").description("List all c
       customConnectors
     );
     const connectorSlugs = discoveredConnectors.map((connector) => {
-      return connector.connectorRef;
+      return connector.slug;
     });
     const connectorSlugWidth = Math.max(
       4,
@@ -982,7 +981,7 @@ var listCommand = new Command().name("list").alias("ls").description("List all c
     );
     const authorizedHeader = agentCtx ? `AUTHORIZED FOR ${agentCtx.displayName}` : null;
     const headerParts = [
-      "TYPE".padEnd(connectorSlugWidth),
+      "SLUG".padEnd(connectorSlugWidth),
       connectedAsHeader.padEnd(connectedAsWidth)
     ];
     if (authorizedHeader) headerParts.push(authorizedHeader);
@@ -1015,7 +1014,7 @@ function parseLimit(raw) {
   return n;
 }
 var searchCommand = new Command().name("search").description(
-  "Search connectors by type, label, category, generation type, or tag"
+  "Search connectors by slug, label, category, generation type, or tag"
 ).argument("<keyword>", "Search keyword (case-insensitive)").option("--agent <id>", "Show per-agent authorization column").option(
   "--limit <n>",
   `Maximum number of results to display (default ${DEFAULT_LIMIT})`,
@@ -1049,7 +1048,7 @@ var searchCommand = new Command().name("search").description(
       if (total > options.limit) {
         console.log(`Too many results (top ${options.limit} of ${total}):`);
       }
-      const connectorSlugHeader = "TYPE";
+      const connectorSlugHeader = "SLUG";
       const connectedAsHeader = "CONNECTED AS";
       const connectedCells = results.map((r) => {
         return renderConnectorDiscoveryConnectedAsCell(r.connector);
@@ -1057,7 +1056,7 @@ var searchCommand = new Command().name("search").description(
       const connectorSlugWidth = Math.max(
         connectorSlugHeader.length,
         ...results.map((r) => {
-          return r.connector.connectorRef.length;
+          return r.connector.slug.length;
         })
       );
       const connectedAsWidth = Math.max(
@@ -1077,7 +1076,7 @@ var searchCommand = new Command().name("search").description(
       for (let i = 0; i < results.length; i++) {
         const result = results[i];
         const parts = [
-          result.connector.connectorRef.padEnd(connectorSlugWidth),
+          result.connector.slug.padEnd(connectorSlugWidth),
           padEndAnsi(connectedCells[i], connectedAsWidth)
         ];
         if (agentCtx) {
@@ -1130,7 +1129,7 @@ function printConnectorDetails(connector) {
   }
 }
 async function printAgentAction(connector, agentCtx) {
-  const connectorSlug = connector.connectorRef;
+  const connectorSlug = connector.slug;
   const authorized = agentCtx.authorizedConnectorSlugs.has(connectorSlug);
   const isConnected = connector.connected;
   const needsReconnect = connector.connectionStatus === "reconnect-required";
@@ -1193,7 +1192,7 @@ async function printAgentAction(connector, agentCtx) {
   }
 }
 async function printStandaloneAction(connector) {
-  const connectorSlug = connector.connectorRef;
+  const connectorSlug = connector.slug;
   if (connector.connectionStatus === "connected" || connector.connectionStatus === "scope-mismatch") {
     return;
   }
@@ -1210,7 +1209,7 @@ async function printStandaloneAction(connector) {
     console.log(`Connect it at: [Connect ${connectorSlug}](${url})`);
   }
 }
-var statusCommand = new Command().name("status").description("Show detailed status of a connector").argument("<type>", "Connector type (e.g., github)").option("--agent <id>", "Show authorization state for the given agent").action(
+var statusCommand = new Command().name("status").description("Show detailed status of a connector").argument("<slug>", "Connector slug (e.g., github)").option("--agent <id>", "Show authorization state for the given agent").action(
   withErrorHandler(
     async (connectorSlug, options) => {
       const [catalog, agentCtx] = await Promise.all([
@@ -1231,7 +1230,7 @@ var statusCommand = new Command().name("status").description("Show detailed stat
           }
         );
       }
-      console.log(`Connector: ${source_default.cyan(connector.connectorRef)}`);
+      console.log(`Connector: ${source_default.cyan(connector.slug)}`);
       console.log();
       printConnectorDetails(connector);
       if (agentCtx) {
@@ -1547,7 +1546,7 @@ if (!callbackPromptAvailable) {
 }
 var callbackPromptExample = callbackPromptAvailable ? '  zero connector permission-request github --permission contents:write --callback-prompt "Re-check the permission, then continue the previous task"\n' : "";
 var callbackPromptNotes = callbackPromptAvailable ? "  - Use --callback-prompt only when this turn needs exactly one connector or permission action\n  - Callback prompts are included in the URL; keep them concise and do not include secrets\n" : "";
-var permissionRequestCommand2 = new Command().name("permission-request").description("Request permission to use a connector capability").argument("<connector-ref>", "The connector type (e.g. github)").addOption(
+var permissionRequestCommand2 = new Command().name("permission-request").description("Request permission to use a connector capability").argument("<slug>", "The connector slug (e.g. github)").addOption(
   new Option(
     "--permission <name>",
     "The permission name to request"
@@ -1603,9 +1602,9 @@ ${callbackPromptNotes}  - Permission requests update the current user's connecto
       const agentId = opts.agent ?? process.env.ZERO_AGENT_ID;
       const metadata = await getZeroConnectorCatalogPermissions(connectorSlug);
       if (!metadata) {
-        throw new Error(`Unknown connector type: ${connectorSlug}`);
+        throw new Error(`Unknown connector slug: ${connectorSlug}`);
       }
-      if (opts.permission !== UNKNOWN_PERMISSION_GRANT && !findFirewallMetadataPermission(metadata, opts.permission)) {
+      if (opts.permission !== UNKNOWN_PERMISSION_GRANT && !hasConnectorFirewallMetadataPermission(metadata, opts.permission)) {
         throw new Error(
           `Unknown permission "${opts.permission}" for ${connectorSlug}`
         );
@@ -1626,4 +1625,4 @@ var zeroConnectorCommand = new Command().name("connector").description("Manage a
 export {
   zeroConnectorCommand
 };
-//# sourceMappingURL=connector-MY7K7RJN.js.map
+//# sourceMappingURL=connector-6YIH3K55.js.map