@vm0/cli 9.269.5 → 9.270.1

package/{chunk-TMSICUKM.js → chunk-XNBEOZ72.js}

@@ -225,6 +225,12 @@ var FEATURE_SWITCHES = {
     enabled: false,
     userOverridable: false
   },
+  ["japaneseLocale" /* JapaneseLocale */]: {
+    maintainer: "yuma@vm0.ai",
+    description: "Allow ja-JP preference writes after incompatible API readers and rollback candidates have drained.",
+    enabled: false,
+    userOverridable: false
+  },
   ["banking" /* Banking */]: {
     maintainer: "linghan@vm0.ai",
     description: "Enable the managed Zero Banking gateway and banking:read ZERO_TOKEN capability for Finicity-backed accounts, balances, and transactions.",
@@ -389,8 +395,7 @@ var FEATURE_SWITCHES = {
   ["artifacts" /* Artifacts */]: {
     maintainer: "bingjie@vm0.ai",
     description: "Show the Artifacts manage page for generated artifacts in the current organization.",
-    enabled: false,
-    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
+    enabled: true
   },
   ["hostedArtifactVersions" /* HostedArtifactVersions */]: {
     maintainer: "yuma@vm0.ai",
@@ -439,6 +444,12 @@ var FEATURE_SWITCHES = {
     enabled: false,
     userOverridable: true
   },
+  ["customConnectorCliCreate" /* CustomConnectorCliCreate */]: {
+    maintainer: "liangyou@vm0.ai",
+    description: "Allow Zero CLI agents to create and configure custom connectors directly.",
+    enabled: false,
+    enabledOrgIdHashes: STAFF_ORG_ID_HASHES
+  },
   ["customConnectorOAuth2" /* CustomConnectorOAuth2 */]: {
     maintainer: "liangyou@vm0.ai",
     description: "Allow org admins to add OAuth 2.0 authentication to custom connectors.",
@@ -473,4 +484,4 @@ function isFeatureEnabled(key, ctx) {
 export {
   isFeatureEnabled
 };
-//# sourceMappingURL=chunk-TMSICUKM.js.map
+//# sourceMappingURL=chunk-XNBEOZ72.js.map

package/chunk-XNBEOZ72.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../packages/core/src/feature-switch-key.ts","../../../packages/core/src/feature-switch.ts","../../../packages/core/src/identity-hash.ts"],"sourcesContent":["/**\n * Feature switch keys\n *\n * Defines all available feature switch identifiers.\n */\nexport enum FeatureSwitchKey {\n  Dummy = \"dummy\",\n  AhrefsConnector = \"ahrefsConnector\",\n  BillConnector = \"billConnector\",\n  BentomlConnector = \"bentomlConnector\",\n  BoxConnector = \"boxConnector\",\n  CanvaConnector = \"canvaConnector\",\n  CalComConnector = \"calComConnector\",\n  CopperConnector = \"copperConnector\",\n  DatadogConnector = \"datadogConnector\",\n  DeelConnector = \"deelConnector\",\n  DocuSignConnector = \"docusignConnector\",\n  DropboxConnector = \"dropboxConnector\",\n  FigmaConnector = \"figmaConnector\",\n  ExpensifyConnector = \"expensifyConnector\",\n  GoogleContactsConnector = \"googleContactsConnector\",\n  GoogleFormsConnector = \"googleFormsConnector\",\n  JoggAiConnector = \"joggAiConnector\",\n  MercuryConnector = \"mercuryConnector\",\n  NeonConnector = \"neonConnector\",\n  NetSuiteConnector = \"netSuiteConnector\",\n  GarminConnectConnector = \"garminConnectConnector\",\n  QuickBooksConnector = \"quickbooksConnector\",\n  RedditConnector = \"redditConnector\",\n  SupabaseConnector = \"supabaseConnector\",\n  WebflowConnector = \"webflowConnector\",\n  CloseConnector = \"closeConnector\",\n  MetaAdsConnector = \"metaAdsConnector\",\n  TikTokAdsConnector = \"tiktokAdsConnector\",\n  AwsConnector = \"awsConnector\",\n  PosthogConnector = \"posthogConnector\",\n  PayPalConnector = \"payPalConnector\",\n  RampConnector = \"rampConnector\",\n  MailchimpConnector = \"mailchimpConnector\",\n  ResendConnector = \"resendConnector\",\n  PexelsConnector = \"pexelsConnector\",\n  SpotifyConnector = \"spotifyConnector\",\n  ZeroDebug = \"zeroDebug\",\n  LanguagePreference = \"languagePreference\",\n  BrazilianPortugueseLocale = \"brazilianPortugueseLocale\",\n  JapaneseLocale = \"japaneseLocale\",\n  ZeroBrowser = \"zeroBrowser\",\n  ZeroChatMessaging = \"zeroChatMessaging\",\n  ZeroMailReplyFollowUp = \"zeroMailReplyFollowUp\",\n  Banking = \"banking\",\n  Lab = \"lab\",\n  NotionWorkflowAutomations = \"notionWorkflowAutomations\",\n  GithubWebhookAutomations = \"githubWebhookAutomations\",\n  MorningBrief = \"morningBrief\",\n  ManualMorningBrief = \"manualMorningBrief\",\n  TestOauthConnector = \"testOauthConnector\",\n  FreshdeskConnector = \"freshdeskConnector\",\n  StabilityAiConnector = \"stabilityAiConnector\",\n  ZoomConnector = \"zoomConnector\",\n  WorkdayConnector = \"workdayConnector\",\n  CodexFastMode = \"codexFastMode\",\n  ClaudeSessionPruning = \"claudeSessionPruning\",\n  RealAgentInPreview = \"realAgentInPreview\",\n  ComposerUploadPopover = \"composerUploadPopover\",\n  StructuredPromptInlineTemplates = \"structuredPromptInlineTemplates\",\n\n  ZapierConnector = \"zapierConnector\",\n  ComputerUseDesktopPlugins = \"computerUseDesktopPlugins\",\n  ChatThreadUnifiedSearch = \"chatThreadUnifiedSearch\",\n  ComposerSkillSubstringSearch = \"composerSkillSubstringSearch\",\n  SidebarSubscriptionUsage = \"sidebarSubscriptionUsage\",\n  SlackDmSessionRouting = \"slackDmSessionRouting\",\n  TeamsIntegration = \"teamsIntegration\",\n  FeishuIntegration = \"feishuIntegration\",\n  StrapiIntegration = \"strapiIntegration\",\n  Artifacts = \"artifacts\",\n  HostedArtifactVersions = \"hostedArtifactVersions\",\n  VideoArtifactPosters = \"videoArtifactPosters\",\n  ImageStyleR2 = \"imageStyleR2\",\n  WorkflowConnectorReadiness = \"workflowConnectorReadiness\",\n  ComposerConnectorPermissions = \"composerConnectorPermissions\",\n  ThreeColumnNav = \"threeColumnNav\",\n  ChatThreadSidebarAutoOpen = \"chatThreadSidebarAutoOpen\",\n  CustomConnectorCliCreate = \"customConnectorCliCreate\",\n  CustomConnectorOAuth2 = \"customConnectorOAuth2\",\n}\n","/**\n * Feature switch system\n *\n * Provides centralized feature flag management with user-identity based overrides.\n * User IDs are stored as FNV-1a hashes to avoid exposing plain-text identifiers in source code.\n *\n * NOT AN AUTHORIZATION BOUNDARY. User-overridable switches can be self-enabled\n * through `POST /api/zero/feature-switches`, and `userOverridable: false` only\n * excludes a switch from that API. For money-granting, credential, or\n * privilege-escalation endpoints, gate with a hard identity check (e.g.\n * `isStaffOrg()` from `./staff-org`) instead of this system.\n */\n\nimport { FeatureSwitchKey } from \"./feature-switch-key\";\nimport { STAFF_ORG_ID_HASHES, fnv1a } from \"./identity-hash\";\n\nexport interface FeatureSwitch {\n  readonly maintainer: string;\n  readonly description?: string;\n  readonly enabled: boolean;\n  readonly enabledUserHashes?: readonly string[];\n  readonly enabledEmailHashes?: readonly string[];\n  readonly enabledOrgIdHashes?: readonly string[];\n  readonly userOverridable?: boolean;\n}\n\nexport interface FeatureSwitchMetadata {\n  readonly maintainer: string;\n  readonly description?: string;\n  readonly userOverridable: boolean;\n}\n\nexport interface FeatureSwitchContext {\n  readonly userId?: string;\n  readonly email?: string;\n  readonly orgId?: string;\n  readonly overrides?: Partial<Record<FeatureSwitchKey, boolean>>;\n}\n\n/**\n * Registry of all feature switches\n */\nconst FEATURE_SWITCHES: Record<FeatureSwitchKey, FeatureSwitch> = {\n  [FeatureSwitchKey.Dummy]: {\n    maintainer: \"ethan@vm0.ai\",\n    description: \"Test-only feature switch for flag system validation\",\n    enabled: true,\n  },\n  [FeatureSwitchKey.AhrefsConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Ahrefs SEO connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.BillConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the BILL Spend & Expense connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.BentomlConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the BentoML model serving connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.BoxConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Box file storage connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.CanvaConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Canva design connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.CalComConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Cal.com scheduling connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.CopperConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Copper CRM connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.DatadogConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Datadog observability connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.DeelConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Deel HR connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.DocuSignConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the DocuSign e-signature connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.DropboxConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Dropbox file storage connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.FigmaConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Figma design connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ExpensifyConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Expensify accounting connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.GoogleContactsConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Google Contacts connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.GoogleFormsConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Google Forms connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.JoggAiConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the JoggAI video generation connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.MercuryConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Mercury banking connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.NeonConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Neon serverless Postgres connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.NetSuiteConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Oracle NetSuite ERP connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.GarminConnectConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Garmin Connect wellness connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.QuickBooksConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the QuickBooks accounting connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.RedditConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Reddit connector integration\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.SupabaseConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Supabase database connector integration\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.CloseConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Close CRM connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.WebflowConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Webflow site management connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.MetaAdsConnector]: {\n    maintainer: \"ethan@vm0.ai\",\n    description: \"Enable the Meta Ads Manager connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.TikTokAdsConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the TikTok Ads Manager connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.AwsConnector]: {\n    maintainer: \"liangyou@vm0.ai\",\n    description: \"Enable the temporary AWS remote login connector\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.PosthogConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the PostHog analytics connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.PayPalConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the PayPal payments connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.RampConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Ramp spend management connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.MailchimpConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Mailchimp email marketing connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ResendConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Resend email service connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.PexelsConnector]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description: \"Enable the Pexels stock photo and video connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.SpotifyConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Spotify connector integration\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ZeroDebug]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Reveal activity debug surfaces, activity log navigation, appended system prompts, and Debug preferences\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.LanguagePreference]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Enable workspace language bootstrap, persistence, and the Settings preference entry.\",\n    enabled: true,\n  },\n  [FeatureSwitchKey.BrazilianPortugueseLocale]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Allow pt-BR preference writes after incompatible API readers and rollback candidates have drained.\",\n    enabled: false,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.JapaneseLocale]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Allow ja-JP preference writes after incompatible API readers and rollback candidates have drained.\",\n    enabled: false,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.Banking]: {\n    maintainer: \"linghan@vm0.ai\",\n    description:\n      \"Enable the managed Zero Banking gateway and banking:read ZERO_TOKEN capability for Finicity-backed accounts, balances, and transactions.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.Lab]: {\n    maintainer: \"ethan@vm0.ai\",\n    description: \"Show the Lab page for toggling experimental features\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.MorningBrief]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Enable the daily 7:00 local-time Morning Brief email built from GitHub, Gmail, and Google Calendar.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: true,\n  },\n  [FeatureSwitchKey.ManualMorningBrief]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Show a Send now button in Settings that triggers a Morning Brief immediately for testing.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: true,\n  },\n  [FeatureSwitchKey.NotionWorkflowAutomations]: {\n    maintainer: \"lancy@vm0.ai\",\n    description:\n      \"Enable Notion event workflow automations, starting with child pages created under a configured parent page.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.GithubWebhookAutomations]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Show creation entry points for GitHub workflow job, pull request review, deployment status, and issue comment automations.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.TestOauthConnector]: {\n    maintainer: \"liangyou@vm0.ai\",\n    description:\n      \"Enable the test-oauth connector, a synthetic OAuth 2.0 provider used only for automated tests. Off in prod.\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.FreshdeskConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Freshdesk helpdesk connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.StabilityAiConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Stability AI image generation connector\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ZoomConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Enable the Zoom connector (OAuth 2.0) for meetings, past participants, and cloud recordings access\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.WorkdayConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description: \"Enable the Workday HCM and finance connector\",\n    enabled: false,\n  },\n\n  [FeatureSwitchKey.CodexFastMode]: {\n    maintainer: \"lancy@vm0.ai\",\n    description:\n      \"Enable Codex fast mode for ChatGPT subscription GPT 5.5 and GPT 5.6 web chat runs.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ClaudeSessionPruning]: {\n    maintainer: \"liangyou@vm0.ai\",\n    description:\n      \"Prune oversized Claude Code checkpoint histories to the latest native compact generation.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.RealAgentInPreview]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Send preview chat runs through real agent CLIs instead of preview mock runners.\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ComposerUploadPopover]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description:\n      \"Use the Upload popover in the chat composer instead of the legacy paperclip attachment button.\",\n    enabled: false,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.StructuredPromptInlineTemplates]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description:\n      \"Enable multiple inline artifact templates in structured chat prompts.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: true,\n  },\n  [FeatureSwitchKey.ZapierConnector]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Enable the Zapier connector. When disabled, Zapier is hidden from the connectors list and cannot be connected.\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.ComputerUseDesktopPlugins]: {\n    maintainer: \"lancy@vm0.ai\",\n    description:\n      \"Enable Zero Desktop Computer Use plugins for local resources, starting with the bundled filesystem plugin gateway.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ChatThreadUnifiedSearch]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Show chat thread title results from the local event-driven thread cache in the command-shift-a conversation picker.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ChatThreadSidebarAutoOpen]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Automatically open the latest sidebar-capable card from a running or successfully completed chat run when the utility sidebar is closed and split view is available.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ComposerSkillSubstringSearch]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Match chat composer slash skill suggestions by any slug substring instead of only prefixes.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ThreeColumnNav]: {\n    maintainer: \"ming@vm0.ai\",\n    description:\n      \"Slack-style three-column navigation: a labeled icon rail, a pinned-agents and chat-threads list column, and the conversation pane.\",\n    enabled: false,\n    // Ming only for the first pass; widen to staff once it settles.\n    enabledEmailHashes: [\"54757055\"], // fnv1a(\"ming@vm0.ai\")\n  },\n  [FeatureSwitchKey.SidebarSubscriptionUsage]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Show Codex and Claude Code personal subscription usage in the Zero sidebar footer.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.SlackDmSessionRouting]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Reuse agent/model-scoped sessions for top-level Slack direct messages after compatible callback readers are deployed.\",\n    enabled: false,\n  },\n  [FeatureSwitchKey.TeamsIntegration]: {\n    maintainer: \"linghan@vm0.ai\",\n    description:\n      \"Show standalone Microsoft Teams integration settings, connect flows, and Works page entry points.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.FeishuIntegration]: {\n    maintainer: \"linghan@vm0.ai\",\n    description:\n      \"Show the Feishu direct-message integration and Works page entry point.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.StrapiIntegration]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Enable Strapi integration settings and Strapi entry-published workflow automations.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.Artifacts]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description:\n      \"Show the Artifacts manage page for generated artifacts in the current organization.\",\n    enabled: true,\n  },\n  [FeatureSwitchKey.HostedArtifactVersions]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Create immutable hosted artifact versions behind stable site aliases.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.VideoArtifactPosters]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description:\n      \"Generate poster images asynchronously when video artifacts are recorded.\",\n    enabled: true,\n  },\n  [FeatureSwitchKey.ImageStyleR2]: {\n    maintainer: \"bingjie@vm0.ai\",\n    description:\n      \"Resolve archive-enabled image styles from private R2 packages. When off, image style authoring continues reading vm0-skills from GitHub.\",\n    enabled: true,\n  },\n  [FeatureSwitchKey.WorkflowConnectorReadiness]: {\n    maintainer: \"lancy@vm0.ai\",\n    description:\n      \"Show the manual connector readiness check on workflow settings pages.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.ZeroMailReplyFollowUp]: {\n    maintainer: \"yuma@vm0.ai\",\n    description:\n      \"Enable Zero Mail reply follow-up after all API deployments can read Gmail event configurations with threadId.\",\n    enabled: false,\n    userOverridable: false,\n  },\n  [FeatureSwitchKey.ZeroBrowser]: {\n    maintainer: \"liangyou@vm0.ai\",\n    description:\n      \"Enable thread-scoped Cloud browser access in chat and the Zero CLI.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ZeroChatMessaging]: {\n    maintainer: \"ethan@vm0.ai\",\n    description:\n      \"Advertise zero chat create, send, and cancel in the agent system prompt without gating the CLI commands or API.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.ComposerConnectorPermissions]: {\n    maintainer: \"ming@vm0.ai\",\n    description:\n      \"Show the configure-permissions entry in the chat composer connector popover, opening the agent×connector firewall dialog inline.\",\n    enabled: false,\n    userOverridable: true,\n  },\n  [FeatureSwitchKey.CustomConnectorCliCreate]: {\n    maintainer: \"liangyou@vm0.ai\",\n    description:\n      \"Allow Zero CLI agents to create and configure custom connectors directly.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n  [FeatureSwitchKey.CustomConnectorOAuth2]: {\n    maintainer: \"liangyou@vm0.ai\",\n    description:\n      \"Allow org admins to add OAuth 2.0 authentication to custom connectors.\",\n    enabled: false,\n    enabledOrgIdHashes: STAFF_ORG_ID_HASHES,\n  },\n};\n\ninterface ResolvedHashes {\n  readonly userHash?: string;\n  readonly emailHash?: string;\n  readonly orgIdHash?: string;\n}\n\nfunction evaluateSwitch(fs: FeatureSwitch, hashes: ResolvedHashes): boolean {\n  if (fs.enabled) return true;\n  if (hashes.userHash && fs.enabledUserHashes?.includes(hashes.userHash))\n    return true;\n  if (hashes.emailHash && fs.enabledEmailHashes?.includes(hashes.emailHash))\n    return true;\n  if (hashes.orgIdHash && fs.enabledOrgIdHashes?.includes(hashes.orgIdHash))\n    return true;\n  return false;\n}\n\n/**\n * Evaluate all feature switches at once for the given context.\n *\n * Computes identity hashes once and checks all switches synchronously.\n */\nexport function getAllFeatureStates(\n  ctx?: FeatureSwitchContext,\n): Record<FeatureSwitchKey, boolean> {\n  const switches = Object.values(FEATURE_SWITCHES);\n  const hashes: ResolvedHashes = {\n    userHash:\n      ctx?.userId &&\n      switches.some((s) => {\n        return s.enabledUserHashes?.length;\n      })\n        ? fnv1a(ctx.userId)\n        : undefined,\n    emailHash:\n      ctx?.email &&\n      switches.some((s) => {\n        return s.enabledEmailHashes?.length;\n      })\n        ? fnv1a(ctx.email.toLowerCase())\n        : undefined,\n    orgIdHash:\n      ctx?.orgId &&\n      switches.some((s) => {\n        return s.enabledOrgIdHashes?.length;\n      })\n        ? fnv1a(ctx.orgId)\n        : undefined,\n  };\n\n  const result = {} as Record<FeatureSwitchKey, boolean>;\n  for (const key of Object.values(FeatureSwitchKey)) {\n    result[key] = evaluateSwitch(FEATURE_SWITCHES[key], hashes);\n  }\n\n  if (ctx?.overrides) {\n    for (const [key, value] of Object.entries(ctx.overrides)) {\n      if (key in FEATURE_SWITCHES && value !== undefined) {\n        result[key as FeatureSwitchKey] = value;\n      }\n    }\n  }\n\n  return result;\n}\n\n/**\n * Return the description for every feature switch.\n */\nexport function getFeatureSwitchDescriptions(): Record<\n  FeatureSwitchKey,\n  string | undefined\n> {\n  const result = {} as Record<FeatureSwitchKey, string | undefined>;\n  for (const key of Object.values(FeatureSwitchKey)) {\n    result[key] = FEATURE_SWITCHES[key].description;\n  }\n  return result;\n}\n\n/**\n * Return display metadata for every feature switch.\n */\nexport function getFeatureSwitchMetadata(): Record<\n  FeatureSwitchKey,\n  FeatureSwitchMetadata\n> {\n  const result = {} as Record<FeatureSwitchKey, FeatureSwitchMetadata>;\n  for (const key of Object.values(FeatureSwitchKey)) {\n    const featureSwitch = FEATURE_SWITCHES[key];\n    result[key] = {\n      maintainer: featureSwitch.maintainer,\n      description: featureSwitch.description,\n      userOverridable: featureSwitch.userOverridable !== false,\n    };\n  }\n  return result;\n}\n\nexport function isUserOverridableFeatureSwitch(\n  key: string,\n): key is FeatureSwitchKey {\n  if (!(key in FEATURE_SWITCHES)) {\n    return false;\n  }\n  return FEATURE_SWITCHES[key as FeatureSwitchKey].userOverridable !== false;\n}\n\nexport function getUserOverridableFeatureSwitchKeys(): readonly FeatureSwitchKey[] {\n  return Object.values(FeatureSwitchKey).filter(isUserOverridableFeatureSwitch);\n}\n\nexport function filterUserOverridableFeatureSwitchOverrides(\n  switches: Record<string, boolean>,\n): Record<string, boolean> {\n  const filtered: Record<string, boolean> = {};\n  for (const [key, value] of Object.entries(switches)) {\n    if (isUserOverridableFeatureSwitch(key)) {\n      filtered[key] = value;\n    }\n  }\n  return filtered;\n}\n\n/**\n * Check if a feature is enabled for the given context.\n *\n * `ctx` is required so callers must pass identity (userId/orgId/email) or an\n * explicit `{}`. A switch gated by `enabledUserHashes` / `enabledOrgIdHashes`\n * silently returns `false` when ctx omits identity, which has caused bugs.\n * Client-side callers should usually read the platform `featureSwitch$` signal\n * instead — it also merges DB overrides on top of identity context.\n */\nexport function isFeatureEnabled(\n  key: FeatureSwitchKey,\n  ctx: FeatureSwitchContext,\n): boolean {\n  const override = ctx.overrides?.[key];\n  if (override !== undefined) {\n    return override;\n  }\n\n  const featureSwitch = FEATURE_SWITCHES[key];\n  if (featureSwitch.enabled) {\n    return true;\n  }\n  if (ctx.userId && featureSwitch.enabledUserHashes?.length) {\n    if (featureSwitch.enabledUserHashes.includes(fnv1a(ctx.userId)))\n      return true;\n  }\n  if (ctx.email && featureSwitch.enabledEmailHashes?.length) {\n    if (\n      featureSwitch.enabledEmailHashes.includes(fnv1a(ctx.email.toLowerCase()))\n    )\n      return true;\n  }\n  if (ctx.orgId && featureSwitch.enabledOrgIdHashes?.length) {\n    if (featureSwitch.enabledOrgIdHashes.includes(fnv1a(ctx.orgId)))\n      return true;\n  }\n  return false;\n}\n","/**\n * Identity hashing — FNV-1a 32-bit hash used to reference users / orgs / emails\n * without embedding plain-text identifiers in source code.\n *\n * Shared between the feature-switch registry (UI rollout targeting) and\n * `staff-org.ts` (authorization primitive). The hash is deterministic and\n * synchronous; no crypto API needed.\n */\n\nexport function fnv1a(input: string): string {\n  let h = 2166136261 >>> 0;\n  for (let i = 0; i < input.length; i++) {\n    h ^= input.charCodeAt(i);\n    h = Math.imul(h, 16777619) >>> 0;\n  }\n  return h.toString(16).padStart(8, \"0\");\n}\n\n/**\n * Hashes of internal staff org IDs.\n *\n * This list is the source of truth for `isStaffOrg()` — adding an entry here\n * grants that org access to every endpoint that uses `isStaffOrg` as an\n * authorization check. Treat changes with the same care as role grants.\n */\nexport const STAFF_ORG_ID_HASHES: readonly string[] = [\n  \"afce210e\", // org_3ANttyrbWYJk6JKRSTRLEsbsDLe\n];\n"],"mappings":";;;;;;;;AAAA;;;ACAA;;;ACAA;AASO,SAAS,MAAM,OAAuB;AAC3C,MAAI,IAAI,eAAe;AACvB,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,SAAK,MAAM,WAAW,CAAC;AACvB,QAAI,KAAK,KAAK,GAAG,QAAQ,MAAM;AAAA,EACjC;AACA,SAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACvC;AASO,IAAM,sBAAyC;AAAA,EACpD;AAAA;AACF;;;ADeA,IAAM,mBAA4D;AAAA,EAChE,oBAAuB,GAAG;AAAA,IACxB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,kCAA8B,GAAG;AAAA,IAC/B,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,sCAAgC,GAAG;AAAA,IACjC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,4CAAmC,GAAG;AAAA,IACpC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,sCAAgC,GAAG;AAAA,IACjC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wDAAyC,GAAG;AAAA,IAC1C,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,kDAAsC,GAAG;AAAA,IACvC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,4CAAmC,GAAG;AAAA,IACpC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,sDAAwC,GAAG;AAAA,IACzC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,gDAAqC,GAAG;AAAA,IACtC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,4CAAmC,GAAG;AAAA,IACpC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,sCAAgC,GAAG;AAAA,IACjC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,kCAA8B,GAAG;AAAA,IAC/B,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,4BAA2B,GAAG;AAAA,IAC5B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,4DAA2C,GAAG;AAAA,IAC5C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,iBAAiB;AAAA,EACnB;AAAA,EACA,sCAAgC,GAAG;AAAA,IACjC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,iBAAiB;AAAA,EACnB;AAAA,EACA,wBAAyB,GAAG;AAAA,IAC1B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,gBAAqB,GAAG;AAAA,IACtB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,kCAA8B,GAAG;AAAA,IAC/B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,4DAA2C,GAAG;AAAA,IAC5C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,0DAA0C,GAAG;AAAA,IAC3C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,kDAAsC,GAAG;AAAA,IACvC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EACA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AAAA,EAEA,oCAA+B,GAAG;AAAA,IAChC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,kDAAsC,GAAG;AAAA,IACvC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,8CAAoC,GAAG;AAAA,IACrC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,oDAAuC,GAAG;AAAA,IACxC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,iBAAiB;AAAA,EACnB;AAAA,EACA,wEAAiD,GAAG;AAAA,IAClD,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,wCAAiC,GAAG;AAAA,IAClC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,4DAA2C,GAAG;AAAA,IAC5C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,wDAAyC,GAAG;AAAA,IAC1C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,4DAA2C,GAAG;AAAA,IAC5C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,kEAA8C,GAAG;AAAA,IAC/C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,sCAAgC,GAAG;AAAA,IACjC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA;AAAA,IAET,oBAAoB,CAAC,UAAU;AAAA;AAAA,EACjC;AAAA,EACA,0DAA0C,GAAG;AAAA,IAC3C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,oDAAuC,GAAG;AAAA,IACxC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,0CAAkC,GAAG;AAAA,IACnC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,4CAAmC,GAAG;AAAA,IACpC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,4CAAmC,GAAG;AAAA,IACpC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,4BAA2B,GAAG;AAAA,IAC5B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,sDAAwC,GAAG;AAAA,IACzC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,kDAAsC,GAAG;AAAA,IACvC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,kCAA8B,GAAG;AAAA,IAC/B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,EACX;AAAA,EACA,8DAA4C,GAAG;AAAA,IAC7C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,EACnB;AAAA,EACA,oDAAuC,GAAG;AAAA,IACxC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,iBAAiB;AAAA,EACnB;AAAA,EACA,gCAA6B,GAAG;AAAA,IAC9B,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,4CAAmC,GAAG;AAAA,IACpC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,kEAA8C,GAAG;AAAA,IAC/C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,iBAAiB;AAAA,EACnB;AAAA,EACA,0DAA0C,GAAG;AAAA,IAC3C,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AAAA,EACA,oDAAuC,GAAG;AAAA,IACxC,YAAY;AAAA,IACZ,aACE;AAAA,IACF,SAAS;AAAA,IACT,oBAAoB;AAAA,EACtB;AACF;AAuIO,SAAS,iBACd,KACA,KACS;AACT,QAAM,WAAW,IAAI,YAAY,GAAG;AACpC,MAAI,aAAa,QAAW;AAC1B,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,iBAAiB,GAAG;AAC1C,MAAI,cAAc,SAAS;AACzB,WAAO;AAAA,EACT;AACA,MAAI,IAAI,UAAU,cAAc,mBAAmB,QAAQ;AACzD,QAAI,cAAc,kBAAkB,SAAS,MAAM,IAAI,MAAM,CAAC;AAC5D,aAAO;AAAA,EACX;AACA,MAAI,IAAI,SAAS,cAAc,oBAAoB,QAAQ;AACzD,QACE,cAAc,mBAAmB,SAAS,MAAM,IAAI,MAAM,YAAY,CAAC,CAAC;AAExE,aAAO;AAAA,EACX;AACA,MAAI,IAAI,SAAS,cAAc,oBAAoB,QAAQ;AACzD,QAAI,cAAc,mBAAmB,SAAS,MAAM,IAAI,KAAK,CAAC;AAC5D,aAAO;AAAA,EACX;AACA,SAAO;AACT;","names":[]}

package/{chunk-T5FBBPYK.js → chunk-ZAE7DA72.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   UNKNOWN_PERMISSION_GRANT,
   getZeroConnectorCatalogPermissions
-} from "./chunk-MLWYQW2I.js";
+} from "./chunk-IRYWZDHD.js";
 import {
   init_esm_shims
 } from "./chunk-GPYQ24DR.js";
@@ -216,4 +216,4 @@ export {
   connectorPermissionGrantsToFirewallPolicies,
   hasConnectorFirewallMetadataPermission
 };
-//# sourceMappingURL=chunk-T5FBBPYK.js.map
+//# sourceMappingURL=chunk-ZAE7DA72.js.map

package/{computer-use-ZQS76HHA.js → computer-use-RL4LFXTU.js}

@@ -12,13 +12,13 @@ import {
   fetchComputerUseScreenshot,
   getComputerUseCommand,
   listComputerUseHosts
-} from "./chunk-MLWYQW2I.js";
-import "./chunk-6UKHGUHL.js";
+} from "./chunk-IRYWZDHD.js";
+import "./chunk-6APTUGDE.js";
 import {
   ApiRequestError,
   withErrorHandler
-} from "./chunk-PQSRYTDK.js";
-import "./chunk-ZUHSC7WF.js";
+} from "./chunk-LRNTCZW5.js";
+import "./chunk-MD3YWUKO.js";
 import {
   Command
 } from "./chunk-CCWPKGTB.js";
@@ -970,4 +970,4 @@ export {
   formatComputerUseResultForConsole,
   zeroComputerUseCommand
 };
-//# sourceMappingURL=computer-use-ZQS76HHA.js.map
+//# sourceMappingURL=computer-use-RL4LFXTU.js.map

package/{connector-KBXVTIF3.js → connector-65CXKHFD.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   hasConnectorFirewallMetadataPermission
-} from "./chunk-T5FBBPYK.js";
+} from "./chunk-ZAE7DA72.js";
 import {
   CALLBACK_PROMPT_PLACEHOLDER,
   addRequestedCallbackSearchParams,
@@ -18,13 +18,17 @@ import {
   resolveConnectorDiscoveryAgentContext,
   resolveManualGrantAuthMethod,
   searchConnectorCatalog
-} from "./chunk-IUSQCIFL.js";
+} from "./chunk-DVGDO4XK.js";
 import {
   UNKNOWN_PERMISSION_GRANT,
+  addZeroAgentCustomConnector,
   connectZeroConnectorManualGrant,
   createBrowserAuthorizationRequest,
   createComputerUseAuthorizationRequest,
-  customConnectorProposalSchema,
+  createZeroCustomConnector,
+  customConnectorAuthModeSchema,
+  customConnectorOAuthConfigInputSchema,
+  customConnectorValueInputSchema,
   diagnoseZeroConnectorCheck,
   getZeroAgent,
   getZeroAgentCustomConnectors,
@@ -33,21 +37,26 @@ import {
   getZeroConnectorCatalogPermissions,
   getZeroCustomConnector,
   listZeroConnectorCatalogStatus,
-  listZeroCustomConnectors
-} from "./chunk-MLWYQW2I.js";
-import "./chunk-6UKHGUHL.js";
+  listZeroCustomConnectors,
+  setZeroCustomConnectorValues,
+  startZeroCustomConnectorOAuth2,
+  updateCustomConnectorBodySchema
+} from "./chunk-IRYWZDHD.js";
+import "./chunk-6APTUGDE.js";
 import {
   getPlatformOrigin,
   toPlatformUrl
-} from "./chunk-PZ2QW5PN.js";
+} from "./chunk-TRGD5ZVE.js";
 import "./chunk-MA22KQYU.js";
 import {
   ApiRequestError,
   getApiUrl,
   source_default,
   withErrorHandler
-} from "./chunk-PQSRYTDK.js";
-import "./chunk-ZUHSC7WF.js";
+} from "./chunk-LRNTCZW5.js";
+import {
+  decodeZeroTokenPayload
+} from "./chunk-MD3YWUKO.js";
 import {
   Command,
   Option
@@ -1244,7 +1253,253 @@ var statusCommand = new Command().name("status").description("Show detailed stat
 
 // src/commands/zero/connector/custom/index.ts
 init_esm_shims();
+
+// src/commands/zero/connector/custom/create.ts
+init_esm_shims();
 import { readFile } from "fs/promises";
+var customConnectorDefinitionSchema = updateCustomConnectorBodySchema.omit({
+  authMode: true,
+  oauthConfig: true
+});
+var manualCustomConnectorCreateSchema = customConnectorDefinitionSchema.extend({
+  authMode: customConnectorAuthModeSchema.extract(["manual"]),
+  values: customConnectorValueInputSchema.array()
+}).strict();
+var oauthCreateConfigSchema = customConnectorOAuthConfigInputSchema.required({
+  clientSecret: true
+});
+var oauthCustomConnectorCreateSchema = customConnectorDefinitionSchema.extend({
+  authMode: customConnectorAuthModeSchema.extract(["oauth"]),
+  oauthConfig: oauthCreateConfigSchema,
+  values: customConnectorValueInputSchema.array()
+}).strict();
+var customConnectorCreateSchema = manualCustomConnectorCreateSchema.or(
+  oauthCustomConnectorCreateSchema
+);
+function requireCustomConnectorWriteCapability() {
+  const payload = decodeZeroTokenPayload();
+  if (payload && !payload.capabilities.includes("connector:write")) {
+    throw new Error(
+      "Custom connector creation is not enabled for this agent run"
+    );
+  }
+}
+function valueMarker(value) {
+  return `${value.kind}:${value.key}`;
+}
+function validateValues(definition) {
+  const fields = new Map(
+    definition.fields.map((field) => {
+      return [valueMarker(field), field];
+    })
+  );
+  const provided = /* @__PURE__ */ new Set();
+  for (const value of definition.values) {
+    const marker = valueMarker(value);
+    if (!fields.has(marker)) {
+      throw new Error(`Unknown custom connector value: ${marker}`);
+    }
+    if (provided.has(marker)) {
+      throw new Error(`Duplicate custom connector value: ${marker}`);
+    }
+    provided.add(marker);
+  }
+  const missing = definition.fields.flatMap((field) => {
+    const marker = valueMarker(field);
+    return field.required && !provided.has(marker) ? [marker] : [];
+  });
+  if (missing.length > 0) {
+    throw new Error(
+      `Missing required custom connector values: ${missing.join(", ")}`
+    );
+  }
+}
+function printCreateResult(result, json) {
+  if (json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  console.log(
+    source_default.green(`\u2713 Custom connector "${result.connector.displayName}" created`)
+  );
+  console.log(source_default.dim(`  ID:             ${result.connector.id}`));
+  console.log(source_default.dim(`  Slug:           ${result.connector.slug}`));
+  console.log(
+    source_default.dim(`  Authentication: ${result.connector.authMode ?? "manual"}`)
+  );
+  console.log(
+    source_default.dim(
+      `  Status:         ${result.connector.connected ? "connected" : "awaiting authorization"}`
+    )
+  );
+  if (result.agentId && !result.authorizationUrl) {
+    console.log(source_default.dim(`  Agent:          ${result.agentId} (authorized)`));
+  }
+  if (!result.authorizationUrl) {
+    return;
+  }
+  console.log();
+  console.log("Complete OAuth authorization:");
+  console.log(
+    `  [Authorize ${result.connector.displayName}](${result.authorizationUrl})`
+  );
+  if (result.agentId) {
+    console.log(
+      source_default.dim(
+        `  Approval will also authorize this connector for agent ${result.agentId}.`
+      )
+    );
+  }
+}
+async function createManualCustomConnector(definition, agentId) {
+  validateValues(definition);
+  const { values, ...body } = definition;
+  const created = await createZeroCustomConnector(body);
+  const connector = await setZeroCustomConnectorValues(created.id, values);
+  if (agentId) {
+    await addZeroAgentCustomConnector(agentId, connector.id);
+  }
+  return {
+    connector,
+    ...agentId ? { agentId } : {}
+  };
+}
+async function createOAuthCustomConnector(definition, agentId) {
+  const { values, ...body } = definition;
+  if (body.fields.length > 0 || values.length > 0) {
+    throw new Error(
+      "OAuth custom connectors require empty fields and values arrays"
+    );
+  }
+  const created = await createZeroCustomConnector(body);
+  const authorizationUrl = await startZeroCustomConnectorOAuth2(
+    created.id,
+    agentId
+  );
+  return {
+    connector: created,
+    authorizationUrl,
+    ...agentId ? { agentId } : {}
+  };
+}
+var createCustomConnectorCommand = new Command().name("create").description(
+  "Create and configure a manual or OAuth custom connector from JSON"
+).requiredOption(
+  "-f, --file <path>",
+  "JSON file containing the connector definition and credentials"
+).option(
+  "--agent <id>",
+  "Authorize this agent (defaults to ZERO_AGENT_ID when available)"
+).option("--json", "Print the connector and authorization result as JSON").addHelpText(
+  "after",
+  `
+File format:
+  The file must contain one complete connector definition. The agent should
+  generate this file from the user's requirements and credentials.
+
+Agent workflow:
+  1. Ask the user in chat only for missing API details and credentials.
+  2. Derive the prefixes, fields, injections, and OAuth settings.
+  3. Write a temporary JSON file, run this command, then remove the file.
+  The user should not need to write JSON or run this command.
+
+  Common fields:
+    displayName       Human-readable connector name
+    prefixTemplates   Allowed HTTPS API URL prefixes
+    fields            Inputs referenced by manual templates
+    headerInjections  Headers added to matching requests
+    queryInjections   Query parameters added to matching requests
+    authMode          "manual" or "oauth"
+
+Manual mode:
+  Add a values array with one entry for every required field. References use
+  {{secrets.KEY}} or {{variables.KEY}}. The command creates the connector,
+  stores the values, and authorizes --agent in one flow.
+
+  {
+    "displayName": "Acme API",
+    "prefixTemplates": ["https://api.acme.example/v1/"],
+    "fields": [
+      {
+        "key": "api_key",
+        "label": "API key",
+        "kind": "secret",
+        "required": true
+      }
+    ],
+    "headerInjections": [
+      {
+        "name": "Authorization",
+        "valueTemplate": "Bearer {{secrets.api_key}}"
+      }
+    ],
+    "queryInjections": [],
+    "authMode": "manual",
+    "values": [
+      { "key": "api_key", "kind": "secret", "value": "<user-api-key>" }
+    ]
+  }
+
+OAuth mode:
+  Use {{oauth.access_token}} in an injection and provide the complete OAuth
+  client configuration. OAuth mode requires empty fields and values arrays.
+  The command prints an authorization link. If --agent is set, completing
+  OAuth also authorizes that agent.
+
+  {
+    "displayName": "Acme OAuth API",
+    "prefixTemplates": ["https://api.acme.example/v1/"],
+    "fields": [],
+    "headerInjections": [
+      {
+        "name": "Authorization",
+        "valueTemplate": "Bearer {{oauth.access_token}}"
+      }
+    ],
+    "queryInjections": [],
+    "authMode": "oauth",
+    "values": [],
+    "oauthConfig": {
+      "providerAdapter": "standard",
+      "clientId": "<oauth-client-id>",
+      "clientSecret": "<oauth-client-secret>",
+      "authorizationUrl": "https://acme.example/oauth/authorize",
+      "tokenUrl": "https://acme.example/oauth/token",
+      "tokenEndpointAuthMethod": "client_secret_post",
+      "pkceMethod": "S256",
+      "scopes": ["read", "write"],
+      "authorizationParams": {}
+    }
+  }
+
+Examples:
+  zero connector custom create --file ./connector.json
+  zero connector custom create --file ./connector.json --agent <agent-id>
+  zero connector custom create --file ./connector.json --json
+
+Notes:
+  - Requires an organization admin
+  - Requires the customConnectorCliCreate feature
+  - OAuth custom connectors also require the customConnectorOAuth2 feature
+  - --agent defaults to ZERO_AGENT_ID inside an agent run
+  - OAuth always requires the user to approve the generated authorization link
+  - The file contains plaintext credentials; keep it temporary and never commit it`
+).action(
+  withErrorHandler(async (options) => {
+    requireCustomConnectorWriteCapability();
+    const raw = await readFile(options.file, "utf8");
+    const input = JSON.parse(raw);
+    const definition = customConnectorCreateSchema.parse(input);
+    const agentId = options.agent ?? process.env.ZERO_AGENT_ID;
+    if (agentId) {
+      await getZeroAgent(agentId);
+    }
+    const result = definition.authMode === "manual" ? await createManualCustomConnector(definition, agentId) : await createOAuthCustomConnector(definition, agentId);
+    printCreateResult(result, options.json ?? false);
+  })
+);
+
+// src/commands/zero/connector/custom/index.ts
 var LABEL_WIDTH2 = 18;
 function renderConnected(connector) {
   if (connector.connected) {
@@ -1255,12 +1510,6 @@ function renderConnected(connector) {
   }
   return source_default.yellow(`missing ${connector.missingRequiredFields.join(", ")}`);
 }
-function encodeBase64UrlJson(value) {
-  return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
-}
-function isJsonObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 async function resolveCustomAgentContext(agentId) {
   const resolvedAgentId = agentId ?? process.env.ZERO_AGENT_ID;
   if (!resolvedAgentId) {
@@ -1360,36 +1609,7 @@ var statusCommand2 = new Command().name("status").description("Show detailed sta
     }
   )
 );
-var proposeCommand = new Command().name("propose").description("Create a browser save link for a custom connector proposal").requiredOption("--proposal-file <path>", "JSON proposal file").option("--connector-id <id>", "Override connector id for update proposals").option("--agent <id>", "Authorize this agent when the proposal is saved").action(
-  withErrorHandler(
-    async (options) => {
-      const raw = await readFile(options.proposalFile, "utf8");
-      const proposalJson = JSON.parse(raw);
-      if (!isJsonObject(proposalJson)) {
-        throw new Error("Proposal file must contain a JSON object");
-      }
-      const parsed = customConnectorProposalSchema.parse({
-        ...proposalJson,
-        ...options.connectorId ? { connectorId: options.connectorId } : {}
-      });
-      const origin = await getPlatformOrigin();
-      const params = new URLSearchParams({
-        p: encodeBase64UrlJson(parsed)
-      });
-      const agentId = options.agent ?? process.env.ZERO_AGENT_ID;
-      if (agentId) {
-        params.set("agentId", agentId);
-      }
-      const url = `${origin}/connectors/custom/proposal?${params.toString()}`;
-      console.log(`[Configure ${parsed.displayName}](${url})`);
-      console.log();
-      console.log(
-        "Open this link to review, save values, and authorize the connector."
-      );
-    }
-  )
-);
-var customConnectorCommand = new Command().name("custom").description("Inspect and propose org custom connectors").addCommand(listCommand2).addCommand(statusCommand2).addCommand(proposeCommand);
+var customConnectorCommand = new Command().name("custom").description("Create and inspect org custom connectors").addCommand(createCustomConnectorCommand).addCommand(listCommand2).addCommand(statusCommand2);
 
 // src/commands/zero/connector/permission-request.ts
 init_esm_shims();
@@ -1519,7 +1739,7 @@ async function printBrowserPermissionRequestMessage() {
 async function outputPermissionRequestMessage(connectorSlug, label, permission, agentId, callbackPrompt) {
   const platformOrigin = await getPlatformOrigin();
   const urlParams = new URLSearchParams({
-    ref: connectorSlug,
+    connectorSlug,
     permission,
     action: "allow"
   });
@@ -1625,4 +1845,4 @@ var zeroConnectorCommand = new Command().name("connector").description("Manage a
 export {
   zeroConnectorCommand
 };
-//# sourceMappingURL=connector-KBXVTIF3.js.map
+//# sourceMappingURL=connector-65CXKHFD.js.map