@vm0/cli 9.272.3 → 9.272.5

package/{chunk-3P5LSOOY.js → chunk-G7HGHBG7.js}

@@ -15385,7 +15385,7 @@ function createCliClientHeaderInjector(options) {
   };
 }
 var addDefaultCliClientHeaders = createCliClientHeaderInjector({
-  clientVersion: "9.272.3"
+  clientVersion: "9.272.5"
 });
 function addCliClientHeaders(headers) {
   addDefaultCliClientHeaders(headers);
@@ -16805,4 +16805,4 @@ export {
   apiErrorSchema,
   withErrorHandler
 };
-//# sourceMappingURL=chunk-3P5LSOOY.js.map
+//# sourceMappingURL=chunk-G7HGHBG7.js.map

package/{chunk-E4425LE5.js → chunk-I3CP2OUW.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 import {
   UNKNOWN_PERMISSION_GRANT,
   getZeroConnectorCatalogPermissions
-} from "./chunk-E7OSQSSO.js";
+} from "./chunk-IPXIHHOL.js";
 import {
   init_esm_shims
 } from "./chunk-GPYQ24DR.js";
@@ -77,9 +77,6 @@ function createFirewallMetadataPolicyResolver(metadata, overlay) {
 }
 
 // ../../packages/connectors/src/firewall-metadata/policy.ts
-function metadataConnectorSlug(metadata) {
-  return metadata.connectorRef ?? metadata.type;
-}
 function expandFirewallMetadataDefaultPolicy(metadata) {
   const resolver = createFirewallMetadataPolicyResolver(metadata);
   const policies = {};
@@ -99,12 +96,11 @@ function findFirewallMetadataPermission(metadata, name) {
 function resolveFirewallMetadataPolicies(stored, metadata) {
   let resolved = stored;
   for (const detail of metadata) {
-    const connectorSlug = metadataConnectorSlug(detail);
     const defaults = expandFirewallMetadataDefaultPolicy(detail);
-    const existing = resolved?.[connectorSlug];
+    const existing = resolved?.[detail.connectorSlug];
     resolved = {
       ...resolved,
-      [connectorSlug]: {
+      [detail.connectorSlug]: {
         policies: { ...defaults.policies, ...existing?.policies },
         ...existing?.unknownPolicy !== void 0 ? { unknownPolicy: existing.unknownPolicy } : { unknownPolicy: defaults.unknownPolicy }
       }
@@ -115,16 +111,16 @@ function resolveFirewallMetadataPolicies(stored, metadata) {
 function permissionGrantsToFirewallPolicies(grants) {
   const policies = {};
   for (const grant of grants) {
-    const current = policies[grant.connectorRef] ?? { policies: {} };
+    const current = policies[grant.connectorSlug] ?? { policies: {} };
     if (grant.permission === UNKNOWN_PERMISSION_GRANT) {
-      policies[grant.connectorRef] = {
+      policies[grant.connectorSlug] = {
         ...current,
         unknownPolicy: grant.action
       };
       continue;
     }
     current.policies[grant.permission] = grant.action;
-    policies[grant.connectorRef] = current;
+    policies[grant.connectorSlug] = current;
   }
   return Object.keys(policies).length > 0 ? policies : null;
 }
@@ -185,9 +181,7 @@ async function loadConnectorPermissionInfos(args) {
   );
   const resolvedPolicies = resolveFirewallMetadataPolicies(
     args.storedPolicies,
-    defaultPolicyMetadata.map(({ connectorSlug, ...metadata }) => {
-      return { ...metadata, connectorRef: connectorSlug };
-    })
+    defaultPolicyMetadata
   );
   return args.displayConnectorSlugs.map((connectorSlug) => {
     return connectorPermissionInfo({
@@ -198,17 +192,10 @@ async function loadConnectorPermissionInfos(args) {
   });
 }
 function connectorPermissionGrantsToFirewallPolicies(grants) {
-  return permissionGrantsToFirewallPolicies(
-    grants.map(({ connectorSlug, ...grant }) => {
-      return { ...grant, connectorRef: connectorSlug };
-    })
-  );
+  return permissionGrantsToFirewallPolicies(grants);
 }
 function hasConnectorFirewallMetadataPermission(metadata, permission) {
-  return findFirewallMetadataPermission(
-    { ...metadata, connectorRef: metadata.connectorSlug },
-    permission
-  ) !== null;
+  return findFirewallMetadataPermission(metadata, permission) !== null;
 }
 
 export {
@@ -216,4 +203,4 @@ export {
   connectorPermissionGrantsToFirewallPolicies,
   hasConnectorFirewallMetadataPermission
 };
-//# sourceMappingURL=chunk-E4425LE5.js.map
+//# sourceMappingURL=chunk-I3CP2OUW.js.map

package/chunk-I3CP2OUW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/zero/shared/firewall-permissions.ts","../../../packages/connectors/src/firewall-metadata/policy.ts","../../../packages/connectors/src/firewall-metadata/policy-resolver.ts"],"sourcesContent":["import {\n  findFirewallMetadataPermission,\n  permissionGrantsToFirewallPolicies,\n  resolveFirewallMetadataPolicies,\n} from \"@vm0/connectors/firewall-metadata/policy\";\nimport type {\n  FirewallPolicies,\n  FirewallPolicyValue,\n} from \"@vm0/connectors/firewall-types\";\nimport { getZeroConnectorCatalogPermissions } from \"../../../lib/api\";\nimport type { ZeroUserPermissionGrant } from \"../../../lib/api/domains/zero-agents\";\nimport type { ZeroConnectorCatalogPermissionDetail } from \"../../../lib/api/domains/zero-connectors\";\n\nexport interface ConnectorPermissionInfo {\n  readonly connectorSlug: string;\n  readonly hasPermissions: boolean;\n  readonly hasPolicyEntry: boolean;\n  readonly permissions: readonly ZeroConnectorCatalogPermissionDetail[\"permissions\"][number][];\n  readonly policies: Readonly<Record<string, FirewallPolicyValue>> | null;\n  readonly unknownPolicy: FirewallPolicyValue;\n  readonly allowed: number;\n  readonly total: number;\n}\n\ntype PermissionMetadataBySlug = Map<\n  string,\n  ZeroConnectorCatalogPermissionDetail | null\n>;\n\nasync function loadPermissionMetadataBySlug(\n  connectorSlugs: readonly string[],\n): Promise<PermissionMetadataBySlug> {\n  const uniqueConnectorSlugs = [...new Set(connectorSlugs)];\n  const entries = await Promise.all(\n    uniqueConnectorSlugs.map(async (connectorSlug) => {\n      return [\n        connectorSlug,\n        await getZeroConnectorCatalogPermissions(connectorSlug),\n      ] as const;\n    }),\n  );\n  return new Map(entries);\n}\n\nfunction connectorPermissionInfo(args: {\n  readonly connectorSlug: string;\n  readonly metadata: ZeroConnectorCatalogPermissionDetail | null;\n  readonly resolvedPolicies: FirewallPolicies | null;\n}): ConnectorPermissionInfo {\n  if (!args.metadata) {\n    return {\n      connectorSlug: args.connectorSlug,\n      hasPermissions: false,\n      hasPolicyEntry: false,\n      permissions: [],\n      policies: null,\n      unknownPolicy: \"allow\",\n      allowed: 0,\n      total: 0,\n    };\n  }\n\n  const connectorPolicy = args.resolvedPolicies?.[args.metadata.connectorSlug];\n  const policies =\n    connectorPolicy && Object.keys(connectorPolicy.policies).length > 0\n      ? connectorPolicy.policies\n      : null;\n  const total = args.metadata.permissions.length;\n  const allowed = policies\n    ? args.metadata.permissions.filter((permission) => {\n        return policies[permission.name] === \"allow\";\n      }).length\n    : 0;\n\n  return {\n    connectorSlug: args.connectorSlug,\n    hasPermissions: true,\n    hasPolicyEntry: connectorPolicy !== undefined,\n    permissions: args.metadata.permissions,\n    policies,\n    unknownPolicy: connectorPolicy?.unknownPolicy ?? \"allow\",\n    allowed,\n    total,\n  };\n}\n\nexport async function loadConnectorPermissionInfos(args: {\n  readonly displayConnectorSlugs: readonly string[];\n  readonly defaultPolicyConnectorSlugs: readonly string[];\n  readonly storedPolicies: FirewallPolicies | null;\n}): Promise<ConnectorPermissionInfo[]> {\n  const metadataBySlug = await loadPermissionMetadataBySlug([\n    ...args.displayConnectorSlugs,\n    ...args.defaultPolicyConnectorSlugs,\n  ]);\n  const defaultPolicyMetadata = args.defaultPolicyConnectorSlugs.flatMap(\n    (connectorSlug) => {\n      const metadata = metadataBySlug.get(connectorSlug);\n      return metadata ? [metadata] : [];\n    },\n  );\n  const resolvedPolicies = resolveFirewallMetadataPolicies(\n    args.storedPolicies,\n    defaultPolicyMetadata,\n  );\n\n  return args.displayConnectorSlugs.map((connectorSlug) => {\n    return connectorPermissionInfo({\n      connectorSlug,\n      metadata: metadataBySlug.get(connectorSlug) ?? null,\n      resolvedPolicies,\n    });\n  });\n}\n\nexport function connectorPermissionGrantsToFirewallPolicies(\n  grants: readonly ZeroUserPermissionGrant[],\n): FirewallPolicies | null {\n  return permissionGrantsToFirewallPolicies(grants);\n}\n\nexport function hasConnectorFirewallMetadataPermission(\n  metadata: ZeroConnectorCatalogPermissionDetail,\n  permission: string,\n): boolean {\n  return findFirewallMetadataPermission(metadata, permission) !== null;\n}\n","import {\n  UNKNOWN_PERMISSION_GRANT,\n  type FirewallPolicies,\n  type FirewallPolicy,\n  type FirewallPolicyValue,\n} from \"../firewall-types\";\nimport { createFirewallMetadataPolicyResolver } from \"./policy-resolver\";\n\nexport type {\n  FirewallMetadataPolicyListState,\n  FirewallMetadataPolicyOverlay,\n  FirewallMetadataPolicyResolver,\n} from \"./policy-resolver\";\n\nexport interface FirewallPermissionPolicyMetadataPermission {\n  readonly name: string;\n  readonly description?: string;\n}\n\nexport interface FirewallPermissionPolicyCategoryMetadata {\n  readonly categories: Readonly<Record<string, string>>;\n  readonly displayOrder: readonly string[];\n}\n\nexport type FirewallPermissionPolicyDefaultOverrides = Readonly<\n  Partial<Record<FirewallPolicyValue, readonly string[]>>\n>;\n\nexport interface FirewallPermissionPolicyDefaultMetadata {\n  readonly permissionDefault: FirewallPolicyValue;\n  readonly permissionOverrides?: FirewallPermissionPolicyDefaultOverrides;\n  readonly unknownPolicy: FirewallPolicyValue;\n}\n\ninterface FirewallPermissionPolicyMetadataBase {\n  readonly label: string;\n  readonly permissionCount: number;\n  readonly permissions: readonly FirewallPermissionPolicyMetadataPermission[];\n  readonly categories?: FirewallPermissionPolicyCategoryMetadata | null;\n  readonly defaultPolicy: FirewallPermissionPolicyDefaultMetadata;\n}\n\nexport interface FirewallPermissionPolicyMetadata extends FirewallPermissionPolicyMetadataBase {\n  readonly connectorSlug: string;\n}\n\nexport interface FirewallMetadataPermissionGroup<T extends { name: string }> {\n  readonly category: string;\n  readonly permissions: T[];\n}\n\nexport type FirewallPermissionGrantAction = Extract<\n  FirewallPolicyValue,\n  \"allow\" | \"deny\"\n>;\n\nexport interface FirewallPermissionGrant {\n  readonly connectorSlug: string;\n  readonly permission: string;\n  readonly action: FirewallPermissionGrantAction;\n}\n\nexport { createFirewallMetadataPolicyResolver };\n\nexport function expandFirewallMetadataDefaultPolicy(\n  metadata: FirewallPermissionPolicyMetadata,\n): FirewallPolicy {\n  const resolver = createFirewallMetadataPolicyResolver(metadata);\n  const policies: Record<string, FirewallPolicyValue> = {};\n\n  for (const permission of metadata.permissions) {\n    policies[permission.name] = resolver.permission(permission.name);\n  }\n\n  return {\n    policies,\n    unknownPolicy: resolver.unknown(),\n  };\n}\n\nexport function findFirewallMetadataPermission(\n  metadata: FirewallPermissionPolicyMetadata,\n  name: string,\n): FirewallPermissionPolicyMetadata[\"permissions\"][number] | null {\n  return (\n    metadata.permissions.find((permission) => {\n      return permission.name === name;\n    }) ?? null\n  );\n}\n\nexport function groupFirewallMetadataPermissionsByCategory<\n  T extends { name: string },\n>(\n  permissions: readonly T[],\n  metadata: FirewallPermissionPolicyMetadata,\n): FirewallMetadataPermissionGroup<T>[] | null {\n  if (!metadata.categories) {\n    return null;\n  }\n\n  const grouped = new Map<string, T[]>();\n  for (const category of metadata.categories.displayOrder) {\n    grouped.set(category, []);\n  }\n\n  for (const permission of permissions) {\n    const category = metadata.categories.categories[permission.name];\n    if (!category) {\n      continue;\n    }\n    grouped.get(category)?.push(permission);\n  }\n\n  return [...grouped.entries()]\n    .filter(([, groupPermissions]) => {\n      return groupPermissions.length > 0;\n    })\n    .map(([category, groupPermissions]) => {\n      return { category, permissions: groupPermissions };\n    });\n}\n\nexport function resolveFirewallMetadataPolicies(\n  stored: FirewallPolicies | null,\n  metadata: readonly FirewallPermissionPolicyMetadata[],\n): FirewallPolicies | null {\n  let resolved: FirewallPolicies | null = stored;\n  for (const detail of metadata) {\n    const defaults = expandFirewallMetadataDefaultPolicy(detail);\n    const existing = resolved?.[detail.connectorSlug];\n    resolved = {\n      ...resolved,\n      [detail.connectorSlug]: {\n        policies: { ...defaults.policies, ...existing?.policies },\n        ...(existing?.unknownPolicy !== undefined\n          ? { unknownPolicy: existing.unknownPolicy }\n          : { unknownPolicy: defaults.unknownPolicy }),\n      },\n    };\n  }\n  return resolved;\n}\n\nexport function permissionGrantsToFirewallPolicies(\n  grants: readonly FirewallPermissionGrant[],\n): FirewallPolicies | null {\n  const policies: FirewallPolicies = {};\n  for (const grant of grants) {\n    const current = policies[grant.connectorSlug] ?? { policies: {} };\n    if (grant.permission === UNKNOWN_PERMISSION_GRANT) {\n      policies[grant.connectorSlug] = {\n        ...current,\n        unknownPolicy: grant.action,\n      };\n      continue;\n    }\n    current.policies[grant.permission] = grant.action;\n    policies[grant.connectorSlug] = current;\n  }\n  return Object.keys(policies).length > 0 ? policies : null;\n}\n","import type { FirewallPolicyValue } from \"../firewall-types\";\n\ninterface FirewallMetadataPolicyResolverMetadata {\n  readonly defaultPolicy: {\n    readonly permissionDefault: FirewallPolicyValue;\n    readonly permissionOverrides?: Readonly<\n      Partial<Record<FirewallPolicyValue, readonly string[]>>\n    >;\n    readonly unknownPolicy: FirewallPolicyValue;\n  };\n}\n\nexport interface FirewallMetadataPolicyOverlay {\n  readonly permissionDefault?: FirewallPolicyValue;\n  readonly permissionOverrides?: Readonly<Record<string, FirewallPolicyValue>>;\n  readonly unknownPolicy?: FirewallPolicyValue;\n}\n\nexport type FirewallMetadataPolicyListState = FirewallPolicyValue | \"mixed\";\n\n/**\n * Resolves generated metadata defaults with an optional sparse policy overlay.\n * Permission name validation belongs to callers; unknown endpoints use unknown().\n */\nexport interface FirewallMetadataPolicyResolver {\n  permission(name: string): FirewallPolicyValue;\n  unknown(): FirewallPolicyValue;\n  list(permissionNames: readonly string[]): FirewallMetadataPolicyListState;\n  isPermissionOverridden(name: string): boolean;\n  isUnknownOverridden(): boolean;\n}\n\nfunction buildMetadataOverrideLookup(\n  metadata: FirewallMetadataPolicyResolverMetadata,\n): ReadonlyMap<string, FirewallPolicyValue> {\n  const overrides = metadata.defaultPolicy.permissionOverrides;\n  const lookup = new Map<string, FirewallPolicyValue>();\n  if (!overrides) {\n    return lookup;\n  }\n\n  for (const permission of overrides.allow ?? []) {\n    lookup.set(permission, \"allow\");\n  }\n  for (const permission of overrides.deny ?? []) {\n    lookup.set(permission, \"deny\");\n  }\n  for (const permission of overrides.ask ?? []) {\n    lookup.set(permission, \"ask\");\n  }\n\n  return lookup;\n}\n\nfunction getOwnPermissionOverride(\n  overrides: Readonly<Record<string, FirewallPolicyValue>> | undefined,\n  name: string,\n): FirewallPolicyValue | undefined {\n  if (!overrides || !Object.prototype.hasOwnProperty.call(overrides, name)) {\n    return undefined;\n  }\n  return overrides[name];\n}\n\nexport function createFirewallMetadataPolicyResolver(\n  metadata: FirewallMetadataPolicyResolverMetadata,\n  overlay?: FirewallMetadataPolicyOverlay,\n): FirewallMetadataPolicyResolver {\n  const metadataOverrides = buildMetadataOverrideLookup(metadata);\n\n  function metadataPermission(name: string): FirewallPolicyValue {\n    return (\n      metadataOverrides.get(name) ?? metadata.defaultPolicy.permissionDefault\n    );\n  }\n\n  function permission(name: string): FirewallPolicyValue {\n    return (\n      getOwnPermissionOverride(overlay?.permissionOverrides, name) ??\n      overlay?.permissionDefault ??\n      metadataPermission(name)\n    );\n  }\n\n  return {\n    permission,\n    unknown: () => {\n      return overlay?.unknownPolicy ?? metadata.defaultPolicy.unknownPolicy;\n    },\n    list: (permissionNames) => {\n      let first: FirewallPolicyValue | null = null;\n      for (const name of permissionNames) {\n        const current = permission(name);\n        if (first === null) {\n          first = current;\n          continue;\n        }\n        if (first !== current) {\n          return \"mixed\";\n        }\n      }\n      return first ?? \"mixed\";\n    },\n    isPermissionOverridden: (name) => {\n      return permission(name) !== metadataPermission(name);\n    },\n    isUnknownOverridden: () => {\n      return (\n        (overlay?.unknownPolicy ?? metadata.defaultPolicy.unknownPolicy) !==\n        metadata.defaultPolicy.unknownPolicy\n      );\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAAA;;;ACAA;;;ACAA;AAgCA,SAAS,4BACP,UAC0C;AAC1C,QAAM,YAAY,SAAS,cAAc;AACzC,QAAM,SAAS,oBAAI,IAAiC;AACpD,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAEA,aAAW,cAAc,UAAU,SAAS,CAAC,GAAG;AAC9C,WAAO,IAAI,YAAY,OAAO;AAAA,EAChC;AACA,aAAW,cAAc,UAAU,QAAQ,CAAC,GAAG;AAC7C,WAAO,IAAI,YAAY,MAAM;AAAA,EAC/B;AACA,aAAW,cAAc,UAAU,OAAO,CAAC,GAAG;AAC5C,WAAO,IAAI,YAAY,KAAK;AAAA,EAC9B;AAEA,SAAO;AACT;AAEA,SAAS,yBACP,WACA,MACiC;AACjC,MAAI,CAAC,aAAa,CAAC,OAAO,UAAU,eAAe,KAAK,WAAW,IAAI,GAAG;AACxE,WAAO;AAAA,EACT;AACA,SAAO,UAAU,IAAI;AACvB;AAEO,SAAS,qCACd,UACA,SACgC;AAChC,QAAM,oBAAoB,4BAA4B,QAAQ;AAE9D,WAAS,mBAAmB,MAAmC;AAC7D,WACE,kBAAkB,IAAI,IAAI,KAAK,SAAS,cAAc;AAAA,EAE1D;AAEA,WAAS,WAAW,MAAmC;AACrD,WACE,yBAAyB,SAAS,qBAAqB,IAAI,KAC3D,SAAS,qBACT,mBAAmB,IAAI;AAAA,EAE3B;AAEA,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM;AACb,aAAO,SAAS,iBAAiB,SAAS,cAAc;AAAA,IAC1D;AAAA,IACA,MAAM,CAAC,oBAAoB;AACzB,UAAI,QAAoC;AACxC,iBAAW,QAAQ,iBAAiB;AAClC,cAAM,UAAU,WAAW,IAAI;AAC/B,YAAI,UAAU,MAAM;AAClB,kBAAQ;AACR;AAAA,QACF;AACA,YAAI,UAAU,SAAS;AACrB,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,SAAS;AAAA,IAClB;AAAA,IACA,wBAAwB,CAAC,SAAS;AAChC,aAAO,WAAW,IAAI,MAAM,mBAAmB,IAAI;AAAA,IACrD;AAAA,IACA,qBAAqB,MAAM;AACzB,cACG,SAAS,iBAAiB,SAAS,cAAc,mBAClD,SAAS,cAAc;AAAA,IAE3B;AAAA,EACF;AACF;;;ADjDO,SAAS,oCACd,UACgB;AAChB,QAAM,WAAW,qCAAqC,QAAQ;AAC9D,QAAM,WAAgD,CAAC;AAEvD,aAAW,cAAc,SAAS,aAAa;AAC7C,aAAS,WAAW,IAAI,IAAI,SAAS,WAAW,WAAW,IAAI;AAAA,EACjE;AAEA,SAAO;AAAA,IACL;AAAA,IACA,eAAe,SAAS,QAAQ;AAAA,EAClC;AACF;AAEO,SAAS,+BACd,UACA,MACgE;AAChE,SACE,SAAS,YAAY,KAAK,CAAC,eAAe;AACxC,WAAO,WAAW,SAAS;AAAA,EAC7B,CAAC,KAAK;AAEV;AAkCO,SAAS,gCACd,QACA,UACyB;AACzB,MAAI,WAAoC;AACxC,aAAW,UAAU,UAAU;AAC7B,UAAM,WAAW,oCAAoC,MAAM;AAC3D,UAAM,WAAW,WAAW,OAAO,aAAa;AAChD,eAAW;AAAA,MACT,GAAG;AAAA,MACH,CAAC,OAAO,aAAa,GAAG;AAAA,QACtB,UAAU,EAAE,GAAG,SAAS,UAAU,GAAG,UAAU,SAAS;AAAA,QACxD,GAAI,UAAU,kBAAkB,SAC5B,EAAE,eAAe,SAAS,cAAc,IACxC,EAAE,eAAe,SAAS,cAAc;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mCACd,QACyB;AACzB,QAAM,WAA6B,CAAC;AACpC,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,EAAE,UAAU,CAAC,EAAE;AAChE,QAAI,MAAM,eAAe,0BAA0B;AACjD,eAAS,MAAM,aAAa,IAAI;AAAA,QAC9B,GAAG;AAAA,QACH,eAAe,MAAM;AAAA,MACvB;AACA;AAAA,IACF;AACA,YAAQ,SAAS,MAAM,UAAU,IAAI,MAAM;AAC3C,aAAS,MAAM,aAAa,IAAI;AAAA,EAClC;AACA,SAAO,OAAO,KAAK,QAAQ,EAAE,SAAS,IAAI,WAAW;AACvD;;;ADpIA,eAAe,6BACb,gBACmC;AACnC,QAAM,uBAAuB,CAAC,GAAG,IAAI,IAAI,cAAc,CAAC;AACxD,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,qBAAqB,IAAI,OAAO,kBAAkB;AAChD,aAAO;AAAA,QACL;AAAA,QACA,MAAM,mCAAmC,aAAa;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,IAAI,IAAI,OAAO;AACxB;AAEA,SAAS,wBAAwB,MAIL;AAC1B,MAAI,CAAC,KAAK,UAAU;AAClB,WAAO;AAAA,MACL,eAAe,KAAK;AAAA,MACpB,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,MAChB,aAAa,CAAC;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,MACf,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,kBAAkB,KAAK,mBAAmB,KAAK,SAAS,aAAa;AAC3E,QAAM,WACJ,mBAAmB,OAAO,KAAK,gBAAgB,QAAQ,EAAE,SAAS,IAC9D,gBAAgB,WAChB;AACN,QAAM,QAAQ,KAAK,SAAS,YAAY;AACxC,QAAM,UAAU,WACZ,KAAK,SAAS,YAAY,OAAO,CAAC,eAAe;AAC/C,WAAO,SAAS,WAAW,IAAI,MAAM;AAAA,EACvC,CAAC,EAAE,SACH;AAEJ,SAAO;AAAA,IACL,eAAe,KAAK;AAAA,IACpB,gBAAgB;AAAA,IAChB,gBAAgB,oBAAoB;AAAA,IACpC,aAAa,KAAK,SAAS;AAAA,IAC3B;AAAA,IACA,eAAe,iBAAiB,iBAAiB;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,6BAA6B,MAIZ;AACrC,QAAM,iBAAiB,MAAM,6BAA6B;AAAA,IACxD,GAAG,KAAK;AAAA,IACR,GAAG,KAAK;AAAA,EACV,CAAC;AACD,QAAM,wBAAwB,KAAK,4BAA4B;AAAA,IAC7D,CAAC,kBAAkB;AACjB,YAAM,WAAW,eAAe,IAAI,aAAa;AACjD,aAAO,WAAW,CAAC,QAAQ,IAAI,CAAC;AAAA,IAClC;AAAA,EACF;AACA,QAAM,mBAAmB;AAAA,IACvB,KAAK;AAAA,IACL;AAAA,EACF;AAEA,SAAO,KAAK,sBAAsB,IAAI,CAAC,kBAAkB;AACvD,WAAO,wBAAwB;AAAA,MAC7B;AAAA,MACA,UAAU,eAAe,IAAI,aAAa,KAAK;AAAA,MAC/C;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAEO,SAAS,4CACd,QACyB;AACzB,SAAO,mCAAmC,MAAM;AAClD;AAEO,SAAS,uCACd,UACA,YACS;AACT,SAAO,+BAA+B,UAAU,UAAU,MAAM;AAClE;","names":[]}

package/{chunk-E7OSQSSO.js → chunk-IPXIHHOL.js}

@@ -21,7 +21,7 @@ import {
   updateOrgModelPoliciesRequestSchema,
   upsertModelProviderRequestSchema,
   upsertModelProviderResponseSchema
-} from "./chunk-3P5LSOOY.js";
+} from "./chunk-G7HGHBG7.js";
 import {
   __commonJS,
   __esm,
@@ -3527,6 +3527,10 @@ var workflowSnapshotSchema = external_exports.object({
 var goalSnapshotSchema = external_exports.object({
   objectiveBrief: external_exports.string().min(1)
 });
+var chatEventAnnotationSchema = external_exports.object({
+  kind: external_exports.enum(["slack", "feishu", "teams", "telegram", "github"]),
+  href: external_exports.string().url().optional()
+}).strict();
 var chatEventBaseSchema = external_exports.object({
   id: external_exports.string(),
   threadId: external_exports.string(),
@@ -3534,8 +3538,7 @@ var chatEventBaseSchema = external_exports.object({
   runId: external_exports.string().optional(),
   runGroupId: external_exports.string().optional(),
   triggerSource: triggerSourceSchema.optional(),
-  slackMessagePermalink: external_exports.string().url().optional(),
-  feishuChatOpenUrl: external_exports.string().url().optional(),
+  annotation: chatEventAnnotationSchema.optional(),
   isGoalRun: external_exports.boolean().optional(),
   runEventId: external_exports.string().optional(),
   goalSnapshot: goalSnapshotSchema.optional(),
@@ -3582,8 +3585,7 @@ var inputGoalEventSchema = chatEventBaseSchema.extend({
   runId: external_exports.never().optional(),
   runGroupId: external_exports.never().optional(),
   triggerSource: external_exports.never().optional(),
-  slackMessagePermalink: external_exports.never().optional(),
-  feishuChatOpenUrl: external_exports.never().optional(),
+  annotation: external_exports.never().optional(),
   isGoalRun: external_exports.never().optional(),
   runEventId: external_exports.never().optional(),
   goalSnapshot: goalSnapshotSchema,
@@ -3648,15 +3650,6 @@ var runCancelledEventSchema = chatEventBaseSchema.extend({
   error: external_exports.string().optional(),
   runLifecycleEvent: external_exports.literal("cancelled")
 }).strict();
-var legacyQueueAutomationPausedEventSchema = chatEventBaseSchema.extend({
-  eventType: external_exports.literal("queue.automation_paused"),
-  content: external_exports.null(),
-  pauseReason: external_exports.string().nullable()
-}).strict();
-var legacyQueueAutomationResumedEventSchema = chatEventBaseSchema.extend({
-  eventType: external_exports.literal("queue.automation_resumed"),
-  content: external_exports.null()
-}).strict();
 var controlInterruptEventSchema = chatEventBaseSchema.extend({
   eventType: external_exports.literal("control.interrupt"),
   content: external_exports.null(),
@@ -3707,11 +3700,6 @@ var chatEventSchema = external_exports.discriminatedUnion("eventType", [
   goalChangedEventSchema,
   usageRecordedEventSchema
 ]);
-var chatEventResponseSchema = external_exports.discriminatedUnion("eventType", [
-  ...chatEventSchema.options,
-  legacyQueueAutomationPausedEventSchema,
-  legacyQueueAutomationResumedEventSchema
-]);
 if (CHAT_EVENT_TYPES.length !== chatEventSchema.options.length) {
   throw new Error(
     "ChatEvent schema must cover every registered event catalog leaf"
@@ -4315,7 +4303,7 @@ var chatThreadEventsContract = c12.router({
     }),
     responses: {
       200: external_exports.object({
-        events: external_exports.array(chatEventResponseSchema)
+        events: external_exports.array(chatEventSchema)
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -4330,7 +4318,7 @@ var chatThreadEventsContract = c12.router({
     headers: authHeadersSchema,
     pathParams: chatThreadEventPathParamsSchema,
     responses: {
-      200: chatEventResponseSchema,
+      200: chatEventSchema,
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -4435,9 +4423,6 @@ var artifactsContract = c12.router({
     summary: "Delete a resumable image artifact edit snapshot for the caller"
   }
 });
-function isCanonicalChatEventResponse(event) {
-  return event.eventType !== "queue.automation_paused" && event.eventType !== "queue.automation_resumed";
-}
 
 // ../../packages/api-contracts/src/contracts/zero-agents.ts
 var c13 = initContract();
@@ -5409,11 +5394,20 @@ var connectorCatalogCompatibilityReasonSchema = external_exports.enum([
   "missing-platform-configuration"
 ]);
 var connectorCatalogFilteredAuthMethodSchema = external_exports.object({
-  // TODO(#23619): Rename this diagnostics wire field after clients migrate.
+  connectorSlug: connectorSlugSchema.optional(),
+  // TODO(#24186): Remove after the prepared Platform receiver is required.
   connectorRef: connectorSlugSchema,
   authMethodId: connectorAuthMethodIdSchema,
   reasons: external_exports.array(connectorCatalogCompatibilityReasonSchema).min(1)
-});
+}).refine(
+  ({ connectorSlug, connectorRef }) => {
+    return connectorSlug === void 0 || connectorSlug === connectorRef;
+  },
+  {
+    message: "connectorSlug and connectorRef must match",
+    path: ["connectorSlug"]
+  }
+);
 var connectorCatalogFilteredAuthMethodsSchema = external_exports.array(
   connectorCatalogFilteredAuthMethodSchema
 );
@@ -8071,7 +8065,7 @@ async function listZeroChatEvents(options) {
     }
   });
   if (result.status === 200) {
-    return result.body.events.filter(isCanonicalChatEventResponse);
+    return result.body.events;
   }
   handleError(result, "Failed to list chat events");
 }
@@ -13445,4 +13439,4 @@ export {
   getHostedSiteFiles,
   getHostedSiteDeployments
 };
-//# sourceMappingURL=chunk-E7OSQSSO.js.map
+//# sourceMappingURL=chunk-IPXIHHOL.js.map