@vm0/cli 9.276.0 → 9.276.1

package/{chunk-BINP2SIK.js → chunk-NUK6BSMQ.js}

@@ -15385,7 +15385,7 @@ function createCliClientHeaderInjector(options) {
   };
 }
 var addDefaultCliClientHeaders = createCliClientHeaderInjector({
-  clientVersion: "9.276.0"
+  clientVersion: "9.276.1"
 });
 function addCliClientHeaders(headers) {
   addDefaultCliClientHeaders(headers);
@@ -16848,4 +16848,4 @@ export {
   apiErrorSchema,
   withErrorHandler
 };
-//# sourceMappingURL=chunk-BINP2SIK.js.map
+//# sourceMappingURL=chunk-NUK6BSMQ.js.map

package/{chunk-VF6NEP63.js → chunk-OHA5XMTM.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   getApiUrl
-} from "./chunk-BINP2SIK.js";
+} from "./chunk-NUK6BSMQ.js";
 import {
   init_esm_shims
 } from "./chunk-AUWSMG4F.js";
@@ -46,4 +46,4 @@ export {
   toPlatformUrl,
   getPlatformOrigin
 };
-//# sourceMappingURL=chunk-VF6NEP63.js.map
+//# sourceMappingURL=chunk-OHA5XMTM.js.map

package/{chunk-DNRMAFE7.js → chunk-VH6AYJ2T.js}

@@ -2,12 +2,14 @@
 import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
-  UNKNOWN_PERMISSION_GRANT,
   getZeroConnectorCatalogPermissions
-} from "./chunk-3WAJCD24.js";
+} from "./chunk-DCTUWMGG.js";
+import {
+  UNKNOWN_PERMISSION_GRANT
+} from "./chunk-X6A4NKYJ.js";
 import {
   source_default
-} from "./chunk-BINP2SIK.js";
+} from "./chunk-NUK6BSMQ.js";
 import {
   init_esm_shims
 } from "./chunk-AUWSMG4F.js";
@@ -206,4 +208,4 @@ export {
   loadConnectorPermissionInfos,
   connectorPermissionGrantsToFirewallPolicies
 };
-//# sourceMappingURL=chunk-DNRMAFE7.js.map
+//# sourceMappingURL=chunk-VH6AYJ2T.js.map

package/{chunk-DNRMAFE7.js.map → chunk-VH6AYJ2T.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/lib/utils/format-utils.ts","../src/commands/zero/shared/firewall-permissions.ts","../../../packages/connectors/src/firewall-metadata/policy.ts","../../../packages/connectors/src/firewall-metadata/policy-resolver.ts"],"sourcesContent":["import chalk from \"chalk\";\nimport type { FirewallPolicyValue } from \"@vm0/connectors/firewall-types\";\n\nexport function policyIcon(policy: FirewallPolicyValue): string {\n  if (policy === \"allow\") return chalk.green(\"✓\");\n  if (policy === \"ask\") return chalk.yellow(\"?\");\n  return chalk.dim(\"✗\");\n}\n","import {\n  permissionGrantsToFirewallPolicies,\n  resolveFirewallMetadataPolicies,\n} from \"@vm0/connectors/firewall-metadata/policy\";\nimport type {\n  FirewallPolicies,\n  FirewallPolicyValue,\n} from \"@vm0/connectors/firewall-types\";\nimport { getZeroConnectorCatalogPermissions } from \"../../../lib/api\";\nimport type { ZeroUserPermissionGrant } from \"../../../lib/api/domains/zero-agents\";\nimport type { ZeroConnectorCatalogPermissionDetail } from \"../../../lib/api/domains/zero-connectors\";\n\nexport interface ConnectorPermissionInfo {\n  readonly connectorSlug: string;\n  readonly hasPermissions: boolean;\n  readonly hasPolicyEntry: boolean;\n  readonly permissions: readonly ZeroConnectorCatalogPermissionDetail[\"permissions\"][number][];\n  readonly policies: Readonly<Record<string, FirewallPolicyValue>> | null;\n  readonly unknownPolicy: FirewallPolicyValue;\n  readonly allowed: number;\n  readonly total: number;\n}\n\ntype PermissionMetadataBySlug = Map<\n  string,\n  ZeroConnectorCatalogPermissionDetail | null\n>;\n\nasync function loadPermissionMetadataBySlug(\n  connectorSlugs: readonly string[],\n): Promise<PermissionMetadataBySlug> {\n  const uniqueConnectorSlugs = [...new Set(connectorSlugs)];\n  const entries = await Promise.all(\n    uniqueConnectorSlugs.map(async (connectorSlug) => {\n      return [\n        connectorSlug,\n        await getZeroConnectorCatalogPermissions(connectorSlug),\n      ] as const;\n    }),\n  );\n  return new Map(entries);\n}\n\nfunction connectorPermissionInfo(args: {\n  readonly connectorSlug: string;\n  readonly metadata: ZeroConnectorCatalogPermissionDetail | null;\n  readonly resolvedPolicies: FirewallPolicies | null;\n}): ConnectorPermissionInfo {\n  if (!args.metadata) {\n    return {\n      connectorSlug: args.connectorSlug,\n      hasPermissions: false,\n      hasPolicyEntry: false,\n      permissions: [],\n      policies: null,\n      unknownPolicy: \"allow\",\n      allowed: 0,\n      total: 0,\n    };\n  }\n\n  const connectorPolicy = args.resolvedPolicies?.[args.metadata.connectorSlug];\n  const policies =\n    connectorPolicy && Object.keys(connectorPolicy.policies).length > 0\n      ? connectorPolicy.policies\n      : null;\n  const total = args.metadata.permissions.length;\n  const allowed = policies\n    ? args.metadata.permissions.filter((permission) => {\n        return policies[permission.name] === \"allow\";\n      }).length\n    : 0;\n\n  return {\n    connectorSlug: args.connectorSlug,\n    hasPermissions: true,\n    hasPolicyEntry: connectorPolicy !== undefined,\n    permissions: args.metadata.permissions,\n    policies,\n    unknownPolicy: connectorPolicy?.unknownPolicy ?? \"allow\",\n    allowed,\n    total,\n  };\n}\n\nexport async function loadConnectorPermissionInfos(args: {\n  readonly displayConnectorSlugs: readonly string[];\n  readonly defaultPolicyConnectorSlugs: readonly string[];\n  readonly storedPolicies: FirewallPolicies | null;\n}): Promise<ConnectorPermissionInfo[]> {\n  const metadataBySlug = await loadPermissionMetadataBySlug([\n    ...args.displayConnectorSlugs,\n    ...args.defaultPolicyConnectorSlugs,\n  ]);\n  const defaultPolicyMetadata = args.defaultPolicyConnectorSlugs.flatMap(\n    (connectorSlug) => {\n      const metadata = metadataBySlug.get(connectorSlug);\n      return metadata ? [metadata] : [];\n    },\n  );\n  const resolvedPolicies = resolveFirewallMetadataPolicies(\n    args.storedPolicies,\n    defaultPolicyMetadata,\n  );\n\n  return args.displayConnectorSlugs.map((connectorSlug) => {\n    return connectorPermissionInfo({\n      connectorSlug,\n      metadata: metadataBySlug.get(connectorSlug) ?? null,\n      resolvedPolicies,\n    });\n  });\n}\n\nexport function connectorPermissionGrantsToFirewallPolicies(\n  grants: readonly ZeroUserPermissionGrant[],\n): FirewallPolicies | null {\n  return permissionGrantsToFirewallPolicies(grants);\n}\n","import {\n  UNKNOWN_PERMISSION_GRANT,\n  type FirewallPolicies,\n  type FirewallPolicy,\n  type FirewallPolicyValue,\n} from \"../firewall-types\";\nimport { createFirewallMetadataPolicyResolver } from \"./policy-resolver\";\n\nexport type {\n  FirewallMetadataPolicyListState,\n  FirewallMetadataPolicyOverlay,\n  FirewallMetadataPolicyResolver,\n} from \"./policy-resolver\";\n\nexport interface FirewallPermissionPolicyMetadataPermission {\n  readonly name: string;\n  readonly description?: string;\n}\n\nexport interface FirewallPermissionPolicyCategoryMetadata {\n  readonly categories: Readonly<Record<string, string>>;\n  readonly displayOrder: readonly string[];\n}\n\nexport type FirewallPermissionPolicyDefaultOverrides = Readonly<\n  Partial<Record<FirewallPolicyValue, readonly string[]>>\n>;\n\nexport interface FirewallPermissionPolicyDefaultMetadata {\n  readonly permissionDefault: FirewallPolicyValue;\n  readonly permissionOverrides?: FirewallPermissionPolicyDefaultOverrides;\n  readonly unknownPolicy: FirewallPolicyValue;\n}\n\ninterface FirewallPermissionPolicyMetadataBase {\n  readonly label: string;\n  readonly permissionCount: number;\n  readonly permissions: readonly FirewallPermissionPolicyMetadataPermission[];\n  readonly categories?: FirewallPermissionPolicyCategoryMetadata | null;\n  readonly defaultPolicy: FirewallPermissionPolicyDefaultMetadata;\n}\n\nexport interface FirewallPermissionPolicyMetadata extends FirewallPermissionPolicyMetadataBase {\n  readonly connectorSlug: string;\n}\n\nexport interface FirewallMetadataPermissionGroup<T extends { name: string }> {\n  readonly category: string;\n  readonly permissions: T[];\n}\n\nexport type FirewallPermissionGrantAction = Extract<\n  FirewallPolicyValue,\n  \"allow\" | \"deny\"\n>;\n\nexport interface FirewallPermissionGrant {\n  readonly connectorSlug: string;\n  readonly permission: string;\n  readonly action: FirewallPermissionGrantAction;\n}\n\nexport { createFirewallMetadataPolicyResolver };\n\nexport function expandFirewallMetadataDefaultPolicy(\n  metadata: FirewallPermissionPolicyMetadata,\n): FirewallPolicy {\n  const resolver = createFirewallMetadataPolicyResolver(metadata);\n  const policies: Record<string, FirewallPolicyValue> = {};\n\n  for (const permission of metadata.permissions) {\n    policies[permission.name] = resolver.permission(permission.name);\n  }\n\n  return {\n    policies,\n    unknownPolicy: resolver.unknown(),\n  };\n}\n\nexport function findFirewallMetadataPermission(\n  metadata: FirewallPermissionPolicyMetadata,\n  name: string,\n): FirewallPermissionPolicyMetadata[\"permissions\"][number] | null {\n  return (\n    metadata.permissions.find((permission) => {\n      return permission.name === name;\n    }) ?? null\n  );\n}\n\nexport function groupFirewallMetadataPermissionsByCategory<\n  T extends { name: string },\n>(\n  permissions: readonly T[],\n  metadata: FirewallPermissionPolicyMetadata,\n): FirewallMetadataPermissionGroup<T>[] | null {\n  if (!metadata.categories) {\n    return null;\n  }\n\n  const grouped = new Map<string, T[]>();\n  for (const category of metadata.categories.displayOrder) {\n    grouped.set(category, []);\n  }\n\n  for (const permission of permissions) {\n    const category = metadata.categories.categories[permission.name];\n    if (!category) {\n      continue;\n    }\n    grouped.get(category)?.push(permission);\n  }\n\n  return [...grouped.entries()]\n    .filter(([, groupPermissions]) => {\n      return groupPermissions.length > 0;\n    })\n    .map(([category, groupPermissions]) => {\n      return { category, permissions: groupPermissions };\n    });\n}\n\nexport function resolveFirewallMetadataPolicies(\n  stored: FirewallPolicies | null,\n  metadata: readonly FirewallPermissionPolicyMetadata[],\n): FirewallPolicies | null {\n  let resolved: FirewallPolicies | null = stored;\n  for (const detail of metadata) {\n    const defaults = expandFirewallMetadataDefaultPolicy(detail);\n    const existing = resolved?.[detail.connectorSlug];\n    resolved = {\n      ...resolved,\n      [detail.connectorSlug]: {\n        policies: { ...defaults.policies, ...existing?.policies },\n        ...(existing?.unknownPolicy !== undefined\n          ? { unknownPolicy: existing.unknownPolicy }\n          : { unknownPolicy: defaults.unknownPolicy }),\n      },\n    };\n  }\n  return resolved;\n}\n\nexport function permissionGrantsToFirewallPolicies(\n  grants: readonly FirewallPermissionGrant[],\n): FirewallPolicies | null {\n  const policies: FirewallPolicies = {};\n  for (const grant of grants) {\n    const current = policies[grant.connectorSlug] ?? { policies: {} };\n    if (grant.permission === UNKNOWN_PERMISSION_GRANT) {\n      policies[grant.connectorSlug] = {\n        ...current,\n        unknownPolicy: grant.action,\n      };\n      continue;\n    }\n    current.policies[grant.permission] = grant.action;\n    policies[grant.connectorSlug] = current;\n  }\n  return Object.keys(policies).length > 0 ? policies : null;\n}\n","import type { FirewallPolicyValue } from \"../firewall-types\";\n\ninterface FirewallMetadataPolicyResolverMetadata {\n  readonly defaultPolicy: {\n    readonly permissionDefault: FirewallPolicyValue;\n    readonly permissionOverrides?: Readonly<\n      Partial<Record<FirewallPolicyValue, readonly string[]>>\n    >;\n    readonly unknownPolicy: FirewallPolicyValue;\n  };\n}\n\nexport interface FirewallMetadataPolicyOverlay {\n  readonly permissionDefault?: FirewallPolicyValue;\n  readonly permissionOverrides?: Readonly<Record<string, FirewallPolicyValue>>;\n  readonly unknownPolicy?: FirewallPolicyValue;\n}\n\nexport type FirewallMetadataPolicyListState = FirewallPolicyValue | \"mixed\";\n\n/**\n * Resolves generated metadata defaults with an optional sparse policy overlay.\n * Permission name validation belongs to callers; unknown endpoints use unknown().\n */\nexport interface FirewallMetadataPolicyResolver {\n  permission(name: string): FirewallPolicyValue;\n  unknown(): FirewallPolicyValue;\n  list(permissionNames: readonly string[]): FirewallMetadataPolicyListState;\n  isPermissionOverridden(name: string): boolean;\n  isUnknownOverridden(): boolean;\n}\n\nfunction buildMetadataOverrideLookup(\n  metadata: FirewallMetadataPolicyResolverMetadata,\n): ReadonlyMap<string, FirewallPolicyValue> {\n  const overrides = metadata.defaultPolicy.permissionOverrides;\n  const lookup = new Map<string, FirewallPolicyValue>();\n  if (!overrides) {\n    return lookup;\n  }\n\n  for (const permission of overrides.allow ?? []) {\n    lookup.set(permission, \"allow\");\n  }\n  for (const permission of overrides.deny ?? []) {\n    lookup.set(permission, \"deny\");\n  }\n  for (const permission of overrides.ask ?? []) {\n    lookup.set(permission, \"ask\");\n  }\n\n  return lookup;\n}\n\nfunction getOwnPermissionOverride(\n  overrides: Readonly<Record<string, FirewallPolicyValue>> | undefined,\n  name: string,\n): FirewallPolicyValue | undefined {\n  if (!overrides || !Object.prototype.hasOwnProperty.call(overrides, name)) {\n    return undefined;\n  }\n  return overrides[name];\n}\n\nexport function createFirewallMetadataPolicyResolver(\n  metadata: FirewallMetadataPolicyResolverMetadata,\n  overlay?: FirewallMetadataPolicyOverlay,\n): FirewallMetadataPolicyResolver {\n  const metadataOverrides = buildMetadataOverrideLookup(metadata);\n\n  function metadataPermission(name: string): FirewallPolicyValue {\n    return (\n      metadataOverrides.get(name) ?? metadata.defaultPolicy.permissionDefault\n    );\n  }\n\n  function permission(name: string): FirewallPolicyValue {\n    return (\n      getOwnPermissionOverride(overlay?.permissionOverrides, name) ??\n      overlay?.permissionDefault ??\n      metadataPermission(name)\n    );\n  }\n\n  return {\n    permission,\n    unknown: () => {\n      return overlay?.unknownPolicy ?? metadata.defaultPolicy.unknownPolicy;\n    },\n    list: (permissionNames) => {\n      let first: FirewallPolicyValue | null = null;\n      for (const name of permissionNames) {\n        const current = permission(name);\n        if (first === null) {\n          first = current;\n          continue;\n        }\n        if (first !== current) {\n          return \"mixed\";\n        }\n      }\n      return first ?? \"mixed\";\n    },\n    isPermissionOverridden: (name) => {\n      return permission(name) !== metadataPermission(name);\n    },\n    isUnknownOverridden: () => {\n      return (\n        (overlay?.unknownPolicy ?? metadata.defaultPolicy.unknownPolicy) !==\n        metadata.defaultPolicy.unknownPolicy\n      );\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA;AAGO,SAAS,WAAW,QAAqC;AAC9D,MAAI,WAAW,QAAS,QAAO,eAAM,MAAM,QAAG;AAC9C,MAAI,WAAW,MAAO,QAAO,eAAM,OAAO,GAAG;AAC7C,SAAO,eAAM,IAAI,QAAG;AACtB;;;ACPA;;;ACAA;;;ACAA;AAgCA,SAAS,4BACP,UAC0C;AAC1C,QAAM,YAAY,SAAS,cAAc;AACzC,QAAM,SAAS,oBAAI,IAAiC;AACpD,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAEA,aAAW,cAAc,UAAU,SAAS,CAAC,GAAG;AAC9C,WAAO,IAAI,YAAY,OAAO;AAAA,EAChC;AACA,aAAW,cAAc,UAAU,QAAQ,CAAC,GAAG;AAC7C,WAAO,IAAI,YAAY,MAAM;AAAA,EAC/B;AACA,aAAW,cAAc,UAAU,OAAO,CAAC,GAAG;AAC5C,WAAO,IAAI,YAAY,KAAK;AAAA,EAC9B;AAEA,SAAO;AACT;AAEA,SAAS,yBACP,WACA,MACiC;AACjC,MAAI,CAAC,aAAa,CAAC,OAAO,UAAU,eAAe,KAAK,WAAW,IAAI,GAAG;AACxE,WAAO;AAAA,EACT;AACA,SAAO,UAAU,IAAI;AACvB;AAEO,SAAS,qCACd,UACA,SACgC;AAChC,QAAM,oBAAoB,4BAA4B,QAAQ;AAE9D,WAAS,mBAAmB,MAAmC;AAC7D,WACE,kBAAkB,IAAI,IAAI,KAAK,SAAS,cAAc;AAAA,EAE1D;AAEA,WAAS,WAAW,MAAmC;AACrD,WACE,yBAAyB,SAAS,qBAAqB,IAAI,KAC3D,SAAS,qBACT,mBAAmB,IAAI;AAAA,EAE3B;AAEA,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM;AACb,aAAO,SAAS,iBAAiB,SAAS,cAAc;AAAA,IAC1D;AAAA,IACA,MAAM,CAAC,oBAAoB;AACzB,UAAI,QAAoC;AACxC,iBAAW,QAAQ,iBAAiB;AAClC,cAAM,UAAU,WAAW,IAAI;AAC/B,YAAI,UAAU,MAAM;AAClB,kBAAQ;AACR;AAAA,QACF;AACA,YAAI,UAAU,SAAS;AACrB,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,SAAS;AAAA,IAClB;AAAA,IACA,wBAAwB,CAAC,SAAS;AAChC,aAAO,WAAW,IAAI,MAAM,mBAAmB,IAAI;AAAA,IACrD;AAAA,IACA,qBAAqB,MAAM;AACzB,cACG,SAAS,iBAAiB,SAAS,cAAc,mBAClD,SAAS,cAAc;AAAA,IAE3B;AAAA,EACF;AACF;;;ADjDO,SAAS,oCACd,UACgB;AAChB,QAAM,WAAW,qCAAqC,QAAQ;AAC9D,QAAM,WAAgD,CAAC;AAEvD,aAAW,cAAc,SAAS,aAAa;AAC7C,aAAS,WAAW,IAAI,IAAI,SAAS,WAAW,WAAW,IAAI;AAAA,EACjE;AAEA,SAAO;AAAA,IACL;AAAA,IACA,eAAe,SAAS,QAAQ;AAAA,EAClC;AACF;AA6CO,SAAS,gCACd,QACA,UACyB;AACzB,MAAI,WAAoC;AACxC,aAAW,UAAU,UAAU;AAC7B,UAAM,WAAW,oCAAoC,MAAM;AAC3D,UAAM,WAAW,WAAW,OAAO,aAAa;AAChD,eAAW;AAAA,MACT,GAAG;AAAA,MACH,CAAC,OAAO,aAAa,GAAG;AAAA,QACtB,UAAU,EAAE,GAAG,SAAS,UAAU,GAAG,UAAU,SAAS;AAAA,QACxD,GAAI,UAAU,kBAAkB,SAC5B,EAAE,eAAe,SAAS,cAAc,IACxC,EAAE,eAAe,SAAS,cAAc;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mCACd,QACyB;AACzB,QAAM,WAA6B,CAAC;AACpC,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,EAAE,UAAU,CAAC,EAAE;AAChE,QAAI,MAAM,eAAe,0BAA0B;AACjD,eAAS,MAAM,aAAa,IAAI;AAAA,QAC9B,GAAG;AAAA,QACH,eAAe,MAAM;AAAA,MACvB;AACA;AAAA,IACF;AACA,YAAQ,SAAS,MAAM,UAAU,IAAI,MAAM;AAC3C,aAAS,MAAM,aAAa,IAAI;AAAA,EAClC;AACA,SAAO,OAAO,KAAK,QAAQ,EAAE,SAAS,IAAI,WAAW;AACvD;;;ADrIA,eAAe,6BACb,gBACmC;AACnC,QAAM,uBAAuB,CAAC,GAAG,IAAI,IAAI,cAAc,CAAC;AACxD,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,qBAAqB,IAAI,OAAO,kBAAkB;AAChD,aAAO;AAAA,QACL;AAAA,QACA,MAAM,mCAAmC,aAAa;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,IAAI,IAAI,OAAO;AACxB;AAEA,SAAS,wBAAwB,MAIL;AAC1B,MAAI,CAAC,KAAK,UAAU;AAClB,WAAO;AAAA,MACL,eAAe,KAAK;AAAA,MACpB,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,MAChB,aAAa,CAAC;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,MACf,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,kBAAkB,KAAK,mBAAmB,KAAK,SAAS,aAAa;AAC3E,QAAM,WACJ,mBAAmB,OAAO,KAAK,gBAAgB,QAAQ,EAAE,SAAS,IAC9D,gBAAgB,WAChB;AACN,QAAM,QAAQ,KAAK,SAAS,YAAY;AACxC,QAAM,UAAU,WACZ,KAAK,SAAS,YAAY,OAAO,CAAC,eAAe;AAC/C,WAAO,SAAS,WAAW,IAAI,MAAM;AAAA,EACvC,CAAC,EAAE,SACH;AAEJ,SAAO;AAAA,IACL,eAAe,KAAK;AAAA,IACpB,gBAAgB;AAAA,IAChB,gBAAgB,oBAAoB;AAAA,IACpC,aAAa,KAAK,SAAS;AAAA,IAC3B;AAAA,IACA,eAAe,iBAAiB,iBAAiB;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,6BAA6B,MAIZ;AACrC,QAAM,iBAAiB,MAAM,6BAA6B;AAAA,IACxD,GAAG,KAAK;AAAA,IACR,GAAG,KAAK;AAAA,EACV,CAAC;AACD,QAAM,wBAAwB,KAAK,4BAA4B;AAAA,IAC7D,CAAC,kBAAkB;AACjB,YAAM,WAAW,eAAe,IAAI,aAAa;AACjD,aAAO,WAAW,CAAC,QAAQ,IAAI,CAAC;AAAA,IAClC;AAAA,EACF;AACA,QAAM,mBAAmB;AAAA,IACvB,KAAK;AAAA,IACL;AAAA,EACF;AAEA,SAAO,KAAK,sBAAsB,IAAI,CAAC,kBAAkB;AACvD,WAAO,wBAAwB;AAAA,MAC7B;AAAA,MACA,UAAU,eAAe,IAAI,aAAa,KAAK;AAAA,MAC/C;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAEO,SAAS,4CACd,QACyB;AACzB,SAAO,mCAAmC,MAAM;AAClD;","names":[]}
+{"version":3,"sources":["../src/lib/utils/format-utils.ts","../src/commands/zero/shared/firewall-permissions.ts","../../../packages/connectors/src/firewall-metadata/policy.ts","../../../packages/connectors/src/firewall-metadata/policy-resolver.ts"],"sourcesContent":["import chalk from \"chalk\";\nimport type { FirewallPolicyValue } from \"@vm0/connectors/firewall-types\";\n\nexport function policyIcon(policy: FirewallPolicyValue): string {\n  if (policy === \"allow\") return chalk.green(\"✓\");\n  if (policy === \"ask\") return chalk.yellow(\"?\");\n  return chalk.dim(\"✗\");\n}\n","import {\n  permissionGrantsToFirewallPolicies,\n  resolveFirewallMetadataPolicies,\n} from \"@vm0/connectors/firewall-metadata/policy\";\nimport type {\n  FirewallPolicies,\n  FirewallPolicyValue,\n} from \"@vm0/connectors/firewall-types\";\nimport { getZeroConnectorCatalogPermissions } from \"../../../lib/api\";\nimport type { ZeroUserPermissionGrant } from \"../../../lib/api/domains/zero-agents\";\nimport type { ZeroConnectorCatalogPermissionDetail } from \"../../../lib/api/domains/zero-connectors\";\n\nexport interface ConnectorPermissionInfo {\n  readonly connectorSlug: string;\n  readonly hasPermissions: boolean;\n  readonly hasPolicyEntry: boolean;\n  readonly permissions: readonly ZeroConnectorCatalogPermissionDetail[\"permissions\"][number][];\n  readonly policies: Readonly<Record<string, FirewallPolicyValue>> | null;\n  readonly unknownPolicy: FirewallPolicyValue;\n  readonly allowed: number;\n  readonly total: number;\n}\n\ntype PermissionMetadataBySlug = Map<\n  string,\n  ZeroConnectorCatalogPermissionDetail | null\n>;\n\nasync function loadPermissionMetadataBySlug(\n  connectorSlugs: readonly string[],\n): Promise<PermissionMetadataBySlug> {\n  const uniqueConnectorSlugs = [...new Set(connectorSlugs)];\n  const entries = await Promise.all(\n    uniqueConnectorSlugs.map(async (connectorSlug) => {\n      return [\n        connectorSlug,\n        await getZeroConnectorCatalogPermissions(connectorSlug),\n      ] as const;\n    }),\n  );\n  return new Map(entries);\n}\n\nfunction connectorPermissionInfo(args: {\n  readonly connectorSlug: string;\n  readonly metadata: ZeroConnectorCatalogPermissionDetail | null;\n  readonly resolvedPolicies: FirewallPolicies | null;\n}): ConnectorPermissionInfo {\n  if (!args.metadata) {\n    return {\n      connectorSlug: args.connectorSlug,\n      hasPermissions: false,\n      hasPolicyEntry: false,\n      permissions: [],\n      policies: null,\n      unknownPolicy: \"allow\",\n      allowed: 0,\n      total: 0,\n    };\n  }\n\n  const connectorPolicy = args.resolvedPolicies?.[args.metadata.connectorSlug];\n  const policies =\n    connectorPolicy && Object.keys(connectorPolicy.policies).length > 0\n      ? connectorPolicy.policies\n      : null;\n  const total = args.metadata.permissions.length;\n  const allowed = policies\n    ? args.metadata.permissions.filter((permission) => {\n        return policies[permission.name] === \"allow\";\n      }).length\n    : 0;\n\n  return {\n    connectorSlug: args.connectorSlug,\n    hasPermissions: true,\n    hasPolicyEntry: connectorPolicy !== undefined,\n    permissions: args.metadata.permissions,\n    policies,\n    unknownPolicy: connectorPolicy?.unknownPolicy ?? \"allow\",\n    allowed,\n    total,\n  };\n}\n\nexport async function loadConnectorPermissionInfos(args: {\n  readonly displayConnectorSlugs: readonly string[];\n  readonly defaultPolicyConnectorSlugs: readonly string[];\n  readonly storedPolicies: FirewallPolicies | null;\n}): Promise<ConnectorPermissionInfo[]> {\n  const metadataBySlug = await loadPermissionMetadataBySlug([\n    ...args.displayConnectorSlugs,\n    ...args.defaultPolicyConnectorSlugs,\n  ]);\n  const defaultPolicyMetadata = args.defaultPolicyConnectorSlugs.flatMap(\n    (connectorSlug) => {\n      const metadata = metadataBySlug.get(connectorSlug);\n      return metadata ? [metadata] : [];\n    },\n  );\n  const resolvedPolicies = resolveFirewallMetadataPolicies(\n    args.storedPolicies,\n    defaultPolicyMetadata,\n  );\n\n  return args.displayConnectorSlugs.map((connectorSlug) => {\n    return connectorPermissionInfo({\n      connectorSlug,\n      metadata: metadataBySlug.get(connectorSlug) ?? null,\n      resolvedPolicies,\n    });\n  });\n}\n\nexport function connectorPermissionGrantsToFirewallPolicies(\n  grants: readonly ZeroUserPermissionGrant[],\n): FirewallPolicies | null {\n  return permissionGrantsToFirewallPolicies(grants);\n}\n","import {\n  UNKNOWN_PERMISSION_GRANT,\n  type FirewallPolicies,\n  type FirewallPolicy,\n  type FirewallPolicyValue,\n} from \"../firewall-types\";\nimport { createFirewallMetadataPolicyResolver } from \"./policy-resolver\";\n\nexport type {\n  FirewallMetadataPolicyListState,\n  FirewallMetadataPolicyOverlay,\n  FirewallMetadataPolicyResolver,\n} from \"./policy-resolver\";\n\nexport interface FirewallPermissionPolicyMetadataPermission {\n  readonly name: string;\n  readonly description?: string;\n}\n\nexport interface FirewallPermissionPolicyCategoryMetadata {\n  readonly categories: Readonly<Record<string, string>>;\n  readonly displayOrder: readonly string[];\n}\n\nexport type FirewallPermissionPolicyDefaultOverrides = Readonly<\n  Partial<Record<FirewallPolicyValue, readonly string[]>>\n>;\n\nexport interface FirewallPermissionPolicyDefaultMetadata {\n  readonly permissionDefault: FirewallPolicyValue;\n  readonly permissionOverrides?: FirewallPermissionPolicyDefaultOverrides;\n  readonly unknownPolicy: FirewallPolicyValue;\n}\n\ninterface FirewallPermissionPolicyMetadataBase {\n  readonly label: string;\n  readonly permissionCount: number;\n  readonly permissions: readonly FirewallPermissionPolicyMetadataPermission[];\n  readonly categories?: FirewallPermissionPolicyCategoryMetadata | null;\n  readonly defaultPolicy: FirewallPermissionPolicyDefaultMetadata;\n}\n\nexport interface FirewallPermissionPolicyMetadata extends FirewallPermissionPolicyMetadataBase {\n  readonly connectorSlug: string;\n}\n\nexport interface FirewallMetadataPermissionGroup<T extends { name: string }> {\n  readonly category: string;\n  readonly permissions: T[];\n}\n\nexport type FirewallPermissionGrantAction = Extract<\n  FirewallPolicyValue,\n  \"allow\" | \"deny\"\n>;\n\nexport interface FirewallPermissionGrant {\n  readonly connectorSlug: string;\n  readonly permission: string;\n  readonly action: FirewallPermissionGrantAction;\n}\n\nexport { createFirewallMetadataPolicyResolver };\n\nexport function expandFirewallMetadataDefaultPolicy(\n  metadata: FirewallPermissionPolicyMetadata,\n): FirewallPolicy {\n  const resolver = createFirewallMetadataPolicyResolver(metadata);\n  const policies: Record<string, FirewallPolicyValue> = {};\n\n  for (const permission of metadata.permissions) {\n    policies[permission.name] = resolver.permission(permission.name);\n  }\n\n  return {\n    policies,\n    unknownPolicy: resolver.unknown(),\n  };\n}\n\nexport function findFirewallMetadataPermission(\n  metadata: FirewallPermissionPolicyMetadata,\n  name: string,\n): FirewallPermissionPolicyMetadata[\"permissions\"][number] | null {\n  return (\n    metadata.permissions.find((permission) => {\n      return permission.name === name;\n    }) ?? null\n  );\n}\n\nexport function groupFirewallMetadataPermissionsByCategory<\n  T extends { name: string },\n>(\n  permissions: readonly T[],\n  metadata: FirewallPermissionPolicyMetadata,\n): FirewallMetadataPermissionGroup<T>[] | null {\n  if (!metadata.categories) {\n    return null;\n  }\n\n  const grouped = new Map<string, T[]>();\n  for (const category of metadata.categories.displayOrder) {\n    grouped.set(category, []);\n  }\n\n  for (const permission of permissions) {\n    const category = metadata.categories.categories[permission.name];\n    if (!category) {\n      continue;\n    }\n    grouped.get(category)?.push(permission);\n  }\n\n  return [...grouped.entries()]\n    .filter(([, groupPermissions]) => {\n      return groupPermissions.length > 0;\n    })\n    .map(([category, groupPermissions]) => {\n      return { category, permissions: groupPermissions };\n    });\n}\n\nexport function resolveFirewallMetadataPolicies(\n  stored: FirewallPolicies | null,\n  metadata: readonly FirewallPermissionPolicyMetadata[],\n): FirewallPolicies | null {\n  let resolved: FirewallPolicies | null = stored;\n  for (const detail of metadata) {\n    const defaults = expandFirewallMetadataDefaultPolicy(detail);\n    const existing = resolved?.[detail.connectorSlug];\n    resolved = {\n      ...resolved,\n      [detail.connectorSlug]: {\n        policies: { ...defaults.policies, ...existing?.policies },\n        ...(existing?.unknownPolicy !== undefined\n          ? { unknownPolicy: existing.unknownPolicy }\n          : { unknownPolicy: defaults.unknownPolicy }),\n      },\n    };\n  }\n  return resolved;\n}\n\nexport function permissionGrantsToFirewallPolicies(\n  grants: readonly FirewallPermissionGrant[],\n): FirewallPolicies | null {\n  const policies: FirewallPolicies = {};\n  for (const grant of grants) {\n    const current = policies[grant.connectorSlug] ?? { policies: {} };\n    if (grant.permission === UNKNOWN_PERMISSION_GRANT) {\n      policies[grant.connectorSlug] = {\n        ...current,\n        unknownPolicy: grant.action,\n      };\n      continue;\n    }\n    current.policies[grant.permission] = grant.action;\n    policies[grant.connectorSlug] = current;\n  }\n  return Object.keys(policies).length > 0 ? policies : null;\n}\n","import type { FirewallPolicyValue } from \"../firewall-types\";\n\ninterface FirewallMetadataPolicyResolverMetadata {\n  readonly defaultPolicy: {\n    readonly permissionDefault: FirewallPolicyValue;\n    readonly permissionOverrides?: Readonly<\n      Partial<Record<FirewallPolicyValue, readonly string[]>>\n    >;\n    readonly unknownPolicy: FirewallPolicyValue;\n  };\n}\n\nexport interface FirewallMetadataPolicyOverlay {\n  readonly permissionDefault?: FirewallPolicyValue;\n  readonly permissionOverrides?: Readonly<Record<string, FirewallPolicyValue>>;\n  readonly unknownPolicy?: FirewallPolicyValue;\n}\n\nexport type FirewallMetadataPolicyListState = FirewallPolicyValue | \"mixed\";\n\n/**\n * Resolves generated metadata defaults with an optional sparse policy overlay.\n * Permission name validation belongs to callers; unknown endpoints use unknown().\n */\nexport interface FirewallMetadataPolicyResolver {\n  permission(name: string): FirewallPolicyValue;\n  unknown(): FirewallPolicyValue;\n  list(permissionNames: readonly string[]): FirewallMetadataPolicyListState;\n  isPermissionOverridden(name: string): boolean;\n  isUnknownOverridden(): boolean;\n}\n\nfunction buildMetadataOverrideLookup(\n  metadata: FirewallMetadataPolicyResolverMetadata,\n): ReadonlyMap<string, FirewallPolicyValue> {\n  const overrides = metadata.defaultPolicy.permissionOverrides;\n  const lookup = new Map<string, FirewallPolicyValue>();\n  if (!overrides) {\n    return lookup;\n  }\n\n  for (const permission of overrides.allow ?? []) {\n    lookup.set(permission, \"allow\");\n  }\n  for (const permission of overrides.deny ?? []) {\n    lookup.set(permission, \"deny\");\n  }\n  for (const permission of overrides.ask ?? []) {\n    lookup.set(permission, \"ask\");\n  }\n\n  return lookup;\n}\n\nfunction getOwnPermissionOverride(\n  overrides: Readonly<Record<string, FirewallPolicyValue>> | undefined,\n  name: string,\n): FirewallPolicyValue | undefined {\n  if (!overrides || !Object.prototype.hasOwnProperty.call(overrides, name)) {\n    return undefined;\n  }\n  return overrides[name];\n}\n\nexport function createFirewallMetadataPolicyResolver(\n  metadata: FirewallMetadataPolicyResolverMetadata,\n  overlay?: FirewallMetadataPolicyOverlay,\n): FirewallMetadataPolicyResolver {\n  const metadataOverrides = buildMetadataOverrideLookup(metadata);\n\n  function metadataPermission(name: string): FirewallPolicyValue {\n    return (\n      metadataOverrides.get(name) ?? metadata.defaultPolicy.permissionDefault\n    );\n  }\n\n  function permission(name: string): FirewallPolicyValue {\n    return (\n      getOwnPermissionOverride(overlay?.permissionOverrides, name) ??\n      overlay?.permissionDefault ??\n      metadataPermission(name)\n    );\n  }\n\n  return {\n    permission,\n    unknown: () => {\n      return overlay?.unknownPolicy ?? metadata.defaultPolicy.unknownPolicy;\n    },\n    list: (permissionNames) => {\n      let first: FirewallPolicyValue | null = null;\n      for (const name of permissionNames) {\n        const current = permission(name);\n        if (first === null) {\n          first = current;\n          continue;\n        }\n        if (first !== current) {\n          return \"mixed\";\n        }\n      }\n      return first ?? \"mixed\";\n    },\n    isPermissionOverridden: (name) => {\n      return permission(name) !== metadataPermission(name);\n    },\n    isUnknownOverridden: () => {\n      return (\n        (overlay?.unknownPolicy ?? metadata.defaultPolicy.unknownPolicy) !==\n        metadata.defaultPolicy.unknownPolicy\n      );\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA;AAGO,SAAS,WAAW,QAAqC;AAC9D,MAAI,WAAW,QAAS,QAAO,eAAM,MAAM,QAAG;AAC9C,MAAI,WAAW,MAAO,QAAO,eAAM,OAAO,GAAG;AAC7C,SAAO,eAAM,IAAI,QAAG;AACtB;;;ACPA;;;ACAA;;;ACAA;AAgCA,SAAS,4BACP,UAC0C;AAC1C,QAAM,YAAY,SAAS,cAAc;AACzC,QAAM,SAAS,oBAAI,IAAiC;AACpD,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAEA,aAAW,cAAc,UAAU,SAAS,CAAC,GAAG;AAC9C,WAAO,IAAI,YAAY,OAAO;AAAA,EAChC;AACA,aAAW,cAAc,UAAU,QAAQ,CAAC,GAAG;AAC7C,WAAO,IAAI,YAAY,MAAM;AAAA,EAC/B;AACA,aAAW,cAAc,UAAU,OAAO,CAAC,GAAG;AAC5C,WAAO,IAAI,YAAY,KAAK;AAAA,EAC9B;AAEA,SAAO;AACT;AAEA,SAAS,yBACP,WACA,MACiC;AACjC,MAAI,CAAC,aAAa,CAAC,OAAO,UAAU,eAAe,KAAK,WAAW,IAAI,GAAG;AACxE,WAAO;AAAA,EACT;AACA,SAAO,UAAU,IAAI;AACvB;AAEO,SAAS,qCACd,UACA,SACgC;AAChC,QAAM,oBAAoB,4BAA4B,QAAQ;AAE9D,WAAS,mBAAmB,MAAmC;AAC7D,WACE,kBAAkB,IAAI,IAAI,KAAK,SAAS,cAAc;AAAA,EAE1D;AAEA,WAAS,WAAW,MAAmC;AACrD,WACE,yBAAyB,SAAS,qBAAqB,IAAI,KAC3D,SAAS,qBACT,mBAAmB,IAAI;AAAA,EAE3B;AAEA,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM;AACb,aAAO,SAAS,iBAAiB,SAAS,cAAc;AAAA,IAC1D;AAAA,IACA,MAAM,CAAC,oBAAoB;AACzB,UAAI,QAAoC;AACxC,iBAAW,QAAQ,iBAAiB;AAClC,cAAM,UAAU,WAAW,IAAI;AAC/B,YAAI,UAAU,MAAM;AAClB,kBAAQ;AACR;AAAA,QACF;AACA,YAAI,UAAU,SAAS;AACrB,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,SAAS;AAAA,IAClB;AAAA,IACA,wBAAwB,CAAC,SAAS;AAChC,aAAO,WAAW,IAAI,MAAM,mBAAmB,IAAI;AAAA,IACrD;AAAA,IACA,qBAAqB,MAAM;AACzB,cACG,SAAS,iBAAiB,SAAS,cAAc,mBAClD,SAAS,cAAc;AAAA,IAE3B;AAAA,EACF;AACF;;;ADjDO,SAAS,oCACd,UACgB;AAChB,QAAM,WAAW,qCAAqC,QAAQ;AAC9D,QAAM,WAAgD,CAAC;AAEvD,aAAW,cAAc,SAAS,aAAa;AAC7C,aAAS,WAAW,IAAI,IAAI,SAAS,WAAW,WAAW,IAAI;AAAA,EACjE;AAEA,SAAO;AAAA,IACL;AAAA,IACA,eAAe,SAAS,QAAQ;AAAA,EAClC;AACF;AA6CO,SAAS,gCACd,QACA,UACyB;AACzB,MAAI,WAAoC;AACxC,aAAW,UAAU,UAAU;AAC7B,UAAM,WAAW,oCAAoC,MAAM;AAC3D,UAAM,WAAW,WAAW,OAAO,aAAa;AAChD,eAAW;AAAA,MACT,GAAG;AAAA,MACH,CAAC,OAAO,aAAa,GAAG;AAAA,QACtB,UAAU,EAAE,GAAG,SAAS,UAAU,GAAG,UAAU,SAAS;AAAA,QACxD,GAAI,UAAU,kBAAkB,SAC5B,EAAE,eAAe,SAAS,cAAc,IACxC,EAAE,eAAe,SAAS,cAAc;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mCACd,QACyB;AACzB,QAAM,WAA6B,CAAC;AACpC,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,EAAE,UAAU,CAAC,EAAE;AAChE,QAAI,MAAM,eAAe,0BAA0B;AACjD,eAAS,MAAM,aAAa,IAAI;AAAA,QAC9B,GAAG;AAAA,QACH,eAAe,MAAM;AAAA,MACvB;AACA;AAAA,IACF;AACA,YAAQ,SAAS,MAAM,UAAU,IAAI,MAAM;AAC3C,aAAS,MAAM,aAAa,IAAI;AAAA,EAClC;AACA,SAAO,OAAO,KAAK,QAAQ,EAAE,SAAS,IAAI,WAAW;AACvD;;;ADrIA,eAAe,6BACb,gBACmC;AACnC,QAAM,uBAAuB,CAAC,GAAG,IAAI,IAAI,cAAc,CAAC;AACxD,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,qBAAqB,IAAI,OAAO,kBAAkB;AAChD,aAAO;AAAA,QACL;AAAA,QACA,MAAM,mCAAmC,aAAa;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,IAAI,IAAI,OAAO;AACxB;AAEA,SAAS,wBAAwB,MAIL;AAC1B,MAAI,CAAC,KAAK,UAAU;AAClB,WAAO;AAAA,MACL,eAAe,KAAK;AAAA,MACpB,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,MAChB,aAAa,CAAC;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,MACf,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,kBAAkB,KAAK,mBAAmB,KAAK,SAAS,aAAa;AAC3E,QAAM,WACJ,mBAAmB,OAAO,KAAK,gBAAgB,QAAQ,EAAE,SAAS,IAC9D,gBAAgB,WAChB;AACN,QAAM,QAAQ,KAAK,SAAS,YAAY;AACxC,QAAM,UAAU,WACZ,KAAK,SAAS,YAAY,OAAO,CAAC,eAAe;AAC/C,WAAO,SAAS,WAAW,IAAI,MAAM;AAAA,EACvC,CAAC,EAAE,SACH;AAEJ,SAAO;AAAA,IACL,eAAe,KAAK;AAAA,IACpB,gBAAgB;AAAA,IAChB,gBAAgB,oBAAoB;AAAA,IACpC,aAAa,KAAK,SAAS;AAAA,IAC3B;AAAA,IACA,eAAe,iBAAiB,iBAAiB;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,6BAA6B,MAIZ;AACrC,QAAM,iBAAiB,MAAM,6BAA6B;AAAA,IACxD,GAAG,KAAK;AAAA,IACR,GAAG,KAAK;AAAA,EACV,CAAC;AACD,QAAM,wBAAwB,KAAK,4BAA4B;AAAA,IAC7D,CAAC,kBAAkB;AACjB,YAAM,WAAW,eAAe,IAAI,aAAa;AACjD,aAAO,WAAW,CAAC,QAAQ,IAAI,CAAC;AAAA,IAClC;AAAA,EACF;AACA,QAAM,mBAAmB;AAAA,IACvB,KAAK;AAAA,IACL;AAAA,EACF;AAEA,SAAO,KAAK,sBAAsB,IAAI,CAAC,kBAAkB;AACvD,WAAO,wBAAwB;AAAA,MAC7B;AAAA,MACA,UAAU,eAAe,IAAI,aAAa,KAAK;AAAA,MAC/C;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAEO,SAAS,4CACd,QACyB;AACzB,SAAO,mCAAmC,MAAM;AAClD;","names":[]}

package/{chunk-7L3QU2TW.js → chunk-WVWTGU3D.js}

@@ -3,7 +3,7 @@ import { createRequire as __createRequire } from "node:module";
 const require = __createRequire(import.meta.url);
 import {
   MODEL_PROVIDER_TYPES
-} from "./chunk-BINP2SIK.js";
+} from "./chunk-NUK6BSMQ.js";
 import {
   init_esm_shims
 } from "./chunk-AUWSMG4F.js";
@@ -40,4 +40,4 @@ export {
   formatModelProviderRoute,
   formatModelPolicyStatus
 };
-//# sourceMappingURL=chunk-7L3QU2TW.js.map
+//# sourceMappingURL=chunk-WVWTGU3D.js.map