@vm0/cli 9.278.0 → 9.279.0

package/{chunk-A6TMOGPR.js → chunk-TQKKFLRI.js}

@@ -5,32 +5,63 @@ import {
   formatIsoTimestamp,
   isUuid,
   parseBoundedLogCount
-} from "./chunk-VNNPAHD3.js";
+} from "./chunk-UH7XK55U.js";
 import {
   listVideoTemplates
-} from "./chunk-NKYACNWA.js";
+} from "./chunk-DUWZNPUA.js";
 import {
-  connectorCatalogDiagnosticsSchema,
+  zeroAgentVisibilitySchema
+} from "./chunk-JXWXVXOW.js";
+import {
+  connectorCatalogDiagnosticsSchema
+} from "./chunk-HXIDRGW4.js";
+import {
+  agentEventsResponseSchema,
+  cancelRunResponseSchema,
+  createLogPaginationQuerySchema,
   createRunResponseSchema,
+  eventSequenceNumberSchema,
+  getRunResponseSchema,
+  logsListContract,
+  logsSearchQuerySchema,
+  logsSearchResponseSchema,
+  metricsResponseSchema,
+  networkLogEntrySchema,
+  networkLogsResponseSchema,
+  queueResponseSchema,
+  systemLogResponseSchema,
+  unifiedRunRequestSchema
+} from "./chunk-C4LKBBIS.js";
+import {
+  RESUME_SESSION_HISTORY_MAX_BYTES,
+  artifactMissingRootPolicySchema,
+  executionFirewallBuiltinEntrySchema,
+  firewallsSchema,
+  networkPoliciesSchema,
+  secretConnectorMetadataMapSchema,
+  sessionHistoryDownloadSourceSchema,
+  sessionHistoryEncodingSchema,
+  sessionHistorySizeBucketSchema,
+  zeroBuiltInGenerationAcceptedResponseSchema
+} from "./chunk-CMWQJ3XO.js";
+import {
   inviteOrgMemberRequestSchema,
   membershipRequestActionSchema,
   orgMembersResponseSchema,
   orgMessageResponseSchema,
   removeOrgMemberRequestSchema,
   revokeInvitationRequestSchema,
-  searchZeroLogs,
-  unifiedRunRequestSchema,
-  updateOrgMemberRoleRequestSchema,
-  zeroAgentVisibilitySchema
-} from "./chunk-6PN6QGIM.js";
+  updateOrgMemberRoleRequestSchema
+} from "./chunk-5RY3DZTW.js";
 import {
-  authHeadersSchema,
-  firewallsSchema,
-  zeroBuiltInGenerationAcceptedResponseSchema
-} from "./chunk-V7A6ZFHR.js";
+  authHeadersSchema
+} from "./chunk-NIG6LRRX.js";
 import {
   apiErrorSchema,
   external_exports,
+  getClientConfig,
+  handleError,
+  initClient,
   initContract,
   modelProviderListResponseSchema,
   modelProviderResponseSchema,
@@ -40,16 +71,16 @@ import {
   upsertModelProviderRequestSchema,
   upsertModelProviderResponseSchema,
   withErrorHandler
-} from "./chunk-5ZZI2LSO.js";
+} from "./chunk-U2PPHCTL.js";
 import {
   Command
-} from "./chunk-JAUTPXVK.js";
+} from "./chunk-PAULHBEP.js";
 import {
   __commonJS,
   __require,
   __toESM,
   init_esm_shims
-} from "./chunk-AUWSMG4F.js";
+} from "./chunk-52CNCL6Y.js";
 
 // ../../node_modules/.pnpm/yaml@2.8.3/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS({
@@ -734,9 +765,9 @@ var require_Alias = __commonJS({
       } else if (identity.isCollection(node)) {
         let count = 0;
         for (const item of node.items) {
-          const c84 = getAliasCount(doc, item, anchors2);
-          if (c84 > count)
-            count = c84;
+          const c86 = getAliasCount(doc, item, anchors2);
+          if (c86 > count)
+            count = c86;
         }
         return count;
       } else if (identity.isPair(node)) {
@@ -10843,6 +10874,48 @@ var zeroUserModelPreferenceContract = c7.router({
   }
 });
 
+// ../../packages/api-contracts/src/contracts/storages.ts
+init_esm_shims();
+var MAX_FILE_SIZE_BYTES = 104857600;
+var STORAGE_MANIFEST_MAX_FILES = 5e4;
+var STORAGE_MANIFEST_MAX_PATH_BYTES = 8 * 1024 * 1024;
+var fileEntryWithHashSchema = external_exports.object({
+  path: external_exports.string().min(1, "File path is required"),
+  hash: external_exports.string().length(64, "Hash must be SHA-256 (64 hex chars)"),
+  size: external_exports.number().int().min(0, "Size must be non-negative").max(MAX_FILE_SIZE_BYTES, "File size exceeds 100MB limit")
+});
+var storageManifestPathEncoder = new TextEncoder();
+var storageManifestFilesSchema = external_exports.array(fileEntryWithHashSchema).max(
+  STORAGE_MANIFEST_MAX_FILES,
+  `Storage manifest exceeds ${STORAGE_MANIFEST_MAX_FILES} files`
+).refine(
+  (files) => {
+    if (files.length > STORAGE_MANIFEST_MAX_FILES) {
+      return true;
+    }
+    let pathBytes = 0;
+    for (const file of files) {
+      pathBytes += storageManifestPathEncoder.encode(file.path).byteLength;
+      if (pathBytes > STORAGE_MANIFEST_MAX_PATH_BYTES) {
+        return false;
+      }
+    }
+    return true;
+  },
+  {
+    message: `Storage manifest paths exceed ${STORAGE_MANIFEST_MAX_PATH_BYTES} UTF-8 bytes`
+  }
+);
+var storageChangesSchema = external_exports.object({
+  added: external_exports.array(external_exports.string()),
+  modified: external_exports.array(external_exports.string()),
+  deleted: external_exports.array(external_exports.string())
+});
+var presignedUploadSchema = external_exports.object({
+  key: external_exports.string(),
+  presignedUrl: external_exports.url()
+});
+
 // ../../packages/api-contracts/src/contracts/presentation-images.ts
 init_esm_shims();
 var c8 = initContract();
@@ -10996,177 +11069,887 @@ var zeroEmailInboundContract = c10.router({
   }
 });
 
-// ../../packages/api-contracts/src/contracts/cli-auth.ts
+// ../../packages/api-contracts/src/contracts/webhooks.ts
 init_esm_shims();
 var c11 = initContract();
-var oauthErrorSchema = external_exports.object({
-  error: external_exports.string(),
-  error_description: external_exports.string()
+var sha256HexSchema = external_exports.string().regex(
+  /^[a-f0-9]{64}$/,
+  "hash must be a lowercase 64-character SHA-256 hex string"
+);
+var thirdPartyWebhookErrorSchema = external_exports.object({ error: external_exports.string() });
+var thirdPartyWebhookOkSchema = external_exports.union([
+  external_exports.string(),
+  external_exports.object({ message: external_exports.literal("pong") })
+]);
+var webhookClerkContract = c11.router({
+  post: {
+    method: "POST",
+    path: "/api/webhooks/clerk",
+    body: c11.type(),
+    responses: {
+      200: thirdPartyWebhookOkSchema,
+      401: thirdPartyWebhookErrorSchema
+    },
+    summary: "Handle Clerk organization and user webhooks"
+  }
 });
-var cliAuthDeviceContract = c11.router({
-  /**
-   * POST /api/cli/auth/device
-   * Initiate device authorization flow
-   */
-  create: {
+var webhookGithubContract = c11.router({
+  post: {
     method: "POST",
-    path: "/api/cli/auth/device",
-    body: external_exports.object({}).optional(),
+    path: "/api/webhooks/github",
+    body: c11.type(),
     responses: {
-      200: external_exports.object({
-        device_code: external_exports.string(),
-        user_code: external_exports.string(),
-        verification_path: external_exports.string(),
-        expires_in: external_exports.number(),
-        interval: external_exports.number()
-      }),
-      500: oauthErrorSchema
+      200: thirdPartyWebhookOkSchema,
+      400: thirdPartyWebhookErrorSchema,
+      401: thirdPartyWebhookErrorSchema,
+      503: thirdPartyWebhookErrorSchema
     },
-    summary: "Initiate device authorization flow"
+    summary: "Handle GitHub App webhooks"
   }
 });
-var cliAuthTokenContract = c11.router({
-  /**
-   * POST /api/cli/auth/token
-   * Exchange device code for access token
-   */
-  exchange: {
+var webhookStripeContract = c11.router({
+  post: {
     method: "POST",
-    path: "/api/cli/auth/token",
-    body: external_exports.object({
-      device_code: external_exports.string().min(1, "device_code is required")
+    path: "/api/webhooks/stripe",
+    body: c11.type(),
+    responses: {
+      200: thirdPartyWebhookOkSchema,
+      401: thirdPartyWebhookErrorSchema,
+      503: thirdPartyWebhookErrorSchema
+    },
+    summary: "Handle Stripe billing webhooks"
+  }
+});
+var gmailWebhookResponseSchema = external_exports.object({
+  success: external_exports.literal(true),
+  watchStates: external_exports.number(),
+  dispatched: external_exports.number(),
+  duplicates: external_exports.number()
+});
+var googleCalendarWebhookResponseSchema = external_exports.object({
+  success: external_exports.literal(true),
+  watchStates: external_exports.number(),
+  dispatched: external_exports.number(),
+  duplicates: external_exports.number()
+});
+var googleWorkspaceEventsWebhookResponseSchema = external_exports.object({
+  success: external_exports.literal(true),
+  watchStates: external_exports.number(),
+  dispatched: external_exports.number(),
+  duplicates: external_exports.number()
+});
+var notionWebhookResponseSchema = external_exports.object({
+  success: external_exports.literal(true),
+  kind: external_exports.enum(["verification", "event"]),
+  pending: external_exports.number(),
+  refreshed: external_exports.number(),
+  duplicates: external_exports.number()
+});
+var workflowAutomationWebhookResponseSchema = external_exports.object({
+  success: external_exports.literal(true),
+  duplicate: external_exports.boolean(),
+  runId: external_exports.string().uuid().optional()
+});
+var webhookGmailContract = c11.router({
+  post: {
+    method: "POST",
+    path: "/api/webhooks/gmail",
+    body: c11.type(),
+    responses: {
+      200: gmailWebhookResponseSchema,
+      400: thirdPartyWebhookErrorSchema,
+      401: thirdPartyWebhookErrorSchema,
+      429: thirdPartyWebhookErrorSchema,
+      503: thirdPartyWebhookErrorSchema
+    },
+    summary: "Handle Gmail Pub/Sub push notifications"
+  }
+});
+var webhookGoogleCalendarContract = c11.router({
+  post: {
+    method: "POST",
+    path: "/api/webhooks/google-calendar",
+    body: c11.type(),
+    responses: {
+      200: googleCalendarWebhookResponseSchema,
+      400: thirdPartyWebhookErrorSchema,
+      401: thirdPartyWebhookErrorSchema,
+      429: thirdPartyWebhookErrorSchema,
+      503: thirdPartyWebhookErrorSchema
+    },
+    summary: "Handle Google Calendar push notifications"
+  }
+});
+var webhookGoogleWorkspaceEventsContract = c11.router({
+  post: {
+    method: "POST",
+    path: "/api/webhooks/google-workspace-events",
+    body: c11.type(),
+    responses: {
+      200: googleWorkspaceEventsWebhookResponseSchema,
+      400: thirdPartyWebhookErrorSchema,
+      401: thirdPartyWebhookErrorSchema,
+      429: thirdPartyWebhookErrorSchema,
+      503: thirdPartyWebhookErrorSchema
+    },
+    summary: "Handle Google Workspace Events Pub/Sub push notifications"
+  }
+});
+var webhookNotionContract = c11.router({
+  post: {
+    method: "POST",
+    path: "/api/webhooks/notion",
+    body: c11.type(),
+    responses: {
+      200: notionWebhookResponseSchema,
+      400: thirdPartyWebhookErrorSchema,
+      401: thirdPartyWebhookErrorSchema,
+      503: thirdPartyWebhookErrorSchema
+    },
+    summary: "Handle Notion webhook events"
+  }
+});
+var workflowAutomationWebhookPostRoute = {
+  method: "POST",
+  pathParams: external_exports.object({
+    token: external_exports.string().min(1)
+  }),
+  body: c11.type(),
+  responses: {
+    200: workflowAutomationWebhookResponseSchema,
+    400: thirdPartyWebhookErrorSchema,
+    401: thirdPartyWebhookErrorSchema,
+    404: thirdPartyWebhookErrorSchema,
+    413: thirdPartyWebhookErrorSchema,
+    429: thirdPartyWebhookErrorSchema,
+    500: thirdPartyWebhookErrorSchema
+  }
+};
+var webhookWorkflowAutomationContract = c11.router({
+  post: {
+    ...workflowAutomationWebhookPostRoute,
+    path: "/api/webhooks/workflow-automations/:token",
+    summary: "Handle inbound workflow automation webhooks"
+  }
+});
+var webhookBuiltInGenerationFalContract = c11.router({
+  post: {
+    method: "POST",
+    path: "/api/webhooks/built-in-generations/fal/:generationId",
+    pathParams: external_exports.object({
+      generationId: external_exports.uuid()
+    }),
+    query: external_exports.object({
+      token: external_exports.string().min(1),
+      visualKey: external_exports.string().min(1).optional()
     }),
+    body: c11.type(),
     responses: {
-      // Success - token issued
-      200: external_exports.object({
-        access_token: external_exports.string(),
-        token_type: external_exports.literal("Bearer"),
-        expires_in: external_exports.number()
-      }),
-      // Authorization pending
-      202: oauthErrorSchema,
-      // Various error states
-      400: oauthErrorSchema,
-      500: oauthErrorSchema
+      200: thirdPartyWebhookOkSchema,
+      400: thirdPartyWebhookErrorSchema,
+      401: thirdPartyWebhookErrorSchema,
+      503: thirdPartyWebhookErrorSchema
     },
-    summary: "Exchange device code for access token"
+    summary: "Handle fal built-in generation webhooks"
   }
 });
-var apiErrorResponseSchema = external_exports.object({
-  error: external_exports.object({ message: external_exports.string(), code: external_exports.string() })
+var webhookBuiltInGenerationBytePlusContract = c11.router({
+  post: {
+    method: "POST",
+    path: "/api/webhooks/built-in-generations/byteplus/:generationId",
+    pathParams: external_exports.object({
+      generationId: external_exports.uuid()
+    }),
+    query: external_exports.object({
+      token: external_exports.string().min(1),
+      visualKey: external_exports.string().min(1).optional()
+    }),
+    body: c11.type(),
+    responses: {
+      200: thirdPartyWebhookOkSchema,
+      400: thirdPartyWebhookErrorSchema,
+      401: thirdPartyWebhookErrorSchema,
+      503: thirdPartyWebhookErrorSchema
+    },
+    summary: "Handle BytePlus built-in generation webhooks"
+  }
 });
-var cliAuthApproveErrorSchema = external_exports.object({
-  success: external_exports.literal(false),
-  error: external_exports.string()
+var webhookBuiltInGenerationJoggAiContract = c11.router({
+  post: {
+    method: "POST",
+    path: "/api/webhooks/built-in-generations/joggai/:generationId",
+    pathParams: external_exports.object({
+      generationId: external_exports.uuid()
+    }),
+    query: external_exports.object({
+      token: external_exports.string().min(1)
+    }),
+    body: c11.type(),
+    responses: {
+      200: thirdPartyWebhookOkSchema,
+      400: thirdPartyWebhookErrorSchema,
+      401: thirdPartyWebhookErrorSchema,
+      503: thirdPartyWebhookErrorSchema
+    },
+    summary: "Handle JoggAI built-in generation webhooks"
+  }
+});
+var sandboxReuseResultSchema = external_exports.enum([
+  "reused",
+  "featureDisabled",
+  "noSessionId",
+  "noReuseKey",
+  "poolMiss",
+  "profileMismatch",
+  "deviceLimitMismatch",
+  "unparkFailed"
+]);
+var agentEventSchema = external_exports.object({
+  type: external_exports.string(),
+  sequenceNumber: eventSequenceNumberSchema
+}).passthrough();
+var artifactSnapshotsSchema = external_exports.array(
+  external_exports.object({
+    name: external_exports.string(),
+    version: external_exports.string(),
+    mountPath: external_exports.string(),
+    missingRootPolicy: artifactMissingRootPolicySchema.optional()
+  })
+);
+var volumeVersionsSnapshotSchema = external_exports.object({
+  versions: external_exports.record(external_exports.string(), external_exports.string())
 });
-var cliAuthApproveContract = c11.router({
+var firewallAuthErrorSchema = external_exports.object({
+  error: external_exports.object({
+    message: external_exports.string(),
+    code: external_exports.string(),
+    connectors: external_exports.array(external_exports.string()).optional(),
+    failureReason: external_exports.enum(["upstream_provider", "reconnect_required"]).optional()
+  })
+});
+var firewallAwsSigv4AuthSchema = external_exports.object({
+  accessKeyId: external_exports.string().min(1),
+  secretAccessKey: external_exports.string().min(1),
+  sessionToken: external_exports.string().min(1).optional()
+}).strict();
+var firewallAuthResponseSchema = external_exports.object({
+  headers: external_exports.record(external_exports.string(), external_exports.string()),
+  base: external_exports.string().optional(),
+  query: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  awsSigv4: firewallAwsSigv4AuthSchema.optional(),
+  // Effective addon cache expiry as Unix seconds. Access token expiry is the
+  // normal source; billable firewall auth can shorten it to force credit
+  // re-authorization. Null means non-expiring only for non-billable auth.
+  expiresAt: external_exports.number().nullable(),
+  resolvedSecrets: external_exports.array(external_exports.string()),
+  refreshedConnectors: external_exports.array(external_exports.string()),
+  refreshedSecrets: external_exports.array(external_exports.string())
+});
+var webhookFirewallAuthContract = c11.router({
   /**
-   * POST /api/cli/auth/approve
-   * Approve a pending CLI device code from a browser session
+   * POST /api/webhooks/agent/firewall/auth
+   * Resolve firewall auth templates and refresh access tokens on demand.
    */
-  approve: {
+  resolve: {
     method: "POST",
-    path: "/api/cli/auth/approve",
+    path: "/api/webhooks/agent/firewall/auth",
     headers: authHeadersSchema,
     body: external_exports.object({
-      device_code: external_exports.string().min(1, "device_code is required"),
-      timezone: external_exports.string().min(1).optional()
+      // Encrypted runtime secret namespace. After decryption, keys are the
+      // `NAME` in `${{ secrets.NAME }}`.
+      encryptedSecrets: external_exports.string().min(1),
+      authHeaders: external_exports.record(external_exports.string(), external_exports.string()),
+      authBase: external_exports.string().optional(),
+      authQuery: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+      authAwsSigv4: firewallAwsSigv4AuthSchema.optional(),
+      // Maps firewall auth secret env aliases (the `NAME` in `${{ secrets.NAME }}`)
+      // to the connector or provider owner that can refresh/resolve access.
+      secretConnectorMap: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+      // Same keys as secretConnectorMap; adds source details when the owner
+      // alone is not enough to locate access storage.
+      secretConnectorMetadataMap: secretConnectorMetadataMapSchema.optional(),
+      vars: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+      // Set by mitm from billableFirewalls. Server uses this only to bound
+      // auth cache lifetime by the current credit authorization lease.
+      firewallBillable: external_exports.boolean().optional(),
+      forceRefresh: external_exports.boolean().optional()
     }),
     responses: {
-      200: external_exports.object({ success: external_exports.literal(true) }),
-      400: cliAuthApproveErrorSchema,
-      401: apiErrorResponseSchema,
-      403: apiErrorResponseSchema
+      200: firewallAuthResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      402: apiErrorSchema,
+      403: apiErrorSchema,
+      424: firewallAuthErrorSchema,
+      502: firewallAuthErrorSchema,
+      500: apiErrorSchema
     },
-    summary: "Approve a CLI device authorization flow"
+    summary: "Resolve firewall auth templates"
   }
 });
-
-// ../../packages/api-contracts/src/contracts/auth.ts
-init_esm_shims();
-var c12 = initContract();
-var authContract = c12.router({
+var webhookEventsContract = c11.router({
   /**
-   * GET /api/auth/me
-   * Get current user information
+   * POST /api/webhooks/agent/events
+   * Receive agent events from sandbox
    */
-  me: {
-    method: "GET",
-    path: "/api/auth/me",
+  send: {
+    method: "POST",
+    path: "/api/webhooks/agent/events",
     headers: authHeadersSchema,
+    body: external_exports.object({
+      runId: external_exports.string().min(1, "runId is required"),
+      events: external_exports.array(agentEventSchema).min(1, "events array cannot be empty")
+    }),
     responses: {
       200: external_exports.object({
-        userId: external_exports.string(),
-        email: external_exports.string()
+        received: external_exports.number(),
+        firstSequence: external_exports.number(),
+        lastSequence: external_exports.number()
       }),
+      400: apiErrorSchema,
       401: apiErrorSchema,
-      403: apiErrorSchema,
       404: apiErrorSchema,
-      500: apiErrorSchema
+      500: apiErrorSchema,
+      503: apiErrorSchema
     },
-    summary: "Get current user information"
+    summary: "Receive agent events from sandbox"
   }
 });
-
-// ../../packages/api-contracts/src/contracts/user-export.ts
-init_esm_shims();
-var c13 = initContract();
-var exportJobStatusSchema = external_exports.enum([
-  "pending",
-  "running",
-  "completed",
-  "failed"
-]);
-var userExportJobSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  status: exportJobStatusSchema,
-  createdAt: external_exports.string(),
-  completedAt: external_exports.string().nullable(),
-  expiresAt: external_exports.string().nullable(),
-  downloadUrl: external_exports.string().url().nullable(),
-  error: external_exports.string().nullable()
-});
-var userExportStatusResponseSchema = external_exports.object({
-  job: userExportJobSchema.nullable(),
-  canExport: external_exports.boolean(),
-  nextExportAt: external_exports.string().nullable()
-});
-var userExportStartResponseSchema = external_exports.object({
-  jobId: external_exports.string().uuid(),
-  status: external_exports.enum(["pending", "running"])
-});
-var userExportContract = c13.router({
-  get: {
-    method: "GET",
-    path: "/api/user/export",
+var webhookCompleteContract = c11.router({
+  /**
+   * POST /api/webhooks/agent/complete
+   * Handle agent run completion (success or failure)
+   */
+  complete: {
+    method: "POST",
+    path: "/api/webhooks/agent/complete",
     headers: authHeadersSchema,
+    body: external_exports.object({
+      runId: external_exports.string().min(1, "runId is required"),
+      exitCode: external_exports.number(),
+      error: external_exports.string().optional(),
+      lastEventSequence: eventSequenceNumberSchema.optional(),
+      // Sandbox id the run executed against. Optional because a run that fails
+      // before VM creation has no sandbox. Persisted to agent_runs.sandbox_id;
+      // the 255-char cap matches the DB column (defense in depth).
+      sandboxId: external_exports.string().max(255).optional(),
+      // Sandbox reuse outcome. One enum value covers both "reused" and the
+      // non-reuse reasons, because (reused, reason) is a partial function —
+      // encoding it as one field makes inconsistent states unrepresentable.
+      // Optional/nullable for old runners and historical rows.
+      sandboxReuseResult: sandboxReuseResultSchema.optional()
+    }),
     responses: {
-      200: userExportStatusResponseSchema,
+      200: external_exports.object({
+        success: external_exports.boolean(),
+        status: external_exports.enum(["completed", "failed"])
+      }),
+      400: apiErrorSchema,
       401: apiErrorSchema,
-      403: apiErrorSchema,
+      404: apiErrorSchema,
       500: apiErrorSchema
     },
-    summary: "Get current user export status"
-  },
-  post: {
+    summary: "Handle agent run completion"
+  }
+});
+var webhookCheckpointsContract = c11.router({
+  /**
+   * POST /api/webhooks/agent/checkpoints
+   * Create a recoverable checkpoint for an agent run.
+   */
+  create: {
     method: "POST",
-    path: "/api/user/export",
+    path: "/api/webhooks/agent/checkpoints",
     headers: authHeadersSchema,
-    body: external_exports.undefined(),
+    body: external_exports.object({
+      runId: external_exports.string().min(1, "runId is required"),
+      cliAgentType: external_exports.string().min(1, "cliAgentType is required"),
+      cliAgentSessionId: external_exports.string().min(1, "cliAgentSessionId is required"),
+      cliAgentSessionHistoryHash: sha256HexSchema,
+      // Multi-artifact snapshots are folded into canonical checkpoint mounts
+      // and projected back into the legacy response shape.
+      artifactSnapshots: artifactSnapshotsSchema.optional(),
+      volumeVersionsSnapshot: volumeVersionsSnapshotSchema.optional()
+    }).strict(),
     responses: {
-      202: userExportStartResponseSchema,
+      200: external_exports.object({
+        checkpointId: external_exports.string(),
+        agentSessionId: external_exports.string(),
+        conversationId: external_exports.string(),
+        artifacts: artifactSnapshotsSchema.optional(),
+        volumes: external_exports.record(external_exports.string(), external_exports.string()).optional()
+      }),
+      400: apiErrorSchema,
       401: apiErrorSchema,
-      403: apiErrorSchema,
-      429: apiErrorSchema,
+      404: apiErrorSchema,
       500: apiErrorSchema
     },
-    summary: "Start a user data export"
+    summary: "Create checkpoint for agent run"
+  }
+});
+var webhookCheckpointsPrepareHistoryContract = c11.router({
+  prepare: {
+    method: "POST",
+    path: "/api/webhooks/agent/checkpoints/prepare-history",
+    headers: authHeadersSchema,
+    body: external_exports.object({
+      runId: external_exports.string().min(1, "runId is required"),
+      hash: sha256HexSchema,
+      rawSize: external_exports.number().int().positive("rawSize must be a positive integer").max(RESUME_SESSION_HISTORY_MAX_BYTES),
+      encodedSize: external_exports.number().int().positive("encodedSize must be a positive integer").max(RESUME_SESSION_HISTORY_MAX_BYTES),
+      encoding: sessionHistoryEncodingSchema.optional()
+    }),
+    responses: {
+      200: external_exports.object({
+        presignedUrl: external_exports.string().optional(),
+        existing: external_exports.boolean(),
+        encoding: sessionHistoryEncodingSchema.optional()
+      }),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Get presigned URL for uploading session history to S3"
+  }
+});
+var webhookHeartbeatContract = c11.router({
+  /**
+   * POST /api/webhooks/agent/heartbeat
+   * Receive heartbeat signals from sandbox
+   */
+  send: {
+    method: "POST",
+    path: "/api/webhooks/agent/heartbeat",
+    headers: authHeadersSchema,
+    body: external_exports.object({
+      runId: external_exports.string().min(1, "runId is required")
+    }),
+    responses: {
+      200: external_exports.object({
+        ok: external_exports.boolean()
+      }),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Receive heartbeat from sandbox"
+  }
+});
+var metricDataSchema = external_exports.object({
+  ts: external_exports.string(),
+  cpu: external_exports.number(),
+  mem_used: external_exports.number(),
+  mem_total: external_exports.number(),
+  disk_used: external_exports.number(),
+  disk_total: external_exports.number()
+});
+var sessionHistoryCompressionRatioBucketSchema = external_exports.enum([
+  "identity",
+  "lt_0_25",
+  "0_25_0_5",
+  "0_5_0_75",
+  "0_75_1",
+  "ge_1"
+]);
+var booleanStringSchema = external_exports.enum(["true", "false"]);
+var sessionHistoryContentLengthStateSchema = external_exports.enum([
+  "absent",
+  "matches_expected",
+  "mismatches_expected",
+  "present_without_expected",
+  "oversized"
+]);
+var sessionHistoryContentEncodingStateSchema = external_exports.enum([
+  "absent",
+  "gzip",
+  "zstd",
+  "other"
+]);
+var sessionHistoryTransferEncodingStateSchema = external_exports.enum([
+  "absent",
+  "chunked",
+  "other"
+]);
+var sandboxOperationDownloadSourceSchema = external_exports.preprocess((value) => {
+  const parsed = sessionHistoryDownloadSourceSchema.safeParse(value);
+  if (parsed.success) {
+    return parsed.data;
+  }
+  if (typeof value === "string") {
+    return void 0;
+  }
+  return value;
+}, sessionHistoryDownloadSourceSchema.optional()).optional();
+var sandboxOperationSchema = external_exports.object({
+  ts: external_exports.string(),
+  action_type: external_exports.string(),
+  duration_ms: external_exports.number(),
+  success: external_exports.boolean(),
+  error: external_exports.string().optional(),
+  encoding: sessionHistoryEncodingSchema.optional(),
+  session_history_raw_size_bucket: sessionHistorySizeBucketSchema.optional(),
+  session_history_encoded_size_bucket: sessionHistorySizeBucketSchema.optional(),
+  session_history_compression_ratio_bucket: sessionHistoryCompressionRatioBucketSchema.optional(),
+  session_history_ref_seen_recently: booleanStringSchema.optional(),
+  session_history_ref_download_inflight: booleanStringSchema.optional(),
+  session_history_content_length_state: sessionHistoryContentLengthStateSchema.optional(),
+  session_history_content_encoding_state: sessionHistoryContentEncodingStateSchema.optional(),
+  session_history_transfer_encoding_state: sessionHistoryTransferEncodingStateSchema.optional(),
+  session_history_download_source: sandboxOperationDownloadSourceSchema
+});
+var webhookTelemetryContract = c11.router({
+  /**
+   * POST /api/webhooks/agent/telemetry
+   * Receive telemetry data (system log, metrics, network logs, and sandbox operations) from sandbox
+   */
+  send: {
+    method: "POST",
+    path: "/api/webhooks/agent/telemetry",
+    headers: authHeadersSchema,
+    body: external_exports.object({
+      runId: external_exports.string().min(1, "runId is required"),
+      systemLog: external_exports.string().optional(),
+      metrics: external_exports.array(metricDataSchema).optional(),
+      networkLogs: external_exports.array(networkLogEntrySchema).optional(),
+      sandboxOperations: external_exports.array(sandboxOperationSchema).optional()
+    }),
+    responses: {
+      200: external_exports.object({
+        success: external_exports.boolean(),
+        id: external_exports.string()
+      }),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Receive telemetry data from sandbox"
+  }
+});
+var webhookStoragesPrepareContract = c11.router({
+  prepare: {
+    method: "POST",
+    path: "/api/webhooks/agent/storages/prepare",
+    headers: authHeadersSchema,
+    body: external_exports.object({
+      runId: external_exports.string().min(1, "runId is required"),
+      // Required for webhook auth
+      /**
+       * Canonical Storage identity authorized against the run's writeback
+       * mounts.
+       */
+      storageId: external_exports.string().uuid(),
+      files: storageManifestFilesSchema,
+      parentVersionId: external_exports.string().optional(),
+      force: external_exports.boolean().optional(),
+      baseVersion: external_exports.string().optional(),
+      changes: storageChangesSchema.optional()
+    }),
+    responses: {
+      200: external_exports.object({
+        versionId: external_exports.string(),
+        existing: external_exports.boolean(),
+        uploads: external_exports.object({
+          archive: presignedUploadSchema,
+          manifest: presignedUploadSchema
+        }).optional()
+      }),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      413: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Prepare for direct S3 upload from sandbox"
+  }
+});
+var webhookStoragesCommitContract = c11.router({
+  commit: {
+    method: "POST",
+    path: "/api/webhooks/agent/storages/commit",
+    headers: authHeadersSchema,
+    body: external_exports.object({
+      runId: external_exports.string().min(1, "runId is required"),
+      // Required for webhook auth
+      /**
+       * Canonical Storage identity authorized against the run's writeback
+       * mounts.
+       */
+      storageId: external_exports.string().uuid(),
+      versionId: external_exports.string().min(1, "Version ID is required"),
+      parentVersionId: external_exports.string().optional(),
+      files: storageManifestFilesSchema,
+      message: external_exports.string().optional()
+    }),
+    responses: {
+      200: external_exports.object({
+        success: external_exports.literal(true),
+        versionId: external_exports.string(),
+        storageName: external_exports.string(),
+        size: external_exports.number(),
+        fileCount: external_exports.number(),
+        deduplicated: external_exports.boolean().optional()
+      }),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      409: apiErrorSchema,
+      // S3 files missing
+      413: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Commit uploaded storage from sandbox"
+  }
+});
+var webhookUsageEventItemSchema = external_exports.object({
+  idempotencyKey: external_exports.uuid(),
+  kind: external_exports.enum(["connector", "model", "image"]),
+  provider: external_exports.string().min(1).max(100),
+  category: external_exports.string().min(1).max(100),
+  quantity: external_exports.number().int().min(0)
+}).strict();
+var webhookUsageEventContract = c11.router({
+  send: {
+    method: "POST",
+    path: "/api/webhooks/agent/usage-event",
+    headers: authHeadersSchema,
+    body: external_exports.object({
+      runId: external_exports.string().min(1, "runId is required"),
+      events: external_exports.array(webhookUsageEventItemSchema).min(1).max(100)
+    }).strict(),
+    responses: {
+      200: external_exports.object({
+        success: external_exports.boolean()
+      }),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Receive billing usage event data from sandbox"
+  }
+});
+var webhookModelUsageObservationItemSchema = external_exports.object({
+  idempotencyKey: external_exports.uuid(),
+  model: external_exports.string().min(1).max(255),
+  inputTokens: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  outputTokens: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  cacheReadInputTokens: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+  cacheCreationInputTokens: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
+}).strict().refine(
+  (event) => {
+    return event.inputTokens > 0 || event.outputTokens > 0 || event.cacheReadInputTokens > 0 || event.cacheCreationInputTokens > 0;
+  },
+  { message: "At least one token counter must be positive" }
+);
+var webhookModelUsageObservationBodySchema = external_exports.object({
+  runId: external_exports.string().min(1, "runId is required"),
+  events: external_exports.array(webhookModelUsageObservationItemSchema).min(1).max(100)
+}).strict().superRefine((body, ctx) => {
+  const idempotencyKeys = /* @__PURE__ */ new Set();
+  body.events.forEach((event, index) => {
+    if (idempotencyKeys.has(event.idempotencyKey)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["events", index, "idempotencyKey"],
+        message: "Idempotency keys must be unique within a request"
+      });
+    }
+    idempotencyKeys.add(event.idempotencyKey);
+  });
+});
+var webhookModelUsageObservationContract = c11.router({
+  send: {
+    method: "POST",
+    path: "/api/webhooks/agent/model-usage-observation",
+    headers: authHeadersSchema,
+    body: webhookModelUsageObservationBodySchema,
+    responses: {
+      200: external_exports.object({
+        success: external_exports.boolean()
+      }),
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Receive compact model usage observation data from sandbox"
   }
 });
 
-// ../../packages/api-contracts/src/contracts/email-unsubscribe.ts
+// ../../packages/api-contracts/src/contracts/cli-auth.ts
+init_esm_shims();
+var c12 = initContract();
+var oauthErrorSchema = external_exports.object({
+  error: external_exports.string(),
+  error_description: external_exports.string()
+});
+var cliAuthDeviceContract = c12.router({
+  /**
+   * POST /api/cli/auth/device
+   * Initiate device authorization flow
+   */
+  create: {
+    method: "POST",
+    path: "/api/cli/auth/device",
+    body: external_exports.object({}).optional(),
+    responses: {
+      200: external_exports.object({
+        device_code: external_exports.string(),
+        user_code: external_exports.string(),
+        verification_path: external_exports.string(),
+        expires_in: external_exports.number(),
+        interval: external_exports.number()
+      }),
+      500: oauthErrorSchema
+    },
+    summary: "Initiate device authorization flow"
+  }
+});
+var cliAuthTokenContract = c12.router({
+  /**
+   * POST /api/cli/auth/token
+   * Exchange device code for access token
+   */
+  exchange: {
+    method: "POST",
+    path: "/api/cli/auth/token",
+    body: external_exports.object({
+      device_code: external_exports.string().min(1, "device_code is required")
+    }),
+    responses: {
+      // Success - token issued
+      200: external_exports.object({
+        access_token: external_exports.string(),
+        token_type: external_exports.literal("Bearer"),
+        expires_in: external_exports.number()
+      }),
+      // Authorization pending
+      202: oauthErrorSchema,
+      // Various error states
+      400: oauthErrorSchema,
+      500: oauthErrorSchema
+    },
+    summary: "Exchange device code for access token"
+  }
+});
+var apiErrorResponseSchema = external_exports.object({
+  error: external_exports.object({ message: external_exports.string(), code: external_exports.string() })
+});
+var cliAuthApproveErrorSchema = external_exports.object({
+  success: external_exports.literal(false),
+  error: external_exports.string()
+});
+var cliAuthApproveContract = c12.router({
+  /**
+   * POST /api/cli/auth/approve
+   * Approve a pending CLI device code from a browser session
+   */
+  approve: {
+    method: "POST",
+    path: "/api/cli/auth/approve",
+    headers: authHeadersSchema,
+    body: external_exports.object({
+      device_code: external_exports.string().min(1, "device_code is required"),
+      timezone: external_exports.string().min(1).optional()
+    }),
+    responses: {
+      200: external_exports.object({ success: external_exports.literal(true) }),
+      400: cliAuthApproveErrorSchema,
+      401: apiErrorResponseSchema,
+      403: apiErrorResponseSchema
+    },
+    summary: "Approve a CLI device authorization flow"
+  }
+});
+
+// ../../packages/api-contracts/src/contracts/auth.ts
+init_esm_shims();
+var c13 = initContract();
+var authContract = c13.router({
+  /**
+   * GET /api/auth/me
+   * Get current user information
+   */
+  me: {
+    method: "GET",
+    path: "/api/auth/me",
+    headers: authHeadersSchema,
+    responses: {
+      200: external_exports.object({
+        userId: external_exports.string(),
+        email: external_exports.string()
+      }),
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Get current user information"
+  }
+});
+
+// ../../packages/api-contracts/src/contracts/user-export.ts
 init_esm_shims();
 var c14 = initContract();
+var exportJobStatusSchema = external_exports.enum([
+  "pending",
+  "running",
+  "completed",
+  "failed"
+]);
+var userExportJobSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  status: exportJobStatusSchema,
+  createdAt: external_exports.string(),
+  completedAt: external_exports.string().nullable(),
+  expiresAt: external_exports.string().nullable(),
+  downloadUrl: external_exports.string().url().nullable(),
+  error: external_exports.string().nullable()
+});
+var userExportStatusResponseSchema = external_exports.object({
+  job: userExportJobSchema.nullable(),
+  canExport: external_exports.boolean(),
+  nextExportAt: external_exports.string().nullable()
+});
+var userExportStartResponseSchema = external_exports.object({
+  jobId: external_exports.string().uuid(),
+  status: external_exports.enum(["pending", "running"])
+});
+var userExportContract = c14.router({
+  get: {
+    method: "GET",
+    path: "/api/user/export",
+    headers: authHeadersSchema,
+    responses: {
+      200: userExportStatusResponseSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Get current user export status"
+  },
+  post: {
+    method: "POST",
+    path: "/api/user/export",
+    headers: authHeadersSchema,
+    body: external_exports.undefined(),
+    responses: {
+      202: userExportStartResponseSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      429: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Start a user data export"
+  }
+});
+
+// ../../packages/api-contracts/src/contracts/email-unsubscribe.ts
+init_esm_shims();
+var c15 = initContract();
 var emailUnsubscribeQuerySchema = external_exports.object({
   token: external_exports.string().optional()
 });
@@ -11176,13 +11959,13 @@ var emailUnsubscribeResponseSchema = external_exports.object({
 var emailUnsubscribeErrorSchema = external_exports.object({
   error: external_exports.string()
 });
-var emailUnsubscribeContract = c14.router({
+var emailUnsubscribeContract = c15.router({
   get: {
     method: "GET",
     path: "/api/email/unsubscribe",
     query: emailUnsubscribeQuerySchema,
     responses: {
-      302: c14.noBody(),
+      302: c15.noBody(),
       400: emailUnsubscribeErrorSchema
     },
     summary: "Redirect to the app unsubscribe page"
@@ -11202,13 +11985,13 @@ var emailUnsubscribeContract = c14.router({
 
 // ../../packages/api-contracts/src/contracts/zero-morning-brief.ts
 init_esm_shims();
-var c15 = initContract();
+var c16 = initContract();
 var triggerMorningBriefResponseSchema = external_exports.object({
   runId: external_exports.string().nullable(),
   briefDate: external_exports.string(),
   queued: external_exports.boolean()
 });
-var zeroMorningBriefContract = c15.router({
+var zeroMorningBriefContract = c16.router({
   trigger: {
     method: "POST",
     path: "/api/zero/morning-brief/trigger",
@@ -11227,7 +12010,7 @@ var zeroMorningBriefContract = c15.router({
 
 // ../../packages/api-contracts/src/contracts/email-morning-brief-unsubscribe.ts
 init_esm_shims();
-var c16 = initContract();
+var c17 = initContract();
 var emailMorningBriefUnsubscribeQuerySchema = external_exports.object({
   token: external_exports.string().optional()
 });
@@ -11237,7 +12020,7 @@ var emailMorningBriefUnsubscribeResponseSchema = external_exports.object({
 var emailMorningBriefUnsubscribeErrorSchema = external_exports.object({
   error: external_exports.string()
 });
-var emailMorningBriefUnsubscribeContract = c16.router({
+var emailMorningBriefUnsubscribeContract = c17.router({
   unsubscribe: {
     method: "POST",
     path: "/api/email/morning-brief/unsubscribe",
@@ -11253,7 +12036,7 @@ var emailMorningBriefUnsubscribeContract = c16.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-authorize.ts
 init_esm_shims();
-var c17 = initContract();
+var c18 = initContract();
 var testOAuthProviderAuthorizeErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11265,13 +12048,13 @@ var testOAuthProviderAuthorizeQuerySchema = external_exports.object({
   scope: external_exports.string().optional(),
   state: external_exports.string().optional()
 });
-var testOAuthProviderAuthorizeContract = c17.router({
+var testOAuthProviderAuthorizeContract = c18.router({
   authorize: {
     method: "GET",
     path: "/api/test/oauth-provider/authorize",
     query: testOAuthProviderAuthorizeQuerySchema,
     responses: {
-      302: c17.noBody(),
+      302: c18.noBody(),
       400: testOAuthProviderAuthorizeErrorSchema,
       404: external_exports.string()
     },
@@ -11281,7 +12064,7 @@ var testOAuthProviderAuthorizeContract = c17.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-echo.ts
 init_esm_shims();
-var c18 = initContract();
+var c19 = initContract();
 var testOAuthProviderEchoErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11289,7 +12072,7 @@ var testOAuthProviderEchoResponseSchema = external_exports.object({
   authorization: external_exports.string(),
   receivedAt: external_exports.string()
 });
-var testOAuthProviderEchoContract = c18.router({
+var testOAuthProviderEchoContract = c19.router({
   echo: {
     method: "GET",
     path: "/api/test/oauth-provider/echo",
@@ -11304,7 +12087,7 @@ var testOAuthProviderEchoContract = c18.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-token.ts
 init_esm_shims();
-var c19 = initContract();
+var c20 = initContract();
 var testOAuthProviderTokenErrorSchema = external_exports.object({
   error: external_exports.string(),
   error_description: external_exports.string().optional()
@@ -11316,11 +12099,11 @@ var testOAuthProviderTokenResponseSchema = external_exports.object({
   expires_in: external_exports.number(),
   scope: external_exports.string()
 });
-var testOAuthProviderTokenContract = c19.router({
+var testOAuthProviderTokenContract = c20.router({
   token: {
     method: "POST",
     path: "/api/test/oauth-provider/token",
-    body: c19.type(),
+    body: c20.type(),
     responses: {
       200: testOAuthProviderTokenResponseSchema,
       400: testOAuthProviderTokenErrorSchema,
@@ -11333,7 +12116,7 @@ var testOAuthProviderTokenContract = c19.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-device-auth.ts
 init_esm_shims();
-var c20 = initContract();
+var c21 = initContract();
 var testOAuthProviderDeviceAuthErrorSchema = external_exports.object({
   error: external_exports.string(),
   error_description: external_exports.string().optional()
@@ -11346,11 +12129,11 @@ var testOAuthProviderDeviceAuthResponseSchema = external_exports.object({
   expires_in: external_exports.number(),
   interval: external_exports.number()
 });
-var testOAuthProviderDeviceAuthContract = c20.router({
+var testOAuthProviderDeviceAuthContract = c21.router({
   deviceAuth: {
     method: "POST",
     path: "/api/test/oauth-provider/device/code",
-    body: c20.type(),
+    body: c21.type(),
     responses: {
       200: testOAuthProviderDeviceAuthResponseSchema,
       400: testOAuthProviderDeviceAuthErrorSchema,
@@ -11363,7 +12146,7 @@ var testOAuthProviderDeviceAuthContract = c20.router({
 
 // ../../packages/api-contracts/src/contracts/test-oauth-provider-userinfo.ts
 init_esm_shims();
-var c21 = initContract();
+var c22 = initContract();
 var testOAuthProviderUserinfoErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11372,7 +12155,7 @@ var testOAuthProviderUserinfoResponseSchema = external_exports.object({
   id: external_exports.string(),
   username: external_exports.string()
 });
-var testOAuthProviderUserinfoContract = c21.router({
+var testOAuthProviderUserinfoContract = c22.router({
   userinfo: {
     method: "GET",
     path: "/api/test/oauth-provider/userinfo",
@@ -11387,7 +12170,7 @@ var testOAuthProviderUserinfoContract = c21.router({
 
 // ../../packages/api-contracts/src/contracts/test-computer-use-state.ts
 init_esm_shims();
-var c22 = initContract();
+var c23 = initContract();
 var testComputerUseStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11411,7 +12194,7 @@ var testComputerUseStateGetResponseSchema = external_exports.object({
 var testComputerUseStateDeleteResponseSchema = external_exports.object({
   ok: external_exports.literal(true)
 });
-var testComputerUseStateContract = c22.router({
+var testComputerUseStateContract = c23.router({
   post: {
     method: "POST",
     path: "/api/test/computer-use-state",
@@ -11453,7 +12236,7 @@ var testComputerUseStateContract = c22.router({
 
 // ../../packages/api-contracts/src/contracts/test-runtime-state.ts
 init_esm_shims();
-var c23 = initContract();
+var c24 = initContract();
 var testRuntimeStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11664,7 +12447,7 @@ var testRuntimeStateActionResponseSchema = external_exports.object({
     heartbeat_generation: external_exports.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable()
   }).optional()
 });
-var testRuntimeStateContract = c23.router({
+var testRuntimeStateContract = c24.router({
   action: {
     method: "POST",
     path: "/api/test/runtime-state/action",
@@ -11680,7 +12463,7 @@ var testRuntimeStateContract = c23.router({
 
 // ../../packages/api-contracts/src/contracts/test-zero-agent-state.ts
 init_esm_shims();
-var c24 = initContract();
+var c25 = initContract();
 var testZeroAgentStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11702,7 +12485,7 @@ var testZeroAgentStateActionBodySchema = external_exports.discriminatedUnion(
 var testZeroAgentStateActionResponseSchema = external_exports.object({
   ok: external_exports.literal(true)
 });
-var testZeroAgentStateContract = c24.router({
+var testZeroAgentStateContract = c25.router({
   action: {
     method: "POST",
     path: "/api/test/zero-agent-state/action",
@@ -11718,7 +12501,7 @@ var testZeroAgentStateContract = c24.router({
 
 // ../../packages/api-contracts/src/contracts/test-model-provider-state.ts
 init_esm_shims();
-var c25 = initContract();
+var c26 = initContract();
 var testModelProviderStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -11736,7 +12519,7 @@ var testModelProviderStateActionBodySchema = external_exports.discriminatedUnion
 var testModelProviderStateActionResponseSchema = external_exports.object({
   ok: external_exports.literal(true)
 });
-var testModelProviderStateContract = c25.router({
+var testModelProviderStateContract = c26.router({
   action: {
     method: "POST",
     path: "/api/test/model-provider-state/action",
@@ -11752,8 +12535,8 @@ var testModelProviderStateContract = c25.router({
 
 // ../../packages/api-contracts/src/contracts/test-mail-draft-state.ts
 init_esm_shims();
-var c26 = initContract();
-var testMailDraftStateContract = c26.router({
+var c27 = initContract();
+var testMailDraftStateContract = c27.router({
   get: {
     method: "GET",
     path: "/api/test/mail-draft-state/:mailDraftId",
@@ -11768,7 +12551,7 @@ var testMailDraftStateContract = c26.router({
 
 // ../../packages/api-contracts/src/contracts/test-usage-insight-state.ts
 init_esm_shims();
-var c27 = initContract();
+var c28 = initContract();
 var nullableDateStringSchema = external_exports.string().nullable();
 var optionalDateStringSchema = external_exports.string().optional();
 var testUsageInsightStateErrorSchema = external_exports.object({
@@ -11931,7 +12714,7 @@ var testUsageInsightStateActionResponseSchema = external_exports.object({
   allocation_count: external_exports.number().optional(),
   insights_daily_permissions: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).optional()
 });
-var testUsageInsightStateContract = c27.router({
+var testUsageInsightStateContract = c28.router({
   action: {
     method: "POST",
     path: "/api/test/usage-insight-state/action",
@@ -11947,14 +12730,14 @@ var testUsageInsightStateContract = c27.router({
 
 // ../../packages/api-contracts/src/contracts/test-usage-settlement.ts
 init_esm_shims();
-var c28 = initContract();
+var c29 = initContract();
 var testUsageSettlementRequestSchema = external_exports.object({
   org_id: external_exports.string().min(1)
 });
 var testUsageSettlementResponseSchema = external_exports.object({
   ok: external_exports.literal(true)
 });
-var testUsageSettlementContract = c28.router({
+var testUsageSettlementContract = c29.router({
   process: {
     method: "POST",
     path: "/api/test/usage-settlement/process",
@@ -11970,7 +12753,7 @@ var testUsageSettlementContract = c28.router({
 
 // ../../packages/api-contracts/src/contracts/test-cron-cleanup-sandboxes-state.ts
 init_esm_shims();
-var c29 = initContract();
+var c30 = initContract();
 var testCronCleanupSandboxesStateActionBodySchema = external_exports.object({
   action: external_exports.enum([
     "seed-run",
@@ -12000,7 +12783,7 @@ var testCronCleanupSandboxesStateActionResponseSchema = external_exports.object(
 var testCronCleanupSandboxesStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
-var testCronCleanupSandboxesStateContract = c29.router({
+var testCronCleanupSandboxesStateContract = c30.router({
   action: {
     method: "POST",
     path: "/api/test/cron-cleanup-sandboxes-state/action",
@@ -12016,7 +12799,7 @@ var testCronCleanupSandboxesStateContract = c29.router({
 
 // ../../packages/api-contracts/src/contracts/test-slack-state.ts
 init_esm_shims();
-var c30 = initContract();
+var c31 = initContract();
 var testSlackStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -12040,7 +12823,6 @@ var testSlackStatePostBodySchema = external_exports.object({
   default_agent_name: external_exports.string().optional(),
   default_agent_display_name: external_exports.string().nullable().optional(),
   compose_content: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  org_slug: external_exports.string().optional(),
   org_name: external_exports.string().optional(),
   seed_secret_names: external_exports.array(external_exports.string()).optional(),
   seed_variables: external_exports.record(external_exports.string(), external_exports.string()).optional()
@@ -12148,7 +12930,7 @@ var testSlackStateResponseSchema = external_exports.object({
     })
   )
 });
-var testSlackStateContract = c30.router({
+var testSlackStateContract = c31.router({
   get: {
     method: "GET",
     path: "/api/test/slack-state",
@@ -12193,7 +12975,7 @@ var testSlackStateContract = c30.router({
 
 // ../../packages/api-contracts/src/contracts/test-slack-mock.ts
 init_esm_shims();
-var c31 = initContract();
+var c32 = initContract();
 var slackMockRequestBodySchema = external_exports.record(external_exports.string(), external_exports.unknown()).optional();
 var slackMockNotFoundSchema = external_exports.string();
 var testSlackMockOkResponseSchema = external_exports.object({
@@ -12263,7 +13045,7 @@ var testSlackMockUsersInfoResponseSchema = testSlackMockOkResponseSchema.extend(
     })
   })
 });
-var testSlackMockContract = c31.router({
+var testSlackMockContract = c32.router({
   assistantThreadsSetStatus: {
     method: "POST",
     path: "/api/test/slack-mock/assistant.threads.setStatus",
@@ -12378,7 +13160,7 @@ var testSlackMockContract = c31.router({
 
 // ../../packages/api-contracts/src/contracts/test-telegram-mock.ts
 init_esm_shims();
-var c32 = initContract();
+var c33 = initContract();
 var testTelegramMockPathParamsSchema = external_exports.object({
   botToken: external_exports.string(),
   method: external_exports.string()
@@ -12391,7 +13173,7 @@ var testTelegramMockErrorResponseSchema = external_exports.object({
   ok: external_exports.literal(false),
   description: external_exports.string()
 });
-var testTelegramMockContract = c32.router({
+var testTelegramMockContract = c33.router({
   post: {
     method: "POST",
     path: "/api/test/telegram-mock/:botToken/:method",
@@ -12407,7 +13189,7 @@ var testTelegramMockContract = c32.router({
 
 // ../../packages/api-contracts/src/contracts/test-teams-mock.ts
 init_esm_shims();
-var c33 = initContract();
+var c34 = initContract();
 var teamsMockBodySchema = external_exports.record(external_exports.string(), external_exports.unknown()).optional();
 var teamsMockOkSchema = external_exports.object({ ok: external_exports.literal(true) });
 var teamsMockTokenResponseSchema = external_exports.object({
@@ -12443,7 +13225,7 @@ var testTeamsMockGraphMessagePathParamsSchema = testTeamsMockGraphMessagesPathPa
 var testTeamsMockGraphUserPathParamsSchema = external_exports.object({
   userId: external_exports.string()
 });
-var testTeamsMockContract = c33.router({
+var testTeamsMockContract = c34.router({
   token: {
     method: "POST",
     path: "/api/test/teams-mock/token",
@@ -12552,7 +13334,7 @@ var testTeamsMockContract = c33.router({
 
 // ../../packages/api-contracts/src/contracts/test-teams-state.ts
 init_esm_shims();
-var c34 = initContract();
+var c35 = initContract();
 var testTeamsStateErrorSchema = external_exports.object({
   error: external_exports.string()
 });
@@ -12685,7 +13467,7 @@ var testTeamsStateResponseSchema = external_exports.object({
     })
   )
 });
-var testTeamsStateContract = c34.router({
+var testTeamsStateContract = c35.router({
   get: {
     method: "GET",
     path: "/api/test/teams-state",
@@ -12729,7 +13511,7 @@ var testTeamsStateContract = c34.router({
 
 // ../../packages/api-contracts/src/contracts/test-telegram-state.ts
 init_esm_shims();
-var c35 = initContract();
+var c36 = initContract();
 var testTelegramStateQuerySchema = external_exports.object({
   bot_id: external_exports.string().optional()
 });
@@ -12802,7 +13584,7 @@ var testTelegramStateSeedResponseSchema = external_exports.object({
   user_link_id: external_exports.string().nullable(),
   default_agent_id: external_exports.string()
 });
-var testTelegramStateContract = c35.router({
+var testTelegramStateContract = c36.router({
   get: {
     method: "GET",
     path: "/api/test/telegram-state",
@@ -12851,7 +13633,7 @@ var testTelegramStateContract = c35.router({
 
 // ../../packages/api-contracts/src/contracts/cron.ts
 init_esm_shims();
-var c36 = initContract();
+var c37 = initContract();
 var cleanupResultSchema = external_exports.object({
   runId: external_exports.string(),
   sandboxId: external_exports.string().nullable(),
@@ -12879,7 +13661,7 @@ var cleanupResponseSchema = external_exports.object({
     )
   })
 });
-var cronCleanupSandboxesContract = c36.router({
+var cronCleanupSandboxesContract = c37.router({
   /**
    * GET /api/cron/cleanup-sandboxes
    * Cron job to cleanup sandboxes that have stopped sending heartbeats
@@ -13029,7 +13811,7 @@ var cronAggregateModelStatsResponseSchema = external_exports.object({
   updatedStats: external_exports.number().int().nonnegative(),
   deletedObservations: external_exports.number().int().nonnegative()
 });
-var cronAggregateUsageContract = c36.router({
+var cronAggregateUsageContract = c37.router({
   aggregate: {
     method: "GET",
     path: "/api/cron/aggregate-usage",
@@ -13041,7 +13823,7 @@ var cronAggregateUsageContract = c36.router({
     summary: "Aggregate daily usage cache"
   }
 });
-var cronProcessUsageEventsContract = c36.router({
+var cronProcessUsageEventsContract = c37.router({
   process: {
     method: "GET",
     path: "/api/cron/process-usage-events",
@@ -13053,7 +13835,7 @@ var cronProcessUsageEventsContract = c36.router({
     summary: "Process pending usage events"
   }
 });
-var cronCompactChatThreadSnapshotsContract = c36.router({
+var cronCompactChatThreadSnapshotsContract = c37.router({
   compact: {
     method: "GET",
     path: "/api/cron/compact-chat-thread-snapshots",
@@ -13065,7 +13847,7 @@ var cronCompactChatThreadSnapshotsContract = c36.router({
     summary: "Compact chat thread snapshots from lifecycle events"
   }
 });
-var cronCompactUsageEventsContract = c36.router({
+var cronCompactUsageEventsContract = c37.router({
   compact: {
     method: "GET",
     path: "/api/cron/compact-usage-events",
@@ -13077,7 +13859,7 @@ var cronCompactUsageEventsContract = c36.router({
     summary: "Compact stable usage events into hourly rollups"
   }
 });
-var cronMonitorChatEventQueueContract = c36.router({
+var cronMonitorChatEventQueueContract = c37.router({
   monitor: {
     method: "GET",
     path: "/api/cron/monitor-chat-event-queue",
@@ -13090,7 +13872,7 @@ var cronMonitorChatEventQueueContract = c36.router({
     summary: "Monitor for orphaned queued chat messages"
   }
 });
-var cronReconcileBillingEntitlementsContract = c36.router({
+var cronReconcileBillingEntitlementsContract = c37.router({
   reconcile: {
     method: "GET",
     path: "/api/cron/reconcile-billing-entitlements",
@@ -13102,7 +13884,7 @@ var cronReconcileBillingEntitlementsContract = c36.router({
     summary: "Reconcile billing entitlements"
   }
 });
-var cronTelegramCleanupContract = c36.router({
+var cronTelegramCleanupContract = c37.router({
   cleanup: {
     method: "GET",
     path: "/api/cron/telegram-cleanup",
@@ -13114,7 +13896,7 @@ var cronTelegramCleanupContract = c36.router({
     summary: "Delete expired Telegram messages"
   }
 });
-var cronConnectorOauthStateCleanupContract = c36.router({
+var cronConnectorOauthStateCleanupContract = c37.router({
   cleanup: {
     method: "GET",
     path: "/api/cron/connector-oauth-state-cleanup",
@@ -13126,7 +13908,7 @@ var cronConnectorOauthStateCleanupContract = c36.router({
     summary: "Delete expired connector OAuth states"
   }
 });
-var cronComputerUseScreenshotCleanupContract = c36.router({
+var cronComputerUseScreenshotCleanupContract = c37.router({
   cleanup: {
     method: "GET",
     path: "/api/cron/computer-use-screenshot-cleanup",
@@ -13138,7 +13920,7 @@ var cronComputerUseScreenshotCleanupContract = c36.router({
     summary: "Delete expired desktop computer-use screenshots"
   }
 });
-var cronBrowserReconcileContract = c36.router({
+var cronBrowserReconcileContract = c37.router({
   reconcile: {
     method: "GET",
     path: "/api/cron/reconcile-browsers",
@@ -13150,7 +13932,7 @@ var cronBrowserReconcileContract = c36.router({
     summary: "Reconcile managed browser idle leases and provider state"
   }
 });
-var cronDrainEmailOutboxContract = c36.router({
+var cronDrainEmailOutboxContract = c37.router({
   drain: {
     method: "GET",
     path: "/api/cron/drain-email-outbox",
@@ -13162,7 +13944,7 @@ var cronDrainEmailOutboxContract = c36.router({
     summary: "Drain pending email outbox messages"
   }
 });
-var cronRenewGmailWatchesContract = c36.router({
+var cronRenewGmailWatchesContract = c37.router({
   renew: {
     method: "GET",
     path: "/api/cron/renew-gmail-watches",
@@ -13174,7 +13956,7 @@ var cronRenewGmailWatchesContract = c36.router({
     summary: "Renew Gmail push notification watches"
   }
 });
-var cronRenewGoogleCalendarWatchesContract = c36.router({
+var cronRenewGoogleCalendarWatchesContract = c37.router({
   renew: {
     method: "GET",
     path: "/api/cron/renew-google-calendar-watches",
@@ -13186,7 +13968,7 @@ var cronRenewGoogleCalendarWatchesContract = c36.router({
     summary: "Renew Google Calendar push notification watches"
   }
 });
-var cronRenewGoogleWorkspaceEventSubscriptionsContract = c36.router({
+var cronRenewGoogleWorkspaceEventSubscriptionsContract = c37.router({
   renew: {
     method: "GET",
     path: "/api/cron/renew-google-workspace-event-subscriptions",
@@ -13198,7 +13980,7 @@ var cronRenewGoogleWorkspaceEventSubscriptionsContract = c36.router({
     summary: "Renew Google Workspace Events subscriptions"
   }
 });
-var cronSyncSkillsContract = c36.router({
+var cronSyncSkillsContract = c37.router({
   sync: {
     method: "GET",
     path: "/api/cron/sync-skills",
@@ -13210,7 +13992,7 @@ var cronSyncSkillsContract = c36.router({
     summary: "Sync official skills from the skills repository"
   }
 });
-var cronConnectorCatalogContract = c36.router({
+var cronConnectorCatalogContract = c37.router({
   sync: {
     method: "GET",
     path: "/api/cron/sync-connector-catalog",
@@ -13222,7 +14004,7 @@ var cronConnectorCatalogContract = c36.router({
     summary: "Sync the validated connector catalog snapshot"
   }
 });
-var cronExecuteWorkflowAutomationsContract = c36.router({
+var cronExecuteWorkflowAutomationsContract = c37.router({
   execute: {
     method: "GET",
     path: "/api/cron/execute-workflow-automations",
@@ -13234,7 +14016,7 @@ var cronExecuteWorkflowAutomationsContract = c36.router({
     summary: "Execute due workflow automations"
   }
 });
-var cronExecuteMorningBriefsContract = c36.router({
+var cronExecuteMorningBriefsContract = c37.router({
   execute: {
     method: "GET",
     path: "/api/cron/execute-morning-briefs",
@@ -13246,7 +14028,7 @@ var cronExecuteMorningBriefsContract = c36.router({
     summary: "Execute due morning briefs"
   }
 });
-var cronAggregateInsightsContract = c36.router({
+var cronAggregateInsightsContract = c37.router({
   aggregate: {
     method: "GET",
     path: "/api/cron/aggregate-insights",
@@ -13258,7 +14040,7 @@ var cronAggregateInsightsContract = c36.router({
     summary: "Aggregate daily usage insights"
   }
 });
-var cronAggregateModelStatsContract = c36.router({
+var cronAggregateModelStatsContract = c37.router({
   aggregate: {
     method: "GET",
     path: "/api/cron/aggregate-model-stats",
@@ -13271,7 +14053,7 @@ var cronAggregateModelStatsContract = c36.router({
     summary: "Aggregate hourly model usage statistics"
   }
 });
-var cronRefreshStoragePresignedUrlsContract = c36.router({
+var cronRefreshStoragePresignedUrlsContract = c37.router({
   refresh: {
     method: "GET",
     path: "/api/cron/refresh-storage-presigned-urls",
@@ -13312,7 +14094,7 @@ var variableListResponseSchema = external_exports.object({
 
 // ../../packages/api-contracts/src/contracts/artifact-catalog.ts
 init_esm_shims();
-var c37 = initContract();
+var c38 = initContract();
 var ARTIFACT_CATALOG_KINDS = [
   "file",
   "hosted-site",
@@ -13399,7 +14181,7 @@ var artifactDetailSchema = external_exports.discriminatedUnion("kind", [
     site: artifactHostedSiteSchema
   })
 ]);
-var artifactCatalogContract = c37.router({
+var artifactCatalogContract = c38.router({
   list: {
     method: "GET",
     path: "/api/zero/artifacts/catalog",
@@ -13438,7 +14220,7 @@ var HEX_DIGITS = new Set("0123456789abcdefABCDEF".split(""));
 
 // ../../packages/api-contracts/src/contracts/zero-user-preferences.ts
 init_esm_shims();
-var c38 = initContract();
+var c39 = initContract();
 var sendModeSchema = external_exports.enum(["enter", "cmd-enter"]);
 var SUPPORTED_USER_LOCALES = [
   "en-US",
@@ -13496,7 +14278,7 @@ var updateUserPreferencesRequestSchema = external_exports.object({
     message: "At least one preference must be provided"
   }
 );
-var zeroUserPreferencesContract = c38.router({
+var zeroUserPreferencesContract = c39.router({
   get: {
     method: "GET",
     path: "/api/zero/user-preferences",
@@ -13525,7 +14307,7 @@ var zeroUserPreferencesContract = c38.router({
 
 // ../../packages/api-contracts/src/contracts/zero-feature-switches.ts
 init_esm_shims();
-var c39 = initContract();
+var c40 = initContract();
 var featureSwitchesResponseSchema = external_exports.object({
   switches: external_exports.record(external_exports.string(), external_exports.boolean()),
   effectiveSwitches: external_exports.record(external_exports.string(), external_exports.boolean()),
@@ -13558,7 +14340,7 @@ var featureSwitchesResponseSchema = external_exports.object({
 var updateFeatureSwitchesRequestSchema = external_exports.object({
   switches: external_exports.record(external_exports.string(), external_exports.boolean())
 });
-var zeroFeatureSwitchesContract = c39.router({
+var zeroFeatureSwitchesContract = c40.router({
   get: {
     method: "GET",
     path: "/api/zero/feature-switches",
@@ -13587,7 +14369,7 @@ var zeroFeatureSwitchesContract = c39.router({
     method: "DELETE",
     path: "/api/zero/feature-switches",
     headers: authHeadersSchema,
-    body: c39.noBody(),
+    body: c40.noBody(),
     responses: {
       200: external_exports.object({ deleted: external_exports.literal(true) }),
       401: apiErrorSchema,
@@ -13599,7 +14381,7 @@ var zeroFeatureSwitchesContract = c39.router({
 
 // ../../packages/api-contracts/src/contracts/onboarding.ts
 init_esm_shims();
-var c40 = initContract();
+var c41 = initContract();
 var onboardingStatusResponseSchema = external_exports.object({
   needsOnboarding: external_exports.boolean(),
   onboardingComplete: external_exports.boolean(),
@@ -13614,7 +14396,7 @@ var onboardingStatusResponseSchema = external_exports.object({
     avatarUrl: external_exports.string().optional()
   }).nullable()
 });
-var onboardingStatusContract = c40.router({
+var onboardingStatusContract = c41.router({
   getStatus: {
     method: "GET",
     path: "/api/zero/onboarding/status",
@@ -13626,7 +14408,7 @@ var onboardingStatusContract = c40.router({
     summary: "Get onboarding status for current user"
   }
 });
-var onboardingCompleteContract = c40.router({
+var onboardingCompleteContract = c41.router({
   complete: {
     method: "POST",
     path: "/api/zero/onboarding/complete",
@@ -13654,7 +14436,7 @@ var skillFrontmatterSchema = external_exports.object({
 
 // ../../packages/api-contracts/src/contracts/zero-codex-device-auth.ts
 init_esm_shims();
-var c41 = initContract();
+var c42 = initContract();
 var codexDeviceAuthScopeSchema = external_exports.enum(["org", "personal"]);
 var codexDeviceAuthStartResponseSchema = external_exports.object({
   sessionToken: external_exports.string(),
@@ -13680,7 +14462,7 @@ var codexDeviceAuthCompleteResponseSchema = external_exports.discriminatedUnion(
 var codexDeviceAuthCancelResponseSchema = external_exports.object({
   status: external_exports.literal("cancelled")
 });
-var zeroCodexDeviceAuthContract = c41.router({
+var zeroCodexDeviceAuthContract = c42.router({
   start: {
     method: "POST",
     path: "/api/zero/model-providers/codex/device-auth/sessions",
@@ -13728,7 +14510,7 @@ var zeroCodexDeviceAuthContract = c41.router({
 
 // ../../packages/api-contracts/src/contracts/zero-claude-code-device-auth.ts
 init_esm_shims();
-var c42 = initContract();
+var c43 = initContract();
 var claudeCodeDeviceAuthScopeSchema = external_exports.enum(["org", "personal"]);
 var claudeCodeDeviceAuthStartResponseSchema = external_exports.object({
   sessionToken: external_exports.string(),
@@ -13746,7 +14528,7 @@ var claudeCodeDeviceAuthCompleteResponseSchema = external_exports.object({
 var claudeCodeDeviceAuthCancelResponseSchema = external_exports.object({
   status: external_exports.literal("cancelled")
 });
-var zeroClaudeCodeDeviceAuthContract = c42.router({
+var zeroClaudeCodeDeviceAuthContract = c43.router({
   start: {
     method: "POST",
     path: "/api/zero/model-providers/claude-code/device-auth/sessions",
@@ -13797,12 +14579,12 @@ var zeroClaudeCodeDeviceAuthContract = c42.router({
 
 // ../../packages/api-contracts/src/contracts/zero-org-logo.ts
 init_esm_shims();
-var c43 = initContract();
+var c44 = initContract();
 var zeroOrgLogoResponseSchema = external_exports.object({
   logoUrl: external_exports.string().nullable(),
   hasImage: external_exports.boolean()
 });
-var zeroOrgLogoContract = c43.router({
+var zeroOrgLogoContract = c44.router({
   get: {
     method: "GET",
     path: "/api/zero/org/logo",
@@ -13820,7 +14602,7 @@ var zeroOrgLogoContract = c43.router({
     path: "/api/zero/org/logo",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c43.type(),
+    body: c44.type(),
     responses: {
       200: zeroOrgLogoResponseSchema,
       400: apiErrorSchema,
@@ -13835,8 +14617,8 @@ var zeroOrgLogoContract = c43.router({
 
 // ../../packages/api-contracts/src/contracts/zero-org-members.ts
 init_esm_shims();
-var c44 = initContract();
-var zeroOrgMembersContract = c44.router({
+var c45 = initContract();
+var zeroOrgMembersContract = c45.router({
   members: {
     method: "GET",
     path: "/api/zero/org/members",
@@ -13882,7 +14664,7 @@ var zeroOrgMembersContract = c44.router({
     summary: "Remove a member from the org (zero proxy)"
   }
 });
-var zeroOrgInviteContract = c44.router({
+var zeroOrgInviteContract = c45.router({
   invite: {
     method: "POST",
     path: "/api/zero/org/invite",
@@ -13912,7 +14694,7 @@ var zeroOrgInviteContract = c44.router({
     summary: "Revoke a pending invitation (zero proxy)"
   }
 });
-var zeroOrgMembershipRequestsContract = c44.router({
+var zeroOrgMembershipRequestsContract = c45.router({
   accept: {
     method: "POST",
     path: "/api/zero/org/membership-requests",
@@ -13945,8 +14727,8 @@ var zeroOrgMembershipRequestsContract = c44.router({
 
 // ../../packages/api-contracts/src/contracts/zero-composes.ts
 init_esm_shims();
-var c45 = initContract();
-var zeroComposesListContract = c45.router({
+var c46 = initContract();
+var zeroComposesListContract = c46.router({
   list: {
     method: "GET",
     path: "/api/zero/composes/list",
@@ -13964,11 +14746,267 @@ var zeroComposesListContract = c45.router({
   }
 });
 
+// ../../packages/api-contracts/src/contracts/zero-runs.ts
+init_esm_shims();
+var zeroRunCreateBodySchema = unifiedRunRequestSchema.omit({
+  triggerSource: true,
+  artifacts: true,
+  disallowedTools: true,
+  volumeVersions: true,
+  vars: true,
+  secrets: true,
+  agentComposeId: true,
+  appendSystemPrompt: true,
+  modelProviderType: true,
+  permissionPolicies: true
+}).extend({
+  agentId: external_exports.string().optional(),
+  modelProvider: external_exports.string().optional()
+});
+var c47 = initContract();
+var zeroLogPaginationQuerySchema = createLogPaginationQuerySchema({
+  cursorKind: "sequence"
+});
+var zeroNetworkLogPaginationQuerySchema = createLogPaginationQuerySchema({
+  cursorKind: "time",
+  maxLimit: 500,
+  defaultLimit: 500,
+  defaultOrder: "asc"
+});
+var zeroTelemetryTimePaginationQuerySchema = createLogPaginationQuerySchema({
+  cursorKind: "time"
+});
+var zeroRunsByIdContract = c47.router({
+  getById: {
+    method: "GET",
+    path: "/api/zero/runs/:id",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({
+      id: external_exports.uuid("Run ID must be a valid UUID")
+    }),
+    responses: {
+      200: getRunResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get agent run by ID (zero proxy)"
+  }
+});
+var zeroRunsCancelContract = c47.router({
+  cancel: {
+    method: "POST",
+    path: "/api/zero/runs/:id/cancel",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({
+      id: external_exports.uuid("Run ID must be a valid UUID")
+    }),
+    body: external_exports.undefined(),
+    responses: {
+      200: cancelRunResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Cancel a pending or running run (zero proxy)"
+  }
+});
+var zeroRunsQueueContract = c47.router({
+  getQueue: {
+    method: "GET",
+    path: "/api/zero/runs/queue",
+    headers: authHeadersSchema,
+    responses: {
+      200: queueResponseSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema
+    },
+    summary: "Get org run queue status (zero proxy)"
+  }
+});
+var zeroRunAgentEventsContract = c47.router({
+  getAgentEvents: {
+    method: "GET",
+    path: "/api/zero/runs/:id/telemetry/agent",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({
+      id: external_exports.uuid("Run ID must be a valid UUID")
+    }),
+    query: zeroLogPaginationQuerySchema,
+    responses: {
+      200: agentEventsResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get agent events with pagination (zero proxy)"
+  }
+});
+var zeroRunSystemLogContract = c47.router({
+  getSystemLog: {
+    method: "GET",
+    path: "/api/zero/runs/:id/telemetry/system-log",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({
+      id: external_exports.uuid("Run ID must be a valid UUID")
+    }),
+    query: zeroTelemetryTimePaginationQuerySchema,
+    responses: {
+      200: systemLogResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get system log with pagination"
+  }
+});
+var zeroRunMetricsContract = c47.router({
+  getMetrics: {
+    method: "GET",
+    path: "/api/zero/runs/:id/telemetry/metrics",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({
+      id: external_exports.uuid("Run ID must be a valid UUID")
+    }),
+    query: zeroTelemetryTimePaginationQuerySchema,
+    responses: {
+      200: metricsResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get metrics with pagination"
+  }
+});
+var runContextVolumeSchema = external_exports.object({
+  name: external_exports.string(),
+  mountPath: external_exports.string(),
+  vasStorageName: external_exports.string(),
+  vasVersionId: external_exports.string()
+});
+var runContextArtifactSchema = external_exports.object({
+  mountPath: external_exports.string(),
+  vasStorageName: external_exports.string(),
+  vasVersionId: external_exports.string()
+});
+var runContextSanitizedFirewallSchema = external_exports.object({
+  name: external_exports.string(),
+  apis: external_exports.array(
+    external_exports.object({
+      base: external_exports.string(),
+      permissions: external_exports.array(
+        external_exports.object({
+          name: external_exports.string(),
+          description: external_exports.string().optional(),
+          rules: external_exports.array(external_exports.string())
+        })
+      ).optional()
+    })
+  )
+});
+var runContextFirewallSchema = external_exports.union([
+  executionFirewallBuiltinEntrySchema,
+  runContextSanitizedFirewallSchema
+]);
+var runContextResponseSchema = external_exports.object({
+  prompt: external_exports.string(),
+  appendSystemPrompt: external_exports.string().nullable(),
+  runId: external_exports.string(),
+  sessionId: external_exports.string().nullable(),
+  cliAgentType: external_exports.string().optional(),
+  secretNames: external_exports.array(external_exports.string()),
+  vars: external_exports.record(external_exports.string(), external_exports.string()).nullable(),
+  environment: external_exports.record(external_exports.string(), external_exports.string()),
+  firewalls: external_exports.array(runContextFirewallSchema),
+  networkPolicies: networkPoliciesSchema.nullable(),
+  volumes: external_exports.array(runContextVolumeSchema),
+  artifact: runContextArtifactSchema.nullable(),
+  featureFlags: external_exports.record(external_exports.string(), external_exports.boolean()).nullable()
+});
+var zeroRunContextContract = c47.router({
+  getContext: {
+    method: "GET",
+    path: "/api/zero/runs/:id/context",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({
+      id: external_exports.uuid("Run ID must be a valid UUID")
+    }),
+    responses: {
+      200: runContextResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get run execution context snapshot for debugging"
+  }
+});
+var zeroRunNetworkLogsContract = c47.router({
+  getNetworkLogs: {
+    method: "GET",
+    path: "/api/zero/runs/:id/network",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({
+      id: external_exports.uuid("Run ID must be a valid UUID")
+    }),
+    query: zeroNetworkLogPaginationQuerySchema,
+    responses: {
+      200: networkLogsResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get network logs for a run"
+  }
+});
+var runRunnerResponseSchema = external_exports.object({
+  sandboxReuseResult: sandboxReuseResultSchema.nullable()
+});
+var zeroRunRunnerContract = c47.router({
+  getRunner: {
+    method: "GET",
+    path: "/api/zero/runs/:id/runner",
+    headers: authHeadersSchema,
+    pathParams: external_exports.object({
+      id: external_exports.uuid("Run ID must be a valid UUID")
+    }),
+    responses: {
+      200: runRunnerResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      404: apiErrorSchema
+    },
+    summary: "Get runner-level metadata for a run"
+  }
+});
+var zeroLogsSearchContract = c47.router({
+  searchLogs: {
+    method: "GET",
+    path: "/api/zero/logs/search",
+    headers: authHeadersSchema,
+    query: logsSearchQuerySchema,
+    responses: {
+      200: logsSearchResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema
+    },
+    summary: "Search agent events across runs (zero proxy)"
+  }
+});
+
 // ../../packages/api-contracts/src/contracts/zero-model-providers.ts
 init_esm_shims();
-var c46 = initContract();
+var c48 = initContract();
 var orgUpsertModelProviderRequestSchema = upsertModelProviderRequestSchema.omit({ selectedModel: true });
-var zeroModelProvidersMainContract = c46.router({
+var zeroModelProvidersMainContract = c48.router({
   list: {
     method: "GET",
     path: "/api/zero/model-providers",
@@ -13997,7 +15035,7 @@ var zeroModelProvidersMainContract = c46.router({
     summary: "Create or update an org-level model provider (admin only)"
   }
 });
-var zeroModelProvidersByTypeContract = c46.router({
+var zeroModelProvidersByTypeContract = c48.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/model-providers/:type",
@@ -14006,7 +15044,7 @@ var zeroModelProvidersByTypeContract = c46.router({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c46.noBody(),
+      204: c48.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -14018,14 +15056,14 @@ var zeroModelProvidersByTypeContract = c46.router({
 
 // ../../packages/api-contracts/src/contracts/zero-personal-model-providers.ts
 init_esm_shims();
-var c47 = initContract();
+var c49 = initContract();
 var resetPersonalModelProviderSubscriptionUsageRequestSchema = external_exports.object({
   idempotencyKey: external_exports.uuid()
 });
 var resetPersonalModelProviderSubscriptionUsageResponseSchema = external_exports.object({
   outcome: external_exports.enum(["reset", "nothingToReset", "noCredit", "alreadyRedeemed"])
 });
-var zeroPersonalModelProvidersMainContract = c47.router({
+var zeroPersonalModelProvidersMainContract = c49.router({
   list: {
     method: "GET",
     path: "/api/zero/me/model-providers",
@@ -14054,7 +15092,7 @@ var zeroPersonalModelProvidersMainContract = c47.router({
     summary: "Create or update a personal model provider for the requesting user"
   }
 });
-var zeroPersonalModelProvidersByTypeContract = c47.router({
+var zeroPersonalModelProvidersByTypeContract = c49.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/me/model-providers/:type",
@@ -14063,7 +15101,7 @@ var zeroPersonalModelProvidersByTypeContract = c47.router({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c47.noBody(),
+      204: c49.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -14091,7 +15129,7 @@ var zeroPersonalModelProvidersByTypeContract = c47.router({
 
 // ../../packages/api-contracts/src/contracts/integrations-github.ts
 init_esm_shims();
-var c48 = initContract();
+var c50 = initContract();
 var githubInstallationResponseSchema = external_exports.object({
   installation: external_exports.object({
     id: external_exports.string(),
@@ -14122,7 +15160,7 @@ var githubConnectSignatureSchema = external_exports.object({
 var githubConnectUserBodySchema = external_exports.object({
   connectSignature: githubConnectSignatureSchema.optional()
 }).optional();
-var integrationsGithubContract = c48.router({
+var integrationsGithubContract = c50.router({
   getInstallation: {
     method: "GET",
     path: "/api/integrations/github",
@@ -14156,7 +15194,7 @@ var integrationsGithubContract = c48.router({
 
 // ../../packages/api-contracts/src/contracts/github-oauth.ts
 init_esm_shims();
-var c49 = initContract();
+var c51 = initContract();
 var jsonErrorSchema = external_exports.object({ error: external_exports.string() });
 var githubOauthInstallQuerySchema = external_exports.object({
   vm0UserId: external_exports.string().optional(),
@@ -14186,13 +15224,13 @@ var githubAppSetupCallbackQuerySchema = external_exports.object({
   target_id: external_exports.string().optional(),
   target_type: external_exports.string().optional()
 });
-var githubOauthContract = c49.router({
+var githubOauthContract = c51.router({
   install: {
     method: "GET",
     path: "/api/github/oauth/install",
     query: githubOauthInstallQuerySchema,
     responses: {
-      307: c49.noBody(),
+      307: c51.noBody(),
       503: jsonErrorSchema
     },
     summary: "Start GitHub App OAuth install"
@@ -14202,7 +15240,7 @@ var githubOauthContract = c49.router({
     path: "/api/zero/github/oauth/connect",
     query: githubOauthConnectQuerySchema,
     responses: {
-      307: c49.noBody(),
+      307: c51.noBody(),
       401: apiErrorSchema,
       503: jsonErrorSchema
     },
@@ -14213,7 +15251,7 @@ var githubOauthContract = c49.router({
     path: "/api/zero/github/oauth/connect/callback",
     query: githubOauthConnectCallbackQuerySchema,
     responses: {
-      307: c49.noBody()
+      307: c51.noBody()
     },
     summary: "Handle GitHub user OAuth for the GitHub App"
   },
@@ -14222,7 +15260,7 @@ var githubOauthContract = c49.router({
     path: "/api/github/app/setup/callback",
     query: githubAppSetupCallbackQuerySchema,
     responses: {
-      307: c49.noBody()
+      307: c51.noBody()
     },
     summary: "Handle GitHub App setup callback"
   }
@@ -14233,7 +15271,7 @@ init_esm_shims();
 
 // ../../packages/api-contracts/src/contracts/zero-usage-record.ts
 init_esm_shims();
-var c50 = initContract();
+var c52 = initContract();
 var usageRecordSourceSchema = external_exports.enum([
   "chat",
   "automation",
@@ -14310,7 +15348,7 @@ var usageRecordResponseSchema = external_exports.object({
     total: external_exports.number()
   })
 });
-var zeroUsageRecordContract = c50.router({
+var zeroUsageRecordContract = c52.router({
   get: {
     method: "GET",
     path: "/api/zero/usage/record",
@@ -14335,7 +15373,7 @@ var zeroUsageRecordContract = c50.router({
 });
 
 // ../../packages/api-contracts/src/contracts/zero-usage.ts
-var c51 = initContract();
+var c53 = initContract();
 var memberUsageSchema = external_exports.object({
   userId: external_exports.string(),
   email: external_exports.string(),
@@ -14352,7 +15390,7 @@ var usageMembersResponseSchema = external_exports.object({
   }).nullable(),
   members: external_exports.array(memberUsageSchema)
 });
-var zeroUsageMembersContract = c51.router({
+var zeroUsageMembersContract = c53.router({
   get: {
     method: "GET",
     path: "/api/zero/usage/members",
@@ -14374,7 +15412,7 @@ var zeroUsageMembersContract = c51.router({
 
 // ../../packages/api-contracts/src/contracts/zero-usage-daily.ts
 init_esm_shims();
-var c52 = initContract();
+var c54 = initContract();
 var usageRunSchema = external_exports.object({
   runId: external_exports.string(),
   agentName: external_exports.string().nullable(),
@@ -14401,7 +15439,7 @@ var usageRunsResponseSchema = external_exports.object({
     total: external_exports.number()
   })
 });
-var zeroUsageRunsContract = c52.router({
+var zeroUsageRunsContract = c54.router({
   get: {
     method: "GET",
     path: "/api/zero/usage/runs",
@@ -14429,7 +15467,7 @@ var zeroUsageRunsContract = c52.router({
 
 // ../../packages/api-contracts/src/contracts/zero-usage-insight.ts
 init_esm_shims();
-var c53 = initContract();
+var c55 = initContract();
 var usageInsightBucketSchema = external_exports.object({
   ts: external_exports.string(),
   // ISO string for the bucket start
@@ -14466,7 +15504,7 @@ var usageInsightResponseSchema = external_exports.object({
   grandTotalCredits: external_exports.number(),
   grandTotalTokens: external_exports.number()
 });
-var zeroUsageInsightContract = c53.router({
+var zeroUsageInsightContract = c55.router({
   get: {
     method: "GET",
     path: "/api/zero/usage/insight",
@@ -14489,7 +15527,7 @@ var zeroUsageInsightContract = c53.router({
 
 // ../../packages/api-contracts/src/contracts/usage.ts
 init_esm_shims();
-var c54 = initContract();
+var c56 = initContract();
 var dailyUsageSchema = external_exports.object({
   date: external_exports.string(),
   run_count: external_exports.number(),
@@ -14506,7 +15544,7 @@ var usageResponseSchema = external_exports.object({
   }),
   daily: external_exports.array(dailyUsageSchema)
 });
-var usageContract = c54.router({
+var usageContract = c56.router({
   get: {
     method: "GET",
     path: "/api/usage",
@@ -14527,7 +15565,7 @@ var usageContract = c54.router({
 
 // ../../packages/api-contracts/src/contracts/zero-team.ts
 init_esm_shims();
-var c55 = initContract();
+var c57 = initContract();
 var teamComposeItemSchema = external_exports.object({
   id: external_exports.string(),
   ownerId: external_exports.string().optional(),
@@ -14539,7 +15577,7 @@ var teamComposeItemSchema = external_exports.object({
   headVersionId: external_exports.string().nullable(),
   updatedAt: external_exports.string()
 });
-var zeroTeamContract = c55.router({
+var zeroTeamContract = c57.router({
   list: {
     method: "GET",
     path: "/api/zero/team",
@@ -14556,7 +15594,7 @@ var zeroTeamContract = c55.router({
 
 // ../../packages/api-contracts/src/contracts/zero-integrations-slack.ts
 init_esm_shims();
-var c56 = initContract();
+var c58 = initContract();
 var slackEnvironmentSchema = external_exports.object({
   requiredSecrets: external_exports.array(external_exports.string()),
   requiredVars: external_exports.array(external_exports.string()),
@@ -14577,7 +15615,7 @@ var slackOrgStatusSchema = external_exports.object({
   /** OAuth install URL for re-authorization (admin-only, when scopeMismatch). */
   reinstallUrl: external_exports.string().nullable().optional()
 });
-var zeroIntegrationsSlackContract = c56.router({
+var zeroIntegrationsSlackContract = c58.router({
   getStatus: {
     method: "GET",
     path: "/api/zero/integrations/slack",
@@ -14592,7 +15630,7 @@ var zeroIntegrationsSlackContract = c56.router({
     method: "DELETE",
     path: "/api/zero/integrations/slack",
     headers: authHeadersSchema,
-    body: c56.noBody(),
+    body: c58.noBody(),
     query: external_exports.object({
       action: external_exports.string().optional()
     }),
@@ -14608,7 +15646,7 @@ var zeroIntegrationsSlackContract = c56.router({
 
 // ../../packages/api-contracts/src/contracts/zero-slack-connect.ts
 init_esm_shims();
-var c57 = initContract();
+var c59 = initContract();
 var slackConnectStatusSchema = external_exports.object({
   isConnected: external_exports.boolean(),
   isAdmin: external_exports.boolean(),
@@ -14620,7 +15658,7 @@ var slackConnectResponseSchema = external_exports.object({
   connectionId: external_exports.string(),
   role: external_exports.string()
 });
-var zeroSlackConnectContract = c57.router({
+var zeroSlackConnectContract = c59.router({
   getStatus: {
     method: "GET",
     path: "/api/zero/integrations/slack/connect",
@@ -14654,12 +15692,12 @@ var zeroSlackConnectContract = c57.router({
 
 // ../../packages/api-contracts/src/contracts/zero-slack-commands.ts
 init_esm_shims();
-var c58 = initContract();
-var zeroSlackCommandsContract = c58.router({
+var c60 = initContract();
+var zeroSlackCommandsContract = c60.router({
   post: {
     method: "POST",
     path: "/api/zero/slack/commands",
-    body: c58.type(),
+    body: c60.type(),
     responses: {
       200: external_exports.unknown(),
       400: external_exports.object({ error: external_exports.string() }),
@@ -14672,12 +15710,12 @@ var zeroSlackCommandsContract = c58.router({
 
 // ../../packages/api-contracts/src/contracts/zero-slack-events.ts
 init_esm_shims();
-var c59 = initContract();
-var zeroSlackEventsContract = c59.router({
+var c61 = initContract();
+var zeroSlackEventsContract = c61.router({
   post: {
     method: "POST",
     path: "/api/zero/slack/events",
-    body: c59.type(),
+    body: c61.type(),
     responses: {
       200: external_exports.unknown(),
       400: external_exports.object({ error: external_exports.string() }),
@@ -14690,7 +15728,7 @@ var zeroSlackEventsContract = c59.router({
 
 // ../../packages/api-contracts/src/contracts/zero-teams-bot.ts
 init_esm_shims();
-var c60 = initContract();
+var c62 = initContract();
 var teamsActorSchema = external_exports.object({
   id: external_exports.string(),
   name: external_exports.string().nullable(),
@@ -14792,7 +15830,7 @@ var teamsBotIngressResponseSchema = external_exports.object({
   connectUrl: external_exports.string().nullable().optional(),
   dispatch: teamsBotDispatchResponseSchema.optional()
 });
-var zeroTeamsBotContract = c60.router({
+var zeroTeamsBotContract = c62.router({
   post: {
     method: "POST",
     path: "/api/zero/teams/bot",
@@ -14810,7 +15848,7 @@ var zeroTeamsBotContract = c60.router({
 
 // ../../packages/api-contracts/src/contracts/zero-teams-connect.ts
 init_esm_shims();
-var c61 = initContract();
+var c63 = initContract();
 var nullableStringSchema = external_exports.string().nullable();
 var teamsEnvironmentSchema = external_exports.object({
   requiredSecrets: external_exports.array(external_exports.string()),
@@ -14865,7 +15903,7 @@ var teamsConnectResponseSchema = external_exports.object({
 var teamsDisconnectResponseSchema = external_exports.object({
   success: external_exports.literal(true)
 });
-var zeroTeamsConnectContract = c61.router({
+var zeroTeamsConnectContract = c63.router({
   getStatus: {
     method: "GET",
     path: "/api/zero/integrations/teams/connect",
@@ -14909,7 +15947,7 @@ var zeroTeamsConnectContract = c61.router({
 
 // ../../packages/api-contracts/src/contracts/zero-teams-browser-connect.ts
 init_esm_shims();
-var c62 = initContract();
+var c64 = initContract();
 var zeroTeamsBrowserConnectQuerySchema = external_exports.object({
   tenantId: external_exports.string().optional(),
   tenantName: external_exports.string().optional(),
@@ -14929,13 +15967,13 @@ var zeroTeamsBrowserConnectQuerySchema = external_exports.object({
   threadId: external_exports.string().optional(),
   orgId: external_exports.string().optional()
 });
-var zeroTeamsBrowserConnectContract = c62.router({
+var zeroTeamsBrowserConnectContract = c64.router({
   connect: {
     method: "GET",
     path: "/api/zero/teams/connect",
     query: zeroTeamsBrowserConnectQuerySchema,
     responses: {
-      307: c62.noBody(),
+      307: c64.noBody(),
       500: external_exports.object({ error: external_exports.string() })
     },
     summary: "Browser Microsoft Teams connect flow"
@@ -14944,7 +15982,7 @@ var zeroTeamsBrowserConnectContract = c62.router({
 
 // ../../packages/api-contracts/src/contracts/zero-teams-oauth.ts
 init_esm_shims();
-var c63 = initContract();
+var c65 = initContract();
 var jsonErrorSchema2 = external_exports.object({ error: external_exports.string() });
 var zeroTeamsOauthConnectQuerySchema = external_exports.object({
   orgId: external_exports.string().optional(),
@@ -14957,13 +15995,13 @@ var zeroTeamsOauthCallbackQuerySchema = external_exports.object({
   error_description: external_exports.string().optional(),
   state: external_exports.string().optional()
 });
-var zeroTeamsOauthContract = c63.router({
+var zeroTeamsOauthContract = c65.router({
   connect: {
     method: "GET",
     path: "/api/zero/teams/oauth/connect",
     query: zeroTeamsOauthConnectQuerySchema,
     responses: {
-      307: c63.noBody(),
+      307: c65.noBody(),
       400: jsonErrorSchema2,
       503: jsonErrorSchema2
     },
@@ -14974,7 +16012,7 @@ var zeroTeamsOauthContract = c63.router({
     path: "/api/zero/teams/oauth/callback",
     query: zeroTeamsOauthCallbackQuerySchema,
     responses: {
-      307: c63.noBody(),
+      307: c65.noBody(),
       400: jsonErrorSchema2,
       503: jsonErrorSchema2
     },
@@ -14984,12 +16022,12 @@ var zeroTeamsOauthContract = c63.router({
 
 // ../../packages/api-contracts/src/contracts/zero-slack-interactive.ts
 init_esm_shims();
-var c64 = initContract();
-var zeroSlackInteractiveContract = c64.router({
+var c66 = initContract();
+var zeroSlackInteractiveContract = c66.router({
   post: {
     method: "POST",
     path: "/api/zero/slack/interactive",
-    body: c64.type(),
+    body: c66.type(),
     responses: {
       200: external_exports.unknown(),
       400: external_exports.object({ error: external_exports.string() }),
@@ -15002,7 +16040,7 @@ var zeroSlackInteractiveContract = c64.router({
 
 // ../../packages/api-contracts/src/contracts/zero-slack-oauth.ts
 init_esm_shims();
-var c65 = initContract();
+var c67 = initContract();
 var jsonErrorSchema3 = external_exports.object({ error: external_exports.string() });
 var zeroSlackOauthInstallQuerySchema = external_exports.object({
   orgId: external_exports.string().optional(),
@@ -15020,13 +16058,13 @@ var zeroSlackOauthCallbackQuerySchema = external_exports.object({
   error: external_exports.string().optional(),
   state: external_exports.string().optional()
 });
-var zeroSlackOauthContract = c65.router({
+var zeroSlackOauthContract = c67.router({
   install: {
     method: "GET",
     path: "/api/zero/slack/oauth/install",
     query: zeroSlackOauthInstallQuerySchema,
     responses: {
-      307: c65.noBody(),
+      307: c67.noBody(),
       503: jsonErrorSchema3
     },
     summary: "Start Slack bot OAuth install"
@@ -15036,7 +16074,7 @@ var zeroSlackOauthContract = c65.router({
     path: "/api/zero/slack/oauth/connect",
     query: zeroSlackOauthConnectQuerySchema,
     responses: {
-      307: c65.noBody(),
+      307: c67.noBody(),
       400: jsonErrorSchema3,
       404: jsonErrorSchema3,
       503: jsonErrorSchema3
@@ -15048,7 +16086,7 @@ var zeroSlackOauthContract = c65.router({
     path: "/api/zero/slack/oauth/callback",
     query: zeroSlackOauthCallbackQuerySchema,
     responses: {
-      307: c65.noBody(),
+      307: c67.noBody(),
       400: jsonErrorSchema3,
       503: jsonErrorSchema3
     },
@@ -15058,12 +16096,12 @@ var zeroSlackOauthContract = c65.router({
 
 // ../../packages/api-contracts/src/contracts/zero-slack-channels.ts
 init_esm_shims();
-var c66 = initContract();
+var c68 = initContract();
 var slackChannelSchema = external_exports.object({
   id: external_exports.string(),
   name: external_exports.string()
 });
-var zeroSlackChannelsContract = c66.router({
+var zeroSlackChannelsContract = c68.router({
   list: {
     method: "GET",
     path: "/api/zero/slack/channels",
@@ -15079,12 +16117,12 @@ var zeroSlackChannelsContract = c66.router({
 
 // ../../packages/api-contracts/src/contracts/zero-queue-position.ts
 init_esm_shims();
-var c67 = initContract();
+var c69 = initContract();
 var queuePositionResponseSchema = external_exports.object({
   position: external_exports.number(),
   total: external_exports.number()
 });
-var zeroQueuePositionContract = c67.router({
+var zeroQueuePositionContract = c69.router({
   getPosition: {
     method: "GET",
     path: "/api/zero/queue-position",
@@ -15104,7 +16142,7 @@ var zeroQueuePositionContract = c67.router({
 
 // ../../packages/api-contracts/src/contracts/zero-report-error.ts
 init_esm_shims();
-var c68 = initContract();
+var c70 = initContract();
 var reportErrorBodySchema = external_exports.object({
   runId: external_exports.uuid("Run ID must be a valid UUID"),
   title: external_exports.string().min(1, "Title is required"),
@@ -15113,7 +16151,7 @@ var reportErrorBodySchema = external_exports.object({
 var reportErrorResponseSchema = external_exports.object({
   reference: external_exports.string()
 });
-var zeroReportErrorContract = c68.router({
+var zeroReportErrorContract = c70.router({
   submit: {
     method: "POST",
     path: "/api/zero/report-error",
@@ -15132,7 +16170,7 @@ var zeroReportErrorContract = c68.router({
 
 // ../../packages/api-contracts/src/contracts/zero-insights.ts
 init_esm_shims();
-var c69 = initContract();
+var c71 = initContract();
 var insightAgentSchema = external_exports.object({
   agentName: external_exports.string(),
   agentId: external_exports.string().nullable(),
@@ -15192,7 +16230,7 @@ var insightsResponseSchema = external_exports.object({
   totalRuns: external_exports.number(),
   lastUpdated: external_exports.string().nullable()
 });
-var zeroInsightsContract = c69.router({
+var zeroInsightsContract = c71.router({
   get: {
     method: "GET",
     path: "/api/zero/insights",
@@ -15210,8 +16248,8 @@ var zeroInsightsContract = c69.router({
 
 // ../../packages/api-contracts/src/contracts/push-subscriptions.ts
 init_esm_shims();
-var c70 = initContract();
-var pushSubscriptionsContract = c70.router({
+var c72 = initContract();
+var pushSubscriptionsContract = c72.router({
   register: {
     method: "POST",
     path: "/api/zero/push-subscriptions",
@@ -15235,7 +16273,7 @@ var pushSubscriptionsContract = c70.router({
 
 // ../../packages/api-contracts/src/contracts/zero-image-io-generate.ts
 init_esm_shims();
-var c71 = initContract();
+var c73 = initContract();
 var stringOrStringArraySchema = external_exports.union([
   external_exports.string(),
   external_exports.array(external_exports.string()).readonly()
@@ -15290,7 +16328,7 @@ var zeroImageIoGenerateResponseSchema = external_exports.object({
   inputFidelity: external_exports.string().optional(),
   imagePromptStrength: external_exports.number().optional()
 });
-var zeroImageIoGenerateContract = c71.router({
+var zeroImageIoGenerateContract = c73.router({
   post: {
     method: "POST",
     path: "/api/zero/image-io/generate",
@@ -15313,7 +16351,7 @@ var zeroImageIoGenerateContract = c71.router({
 
 // ../../packages/api-contracts/src/contracts/zero-image-io-interpret-marks.ts
 init_esm_shims();
-var c72 = initContract();
+var c74 = initContract();
 var ZERO_IMAGE_INTERPRET_MARKS_MAX_REGIONS = 16;
 var ZERO_IMAGE_INTERPRET_MARKS_MAX_INSTRUCTION_LENGTH = 2e3;
 var zeroImageIoInterpretMarksRegionSchema = external_exports.object({
@@ -15340,7 +16378,7 @@ var zeroImageIoInterpretMarksResultSchema = external_exports.object({
 var zeroImageIoInterpretMarksResponseSchema = external_exports.object({
   regions: external_exports.array(zeroImageIoInterpretMarksResultSchema)
 });
-var zeroImageIoInterpretMarksContract = c72.router({
+var zeroImageIoInterpretMarksContract = c74.router({
   post: {
     method: "POST",
     path: "/api/zero/image-io/interpret-marks",
@@ -15362,7 +16400,7 @@ var zeroImageIoInterpretMarksContract = c72.router({
 
 // ../../packages/api-contracts/src/contracts/zero-image-share-x.ts
 init_esm_shims();
-var c73 = initContract();
+var c75 = initContract();
 var zeroImageShareXRequestSchema = external_exports.object({
   imageUrl: external_exports.string().min(1),
   caption: external_exports.string().max(280).optional()
@@ -15371,7 +16409,7 @@ var zeroImageShareXResponseSchema = external_exports.object({
   tweetId: external_exports.string(),
   tweetUrl: external_exports.string()
 });
-var zeroImageShareXContract = c73.router({
+var zeroImageShareXContract = c75.router({
   post: {
     method: "POST",
     path: "/api/zero/image-share/x",
@@ -15392,7 +16430,7 @@ var zeroImageShareXContract = c73.router({
 
 // ../../packages/api-contracts/src/contracts/zero-banking.ts
 init_esm_shims();
-var c74 = initContract();
+var c76 = initContract();
 var dateOnlySchema = external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be formatted as YYYY-MM-DD");
 var zeroBankingProviderSchema = external_exports.literal("finicity");
 var zeroBankingAccountSchema = external_exports.object({
@@ -15474,7 +16512,7 @@ var zeroBankingTransactionsResponses = {
   502: apiErrorSchema,
   503: apiErrorSchema
 };
-var zeroBankingContract = c74.router({
+var zeroBankingContract = c76.router({
   accounts: {
     method: "POST",
     path: "/api/zero/banking/accounts",
@@ -15503,7 +16541,7 @@ var zeroBankingContract = c74.router({
 
 // ../../packages/api-contracts/src/contracts/zero-maps.ts
 init_esm_shims();
-var c75 = initContract();
+var c77 = initContract();
 var travelModeSchema = external_exports.enum(["driving", "walking", "bicycling", "transit"]);
 var placeSearchFieldsetSchema = external_exports.enum(["pro", "enterprise"]);
 var placeDetailFieldsetSchema = external_exports.enum(["essentials", "pro", "enterprise"]);
@@ -15611,7 +16649,7 @@ var mapsResponses = {
   502: apiErrorSchema,
   503: apiErrorSchema
 };
-var zeroMapsContract = c75.router({
+var zeroMapsContract = c77.router({
   geocode: {
     method: "POST",
     path: "/api/zero/maps/geocode",
@@ -15672,7 +16710,7 @@ var zeroMapsContract = c75.router({
 
 // ../../packages/api-contracts/src/contracts/zero-weather.ts
 init_esm_shims();
-var c76 = initContract();
+var c78 = initContract();
 var ZERO_WEATHER_ATTRIBUTION = "Source: Includes weather data from Google";
 var ZERO_AIR_QUALITY_ATTRIBUTION = "Source: Includes air quality data from Google";
 var zeroWeatherConditionsOperationSchema = external_exports.enum([
@@ -15751,7 +16789,7 @@ var airQualityResponses = {
   502: apiErrorSchema,
   503: apiErrorSchema
 };
-var zeroWeatherContract = c76.router({
+var zeroWeatherContract = c78.router({
   current: {
     method: "POST",
     path: "/api/zero/weather/current",
@@ -15796,7 +16834,7 @@ var zeroWeatherContract = c76.router({
 
 // ../../packages/api-contracts/src/contracts/zero-video-io-generate.ts
 init_esm_shims();
-var c77 = initContract();
+var c79 = initContract();
 var stringOrStringArraySchema2 = external_exports.union([
   external_exports.string(),
   external_exports.array(external_exports.string()).readonly()
@@ -15837,7 +16875,7 @@ var zeroVideoIoGenerateResponseSchema = external_exports.object({
   sourceUrl: external_exports.string(),
   requestId: external_exports.string().optional()
 });
-var zeroVideoIoGenerateContract = c77.router({
+var zeroVideoIoGenerateContract = c79.router({
   post: {
     method: "POST",
     path: "/api/zero/video-io/generate",
@@ -15861,13 +16899,13 @@ var zeroVideoIoGenerateContract = c77.router({
 
 // ../../packages/api-contracts/src/contracts/zero-voice-io-quota.ts
 init_esm_shims();
-var c78 = initContract();
+var c80 = initContract();
 var audioInputQuotaResponseSchema = external_exports.object({
   allowed: external_exports.boolean(),
   count: external_exports.number().int().nonnegative(),
   limit: external_exports.number().int().nonnegative().nullable()
 });
-var zeroVoiceIoQuotaContract = c78.router({
+var zeroVoiceIoQuotaContract = c80.router({
   get: {
     method: "GET",
     path: "/api/zero/voice-io/quota",
@@ -15883,7 +16921,7 @@ var zeroVoiceIoQuotaContract = c78.router({
 
 // ../../packages/api-contracts/src/contracts/zero-voice-io-speech.ts
 init_esm_shims();
-var c79 = initContract();
+var c81 = initContract();
 var zeroVoiceIoSpeechRequestSchema = external_exports.object({
   text: external_exports.string().optional(),
   voice: external_exports.string().optional(),
@@ -15900,7 +16938,7 @@ var zeroVoiceIoSpeechResponseSchema = external_exports.object({
   model: external_exports.string(),
   voice: external_exports.string()
 });
-var zeroVoiceIoSpeechContract = c79.router({
+var zeroVoiceIoSpeechContract = c81.router({
   post: {
     method: "POST",
     path: "/api/zero/voice-io/speech",
@@ -15922,7 +16960,7 @@ var zeroVoiceIoSpeechContract = c79.router({
 
 // ../../packages/api-contracts/src/contracts/zero-voice-io-stt.ts
 init_esm_shims();
-var c80 = initContract();
+var c82 = initContract();
 var zeroVoiceIoSttSegmentSchema = external_exports.object({
   start: external_exports.number(),
   end: external_exports.number(),
@@ -15938,13 +16976,13 @@ var zeroVoiceIoSttQuotaErrorSchema = apiErrorSchema.extend({
     limit: external_exports.number().nullable()
   }).optional()
 });
-var zeroVoiceIoSttContract = c80.router({
+var zeroVoiceIoSttContract = c82.router({
   post: {
     method: "POST",
     path: "/api/zero/voice-io/stt",
     headers: authHeadersSchema,
     contentType: "multipart/form-data",
-    body: c80.type(),
+    body: c82.type(),
     query: external_exports.object({
       verbose: external_exports.coerce.boolean().optional().default(false)
     }),
@@ -15964,7 +17002,7 @@ var zeroVoiceIoSttContract = c80.router({
 
 // ../../packages/api-contracts/src/contracts/zero-uploads.ts
 init_esm_shims();
-var c81 = initContract();
+var c83 = initContract();
 var prepareRequestSchema = external_exports.object({
   filename: external_exports.string().min(1).max(255),
   contentType: external_exports.string().min(1).max(200),
@@ -16040,7 +17078,7 @@ var completeResponseSchema = external_exports.object({
   size: external_exports.number(),
   url: external_exports.string().url()
 });
-var zeroUploadsContract = c81.router({
+var zeroUploadsContract = c83.router({
   prepare: {
     method: "POST",
     path: "/api/zero/uploads/prepare",
@@ -16121,7 +17159,7 @@ var zeroUploadsContract = c81.router({
 
 // ../../packages/api-contracts/src/contracts/zero-integrations-telegram.ts
 init_esm_shims();
-var c82 = initContract();
+var c84 = initContract();
 var telegramEnvironmentSchema = external_exports.object({
   requiredSecrets: external_exports.array(external_exports.string()),
   requiredVars: external_exports.array(external_exports.string()),
@@ -16220,7 +17258,7 @@ var telegramSetupStatusSchema = external_exports.object({
 var telegramWebhookPathParamsSchema = external_exports.object({
   telegramBotId: external_exports.string().min(1)
 });
-var zeroIntegrationsTelegramContract = c82.router({
+var zeroIntegrationsTelegramContract = c84.router({
   list: {
     method: "GET",
     path: "/api/integrations/telegram",
@@ -16251,9 +17289,9 @@ var zeroIntegrationsTelegramContract = c82.router({
     path: "/api/integrations/telegram/:botId",
     headers: authHeadersSchema,
     pathParams: external_exports.object({ botId: external_exports.string().min(1) }),
-    body: c82.noBody(),
+    body: c84.noBody(),
     responses: {
-      204: c82.noBody(),
+      204: c84.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -16264,10 +17302,10 @@ var zeroIntegrationsTelegramContract = c82.router({
     method: "DELETE",
     path: "/api/integrations/telegram/link",
     headers: authHeadersSchema,
-    body: c82.noBody(),
+    body: c84.noBody(),
     query: external_exports.object({ botId: external_exports.string().optional() }),
     responses: {
-      204: c82.noBody(),
+      204: c84.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -16298,7 +17336,7 @@ var zeroIntegrationsTelegramContract = c82.router({
       sig: external_exports.string().optional()
     }),
     responses: {
-      200: c82.otherResponse({
+      200: c84.otherResponse({
         contentType: "application/octet-stream",
         body: external_exports.unknown()
       }),
@@ -16313,7 +17351,7 @@ var zeroIntegrationsTelegramContract = c82.router({
     method: "GET",
     path: "/api/integrations/telegram/auth-callback",
     responses: {
-      200: c82.otherResponse({
+      200: c84.otherResponse({
         contentType: "text/html",
         body: external_exports.unknown()
       })
@@ -16372,19 +17410,19 @@ var zeroIntegrationsTelegramContract = c82.router({
     pathParams: telegramWebhookPathParamsSchema,
     body: external_exports.unknown(),
     responses: {
-      200: c82.otherResponse({
+      200: c84.otherResponse({
         contentType: "text/plain",
         body: external_exports.string()
       }),
-      400: c82.otherResponse({
+      400: c84.otherResponse({
         contentType: "text/plain",
         body: external_exports.string()
       }),
-      401: c82.otherResponse({
+      401: c84.otherResponse({
         contentType: "text/plain",
         body: external_exports.string()
       }),
-      404: c82.otherResponse({
+      404: c84.otherResponse({
         contentType: "text/plain",
         body: external_exports.string()
       })
@@ -16395,7 +17433,7 @@ var zeroIntegrationsTelegramContract = c82.router({
 
 // ../../packages/api-contracts/src/contracts/zero-integrations-agentphone.ts
 init_esm_shims();
-var c83 = initContract();
+var c85 = initContract();
 var agentPhoneConnectBodySchema = external_exports.object({
   phoneHandle: external_exports.string().min(1),
   agentphoneAgentId: external_exports.string().min(1),
@@ -16432,7 +17470,7 @@ var agentPhoneStartLinkResponseSchema = external_exports.object({
   phoneHandle: external_exports.string(),
   verificationSent: external_exports.literal(true)
 });
-var zeroIntegrationsAgentPhoneContract = c83.router({
+var zeroIntegrationsAgentPhoneContract = c85.router({
   connectAgentPhone: {
     method: "POST",
     path: "/api/agentphone/connect",
@@ -16450,7 +17488,7 @@ var zeroIntegrationsAgentPhoneContract = c83.router({
     method: "POST",
     path: "/api/agentphone/webhook",
     headers: agentPhoneWebhookHeadersSchema,
-    body: c83.type(),
+    body: c85.type(),
     responses: {
       200: external_exports.string(),
       400: external_exports.string(),
@@ -16488,9 +17526,9 @@ var zeroIntegrationsAgentPhoneContract = c83.router({
     method: "DELETE",
     path: "/api/integrations/agentphone/link",
     headers: authHeadersSchema,
-    body: c83.noBody(),
+    body: c85.noBody(),
     responses: {
-      204: c83.noBody(),
+      204: c85.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema
     },
@@ -18239,6 +19277,43 @@ function parseSearchQuery(value, label) {
 
 // src/commands/zero/logs/search.ts
 init_esm_shims();
+
+// src/lib/api/domains/zero-logs.ts
+init_esm_shims();
+async function listZeroLogs(options) {
+  const config = await getClientConfig();
+  const client = initClient(logsListContract, config);
+  const result = await client.list({
+    query: {
+      agentId: options?.agentId,
+      status: options?.status,
+      since: options?.since,
+      limit: options?.limit,
+      cursor: options?.cursor
+    }
+  });
+  if (result.status === 200) return result.body;
+  handleError(result, "Failed to list zero logs");
+}
+async function searchZeroLogs(options) {
+  const config = await getClientConfig();
+  const client = initClient(zeroLogsSearchContract, config);
+  const result = await client.searchLogs({
+    query: {
+      keyword: options.keyword,
+      agentId: options.agentId,
+      runId: options.runId,
+      since: options.since,
+      limit: options.limit,
+      before: options.before,
+      after: options.after
+    }
+  });
+  if (result.status === 200) return result.body;
+  handleError(result, "Failed to search zero logs");
+}
+
+// src/commands/zero/logs/search.ts
 var SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3;
 function supportedSearchFramework(framework) {
   const normalized = framework ?? void 0;
@@ -18383,12 +19458,14 @@ Examples:
 );
 
 export {
+  zeroRunAgentEventsContract,
   parseTime,
   isSupportedFramework,
   EventStreamNormalizer,
   EventRenderer,
+  listZeroLogs,
   parseSearchQuery,
   runLogsSearch,
   searchCommand
 };
-//# sourceMappingURL=chunk-A6TMOGPR.js.map
+//# sourceMappingURL=chunk-TQKKFLRI.js.map