@vm0/cli 9.86.10 → 9.87.0

package/{chunk-BB3ODMCC.js → chunk-JOVCRTRX.js}

@@ -47,7 +47,7 @@ if (DSN) {
   Sentry.init({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.86.10",
+    release: "9.87.0",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -66,7 +66,7 @@ if (DSN) {
     }
   });
   Sentry.setContext("cli", {
-    version: "9.86.10",
+    version: "9.87.0",
     command: process.argv.slice(2).join(" ")
   });
   Sentry.setContext("runtime", {
@@ -735,21 +735,55 @@ var composesInstructionsContract = c.router({
 });
 
 // ../../packages/core/src/contracts/runs.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 
-// ../../packages/core/src/contracts/logs.ts
+// ../../packages/core/src/contracts/firewalls.ts
 import { z as z4 } from "zod";
-var paginationSchema = z4.object({
-  hasMore: z4.boolean(),
-  nextCursor: z4.string().nullable(),
-  totalPages: z4.number()
+var firewallPermissionSchema = z4.object({
+  name: z4.string(),
+  description: z4.string().optional(),
+  rules: z4.array(z4.string())
+});
+var firewallApiSchema = z4.object({
+  base: z4.string(),
+  auth: z4.object({
+    headers: z4.record(z4.string(), z4.string())
+  }),
+  permissions: z4.array(firewallPermissionSchema).optional()
+});
+var firewallSchema = z4.object({
+  name: z4.string(),
+  ref: z4.string(),
+  apis: z4.array(firewallApiSchema)
+});
+var experimentalFirewallsSchema = z4.array(firewallSchema);
+var firewallConfigSchema = z4.object({
+  name: z4.string().min(1, "Firewall name is required"),
+  description: z4.string().optional(),
+  apis: z4.array(firewallApiSchema).min(1, "Firewall must have at least one API entry"),
+  placeholders: z4.record(z4.string(), z4.string()).optional()
+});
+var firewallPolicyValueSchema = z4.enum(["allow", "deny", "ask"]);
+var firewallPoliciesSchema = z4.record(
+  z4.string(),
+  z4.record(z4.string(), firewallPolicyValueSchema)
+);
+var BASE_URL_VARS_PATTERN = /\$\{\{\s*vars\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/;
+var BASE_URL_VARS_PATTERN_G = new RegExp(BASE_URL_VARS_PATTERN.source, "g");
+
+// ../../packages/core/src/contracts/logs.ts
+import { z as z5 } from "zod";
+var paginationSchema = z5.object({
+  hasMore: z5.boolean(),
+  nextCursor: z5.string().nullable(),
+  totalPages: z5.number()
 });
-var listQuerySchema = z4.object({
-  cursor: z4.string().optional(),
-  limit: z4.coerce.number().min(1).max(100).default(20)
+var listQuerySchema = z5.object({
+  cursor: z5.string().optional(),
+  limit: z5.coerce.number().min(1).max(100).default(20)
 });
 var c2 = initContract();
-var logStatusSchema = z4.enum([
+var logStatusSchema = z5.enum([
   "queued",
   "pending",
   "running",
@@ -758,7 +792,7 @@ var logStatusSchema = z4.enum([
   "timeout",
   "cancelled"
 ]);
-var triggerSourceSchema = z4.enum([
+var triggerSourceSchema = z5.enum([
   "schedule",
   "web",
   "slack",
@@ -768,50 +802,50 @@ var triggerSourceSchema = z4.enum([
   "cli",
   "agent"
 ]);
-var logEntrySchema = z4.object({
-  id: z4.uuid(),
-  sessionId: z4.string().nullable(),
-  agentId: z4.string().nullable(),
-  displayName: z4.string().nullable(),
-  orgSlug: z4.string().nullable(),
-  framework: z4.string().nullable(),
+var logEntrySchema = z5.object({
+  id: z5.uuid(),
+  sessionId: z5.string().nullable(),
+  agentId: z5.string().nullable(),
+  displayName: z5.string().nullable(),
+  orgSlug: z5.string().nullable(),
+  framework: z5.string().nullable(),
   triggerSource: triggerSourceSchema.nullable(),
-  scheduleId: z4.string().nullable(),
+  scheduleId: z5.string().nullable(),
   status: logStatusSchema,
-  createdAt: z4.string(),
-  startedAt: z4.string().nullable(),
-  completedAt: z4.string().nullable()
+  createdAt: z5.string(),
+  startedAt: z5.string().nullable(),
+  completedAt: z5.string().nullable()
 });
-var logsFiltersSchema = z4.object({
-  statuses: z4.array(logStatusSchema),
-  sources: z4.array(triggerSourceSchema),
-  agents: z4.array(z4.string())
+var logsFiltersSchema = z5.object({
+  statuses: z5.array(logStatusSchema),
+  sources: z5.array(triggerSourceSchema),
+  agents: z5.array(z5.string())
 });
-var logsListResponseSchema = z4.object({
-  data: z4.array(logEntrySchema),
+var logsListResponseSchema = z5.object({
+  data: z5.array(logEntrySchema),
   pagination: paginationSchema,
   filters: logsFiltersSchema
 });
-var artifactSchema = z4.object({
-  name: z4.string().nullable(),
-  version: z4.string().nullable()
-});
-var logDetailSchema = z4.object({
-  id: z4.uuid(),
-  sessionId: z4.string().nullable(),
-  agentId: z4.string().nullable(),
-  displayName: z4.string().nullable(),
-  framework: z4.string().nullable(),
-  modelProvider: z4.string().nullable(),
+var artifactSchema = z5.object({
+  name: z5.string().nullable(),
+  version: z5.string().nullable()
+});
+var logDetailSchema = z5.object({
+  id: z5.uuid(),
+  sessionId: z5.string().nullable(),
+  agentId: z5.string().nullable(),
+  displayName: z5.string().nullable(),
+  framework: z5.string().nullable(),
+  modelProvider: z5.string().nullable(),
   triggerSource: triggerSourceSchema.nullable(),
-  scheduleId: z4.string().nullable(),
+  scheduleId: z5.string().nullable(),
   status: logStatusSchema,
-  prompt: z4.string(),
-  appendSystemPrompt: z4.string().nullable(),
-  error: z4.string().nullable(),
-  createdAt: z4.string(),
-  startedAt: z4.string().nullable(),
-  completedAt: z4.string().nullable(),
+  prompt: z5.string(),
+  appendSystemPrompt: z5.string().nullable(),
+  error: z5.string().nullable(),
+  createdAt: z5.string(),
+  startedAt: z5.string().nullable(),
+  completedAt: z5.string().nullable(),
   artifact: artifactSchema
 });
 var logsListContract = c2.router({
@@ -819,13 +853,13 @@ var logsListContract = c2.router({
     method: "GET",
     path: "/api/zero/logs",
     query: listQuerySchema.extend({
-      search: z4.string().optional(),
-      agent: z4.string().optional(),
-      name: z4.string().optional(),
-      org: z4.string().optional(),
+      search: z5.string().optional(),
+      agent: z5.string().optional(),
+      name: z5.string().optional(),
+      org: z5.string().optional(),
       status: logStatusSchema.optional(),
       triggerSource: triggerSourceSchema.optional(),
-      scheduleId: z4.string().uuid().optional()
+      scheduleId: z5.string().uuid().optional()
     }),
     responses: {
       200: logsListResponseSchema,
@@ -839,8 +873,8 @@ var logsByIdContract = c2.router({
     method: "GET",
     path: "/api/zero/logs/:id",
     headers: authHeadersSchema,
-    pathParams: z4.object({
-      id: z4.string().uuid("Invalid log ID")
+    pathParams: z5.object({
+      id: z5.string().uuid("Invalid log ID")
     }),
     responses: {
       200: logDetailSchema,
@@ -852,110 +886,110 @@ var logsByIdContract = c2.router({
 });
 
 // ../../packages/core/src/contracts/orgs.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // ../../packages/core/src/contracts/org-members.ts
-import { z as z5 } from "zod";
-var orgRoleSchema = z5.enum(["admin", "member"]);
-var orgMemberSchema = z5.object({
-  userId: z5.string(),
-  email: z5.string(),
-  firstName: z5.string().nullable(),
-  lastName: z5.string().nullable(),
-  imageUrl: z5.string(),
+import { z as z6 } from "zod";
+var orgRoleSchema = z6.enum(["admin", "member"]);
+var orgMemberSchema = z6.object({
+  userId: z6.string(),
+  email: z6.string(),
+  firstName: z6.string().nullable(),
+  lastName: z6.string().nullable(),
+  imageUrl: z6.string(),
   role: orgRoleSchema,
-  joinedAt: z5.string()
+  joinedAt: z6.string()
 });
-var orgPendingInvitationSchema = z5.object({
-  id: z5.string(),
-  email: z5.string(),
+var orgPendingInvitationSchema = z6.object({
+  id: z6.string(),
+  email: z6.string(),
   role: orgRoleSchema,
-  createdAt: z5.string()
+  createdAt: z6.string()
 });
-var orgMembershipRequestSchema = z5.object({
-  id: z5.string(),
-  userId: z5.string(),
-  email: z5.string(),
-  firstName: z5.string().nullable(),
-  lastName: z5.string().nullable(),
-  imageUrl: z5.string(),
-  createdAt: z5.string()
+var orgMembershipRequestSchema = z6.object({
+  id: z6.string(),
+  userId: z6.string(),
+  email: z6.string(),
+  firstName: z6.string().nullable(),
+  lastName: z6.string().nullable(),
+  imageUrl: z6.string(),
+  createdAt: z6.string()
 });
-var revokeInvitationRequestSchema = z5.object({
-  invitationId: z5.string()
+var revokeInvitationRequestSchema = z6.object({
+  invitationId: z6.string()
 });
-var membershipRequestActionSchema = z5.object({
-  requestId: z5.string()
+var membershipRequestActionSchema = z6.object({
+  requestId: z6.string()
 });
-var orgMembersResponseSchema = z5.object({
-  slug: z5.string(),
+var orgMembersResponseSchema = z6.object({
+  slug: z6.string(),
   role: orgRoleSchema,
-  members: z5.array(orgMemberSchema),
-  pendingInvitations: z5.array(orgPendingInvitationSchema).optional(),
-  membershipRequests: z5.array(orgMembershipRequestSchema).optional(),
-  createdAt: z5.string()
+  members: z6.array(orgMemberSchema),
+  pendingInvitations: z6.array(orgPendingInvitationSchema).optional(),
+  membershipRequests: z6.array(orgMembershipRequestSchema).optional(),
+  createdAt: z6.string()
 });
-var inviteOrgMemberRequestSchema = z5.object({
-  email: z5.string().email()
+var inviteOrgMemberRequestSchema = z6.object({
+  email: z6.string().email()
 });
-var removeOrgMemberRequestSchema = z5.object({
-  email: z5.string().email()
+var removeOrgMemberRequestSchema = z6.object({
+  email: z6.string().email()
 });
-var updateOrgMemberRoleRequestSchema = z5.object({
-  email: z5.string().email(),
+var updateOrgMemberRoleRequestSchema = z6.object({
+  email: z6.string().email(),
   role: orgRoleSchema
 });
-var orgDomainSchema = z5.object({
-  id: z5.string(),
-  name: z5.string(),
-  enrollmentMode: z5.string(),
-  verification: z5.object({
-    status: z5.string(),
-    strategy: z5.string()
+var orgDomainSchema = z6.object({
+  id: z6.string(),
+  name: z6.string(),
+  enrollmentMode: z6.string(),
+  verification: z6.object({
+    status: z6.string(),
+    strategy: z6.string()
   }),
-  createdAt: z5.string()
+  createdAt: z6.string()
 });
-var orgDomainsResponseSchema = z5.object({
-  domains: z5.array(orgDomainSchema)
+var orgDomainsResponseSchema = z6.object({
+  domains: z6.array(orgDomainSchema)
 });
-var orgEnrollmentModeSchema = z5.enum([
+var orgEnrollmentModeSchema = z6.enum([
   "manual_invitation",
   "automatic_invitation",
   "automatic_suggestion"
 ]);
-var addDomainRequestSchema = z5.object({
-  name: z5.string(),
+var addDomainRequestSchema = z6.object({
+  name: z6.string(),
   enrollmentMode: orgEnrollmentModeSchema
 });
-var domainActionRequestSchema = z5.object({
-  domainId: z5.string()
+var domainActionRequestSchema = z6.object({
+  domainId: z6.string()
 });
-var domainVerifyRequestSchema = z5.object({
-  domainId: z5.string(),
-  verified: z5.boolean()
+var domainVerifyRequestSchema = z6.object({
+  domainId: z6.string(),
+  verified: z6.boolean()
 });
-var orgMessageResponseSchema = z5.object({
-  message: z5.string()
+var orgMessageResponseSchema = z6.object({
+  message: z6.string()
 });
 
 // ../../packages/core/src/contracts/orgs.ts
 var c3 = initContract();
-var orgTierSchema = z6.enum(["free", "pro", "team"]);
-var orgSlugSchema = z6.string().min(3, "Org slug must be at least 3 characters").max(64, "Org slug must be at most 64 characters").regex(
+var orgTierSchema = z7.enum(["free", "pro", "team"]);
+var orgSlugSchema = z7.string().min(3, "Org slug must be at least 3 characters").max(64, "Org slug must be at most 64 characters").regex(
   /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]{1,2}$/,
   "Org slug must contain only lowercase letters, numbers, and hyphens, and must start and end with an alphanumeric character"
 ).transform((s) => s.toLowerCase());
-var orgResponseSchema = z6.object({
-  id: z6.string(),
-  slug: z6.string(),
-  name: z6.string(),
-  tier: z6.string().optional(),
+var orgResponseSchema = z7.object({
+  id: z7.string(),
+  slug: z7.string(),
+  name: z7.string(),
+  tier: z7.string().optional(),
   role: orgRoleSchema.optional()
 });
-var updateOrgRequestSchema = z6.object({
+var updateOrgRequestSchema = z7.object({
   slug: orgSlugSchema.optional(),
-  name: z6.string().min(1).max(128).optional(),
-  force: z6.boolean().optional().default(false)
+  name: z7.string().min(1).max(128).optional(),
+  force: z7.boolean().optional().default(false)
 });
 var orgDefaultAgentContract = c3.router({
   /**
@@ -968,15 +1002,15 @@ var orgDefaultAgentContract = c3.router({
     method: "PUT",
     path: "/api/zero/default-agent",
     headers: authHeadersSchema,
-    query: z6.object({
-      org: z6.string().optional()
+    query: z7.object({
+      org: z7.string().optional()
     }),
-    body: z6.object({
-      agentId: z6.uuid().nullable()
+    body: z7.object({
+      agentId: z7.uuid().nullable()
     }),
     responses: {
-      200: z6.object({
-        agentId: z6.uuid().nullable()
+      200: z7.object({
+        agentId: z7.uuid().nullable()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -999,107 +1033,109 @@ var ALL_RUN_STATUSES = [
   "timeout",
   "cancelled"
 ];
-var runStatusSchema = z7.enum(ALL_RUN_STATUSES);
-var unifiedRunRequestSchema = z7.object({
+var runStatusSchema = z8.enum(ALL_RUN_STATUSES);
+var unifiedRunRequestSchema = z8.object({
   // High-level shortcuts (mutually exclusive with each other)
-  checkpointId: z7.string().optional(),
-  sessionId: z7.string().optional(),
+  checkpointId: z8.string().optional(),
+  sessionId: z8.string().optional(),
   // Base parameters (can be used directly or overridden after shortcut expansion)
-  agentComposeId: z7.string().optional(),
-  agentComposeVersionId: z7.string().optional(),
-  conversationId: z7.string().optional(),
-  artifactName: z7.string().optional(),
-  artifactVersion: z7.string().optional(),
-  vars: z7.record(z7.string(), z7.string()).optional(),
-  secrets: z7.record(z7.string(), z7.string()).optional(),
-  volumeVersions: z7.record(z7.string(), z7.string()).optional(),
-  memoryName: z7.string().optional(),
+  agentComposeId: z8.string().optional(),
+  agentComposeVersionId: z8.string().optional(),
+  conversationId: z8.string().optional(),
+  artifactName: z8.string().optional(),
+  artifactVersion: z8.string().optional(),
+  vars: z8.record(z8.string(), z8.string()).optional(),
+  secrets: z8.record(z8.string(), z8.string()).optional(),
+  volumeVersions: z8.record(z8.string(), z8.string()).optional(),
+  memoryName: z8.string().optional(),
   // Debug flag to force real Claude in mock environments (internal use only)
-  debugNoMockClaude: z7.boolean().optional(),
+  debugNoMockClaude: z8.boolean().optional(),
   // Model provider for automatic secret injection
-  modelProvider: z7.string().optional(),
+  modelProvider: z8.string().optional(),
   // Environment validation flag - when true, validates secrets/vars before running
-  checkEnv: z7.boolean().optional(),
+  checkEnv: z8.boolean().optional(),
   // Required
-  prompt: z7.string().min(1, "Missing prompt"),
+  prompt: z8.string().min(1, "Missing prompt"),
   // Optional system prompt to append to the agent's system prompt
-  appendSystemPrompt: z7.string().optional(),
+  appendSystemPrompt: z8.string().optional(),
   // Optional list of tools to disable in Claude CLI (passed as --disallowed-tools)
-  disallowedTools: z7.array(z7.string()).optional(),
+  disallowedTools: z8.array(z8.string()).optional(),
   // Optional list of tools to make available in Claude CLI (passed as --tools)
-  tools: z7.array(z7.string()).optional(),
+  tools: z8.array(z8.string()).optional(),
   // Settings JSON to pass to Claude CLI (passed as --settings)
-  settings: z7.string().optional(),
+  settings: z8.string().optional(),
   // How the run was triggered (defaults to "cli" on the server if not provided)
-  triggerSource: triggerSourceSchema.optional()
+  triggerSource: triggerSourceSchema.optional(),
+  // Per-permission firewall policies (e.g., { "github": { "actions:read": "allow" } })
+  firewallPolicies: firewallPoliciesSchema.optional()
 });
-var createRunResponseSchema = z7.object({
-  runId: z7.string(),
+var createRunResponseSchema = z8.object({
+  runId: z8.string(),
   status: runStatusSchema,
-  sandboxId: z7.string().optional(),
-  output: z7.string().optional(),
-  error: z7.string().optional(),
-  executionTimeMs: z7.number().optional(),
-  createdAt: z7.string()
-});
-var getRunResponseSchema = z7.object({
-  runId: z7.string(),
-  agentComposeVersionId: z7.string().nullable(),
+  sandboxId: z8.string().optional(),
+  output: z8.string().optional(),
+  error: z8.string().optional(),
+  executionTimeMs: z8.number().optional(),
+  createdAt: z8.string()
+});
+var getRunResponseSchema = z8.object({
+  runId: z8.string(),
+  agentComposeVersionId: z8.string().nullable(),
   status: runStatusSchema,
-  prompt: z7.string(),
-  appendSystemPrompt: z7.string().nullable(),
-  vars: z7.record(z7.string(), z7.string()).optional(),
-  sandboxId: z7.string().optional(),
-  result: z7.object({
-    output: z7.string().optional(),
-    executionTimeMs: z7.number().optional(),
-    agentSessionId: z7.string().optional(),
-    checkpointId: z7.string().optional(),
-    conversationId: z7.string().optional()
+  prompt: z8.string(),
+  appendSystemPrompt: z8.string().nullable(),
+  vars: z8.record(z8.string(), z8.string()).optional(),
+  sandboxId: z8.string().optional(),
+  result: z8.object({
+    output: z8.string().optional(),
+    executionTimeMs: z8.number().optional(),
+    agentSessionId: z8.string().optional(),
+    checkpointId: z8.string().optional(),
+    conversationId: z8.string().optional()
   }).passthrough().optional(),
-  error: z7.string().optional(),
-  createdAt: z7.string(),
-  startedAt: z7.string().optional(),
-  completedAt: z7.string().optional()
-});
-var runEventSchema = z7.object({
-  sequenceNumber: z7.number(),
-  eventType: z7.string(),
-  eventData: z7.unknown(),
-  createdAt: z7.string()
-});
-var runResultSchema = z7.object({
-  checkpointId: z7.string(),
-  agentSessionId: z7.string(),
-  conversationId: z7.string(),
-  artifact: z7.record(z7.string(), z7.string()).optional(),
+  error: z8.string().optional(),
+  createdAt: z8.string(),
+  startedAt: z8.string().optional(),
+  completedAt: z8.string().optional()
+});
+var runEventSchema = z8.object({
+  sequenceNumber: z8.number(),
+  eventType: z8.string(),
+  eventData: z8.unknown(),
+  createdAt: z8.string()
+});
+var runResultSchema = z8.object({
+  checkpointId: z8.string(),
+  agentSessionId: z8.string(),
+  conversationId: z8.string(),
+  artifact: z8.record(z8.string(), z8.string()).optional(),
   // optional when run has no artifact
-  volumes: z7.record(z7.string(), z7.string()).optional(),
-  memory: z7.record(z7.string(), z7.string()).optional()
+  volumes: z8.record(z8.string(), z8.string()).optional(),
+  memory: z8.record(z8.string(), z8.string()).optional()
 });
-var runStateSchema = z7.object({
+var runStateSchema = z8.object({
   status: runStatusSchema,
   result: runResultSchema.optional(),
-  error: z7.string().optional()
+  error: z8.string().optional()
 });
-var eventsResponseSchema = z7.object({
-  events: z7.array(runEventSchema),
-  hasMore: z7.boolean(),
-  nextSequence: z7.number(),
+var eventsResponseSchema = z8.object({
+  events: z8.array(runEventSchema),
+  hasMore: z8.boolean(),
+  nextSequence: z8.number(),
   run: runStateSchema,
-  framework: z7.string()
+  framework: z8.string()
 });
-var runListItemSchema = z7.object({
-  id: z7.string(),
-  agentName: z7.string(),
+var runListItemSchema = z8.object({
+  id: z8.string(),
+  agentName: z8.string(),
   status: runStatusSchema,
-  prompt: z7.string(),
-  appendSystemPrompt: z7.string().nullable(),
-  createdAt: z7.string(),
-  startedAt: z7.string().nullable()
+  prompt: z8.string(),
+  appendSystemPrompt: z8.string().nullable(),
+  createdAt: z8.string(),
+  startedAt: z8.string().nullable()
 });
-var runsListResponseSchema = z7.object({
-  runs: z7.array(runListItemSchema)
+var runsListResponseSchema = z8.object({
+  runs: z8.array(runListItemSchema)
 });
 var runsMainContract = c4.router({
   /**
@@ -1110,16 +1146,16 @@ var runsMainContract = c4.router({
     method: "GET",
     path: "/api/agent/runs",
     headers: authHeadersSchema,
-    query: z7.object({
-      status: z7.string().optional(),
+    query: z8.object({
+      status: z8.string().optional(),
       // comma-separated: "pending,running"
-      agent: z7.string().optional(),
+      agent: z8.string().optional(),
       // agent name filter
-      since: z7.string().optional(),
+      since: z8.string().optional(),
       // ISO timestamp
-      until: z7.string().optional(),
+      until: z8.string().optional(),
       // ISO timestamp
-      limit: z7.coerce.number().min(1).max(100).default(50)
+      limit: z8.coerce.number().min(1).max(100).default(50)
     }),
     responses: {
       200: runsListResponseSchema,
@@ -1160,8 +1196,8 @@ var runsByIdContract = c4.router({
     method: "GET",
     path: "/api/agent/runs/:id",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
     responses: {
       200: getRunResponseSchema,
@@ -1172,10 +1208,10 @@ var runsByIdContract = c4.router({
     summary: "Get agent run by ID"
   }
 });
-var cancelRunResponseSchema = z7.object({
-  id: z7.string(),
-  status: z7.literal("cancelled"),
-  message: z7.string()
+var cancelRunResponseSchema = z8.object({
+  id: z8.string(),
+  status: z8.literal("cancelled"),
+  message: z8.string()
 });
 var runsCancelContract = c4.router({
   /**
@@ -1186,10 +1222,10 @@ var runsCancelContract = c4.router({
     method: "POST",
     path: "/api/agent/runs/:id/cancel",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
-    body: z7.undefined(),
+    body: z8.undefined(),
     responses: {
       200: cancelRunResponseSchema,
       400: apiErrorSchema,
@@ -1209,12 +1245,12 @@ var runEventsContract = c4.router({
     method: "GET",
     path: "/api/agent/runs/:id/events",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
-    query: z7.object({
-      since: z7.coerce.number().default(-1),
-      limit: z7.coerce.number().default(100)
+    query: z8.object({
+      since: z8.coerce.number().default(-1),
+      limit: z8.coerce.number().default(100)
     }),
     responses: {
       200: eventsResponseSchema,
@@ -1224,55 +1260,55 @@ var runEventsContract = c4.router({
     summary: "Get agent run events"
   }
 });
-var telemetryMetricSchema = z7.object({
-  ts: z7.string(),
-  cpu: z7.number(),
-  mem_used: z7.number(),
-  mem_total: z7.number(),
-  disk_used: z7.number(),
-  disk_total: z7.number()
-});
-var systemLogResponseSchema = z7.object({
-  systemLog: z7.string(),
-  hasMore: z7.boolean()
-});
-var metricsResponseSchema = z7.object({
-  metrics: z7.array(telemetryMetricSchema),
-  hasMore: z7.boolean()
-});
-var agentEventsResponseSchema = z7.object({
-  events: z7.array(runEventSchema),
-  hasMore: z7.boolean(),
-  framework: z7.string()
-});
-var networkLogEntrySchema = z7.object({
-  timestamp: z7.string(),
-  type: z7.string().optional(),
-  action: z7.enum(["ALLOW", "DENY"]).optional(),
-  host: z7.string().optional(),
-  port: z7.number().optional(),
-  method: z7.string().optional(),
-  url: z7.string().optional(),
-  status: z7.number().optional(),
-  latency_ms: z7.number().optional(),
-  request_size: z7.number().optional(),
-  response_size: z7.number().optional(),
-  firewall_base: z7.string().optional(),
-  firewall_name: z7.string().optional(),
-  firewall_ref: z7.string().optional(),
-  firewall_permission: z7.string().optional(),
-  firewall_rule_match: z7.string().optional(),
-  firewall_params: z7.record(z7.string(), z7.string()).optional(),
-  firewall_error: z7.string().optional(),
-  error: z7.string().optional()
-});
-var networkLogsResponseSchema = z7.object({
-  networkLogs: z7.array(networkLogEntrySchema),
-  hasMore: z7.boolean()
-});
-var telemetryResponseSchema = z7.object({
-  systemLog: z7.string(),
-  metrics: z7.array(telemetryMetricSchema)
+var telemetryMetricSchema = z8.object({
+  ts: z8.string(),
+  cpu: z8.number(),
+  mem_used: z8.number(),
+  mem_total: z8.number(),
+  disk_used: z8.number(),
+  disk_total: z8.number()
+});
+var systemLogResponseSchema = z8.object({
+  systemLog: z8.string(),
+  hasMore: z8.boolean()
+});
+var metricsResponseSchema = z8.object({
+  metrics: z8.array(telemetryMetricSchema),
+  hasMore: z8.boolean()
+});
+var agentEventsResponseSchema = z8.object({
+  events: z8.array(runEventSchema),
+  hasMore: z8.boolean(),
+  framework: z8.string()
+});
+var networkLogEntrySchema = z8.object({
+  timestamp: z8.string(),
+  type: z8.string().optional(),
+  action: z8.enum(["ALLOW", "DENY"]).optional(),
+  host: z8.string().optional(),
+  port: z8.number().optional(),
+  method: z8.string().optional(),
+  url: z8.string().optional(),
+  status: z8.number().optional(),
+  latency_ms: z8.number().optional(),
+  request_size: z8.number().optional(),
+  response_size: z8.number().optional(),
+  firewall_base: z8.string().optional(),
+  firewall_name: z8.string().optional(),
+  firewall_ref: z8.string().optional(),
+  firewall_permission: z8.string().optional(),
+  firewall_rule_match: z8.string().optional(),
+  firewall_params: z8.record(z8.string(), z8.string()).optional(),
+  firewall_error: z8.string().optional(),
+  error: z8.string().optional()
+});
+var networkLogsResponseSchema = z8.object({
+  networkLogs: z8.array(networkLogEntrySchema),
+  hasMore: z8.boolean()
+});
+var telemetryResponseSchema = z8.object({
+  systemLog: z8.string(),
+  metrics: z8.array(telemetryMetricSchema)
 });
 var runTelemetryContract = c4.router({
   /**
@@ -1283,8 +1319,8 @@ var runTelemetryContract = c4.router({
     method: "GET",
     path: "/api/agent/runs/:id/telemetry",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
     responses: {
       200: telemetryResponseSchema,
@@ -1303,13 +1339,13 @@ var runSystemLogContract = c4.router({
     method: "GET",
     path: "/api/agent/runs/:id/telemetry/system-log",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
-    query: z7.object({
-      since: z7.coerce.number().optional(),
-      limit: z7.coerce.number().min(1).max(100).default(5),
-      order: z7.enum(["asc", "desc"]).default("desc")
+    query: z8.object({
+      since: z8.coerce.number().optional(),
+      limit: z8.coerce.number().min(1).max(100).default(5),
+      order: z8.enum(["asc", "desc"]).default("desc")
     }),
     responses: {
       200: systemLogResponseSchema,
@@ -1328,13 +1364,13 @@ var runMetricsContract = c4.router({
     method: "GET",
     path: "/api/agent/runs/:id/telemetry/metrics",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
-    query: z7.object({
-      since: z7.coerce.number().optional(),
-      limit: z7.coerce.number().min(1).max(100).default(5),
-      order: z7.enum(["asc", "desc"]).default("desc")
+    query: z8.object({
+      since: z8.coerce.number().optional(),
+      limit: z8.coerce.number().min(1).max(100).default(5),
+      order: z8.enum(["asc", "desc"]).default("desc")
     }),
     responses: {
       200: metricsResponseSchema,
@@ -1353,13 +1389,13 @@ var runAgentEventsContract = c4.router({
     method: "GET",
     path: "/api/agent/runs/:id/telemetry/agent",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
-    query: z7.object({
-      since: z7.coerce.number().optional(),
-      limit: z7.coerce.number().min(1).max(100).default(5),
-      order: z7.enum(["asc", "desc"]).default("desc")
+    query: z8.object({
+      since: z8.coerce.number().optional(),
+      limit: z8.coerce.number().min(1).max(100).default(5),
+      order: z8.enum(["asc", "desc"]).default("desc")
     }),
     responses: {
       200: agentEventsResponseSchema,
@@ -1378,13 +1414,13 @@ var runNetworkLogsContract = c4.router({
     method: "GET",
     path: "/api/agent/runs/:id/telemetry/network",
     headers: authHeadersSchema,
-    pathParams: z7.object({
-      id: z7.string().min(1, "Run ID is required")
+    pathParams: z8.object({
+      id: z8.string().min(1, "Run ID is required")
     }),
-    query: z7.object({
-      since: z7.coerce.number().optional(),
-      limit: z7.coerce.number().min(1).max(100).default(5),
-      order: z7.enum(["asc", "desc"]).default("desc")
+    query: z8.object({
+      since: z8.coerce.number().optional(),
+      limit: z8.coerce.number().min(1).max(100).default(5),
+      order: z8.enum(["asc", "desc"]).default("desc")
     }),
     responses: {
       200: networkLogsResponseSchema,
@@ -1394,16 +1430,16 @@ var runNetworkLogsContract = c4.router({
     summary: "Get network logs with pagination"
   }
 });
-var searchResultSchema = z7.object({
-  runId: z7.string(),
-  agentName: z7.string(),
+var searchResultSchema = z8.object({
+  runId: z8.string(),
+  agentName: z8.string(),
   matchedEvent: runEventSchema,
-  contextBefore: z7.array(runEventSchema),
-  contextAfter: z7.array(runEventSchema)
+  contextBefore: z8.array(runEventSchema),
+  contextAfter: z8.array(runEventSchema)
 });
-var logsSearchResponseSchema = z7.object({
-  results: z7.array(searchResultSchema),
-  hasMore: z7.boolean()
+var logsSearchResponseSchema = z8.object({
+  results: z8.array(searchResultSchema),
+  hasMore: z8.boolean()
 });
 var logsSearchContract = c4.router({
   /**
@@ -1414,14 +1450,14 @@ var logsSearchContract = c4.router({
     method: "GET",
     path: "/api/logs/search",
     headers: authHeadersSchema,
-    query: z7.object({
-      keyword: z7.string().min(1),
-      agent: z7.string().optional(),
-      runId: z7.string().optional(),
-      since: z7.coerce.number().optional(),
-      limit: z7.coerce.number().min(1).max(50).default(20),
-      before: z7.coerce.number().min(0).max(10).default(0),
-      after: z7.coerce.number().min(0).max(10).default(0)
+    query: z8.object({
+      keyword: z8.string().min(1),
+      agent: z8.string().optional(),
+      runId: z8.string().optional(),
+      since: z8.coerce.number().optional(),
+      limit: z8.coerce.number().min(1).max(50).default(20),
+      before: z8.coerce.number().min(0).max(10).default(0),
+      after: z8.coerce.number().min(0).max(10).default(0)
     }),
     responses: {
       200: logsSearchResponseSchema,
@@ -1430,37 +1466,37 @@ var logsSearchContract = c4.router({
     summary: "Search agent events across runs"
   }
 });
-var queueEntrySchema = z7.object({
-  position: z7.number(),
-  agentName: z7.string().nullable(),
-  agentDisplayName: z7.string().nullable(),
-  userEmail: z7.string().nullable(),
-  createdAt: z7.string(),
-  isOwner: z7.boolean(),
-  runId: z7.string().nullable(),
-  prompt: z7.string().nullable(),
+var queueEntrySchema = z8.object({
+  position: z8.number(),
+  agentName: z8.string().nullable(),
+  agentDisplayName: z8.string().nullable(),
+  userEmail: z8.string().nullable(),
+  createdAt: z8.string(),
+  isOwner: z8.boolean(),
+  runId: z8.string().nullable(),
+  prompt: z8.string().nullable(),
   triggerSource: triggerSourceSchema.nullable(),
-  sessionLink: z7.string().nullable()
+  sessionLink: z8.string().nullable()
 });
-var runningTaskSchema = z7.object({
-  runId: z7.string().nullable(),
-  agentName: z7.string(),
-  agentDisplayName: z7.string().nullable(),
-  userEmail: z7.string(),
-  startedAt: z7.string().nullable(),
-  isOwner: z7.boolean()
+var runningTaskSchema = z8.object({
+  runId: z8.string().nullable(),
+  agentName: z8.string(),
+  agentDisplayName: z8.string().nullable(),
+  userEmail: z8.string(),
+  startedAt: z8.string().nullable(),
+  isOwner: z8.boolean()
 });
-var concurrencyInfoSchema = z7.object({
+var concurrencyInfoSchema = z8.object({
   tier: orgTierSchema,
-  limit: z7.number(),
-  active: z7.number(),
-  available: z7.number()
+  limit: z8.number(),
+  active: z8.number(),
+  available: z8.number()
 });
-var queueResponseSchema = z7.object({
+var queueResponseSchema = z8.object({
   concurrency: concurrencyInfoSchema,
-  queue: z7.array(queueEntrySchema),
-  runningTasks: z7.array(runningTaskSchema),
-  estimatedTimePerRun: z7.number().nullable()
+  queue: z8.array(queueEntrySchema),
+  runningTasks: z8.array(runningTaskSchema),
+  estimatedTimePerRun: z8.number().nullable()
 });
 var runsQueueContract = c4.router({
   /**
@@ -1481,17 +1517,17 @@ var runsQueueContract = c4.router({
 });
 
 // ../../packages/core/src/contracts/storages.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var c5 = initContract();
-var storageTypeSchema = z8.enum(["volume", "artifact", "memory"]);
-var versionQuerySchema = z8.string().regex(/^[a-f0-9]{8,64}$/i, "Version must be 8-64 hex characters").optional();
-var uploadStorageResponseSchema = z8.object({
-  name: z8.string(),
-  versionId: z8.string(),
-  size: z8.number(),
-  fileCount: z8.number(),
+var storageTypeSchema = z9.enum(["volume", "artifact", "memory"]);
+var versionQuerySchema = z9.string().regex(/^[a-f0-9]{8,64}$/i, "Version must be 8-64 hex characters").optional();
+var uploadStorageResponseSchema = z9.object({
+  name: z9.string(),
+  versionId: z9.string(),
+  size: z9.number(),
+  fileCount: z9.number(),
   type: storageTypeSchema,
-  deduplicated: z8.boolean()
+  deduplicated: z9.boolean()
 });
 var storagesContract = c5.router({
   /**
@@ -1533,8 +1569,8 @@ var storagesContract = c5.router({
     method: "GET",
     path: "/api/storages",
     headers: authHeadersSchema,
-    query: z8.object({
-      name: z8.string().min(1, "Storage name is required"),
+    query: z9.object({
+      name: z9.string().min(1, "Storage name is required"),
       version: versionQuerySchema
     }),
     responses: {
@@ -1552,41 +1588,41 @@ var storagesContract = c5.router({
   }
 });
 var MAX_FILE_SIZE_BYTES = 104857600;
-var fileEntryWithHashSchema = z8.object({
-  path: z8.string().min(1, "File path is required"),
-  hash: z8.string().length(64, "Hash must be SHA-256 (64 hex chars)"),
-  size: z8.number().int().min(0, "Size must be non-negative").max(MAX_FILE_SIZE_BYTES, "File size exceeds 100MB limit")
+var fileEntryWithHashSchema = z9.object({
+  path: z9.string().min(1, "File path is required"),
+  hash: z9.string().length(64, "Hash must be SHA-256 (64 hex chars)"),
+  size: z9.number().int().min(0, "Size must be non-negative").max(MAX_FILE_SIZE_BYTES, "File size exceeds 100MB limit")
 });
-var storageChangesSchema = z8.object({
-  added: z8.array(z8.string()),
-  modified: z8.array(z8.string()),
-  deleted: z8.array(z8.string())
+var storageChangesSchema = z9.object({
+  added: z9.array(z9.string()),
+  modified: z9.array(z9.string()),
+  deleted: z9.array(z9.string())
 });
-var presignedUploadSchema = z8.object({
-  key: z8.string(),
-  presignedUrl: z8.url()
+var presignedUploadSchema = z9.object({
+  key: z9.string(),
+  presignedUrl: z9.url()
 });
 var storagesPrepareContract = c5.router({
   prepare: {
     method: "POST",
     path: "/api/storages/prepare",
     headers: authHeadersSchema,
-    body: z8.object({
-      storageName: z8.string().min(1, "Storage name is required"),
+    body: z9.object({
+      storageName: z9.string().min(1, "Storage name is required"),
       storageType: storageTypeSchema,
-      files: z8.array(fileEntryWithHashSchema),
-      force: z8.boolean().optional(),
-      runId: z8.string().optional(),
+      files: z9.array(fileEntryWithHashSchema),
+      force: z9.boolean().optional(),
+      runId: z9.string().optional(),
       // For sandbox auth
-      baseVersion: z8.string().optional(),
+      baseVersion: z9.string().optional(),
       // For incremental uploads
       changes: storageChangesSchema.optional()
     }),
     responses: {
-      200: z8.object({
-        versionId: z8.string(),
-        existing: z8.boolean(),
-        uploads: z8.object({
+      200: z9.object({
+        versionId: z9.string(),
+        existing: z9.boolean(),
+        uploads: z9.object({
           archive: presignedUploadSchema,
           manifest: presignedUploadSchema
         }).optional()
@@ -1606,22 +1642,22 @@ var storagesCommitContract = c5.router({
     method: "POST",
     path: "/api/storages/commit",
     headers: authHeadersSchema,
-    body: z8.object({
-      storageName: z8.string().min(1, "Storage name is required"),
+    body: z9.object({
+      storageName: z9.string().min(1, "Storage name is required"),
       storageType: storageTypeSchema,
-      versionId: z8.string().min(1, "Version ID is required"),
-      files: z8.array(fileEntryWithHashSchema),
-      runId: z8.string().optional(),
-      message: z8.string().optional()
+      versionId: z9.string().min(1, "Version ID is required"),
+      files: z9.array(fileEntryWithHashSchema),
+      runId: z9.string().optional(),
+      message: z9.string().optional()
     }),
     responses: {
-      200: z8.object({
-        success: z8.literal(true),
-        versionId: z8.string(),
-        storageName: z8.string(),
-        size: z8.number(),
-        fileCount: z8.number(),
-        deduplicated: z8.boolean().optional()
+      200: z9.object({
+        success: z9.literal(true),
+        versionId: z9.string(),
+        storageName: z9.string(),
+        size: z9.number(),
+        fileCount: z9.number(),
+        deduplicated: z9.boolean().optional()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -1640,26 +1676,26 @@ var storagesDownloadContract = c5.router({
     method: "GET",
     path: "/api/storages/download",
     headers: authHeadersSchema,
-    query: z8.object({
-      name: z8.string().min(1, "Storage name is required"),
+    query: z9.object({
+      name: z9.string().min(1, "Storage name is required"),
       type: storageTypeSchema,
       version: versionQuerySchema
     }),
     responses: {
       // Normal response with presigned URL
-      200: z8.union([
-        z8.object({
-          url: z8.url(),
-          versionId: z8.string(),
-          fileCount: z8.number(),
-          size: z8.number()
+      200: z9.union([
+        z9.object({
+          url: z9.url(),
+          versionId: z9.string(),
+          fileCount: z9.number(),
+          size: z9.number()
         }),
         // Empty artifact response
-        z8.object({
-          empty: z8.literal(true),
-          versionId: z8.string(),
-          fileCount: z8.literal(0),
-          size: z8.literal(0)
+        z9.object({
+          empty: z9.literal(true),
+          versionId: z9.string(),
+          fileCount: z9.literal(0),
+          size: z9.literal(0)
         })
       ]),
       400: apiErrorSchema,
@@ -1676,16 +1712,16 @@ var storagesListContract = c5.router({
     method: "GET",
     path: "/api/storages/list",
     headers: authHeadersSchema,
-    query: z8.object({
+    query: z9.object({
       type: storageTypeSchema
     }),
     responses: {
-      200: z8.array(
-        z8.object({
-          name: z8.string(),
-          size: z8.number(),
-          fileCount: z8.number(),
-          updatedAt: z8.string()
+      200: z9.array(
+        z9.object({
+          name: z9.string(),
+          size: z9.number(),
+          fileCount: z9.number(),
+          updatedAt: z9.string()
         })
       ),
       401: apiErrorSchema,
@@ -1697,22 +1733,22 @@ var storagesListContract = c5.router({
 });
 
 // ../../packages/core/src/contracts/webhooks.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var c6 = initContract();
-var agentEventSchema = z9.object({
-  type: z9.string(),
-  sequenceNumber: z9.number().int().nonnegative()
+var agentEventSchema = z10.object({
+  type: z10.string(),
+  sequenceNumber: z10.number().int().nonnegative()
 }).passthrough();
-var artifactSnapshotSchema = z9.object({
-  artifactName: z9.string(),
-  artifactVersion: z9.string()
+var artifactSnapshotSchema = z10.object({
+  artifactName: z10.string(),
+  artifactVersion: z10.string()
 });
-var memorySnapshotSchema = z9.object({
-  memoryName: z9.string(),
-  memoryVersion: z9.string()
+var memorySnapshotSchema = z10.object({
+  memoryName: z10.string(),
+  memoryVersion: z10.string()
 });
-var volumeVersionsSnapshotSchema = z9.object({
-  versions: z9.record(z9.string(), z9.string())
+var volumeVersionsSnapshotSchema = z10.object({
+  versions: z10.record(z10.string(), z10.string())
 });
 var webhookEventsContract = c6.router({
   /**
@@ -1723,15 +1759,15 @@ var webhookEventsContract = c6.router({
     method: "POST",
     path: "/api/webhooks/agent/events",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
-      events: z9.array(agentEventSchema).min(1, "events array cannot be empty")
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
+      events: z10.array(agentEventSchema).min(1, "events array cannot be empty")
     }),
     responses: {
-      200: z9.object({
-        received: z9.number(),
-        firstSequence: z9.number(),
-        lastSequence: z9.number()
+      200: z10.object({
+        received: z10.number(),
+        firstSequence: z10.number(),
+        lastSequence: z10.number()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -1750,15 +1786,15 @@ var webhookCompleteContract = c6.router({
     method: "POST",
     path: "/api/webhooks/agent/complete",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
-      exitCode: z9.number(),
-      error: z9.string().optional()
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
+      exitCode: z10.number(),
+      error: z10.string().optional()
     }),
     responses: {
-      200: z9.object({
-        success: z9.boolean(),
-        status: z9.enum(["completed", "failed"])
+      200: z10.object({
+        success: z10.boolean(),
+        status: z10.enum(["completed", "failed"])
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -1777,23 +1813,23 @@ var webhookCheckpointsContract = c6.router({
     method: "POST",
     path: "/api/webhooks/agent/checkpoints",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
-      cliAgentType: z9.string().min(1, "cliAgentType is required"),
-      cliAgentSessionId: z9.string().min(1, "cliAgentSessionId is required"),
-      cliAgentSessionHistory: z9.string().min(1, "cliAgentSessionHistory is required"),
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
+      cliAgentType: z10.string().min(1, "cliAgentType is required"),
+      cliAgentSessionId: z10.string().min(1, "cliAgentSessionId is required"),
+      cliAgentSessionHistory: z10.string().min(1, "cliAgentSessionHistory is required"),
       artifactSnapshot: artifactSnapshotSchema.optional(),
       memorySnapshot: memorySnapshotSchema.optional(),
       volumeVersionsSnapshot: volumeVersionsSnapshotSchema.optional()
     }),
     responses: {
-      200: z9.object({
-        checkpointId: z9.string(),
-        agentSessionId: z9.string(),
-        conversationId: z9.string(),
+      200: z10.object({
+        checkpointId: z10.string(),
+        agentSessionId: z10.string(),
+        conversationId: z10.string(),
         artifact: artifactSnapshotSchema.optional(),
         memory: memorySnapshotSchema.optional(),
-        volumes: z9.record(z9.string(), z9.string()).optional()
+        volumes: z10.record(z10.string(), z10.string()).optional()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -1812,12 +1848,12 @@ var webhookHeartbeatContract = c6.router({
     method: "POST",
     path: "/api/webhooks/agent/heartbeat",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required")
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required")
     }),
     responses: {
-      200: z9.object({
-        ok: z9.boolean()
+      200: z10.object({
+        ok: z10.boolean()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -1845,11 +1881,11 @@ var webhookStoragesContract = c6.router({
     contentType: "multipart/form-data",
     body: c6.type(),
     responses: {
-      200: z9.object({
-        versionId: z9.string(),
-        storageName: z9.string(),
-        size: z9.number(),
-        fileCount: z9.number()
+      200: z10.object({
+        versionId: z10.string(),
+        storageName: z10.string(),
+        size: z10.number(),
+        fileCount: z10.number()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -1879,17 +1915,17 @@ var webhookStoragesIncrementalContract = c6.router({
     contentType: "multipart/form-data",
     body: c6.type(),
     responses: {
-      200: z9.object({
-        versionId: z9.string(),
-        storageName: z9.string(),
-        size: z9.number(),
-        fileCount: z9.number(),
-        incrementalStats: z9.object({
-          addedFiles: z9.number(),
-          modifiedFiles: z9.number(),
-          deletedFiles: z9.number(),
-          unchangedFiles: z9.number(),
-          bytesUploaded: z9.number()
+      200: z10.object({
+        versionId: z10.string(),
+        storageName: z10.string(),
+        size: z10.number(),
+        fileCount: z10.number(),
+        incrementalStats: z10.object({
+          addedFiles: z10.number(),
+          modifiedFiles: z10.number(),
+          deletedFiles: z10.number(),
+          unchangedFiles: z10.number(),
+          bytesUploaded: z10.number()
         }).optional()
       }),
       400: apiErrorSchema,
@@ -1900,41 +1936,41 @@ var webhookStoragesIncrementalContract = c6.router({
     summary: "Upload storage version incrementally from sandbox"
   }
 });
-var metricDataSchema = z9.object({
-  ts: z9.string(),
-  cpu: z9.number(),
-  mem_used: z9.number(),
-  mem_total: z9.number(),
-  disk_used: z9.number(),
-  disk_total: z9.number()
-});
-var sandboxOperationSchema = z9.object({
-  ts: z9.string(),
-  action_type: z9.string(),
-  duration_ms: z9.number(),
-  success: z9.boolean(),
-  error: z9.string().optional()
-});
-var networkLogSchema = z9.object({
-  timestamp: z9.string(),
-  type: z9.string().optional(),
-  action: z9.enum(["ALLOW", "DENY"]).optional(),
-  host: z9.string().optional(),
-  port: z9.number().optional(),
-  method: z9.string().optional(),
-  url: z9.string().optional(),
-  status: z9.number().optional(),
-  latency_ms: z9.number().optional(),
-  request_size: z9.number().optional(),
-  response_size: z9.number().optional(),
-  firewall_base: z9.string().optional(),
-  firewall_name: z9.string().optional(),
-  firewall_ref: z9.string().optional(),
-  firewall_permission: z9.string().optional(),
-  firewall_rule_match: z9.string().optional(),
-  firewall_params: z9.record(z9.string(), z9.string()).optional(),
-  firewall_error: z9.string().optional(),
-  error: z9.string().optional()
+var metricDataSchema = z10.object({
+  ts: z10.string(),
+  cpu: z10.number(),
+  mem_used: z10.number(),
+  mem_total: z10.number(),
+  disk_used: z10.number(),
+  disk_total: z10.number()
+});
+var sandboxOperationSchema = z10.object({
+  ts: z10.string(),
+  action_type: z10.string(),
+  duration_ms: z10.number(),
+  success: z10.boolean(),
+  error: z10.string().optional()
+});
+var networkLogSchema = z10.object({
+  timestamp: z10.string(),
+  type: z10.string().optional(),
+  action: z10.enum(["ALLOW", "DENY"]).optional(),
+  host: z10.string().optional(),
+  port: z10.number().optional(),
+  method: z10.string().optional(),
+  url: z10.string().optional(),
+  status: z10.number().optional(),
+  latency_ms: z10.number().optional(),
+  request_size: z10.number().optional(),
+  response_size: z10.number().optional(),
+  firewall_base: z10.string().optional(),
+  firewall_name: z10.string().optional(),
+  firewall_ref: z10.string().optional(),
+  firewall_permission: z10.string().optional(),
+  firewall_rule_match: z10.string().optional(),
+  firewall_params: z10.record(z10.string(), z10.string()).optional(),
+  firewall_error: z10.string().optional(),
+  error: z10.string().optional()
 });
 var webhookTelemetryContract = c6.router({
   /**
@@ -1945,17 +1981,17 @@ var webhookTelemetryContract = c6.router({
     method: "POST",
     path: "/api/webhooks/agent/telemetry",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
-      systemLog: z9.string().optional(),
-      metrics: z9.array(metricDataSchema).optional(),
-      networkLogs: z9.array(networkLogSchema).optional(),
-      sandboxOperations: z9.array(sandboxOperationSchema).optional()
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
+      systemLog: z10.string().optional(),
+      metrics: z10.array(metricDataSchema).optional(),
+      networkLogs: z10.array(networkLogSchema).optional(),
+      sandboxOperations: z10.array(sandboxOperationSchema).optional()
     }),
     responses: {
-      200: z9.object({
-        success: z9.boolean(),
-        id: z9.string()
+      200: z10.object({
+        success: z10.boolean(),
+        id: z10.string()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -1970,22 +2006,22 @@ var webhookStoragesPrepareContract = c6.router({
     method: "POST",
     path: "/api/webhooks/agent/storages/prepare",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
       // Required for webhook auth
-      storageName: z9.string().min(1, "Storage name is required"),
+      storageName: z10.string().min(1, "Storage name is required"),
       storageType: storageTypeSchema,
-      files: z9.array(fileEntryWithHashSchema),
-      parentVersionId: z9.string().optional(),
-      force: z9.boolean().optional(),
-      baseVersion: z9.string().optional(),
+      files: z10.array(fileEntryWithHashSchema),
+      parentVersionId: z10.string().optional(),
+      force: z10.boolean().optional(),
+      baseVersion: z10.string().optional(),
       changes: storageChangesSchema.optional()
     }),
     responses: {
-      200: z9.object({
-        versionId: z9.string(),
-        existing: z9.boolean(),
-        uploads: z9.object({
+      200: z10.object({
+        versionId: z10.string(),
+        existing: z10.boolean(),
+        uploads: z10.object({
           archive: presignedUploadSchema,
           manifest: presignedUploadSchema
         }).optional()
@@ -2004,24 +2040,24 @@ var webhookStoragesCommitContract = c6.router({
     method: "POST",
     path: "/api/webhooks/agent/storages/commit",
     headers: authHeadersSchema,
-    body: z9.object({
-      runId: z9.string().min(1, "runId is required"),
+    body: z10.object({
+      runId: z10.string().min(1, "runId is required"),
       // Required for webhook auth
-      storageName: z9.string().min(1, "Storage name is required"),
+      storageName: z10.string().min(1, "Storage name is required"),
       storageType: storageTypeSchema,
-      versionId: z9.string().min(1, "Version ID is required"),
-      parentVersionId: z9.string().optional(),
-      files: z9.array(fileEntryWithHashSchema),
-      message: z9.string().optional()
+      versionId: z10.string().min(1, "Version ID is required"),
+      parentVersionId: z10.string().optional(),
+      files: z10.array(fileEntryWithHashSchema),
+      message: z10.string().optional()
     }),
     responses: {
-      200: z9.object({
-        success: z9.literal(true),
-        versionId: z9.string(),
-        storageName: z9.string(),
-        size: z9.number(),
-        fileCount: z9.number(),
-        deduplicated: z9.boolean().optional()
+      200: z10.object({
+        success: z10.literal(true),
+        versionId: z10.string(),
+        storageName: z10.string(),
+        size: z10.number(),
+        fileCount: z10.number(),
+        deduplicated: z10.boolean().optional()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -2036,11 +2072,11 @@ var webhookStoragesCommitContract = c6.router({
 });
 
 // ../../packages/core/src/contracts/cli-auth.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var c7 = initContract();
-var oauthErrorSchema = z10.object({
-  error: z10.string(),
-  error_description: z10.string()
+var oauthErrorSchema = z11.object({
+  error: z11.string(),
+  error_description: z11.string()
 });
 var cliAuthDeviceContract = c7.router({
   /**
@@ -2050,14 +2086,14 @@ var cliAuthDeviceContract = c7.router({
   create: {
     method: "POST",
     path: "/api/cli/auth/device",
-    body: z10.object({}).optional(),
+    body: z11.object({}).optional(),
     responses: {
-      200: z10.object({
-        device_code: z10.string(),
-        user_code: z10.string(),
-        verification_path: z10.string(),
-        expires_in: z10.number(),
-        interval: z10.number()
+      200: z11.object({
+        device_code: z11.string(),
+        user_code: z11.string(),
+        verification_path: z11.string(),
+        expires_in: z11.number(),
+        interval: z11.number()
       }),
       500: oauthErrorSchema
     },
@@ -2072,16 +2108,16 @@ var cliAuthTokenContract = c7.router({
   exchange: {
     method: "POST",
     path: "/api/cli/auth/token",
-    body: z10.object({
-      device_code: z10.string().min(1, "device_code is required")
+    body: z11.object({
+      device_code: z11.string().min(1, "device_code is required")
     }),
     responses: {
       // Success - token issued
-      200: z10.object({
-        access_token: z10.string(),
-        token_type: z10.literal("Bearer"),
-        expires_in: z10.number(),
-        org_slug: z10.string().optional()
+      200: z11.object({
+        access_token: z11.string(),
+        token_type: z11.literal("Bearer"),
+        expires_in: z11.number(),
+        org_slug: z11.string().optional()
       }),
       // Authorization pending
       202: oauthErrorSchema,
@@ -2092,8 +2128,8 @@ var cliAuthTokenContract = c7.router({
     summary: "Exchange device code for access token"
   }
 });
-var apiErrorResponseSchema = z10.object({
-  error: z10.object({ message: z10.string(), code: z10.string() })
+var apiErrorResponseSchema = z11.object({
+  error: z11.object({ message: z11.string(), code: z11.string() })
 });
 var cliAuthOrgContract = c7.router({
   /**
@@ -2104,13 +2140,13 @@ var cliAuthOrgContract = c7.router({
     method: "POST",
     path: "/api/cli/auth/org",
     headers: authHeadersSchema,
-    body: z10.object({ slug: z10.string().min(1) }),
+    body: z11.object({ slug: z11.string().min(1) }),
     responses: {
-      200: z10.object({
-        access_token: z10.string(),
-        token_type: z10.literal("Bearer"),
-        expires_in: z10.number(),
-        org_slug: z10.string()
+      200: z11.object({
+        access_token: z11.string(),
+        token_type: z11.literal("Bearer"),
+        expires_in: z11.number(),
+        org_slug: z11.string()
       }),
       400: oauthErrorSchema,
       401: apiErrorResponseSchema,
@@ -2122,7 +2158,7 @@ var cliAuthOrgContract = c7.router({
 });
 
 // ../../packages/core/src/contracts/auth.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var c8 = initContract();
 var authContract = c8.router({
   /**
@@ -2134,9 +2170,9 @@ var authContract = c8.router({
     path: "/api/auth/me",
     headers: authHeadersSchema,
     responses: {
-      200: z11.object({
-        userId: z11.string(),
-        email: z11.string()
+      200: z12.object({
+        userId: z12.string(),
+        email: z12.string()
       }),
       401: apiErrorSchema,
       403: apiErrorSchema,
@@ -2148,19 +2184,19 @@ var authContract = c8.router({
 });
 
 // ../../packages/core/src/contracts/cron.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var c9 = initContract();
-var cleanupResultSchema = z12.object({
-  runId: z12.string(),
-  sandboxId: z12.string().nullable(),
-  status: z12.enum(["cleaned", "error"]),
-  error: z12.string().optional(),
-  reason: z12.string().optional()
-});
-var cleanupResponseSchema = z12.object({
-  cleaned: z12.number(),
-  errors: z12.number(),
-  results: z12.array(cleanupResultSchema)
+var cleanupResultSchema = z13.object({
+  runId: z13.string(),
+  sandboxId: z13.string().nullable(),
+  status: z13.enum(["cleaned", "error"]),
+  error: z13.string().optional(),
+  reason: z13.string().optional()
+});
+var cleanupResponseSchema = z13.object({
+  cleaned: z13.number(),
+  errors: z13.number(),
+  results: z13.array(cleanupResultSchema)
 });
 var cronCleanupSandboxesContract = c9.router({
   /**
@@ -2181,54 +2217,54 @@ var cronCleanupSandboxesContract = c9.router({
 });
 
 // ../../packages/core/src/contracts/secrets.ts
-import { z as z13 } from "zod";
-var secretNameSchema = z13.string().min(1, "Secret name is required").max(255, "Secret name must be at most 255 characters").regex(
+import { z as z14 } from "zod";
+var secretNameSchema = z14.string().min(1, "Secret name is required").max(255, "Secret name must be at most 255 characters").regex(
   /^[A-Z][A-Z0-9_]*$/,
   "Secret name must contain only uppercase letters, numbers, and underscores, and must start with a letter (e.g., MY_API_KEY)"
 );
-var secretTypeSchema = z13.enum(["user", "model-provider", "connector"]);
-var secretResponseSchema = z13.object({
-  id: z13.uuid(),
-  name: z13.string(),
-  description: z13.string().nullable(),
+var secretTypeSchema = z14.enum(["user", "model-provider", "connector"]);
+var secretResponseSchema = z14.object({
+  id: z14.uuid(),
+  name: z14.string(),
+  description: z14.string().nullable(),
   type: secretTypeSchema,
-  createdAt: z13.string(),
-  updatedAt: z13.string()
+  createdAt: z14.string(),
+  updatedAt: z14.string()
 });
-var secretListResponseSchema = z13.object({
-  secrets: z13.array(secretResponseSchema)
+var secretListResponseSchema = z14.object({
+  secrets: z14.array(secretResponseSchema)
 });
-var setSecretRequestSchema = z13.object({
+var setSecretRequestSchema = z14.object({
   name: secretNameSchema,
-  value: z13.string().min(1, "Secret value is required"),
-  description: z13.string().max(1e3).optional()
+  value: z14.string().min(1, "Secret value is required"),
+  description: z14.string().max(1e3).optional()
 });
 
 // ../../packages/core/src/contracts/variables.ts
-import { z as z14 } from "zod";
-var variableNameSchema = z14.string().min(1, "Variable name is required").max(255, "Variable name must be at most 255 characters").regex(
+import { z as z15 } from "zod";
+var variableNameSchema = z15.string().min(1, "Variable name is required").max(255, "Variable name must be at most 255 characters").regex(
   /^[A-Z][A-Z0-9_]*$/,
   "Variable name must contain only uppercase letters, numbers, and underscores, and must start with a letter (e.g., MY_VAR)"
 );
-var variableResponseSchema = z14.object({
-  id: z14.uuid(),
-  name: z14.string(),
-  value: z14.string(),
-  description: z14.string().nullable(),
-  createdAt: z14.string(),
-  updatedAt: z14.string()
+var variableResponseSchema = z15.object({
+  id: z15.uuid(),
+  name: z15.string(),
+  value: z15.string(),
+  description: z15.string().nullable(),
+  createdAt: z15.string(),
+  updatedAt: z15.string()
 });
-var variableListResponseSchema = z14.object({
-  variables: z14.array(variableResponseSchema)
+var variableListResponseSchema = z15.object({
+  variables: z15.array(variableResponseSchema)
 });
-var setVariableRequestSchema = z14.object({
+var setVariableRequestSchema = z15.object({
   name: variableNameSchema,
-  value: z14.string().min(1, "Variable value is required"),
-  description: z14.string().max(1e3).optional()
+  value: z15.string().min(1, "Variable value is required"),
+  description: z15.string().max(1e3).optional()
 });
 
 // ../../packages/core/src/contracts/model-providers.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var VM0_MODEL_TO_PROVIDER = {
   "claude-sonnet-4.6": {
     concreteType: "anthropic-api-key",
@@ -2590,7 +2626,7 @@ var MODEL_PROVIDER_FIREWALL_CONFIGS = {
     "sk-vm0placeholder000000000000000000"
   )
 };
-var modelProviderTypeSchema = z15.enum([
+var modelProviderTypeSchema = z16.enum([
   "claude-code-oauth-token",
   "anthropic-api-key",
   "openrouter-api-key",
@@ -2603,7 +2639,7 @@ var modelProviderTypeSchema = z15.enum([
   "aws-bedrock",
   "vm0"
 ]);
-var modelProviderFrameworkSchema = z15.enum(["claude-code"]);
+var modelProviderFrameworkSchema = z16.enum(["claude-code"]);
 function hasAuthMethods(type) {
   const config = MODEL_PROVIDER_TYPES[type];
   return "authMethods" in config;
@@ -2648,108 +2684,108 @@ function getCustomModelPlaceholder(type) {
   const config = MODEL_PROVIDER_TYPES[type];
   return "customModelPlaceholder" in config ? config.customModelPlaceholder : void 0;
 }
-var modelProviderResponseSchema = z15.object({
-  id: z15.uuid(),
+var modelProviderResponseSchema = z16.object({
+  id: z16.uuid(),
   type: modelProviderTypeSchema,
   framework: modelProviderFrameworkSchema,
-  secretName: z15.string().nullable(),
+  secretName: z16.string().nullable(),
   // Legacy single-secret (deprecated for multi-auth)
-  authMethod: z15.string().nullable(),
+  authMethod: z16.string().nullable(),
   // For multi-auth providers
-  secretNames: z15.array(z15.string()).nullable(),
+  secretNames: z16.array(z16.string()).nullable(),
   // For multi-auth providers
-  isDefault: z15.boolean(),
-  selectedModel: z15.string().nullable(),
-  createdAt: z15.string(),
-  updatedAt: z15.string()
+  isDefault: z16.boolean(),
+  selectedModel: z16.string().nullable(),
+  createdAt: z16.string(),
+  updatedAt: z16.string()
 });
-var modelProviderListResponseSchema = z15.object({
-  modelProviders: z15.array(modelProviderResponseSchema)
+var modelProviderListResponseSchema = z16.object({
+  modelProviders: z16.array(modelProviderResponseSchema)
 });
-var upsertModelProviderRequestSchema = z15.object({
+var upsertModelProviderRequestSchema = z16.object({
   type: modelProviderTypeSchema,
-  secret: z15.string().min(1).optional(),
+  secret: z16.string().min(1).optional(),
   // Legacy single secret
-  authMethod: z15.string().optional(),
+  authMethod: z16.string().optional(),
   // For multi-auth providers
-  secrets: z15.record(z15.string(), z15.string()).optional(),
+  secrets: z16.record(z16.string(), z16.string()).optional(),
   // For multi-auth providers
-  selectedModel: z15.string().optional()
+  selectedModel: z16.string().optional()
 });
-var upsertModelProviderResponseSchema = z15.object({
+var upsertModelProviderResponseSchema = z16.object({
   provider: modelProviderResponseSchema,
-  created: z15.boolean()
+  created: z16.boolean()
 });
-var updateModelRequestSchema = z15.object({
-  selectedModel: z15.string().optional()
+var updateModelRequestSchema = z16.object({
+  selectedModel: z16.string().optional()
 });
 
 // ../../packages/core/src/contracts/sessions.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 
 // ../../packages/core/src/contracts/chat-threads.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var c10 = initContract();
-var chatThreadListItemSchema = z16.object({
-  id: z16.string(),
-  title: z16.string().nullable(),
-  preview: z16.string().nullable(),
-  agentId: z16.string(),
-  createdAt: z16.string(),
-  updatedAt: z16.string()
+var chatThreadListItemSchema = z17.object({
+  id: z17.string(),
+  title: z17.string().nullable(),
+  preview: z17.string().nullable(),
+  agentId: z17.string(),
+  createdAt: z17.string(),
+  updatedAt: z17.string()
 });
-var toolSummaryEntrySchema = z16.object({
-  kind: z16.literal("tool"),
-  name: z16.string(),
-  input: z16.record(z16.string(), z16.unknown()).optional()
+var toolSummaryEntrySchema = z17.object({
+  kind: z17.literal("tool"),
+  name: z17.string(),
+  input: z17.record(z17.string(), z17.unknown()).optional()
 });
-var textSummaryEntrySchema = z16.object({
-  kind: z16.literal("text"),
-  text: z16.string()
+var textSummaryEntrySchema = z17.object({
+  kind: z17.literal("text"),
+  text: z17.string()
 });
-var summaryEntrySchema = z16.union([
-  z16.string(),
+var summaryEntrySchema = z17.union([
+  z17.string(),
   toolSummaryEntrySchema,
   textSummaryEntrySchema
 ]);
-var storedChatMessageSchema = z16.object({
-  role: z16.enum(["user", "assistant"]),
-  content: z16.string(),
-  runId: z16.string().optional(),
-  error: z16.string().optional(),
-  summaries: z16.array(summaryEntrySchema).optional(),
-  createdAt: z16.string()
-});
-var unsavedRunSchema = z16.object({
-  runId: z16.string(),
-  status: z16.string(),
-  prompt: z16.string(),
-  error: z16.string().nullable()
-});
-var chatThreadDetailSchema = z16.object({
-  id: z16.string(),
-  title: z16.string().nullable(),
-  agentId: z16.string(),
-  chatMessages: z16.array(storedChatMessageSchema),
-  latestSessionId: z16.string().nullable(),
-  unsavedRuns: z16.array(unsavedRunSchema),
-  createdAt: z16.string(),
-  updatedAt: z16.string()
+var storedChatMessageSchema = z17.object({
+  role: z17.enum(["user", "assistant"]),
+  content: z17.string(),
+  runId: z17.string().optional(),
+  error: z17.string().optional(),
+  summaries: z17.array(summaryEntrySchema).optional(),
+  createdAt: z17.string()
+});
+var unsavedRunSchema = z17.object({
+  runId: z17.string(),
+  status: z17.string(),
+  prompt: z17.string(),
+  error: z17.string().nullable()
+});
+var chatThreadDetailSchema = z17.object({
+  id: z17.string(),
+  title: z17.string().nullable(),
+  agentId: z17.string(),
+  chatMessages: z17.array(storedChatMessageSchema),
+  latestSessionId: z17.string().nullable(),
+  unsavedRuns: z17.array(unsavedRunSchema),
+  createdAt: z17.string(),
+  updatedAt: z17.string()
 });
 var chatThreadsContract = c10.router({
   create: {
     method: "POST",
     path: "/api/zero/chat-threads",
     headers: authHeadersSchema,
-    body: z16.object({
-      agentId: z16.string().min(1),
-      title: z16.string().optional()
+    body: z17.object({
+      agentId: z17.string().min(1),
+      title: z17.string().optional()
     }),
     responses: {
-      201: z16.object({
-        id: z16.string(),
-        title: z16.string().nullable(),
-        createdAt: z16.string()
+      201: z17.object({
+        id: z17.string(),
+        title: z17.string().nullable(),
+        createdAt: z17.string()
       }),
       401: apiErrorSchema
     },
@@ -2759,11 +2795,11 @@ var chatThreadsContract = c10.router({
     method: "GET",
     path: "/api/zero/chat-threads",
     headers: authHeadersSchema,
-    query: z16.object({
-      agentId: z16.string().min(1, "agentId is required")
+    query: z17.object({
+      agentId: z17.string().min(1, "agentId is required")
     }),
     responses: {
-      200: z16.object({ threads: z16.array(chatThreadListItemSchema) }),
+      200: z17.object({ threads: z17.array(chatThreadListItemSchema) }),
       401: apiErrorSchema
     },
     summary: "List chat threads for an agent"
@@ -2774,7 +2810,7 @@ var chatThreadByIdContract = c10.router({
     method: "GET",
     path: "/api/zero/chat-threads/:id",
     headers: authHeadersSchema,
-    pathParams: z16.object({ id: z16.string() }),
+    pathParams: z17.object({ id: z17.string() }),
     responses: {
       200: chatThreadDetailSchema,
       401: apiErrorSchema,
@@ -2788,9 +2824,9 @@ var chatThreadRunsContract = c10.router({
     method: "POST",
     path: "/api/zero/chat-threads/:id/runs",
     headers: authHeadersSchema,
-    pathParams: z16.object({ id: z16.string() }),
-    body: z16.object({
-      runId: z16.string().min(1)
+    pathParams: z17.object({ id: z17.string() }),
+    body: z17.object({
+      runId: z17.string().min(1)
     }),
     responses: {
       204: c10.noBody(),
@@ -2805,18 +2841,18 @@ var chatMessagesContract = c10.router({
     method: "POST",
     path: "/api/zero/chat/messages",
     headers: authHeadersSchema,
-    body: z16.object({
-      agentId: z16.string().min(1),
-      prompt: z16.string().min(1),
-      threadId: z16.string().optional(),
-      modelProvider: z16.string().optional()
+    body: z17.object({
+      agentId: z17.string().min(1),
+      prompt: z17.string().min(1),
+      threadId: z17.string().optional(),
+      modelProvider: z17.string().optional()
     }),
     responses: {
-      201: z16.object({
-        runId: z16.string(),
-        threadId: z16.string(),
+      201: z17.object({
+        runId: z17.string(),
+        threadId: z17.string(),
         status: runStatusSchema,
-        createdAt: z16.string()
+        createdAt: z17.string()
       }),
       400: apiErrorSchema,
       401: apiErrorSchema,
@@ -2829,50 +2865,50 @@ var chatMessagesContract = c10.router({
 
 // ../../packages/core/src/contracts/sessions.ts
 var c11 = initContract();
-var storedChatMessageSchema2 = z17.object({
-  role: z17.enum(["user", "assistant"]),
-  content: z17.string(),
-  runId: z17.string().optional(),
-  summaries: z17.array(summaryEntrySchema).optional(),
-  createdAt: z17.string()
-});
-var sessionResponseSchema = z17.object({
-  id: z17.string(),
-  agentComposeId: z17.string(),
-  conversationId: z17.string().nullable(),
-  artifactName: z17.string().nullable(),
-  secretNames: z17.array(z17.string()).nullable(),
-  chatMessages: z17.array(storedChatMessageSchema2).optional(),
-  createdAt: z17.string(),
-  updatedAt: z17.string()
-});
-var sessionListItemSchema = z17.object({
-  id: z17.string(),
-  createdAt: z17.string(),
-  updatedAt: z17.string(),
-  messageCount: z17.number(),
-  preview: z17.string().nullable()
-});
-var agentComposeSnapshotSchema = z17.object({
-  agentComposeVersionId: z17.string(),
-  vars: z17.record(z17.string(), z17.string()).optional(),
-  secretNames: z17.array(z17.string()).optional()
-});
-var artifactSnapshotSchema2 = z17.object({
-  artifactName: z17.string(),
-  artifactVersion: z17.string()
-});
-var volumeVersionsSnapshotSchema2 = z17.object({
-  versions: z17.record(z17.string(), z17.string())
-});
-var checkpointResponseSchema = z17.object({
-  id: z17.string(),
-  runId: z17.string(),
-  conversationId: z17.string(),
+var storedChatMessageSchema2 = z18.object({
+  role: z18.enum(["user", "assistant"]),
+  content: z18.string(),
+  runId: z18.string().optional(),
+  summaries: z18.array(summaryEntrySchema).optional(),
+  createdAt: z18.string()
+});
+var sessionResponseSchema = z18.object({
+  id: z18.string(),
+  agentComposeId: z18.string(),
+  conversationId: z18.string().nullable(),
+  artifactName: z18.string().nullable(),
+  secretNames: z18.array(z18.string()).nullable(),
+  chatMessages: z18.array(storedChatMessageSchema2).optional(),
+  createdAt: z18.string(),
+  updatedAt: z18.string()
+});
+var sessionListItemSchema = z18.object({
+  id: z18.string(),
+  createdAt: z18.string(),
+  updatedAt: z18.string(),
+  messageCount: z18.number(),
+  preview: z18.string().nullable()
+});
+var agentComposeSnapshotSchema = z18.object({
+  agentComposeVersionId: z18.string(),
+  vars: z18.record(z18.string(), z18.string()).optional(),
+  secretNames: z18.array(z18.string()).optional()
+});
+var artifactSnapshotSchema2 = z18.object({
+  artifactName: z18.string(),
+  artifactVersion: z18.string()
+});
+var volumeVersionsSnapshotSchema2 = z18.object({
+  versions: z18.record(z18.string(), z18.string())
+});
+var checkpointResponseSchema = z18.object({
+  id: z18.string(),
+  runId: z18.string(),
+  conversationId: z18.string(),
   agentComposeSnapshot: agentComposeSnapshotSchema,
   artifactSnapshot: artifactSnapshotSchema2.nullable(),
   volumeVersionsSnapshot: volumeVersionsSnapshotSchema2.nullable(),
-  createdAt: z17.string()
+  createdAt: z18.string()
 });
 var sessionsContract = c11.router({
   /**
@@ -2883,11 +2919,11 @@ var sessionsContract = c11.router({
     method: "GET",
     path: "/api/agent/sessions",
     headers: authHeadersSchema,
-    query: z17.object({
-      agentComposeId: z17.string().min(1, "agentComposeId is required")
+    query: z18.object({
+      agentComposeId: z18.string().min(1, "agentComposeId is required")
     }),
     responses: {
-      200: z17.object({ sessions: z17.array(sessionListItemSchema) }),
+      200: z18.object({ sessions: z18.array(sessionListItemSchema) }),
       401: apiErrorSchema
     },
     summary: "List chat sessions for an agent"
@@ -2902,8 +2938,8 @@ var sessionsByIdContract = c11.router({
     method: "GET",
     path: "/api/agent/sessions/:id",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      id: z17.string().min(1, "Session ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Session ID is required")
     }),
     responses: {
       200: sessionResponseSchema,
@@ -2923,20 +2959,20 @@ var sessionMessagesContract = c11.router({
     method: "POST",
     path: "/api/agent/sessions/:id/messages",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      id: z17.string().min(1, "Session ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Session ID is required")
     }),
-    body: z17.object({
-      messages: z17.array(
-        z17.object({
-          role: z17.enum(["user", "assistant"]),
-          content: z17.string(),
-          runId: z17.string().optional()
+    body: z18.object({
+      messages: z18.array(
+        z18.object({
+          role: z18.enum(["user", "assistant"]),
+          content: z18.string(),
+          runId: z18.string().optional()
         })
       )
     }),
     responses: {
-      200: z17.object({ success: z17.literal(true) }),
+      200: z18.object({ success: z18.literal(true) }),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -2953,8 +2989,8 @@ var checkpointsByIdContract = c11.router({
     method: "GET",
     path: "/api/agent/checkpoints/:id",
     headers: authHeadersSchema,
-    pathParams: z17.object({
-      id: z17.string().min(1, "Checkpoint ID is required")
+    pathParams: z18.object({
+      id: z18.string().min(1, "Checkpoint ID is required")
     }),
     responses: {
       200: checkpointResponseSchema,
@@ -2968,42 +3004,6 @@ var checkpointsByIdContract = c11.router({
 
 // ../../packages/core/src/contracts/runners.ts
 import { z as z19 } from "zod";
-
-// ../../packages/core/src/contracts/firewalls.ts
-import { z as z18 } from "zod";
-var firewallPermissionSchema = z18.object({
-  name: z18.string(),
-  description: z18.string().optional(),
-  rules: z18.array(z18.string())
-});
-var firewallApiSchema = z18.object({
-  base: z18.string(),
-  auth: z18.object({
-    headers: z18.record(z18.string(), z18.string())
-  }),
-  permissions: z18.array(firewallPermissionSchema).optional()
-});
-var firewallSchema = z18.object({
-  name: z18.string(),
-  ref: z18.string(),
-  apis: z18.array(firewallApiSchema)
-});
-var experimentalFirewallsSchema = z18.array(firewallSchema);
-var firewallConfigSchema = z18.object({
-  name: z18.string().min(1, "Firewall name is required"),
-  description: z18.string().optional(),
-  apis: z18.array(firewallApiSchema).min(1, "Firewall must have at least one API entry"),
-  placeholders: z18.record(z18.string(), z18.string()).optional()
-});
-var firewallPolicyValueSchema = z18.enum(["allow", "deny", "ask"]);
-var firewallPoliciesSchema = z18.record(
-  z18.string(),
-  z18.record(z18.string(), firewallPolicyValueSchema)
-);
-var BASE_URL_VARS_PATTERN = /\$\{\{\s*vars\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/;
-var BASE_URL_VARS_PATTERN_G = new RegExp(BASE_URL_VARS_PATTERN.source, "g");
-
-// ../../packages/core/src/contracts/runners.ts
 var c12 = initContract();
 var runnerGroupSchema = z19.string().regex(
   /^[a-z0-9-]+\/[a-z0-9-]+$/,
@@ -20124,6 +20124,25 @@ function collectVolumeVersions(value, previous) {
   }
   return { ...previous, [volumeName]: version };
 }
+function parseFirewallPolicies(json) {
+  if (!json) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    throw new Error(
+      `Invalid --firewall-policies JSON: ${json}
+Expected format: '{"ref": {"permission": "allow|deny|ask"}}'`
+    );
+  }
+  const result = firewallPoliciesSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new Error(
+      `Invalid --firewall-policies: ${result.error.issues.map((i) => i.message).join(", ")}`
+    );
+  }
+  return result.data;
+}
 function isUUID(str) {
   return /^[0-9a-f-]{36}$/i.test(str);
 }
@@ -20397,6 +20416,7 @@ export {
   EventRenderer,
   collectKeyValue,
   collectVolumeVersions,
+  parseFirewallPolicies,
   isUUID,
   extractVarNames,
   extractSecretNames,
@@ -20406,4 +20426,4 @@ export {
   pollEvents,
   showNextSteps
 };
-//# sourceMappingURL=chunk-BB3ODMCC.js.map
+//# sourceMappingURL=chunk-JOVCRTRX.js.map