@vm0/cli 9.86.6 → 9.86.7

package/{chunk-LN5TTUIA.js → chunk-JX6CVC6B.js}

@@ -47,7 +47,7 @@ if (DSN) {
   Sentry.init({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.86.6",
+    release: "9.86.7",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -66,7 +66,7 @@ if (DSN) {
     }
   });
   Sentry.setContext("cli", {
-    version: "9.86.6",
+    version: "9.86.7",
     command: process.argv.slice(2).join(" ")
   });
   Sentry.setContext("runtime", {
@@ -422,9 +422,6 @@ function resolveFirewallRef(input) {
   return trimmed;
 }
 
-// ../../packages/core/src/firewall-loader.ts
-import { parse as parseYaml } from "yaml";
-
 // ../../packages/core/src/contracts/firewalls.ts
 import { z } from "zod";
 var firewallPermissionSchema = z.object({
@@ -456,6 +453,35 @@ var firewallPoliciesSchema = z.record(
   z.string(),
   z.record(z.string(), firewallPolicyValueSchema)
 );
+var BASE_URL_VARS_PATTERN = /\$\{\{\s*vars\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/;
+var BASE_URL_VARS_PATTERN_G = new RegExp(BASE_URL_VARS_PATTERN.source, "g");
+function hasBaseUrlVars(base) {
+  return BASE_URL_VARS_PATTERN.test(base);
+}
+function validateBaseUrl(base, serviceName) {
+  if (hasBaseUrlVars(base)) return;
+  let url;
+  try {
+    url = new URL(base);
+  } catch {
+    throw new Error(
+      `Invalid base URL "${base}" in firewall "${serviceName}": not a valid URL`
+    );
+  }
+  if (url.search) {
+    throw new Error(
+      `Invalid base URL "${base}" in firewall "${serviceName}": must not contain query string`
+    );
+  }
+  if (url.hash) {
+    throw new Error(
+      `Invalid base URL "${base}" in firewall "${serviceName}": must not contain fragment`
+    );
+  }
+}
+
+// ../../packages/core/src/firewall-loader.ts
+import { parse as parseYaml } from "yaml";
 
 // ../../packages/core/src/contracts/connectors.ts
 import { z as z2 } from "zod";
@@ -5506,6 +5532,89 @@ var discordFirewall = {
   ]
 };
 
+// ../../packages/core/src/firewalls/docusign.generated.ts
+var docusignFirewall = {
+  name: "docusign",
+  description: "DocuSign eSignature REST API",
+  placeholders: {
+    DOCUSIGN_TOKEN: "eyJ0eXAiOiJNVCIsImFsZyI6IlJTMjU2In0.Vm0PlaceHolder000000000000000000.signature"
+  },
+  apis: [
+    {
+      base: "https://www.docusign.net",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.DOCUSIGN_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://na2.docusign.net",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.DOCUSIGN_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://na3.docusign.net",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.DOCUSIGN_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://na4.docusign.net",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.DOCUSIGN_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://eu.docusign.net",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.DOCUSIGN_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://au.docusign.net",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.DOCUSIGN_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://ca.docusign.net",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.DOCUSIGN_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://demo.docusign.net",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.DOCUSIGN_TOKEN }}"
+        }
+      },
+      permissions: []
+    }
+  ]
+};
+
 // ../../packages/core/src/firewalls/dropbox.generated.ts
 var dropboxFirewall = {
   name: "dropbox",
@@ -9531,6 +9640,26 @@ var jotformFirewall = {
   ]
 };
 
+// ../../packages/core/src/firewalls/kommo.generated.ts
+var kommoFirewall = {
+  name: "kommo",
+  description: "Kommo CRM API",
+  placeholders: {
+    KOMMO_API_KEY: "kmApiKey_Vm0PlaceHolder0000000000000000000000"
+  },
+  apis: [
+    {
+      base: "https://${{ vars.KOMMO_SUBDOMAIN }}.kommo.com",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.KOMMO_API_KEY }}"
+        }
+      },
+      permissions: []
+    }
+  ]
+};
+
 // ../../packages/core/src/firewalls/lark.generated.ts
 var larkFirewall = {
   name: "lark",
@@ -9620,6 +9749,71 @@ var loopsFirewall = {
   ]
 };
 
+// ../../packages/core/src/firewalls/make.generated.ts
+var makeFirewall = {
+  name: "make",
+  description: "Make (formerly Integromat) Automation API",
+  placeholders: {
+    MAKE_TOKEN: "mkTkn-Vm0PlaceHolder-0000-0000-000000000000"
+  },
+  apis: [
+    {
+      base: "https://eu1.make.com",
+      auth: {
+        headers: {
+          Authorization: "Token ${{ secrets.MAKE_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://eu2.make.com",
+      auth: {
+        headers: {
+          Authorization: "Token ${{ secrets.MAKE_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://us1.make.com",
+      auth: {
+        headers: {
+          Authorization: "Token ${{ secrets.MAKE_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://us2.make.com",
+      auth: {
+        headers: {
+          Authorization: "Token ${{ secrets.MAKE_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://eu1.make.celonis.com",
+      auth: {
+        headers: {
+          Authorization: "Token ${{ secrets.MAKE_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://us1.make.celonis.com",
+      auth: {
+        headers: {
+          Authorization: "Token ${{ secrets.MAKE_TOKEN }}"
+        }
+      },
+      permissions: []
+    }
+  ]
+};
+
 // ../../packages/core/src/firewalls/mailsac.generated.ts
 var mailsacFirewall = {
   name: "mailsac",
@@ -12619,6 +12813,44 @@ var wixFirewall = {
   ]
 };
 
+// ../../packages/core/src/firewalls/wrike.generated.ts
+var wrikeFirewall = {
+  name: "wrike",
+  description: "Wrike Project Management API",
+  placeholders: {
+    WRIKE_TOKEN: "wrkTkn_Vm0PlaceHolder000000000000000000000000000000"
+  },
+  apis: [
+    {
+      base: "https://www.wrike.com",
+      auth: {
+        headers: {
+          Authorization: "bearer ${{ secrets.WRIKE_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://app-us2.wrike.com",
+      auth: {
+        headers: {
+          Authorization: "bearer ${{ secrets.WRIKE_TOKEN }}"
+        }
+      },
+      permissions: []
+    },
+    {
+      base: "https://app-eu.wrike.com",
+      auth: {
+        headers: {
+          Authorization: "bearer ${{ secrets.WRIKE_TOKEN }}"
+        }
+      },
+      permissions: []
+    }
+  ]
+};
+
 // ../../packages/core/src/firewalls/x.generated.ts
 var xFirewall = {
   name: "x",
@@ -13156,6 +13388,26 @@ var zapsignFirewall = {
   ]
 };
 
+// ../../packages/core/src/firewalls/zendesk.generated.ts
+var zendeskFirewall = {
+  name: "zendesk",
+  description: "Zendesk Support API",
+  placeholders: {
+    ZENDESK_API_TOKEN: "zkTkn_Vm0PlaceHolder000000000000000000000000"
+  },
+  apis: [
+    {
+      base: "https://${{ vars.ZENDESK_SUBDOMAIN }}.zendesk.com",
+      auth: {
+        headers: {
+          Authorization: "Bearer ${{ secrets.ZENDESK_API_TOKEN }}"
+        }
+      },
+      permissions: []
+    }
+  ]
+};
+
 // ../../packages/core/src/firewalls/zeptomail.generated.ts
 var zeptomailFirewall = {
   name: "zeptomail",
@@ -13202,6 +13454,7 @@ var CONNECTOR_FIREWALLS = {
   deepseek: deepseekFirewall,
   devto: devtoFirewall,
   discord: discordFirewall,
+  docusign: docusignFirewall,
   dropbox: dropboxFirewall,
   elevenlabs: elevenlabsFirewall,
   explorium: exploriumFirewall,
@@ -13229,10 +13482,12 @@ var CONNECTOR_FIREWALLS = {
   intercom: intercomFirewall,
   "intervals-icu": intervalsIcuFirewall,
   jotform: jotformFirewall,
+  kommo: kommoFirewall,
   lark: larkFirewall,
   line: lineFirewall,
   linear: linearFirewall,
   loops: loopsFirewall,
+  make: makeFirewall,
   mailsac: mailsacFirewall,
   mercury: mercuryFirewall,
   "meta-ads": metaAdsFirewall,
@@ -13277,11 +13532,13 @@ var CONNECTOR_FIREWALLS = {
   vercel: vercelFirewall,
   webflow: webflowFirewall,
   wix: wixFirewall,
+  wrike: wrikeFirewall,
   x: xFirewall,
   xero: xeroFirewall,
   youtube: youtubeFirewall,
   zapier: zapierFirewall,
   zapsign: zapsignFirewall,
+  zendesk: zendeskFirewall,
   zeptomail: zeptomailFirewall
 };
 function expandPlaceholders(firewall, connectorType) {
@@ -13437,26 +13694,6 @@ function validateRule(rule, permName, serviceName) {
     }
   }
 }
-function validateBaseUrl(base, serviceName) {
-  let url;
-  try {
-    url = new URL(base);
-  } catch {
-    throw new Error(
-      `Invalid base URL "${base}" in firewall "${serviceName}": not a valid URL`
-    );
-  }
-  if (url.search) {
-    throw new Error(
-      `Invalid base URL "${base}" in firewall "${serviceName}": must not contain query string`
-    );
-  }
-  if (url.hash) {
-    throw new Error(
-      `Invalid base URL "${base}" in firewall "${serviceName}": must not contain fragment`
-    );
-  }
-}
 function collectAndValidatePermissions(ref, serviceConfig) {
   if (serviceConfig.apis.length === 0) {
     throw new Error(
@@ -14038,15 +14275,32 @@ var orgMemberSchema = z7.object({
   joinedAt: z7.string()
 });
 var orgPendingInvitationSchema = z7.object({
+  id: z7.string(),
   email: z7.string(),
   role: orgRoleSchema,
   createdAt: z7.string()
 });
+var orgMembershipRequestSchema = z7.object({
+  id: z7.string(),
+  userId: z7.string(),
+  email: z7.string(),
+  firstName: z7.string().nullable(),
+  lastName: z7.string().nullable(),
+  imageUrl: z7.string(),
+  createdAt: z7.string()
+});
+var revokeInvitationRequestSchema = z7.object({
+  invitationId: z7.string()
+});
+var membershipRequestActionSchema = z7.object({
+  requestId: z7.string()
+});
 var orgMembersResponseSchema = z7.object({
   slug: z7.string(),
   role: orgRoleSchema,
   members: z7.array(orgMemberSchema),
   pendingInvitations: z7.array(orgPendingInvitationSchema).optional(),
+  membershipRequests: z7.array(orgMembershipRequestSchema).optional(),
   createdAt: z7.string()
 });
 var inviteOrgMemberRequestSchema = z7.object({
@@ -14059,6 +14313,35 @@ var updateOrgMemberRoleRequestSchema = z7.object({
   email: z7.string().email(),
   role: orgRoleSchema
 });
+var orgDomainSchema = z7.object({
+  id: z7.string(),
+  name: z7.string(),
+  enrollmentMode: z7.string(),
+  verification: z7.object({
+    status: z7.string(),
+    strategy: z7.string()
+  }),
+  createdAt: z7.string()
+});
+var orgDomainsResponseSchema = z7.object({
+  domains: z7.array(orgDomainSchema)
+});
+var orgEnrollmentModeSchema = z7.enum([
+  "manual_invitation",
+  "automatic_invitation",
+  "automatic_suggestion"
+]);
+var addDomainRequestSchema = z7.object({
+  name: z7.string(),
+  enrollmentMode: orgEnrollmentModeSchema
+});
+var domainActionRequestSchema = z7.object({
+  domainId: z7.string()
+});
+var domainVerifyRequestSchema = z7.object({
+  domainId: z7.string(),
+  verified: z7.boolean()
+});
 var orgMessageResponseSchema = z7.object({
   message: z7.string()
 });
@@ -16836,13 +17119,113 @@ var zeroOrgInviteContract = c21.router({
       500: apiErrorSchema
     },
     summary: "Invite a member to the org (zero proxy)"
+  },
+  revoke: {
+    method: "DELETE",
+    path: "/api/zero/org/invite",
+    headers: authHeadersSchema,
+    body: revokeInvitationRequestSchema,
+    responses: {
+      200: orgMessageResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Revoke a pending invitation (zero proxy)"
+  }
+});
+var zeroOrgMembershipRequestsContract = c21.router({
+  accept: {
+    method: "POST",
+    path: "/api/zero/org/membership-requests",
+    headers: authHeadersSchema,
+    body: membershipRequestActionSchema,
+    responses: {
+      200: orgMessageResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Accept a membership request (zero proxy)"
+  },
+  reject: {
+    method: "DELETE",
+    path: "/api/zero/org/membership-requests",
+    headers: authHeadersSchema,
+    body: membershipRequestActionSchema,
+    responses: {
+      200: orgMessageResponseSchema,
+      400: apiErrorSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Reject a membership request (zero proxy)"
+  }
+});
+
+// ../../packages/core/src/contracts/zero-org-domains.ts
+var c22 = initContract();
+var zeroOrgDomainsContract = c22.router({
+  list: {
+    method: "GET",
+    path: "/api/zero/org/domains",
+    headers: authHeadersSchema,
+    responses: {
+      200: orgDomainsResponseSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "List org domains (zero proxy)"
+  },
+  add: {
+    method: "POST",
+    path: "/api/zero/org/domains",
+    headers: authHeadersSchema,
+    body: addDomainRequestSchema,
+    responses: {
+      200: orgMessageResponseSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Add a domain to the org (zero proxy)"
+  },
+  remove: {
+    method: "DELETE",
+    path: "/api/zero/org/domains",
+    headers: authHeadersSchema,
+    body: domainActionRequestSchema,
+    responses: {
+      200: orgMessageResponseSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Remove a domain from the org (zero proxy)"
+  },
+  setVerified: {
+    method: "PATCH",
+    path: "/api/zero/org/domains",
+    headers: authHeadersSchema,
+    body: domainVerifyRequestSchema,
+    responses: {
+      200: orgMessageResponseSchema,
+      401: apiErrorSchema,
+      403: apiErrorSchema,
+      500: apiErrorSchema
+    },
+    summary: "Verify or unverify a domain (zero proxy)"
   }
 });
 
 // ../../packages/core/src/contracts/zero-composes.ts
 import { z as z29 } from "zod";
-var c22 = initContract();
-var zeroComposesMainContract = c22.router({
+var c23 = initContract();
+var zeroComposesMainContract = c23.router({
   getByName: {
     method: "GET",
     path: "/api/zero/composes",
@@ -16860,7 +17243,7 @@ var zeroComposesMainContract = c22.router({
     summary: "Get agent compose by name (zero proxy)"
   }
 });
-var zeroComposesByIdContract = c22.router({
+var zeroComposesByIdContract = c23.router({
   getById: {
     method: "GET",
     path: "/api/zero/composes/:id",
@@ -16883,9 +17266,9 @@ var zeroComposesByIdContract = c22.router({
     pathParams: z29.object({
       id: z29.string().uuid("Compose ID is required")
     }),
-    body: c22.noBody(),
+    body: c23.noBody(),
     responses: {
-      204: c22.noBody(),
+      204: c23.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -16894,7 +17277,7 @@ var zeroComposesByIdContract = c22.router({
     summary: "Delete agent compose (zero proxy)"
   }
 });
-var zeroComposesListContract = c22.router({
+var zeroComposesListContract = c23.router({
   list: {
     method: "GET",
     path: "/api/zero/composes/list",
@@ -16929,8 +17312,8 @@ var zeroRunRequestSchema = unifiedRunRequestSchema.omit({
 }).extend({
   agentId: z30.string().optional()
 });
-var c23 = initContract();
-var zeroRunsMainContract = c23.router({
+var c24 = initContract();
+var zeroRunsMainContract = c24.router({
   create: {
     method: "POST",
     path: "/api/zero/runs",
@@ -16946,7 +17329,7 @@ var zeroRunsMainContract = c23.router({
     summary: "Create and execute agent run (zero proxy)"
   }
 });
-var zeroRunsByIdContract = c23.router({
+var zeroRunsByIdContract = c24.router({
   getById: {
     method: "GET",
     path: "/api/zero/runs/:id",
@@ -16963,7 +17346,7 @@ var zeroRunsByIdContract = c23.router({
     summary: "Get agent run by ID (zero proxy)"
   }
 });
-var zeroRunsCancelContract = c23.router({
+var zeroRunsCancelContract = c24.router({
   cancel: {
     method: "POST",
     path: "/api/zero/runs/:id/cancel",
@@ -16982,7 +17365,7 @@ var zeroRunsCancelContract = c23.router({
     summary: "Cancel a pending or running run (zero proxy)"
   }
 });
-var zeroRunsQueueContract = c23.router({
+var zeroRunsQueueContract = c24.router({
   getQueue: {
     method: "GET",
     path: "/api/zero/runs/queue",
@@ -16995,7 +17378,7 @@ var zeroRunsQueueContract = c23.router({
     summary: "Get org run queue status (zero proxy)"
   }
 });
-var zeroRunAgentEventsContract = c23.router({
+var zeroRunAgentEventsContract = c24.router({
   getAgentEvents: {
     method: "GET",
     path: "/api/zero/runs/:id/telemetry/agent",
@@ -17019,7 +17402,7 @@ var zeroRunAgentEventsContract = c23.router({
 
 // ../../packages/core/src/contracts/zero-schedules.ts
 import { z as z31 } from "zod";
-var c24 = initContract();
+var c25 = initContract();
 var scheduleResponseSchema = z31.object({
   id: z31.string().uuid(),
   agentId: z31.string().uuid(),
@@ -17088,7 +17471,7 @@ var zeroDeployScheduleRequestSchema = z31.object({
     message: "Exactly one of 'cronExpression', 'atTime', or 'intervalSeconds' must be specified"
   }
 );
-var zeroSchedulesMainContract = c24.router({
+var zeroSchedulesMainContract = c25.router({
   deploy: {
     method: "POST",
     path: "/api/zero/schedules",
@@ -17116,7 +17499,7 @@ var zeroSchedulesMainContract = c24.router({
     summary: "List all schedules (zero proxy)"
   }
 });
-var zeroSchedulesByNameContract = c24.router({
+var zeroSchedulesByNameContract = c25.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/schedules/:name",
@@ -17128,7 +17511,7 @@ var zeroSchedulesByNameContract = c24.router({
       agentId: z31.string().uuid("Invalid agent ID")
     }),
     responses: {
-      204: c24.noBody(),
+      204: c25.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema
@@ -17136,7 +17519,7 @@ var zeroSchedulesByNameContract = c24.router({
     summary: "Delete schedule (zero proxy)"
   }
 });
-var zeroSchedulesEnableContract = c24.router({
+var zeroSchedulesEnableContract = c25.router({
   enable: {
     method: "POST",
     path: "/api/zero/schedules/:name/enable",
@@ -17176,7 +17559,7 @@ var zeroSchedulesEnableContract = c24.router({
     summary: "Disable schedule (zero proxy)"
   }
 });
-var zeroScheduleRunContract = c24.router({
+var zeroScheduleRunContract = c25.router({
   run: {
     method: "POST",
     path: "/api/zero/schedules/run",
@@ -17197,8 +17580,8 @@ var zeroScheduleRunContract = c24.router({
 
 // ../../packages/core/src/contracts/zero-model-providers.ts
 import { z as z32 } from "zod";
-var c25 = initContract();
-var zeroModelProvidersMainContract = c25.router({
+var c26 = initContract();
+var zeroModelProvidersMainContract = c26.router({
   list: {
     method: "GET",
     path: "/api/zero/model-providers",
@@ -17226,7 +17609,7 @@ var zeroModelProvidersMainContract = c25.router({
     summary: "Create or update an org-level model provider (admin only)"
   }
 });
-var zeroModelProvidersByTypeContract = c25.router({
+var zeroModelProvidersByTypeContract = c26.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/model-providers/:type",
@@ -17235,7 +17618,7 @@ var zeroModelProvidersByTypeContract = c25.router({
       type: modelProviderTypeSchema
     }),
     responses: {
-      204: c25.noBody(),
+      204: c26.noBody(),
       401: apiErrorSchema,
       403: apiErrorSchema,
       404: apiErrorSchema,
@@ -17244,7 +17627,7 @@ var zeroModelProvidersByTypeContract = c25.router({
     summary: "Delete an org-level model provider (admin only)"
   }
 });
-var zeroModelProvidersDefaultContract = c25.router({
+var zeroModelProvidersDefaultContract = c26.router({
   setDefault: {
     method: "POST",
     path: "/api/zero/model-providers/:type/default",
@@ -17263,7 +17646,7 @@ var zeroModelProvidersDefaultContract = c25.router({
     summary: "Set org-level model provider as default (admin only)"
   }
 });
-var zeroModelProvidersUpdateModelContract = c25.router({
+var zeroModelProvidersUpdateModelContract = c26.router({
   updateModel: {
     method: "PATCH",
     path: "/api/zero/model-providers/:type/model",
@@ -17285,8 +17668,8 @@ var zeroModelProvidersUpdateModelContract = c25.router({
 
 // ../../packages/core/src/contracts/zero-secrets.ts
 import { z as z33 } from "zod";
-var c26 = initContract();
-var zeroSecretsContract = c26.router({
+var c27 = initContract();
+var zeroSecretsContract = c27.router({
   list: {
     method: "GET",
     path: "/api/zero/secrets",
@@ -17313,7 +17696,7 @@ var zeroSecretsContract = c26.router({
     summary: "Create or update a secret"
   }
 });
-var zeroSecretsByNameContract = c26.router({
+var zeroSecretsByNameContract = c27.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/secrets/:name",
@@ -17322,7 +17705,7 @@ var zeroSecretsByNameContract = c26.router({
       name: secretNameSchema
     }),
     responses: {
-      204: c26.noBody(),
+      204: c27.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -17330,7 +17713,7 @@ var zeroSecretsByNameContract = c26.router({
     summary: "Delete a secret by name"
   }
 });
-var zeroVariablesContract = c26.router({
+var zeroVariablesContract = c27.router({
   list: {
     method: "GET",
     path: "/api/zero/variables",
@@ -17357,7 +17740,7 @@ var zeroVariablesContract = c26.router({
     summary: "Create or update a variable"
   }
 });
-var zeroVariablesByNameContract = c26.router({
+var zeroVariablesByNameContract = c27.router({
   delete: {
     method: "DELETE",
     path: "/api/zero/variables/:name",
@@ -17366,7 +17749,7 @@ var zeroVariablesByNameContract = c26.router({
       name: variableNameSchema
     }),
     responses: {
-      204: c26.noBody(),
+      204: c27.noBody(),
       401: apiErrorSchema,
       404: apiErrorSchema,
       500: apiErrorSchema
@@ -17377,7 +17760,7 @@ var zeroVariablesByNameContract = c26.router({
 
 // ../../packages/core/src/contracts/zero-sessions.ts
 import { z as z34 } from "zod";
-var c27 = initContract();
+var c28 = initContract();
 var zeroSessionResponseSchema = z34.object({
   id: z34.string(),
   agentId: z34.string(),
@@ -17388,7 +17771,7 @@ var zeroSessionResponseSchema = z34.object({
   createdAt: z34.string(),
   updatedAt: z34.string()
 });
-var zeroSessionsByIdContract = c27.router({
+var zeroSessionsByIdContract = c28.router({
   getById: {
     method: "GET",
     path: "/api/zero/sessions/:id",
@@ -17408,7 +17791,7 @@ var zeroSessionsByIdContract = c27.router({
 
 // ../../packages/core/src/contracts/integrations.ts
 import { z as z35 } from "zod";
-var c28 = initContract();
+var c29 = initContract();
 var sendSlackMessageBodySchema = z35.object({
   channel: z35.string().min(1, "Channel ID is required"),
   text: z35.string().optional(),
@@ -17420,7 +17803,7 @@ var sendSlackMessageResponseSchema = z35.object({
   ts: z35.string().optional(),
   channel: z35.string().optional()
 });
-var integrationsSlackMessageContract = c28.router({
+var integrationsSlackMessageContract = c29.router({
   sendMessage: {
     method: "POST",
     path: "/api/zero/integrations/slack/message",
@@ -17439,7 +17822,7 @@ var integrationsSlackMessageContract = c28.router({
 
 // ../../packages/core/src/contracts/zero-billing.ts
 import { z as z36 } from "zod";
-var c29 = initContract();
+var c30 = initContract();
 var autoRechargeSchema = z36.object({
   enabled: z36.boolean(),
   threshold: z36.number().nullable(),
@@ -17478,7 +17861,7 @@ var autoRechargeUpdateRequestSchema = z36.object({
   threshold: z36.number().int().positive().optional(),
   amount: z36.number().int().min(1e3).optional()
 });
-var zeroBillingStatusContract = c29.router({
+var zeroBillingStatusContract = c30.router({
   get: {
     method: "GET",
     path: "/api/zero/billing/status",
@@ -17491,7 +17874,7 @@ var zeroBillingStatusContract = c29.router({
     summary: "Get billing status for current org"
   }
 });
-var zeroBillingCheckoutContract = c29.router({
+var zeroBillingCheckoutContract = c30.router({
   create: {
     method: "POST",
     path: "/api/zero/billing/checkout",
@@ -17507,7 +17890,7 @@ var zeroBillingCheckoutContract = c29.router({
     summary: "Create Stripe checkout session"
   }
 });
-var zeroBillingPortalContract = c29.router({
+var zeroBillingPortalContract = c30.router({
   create: {
     method: "POST",
     path: "/api/zero/billing/portal",
@@ -17523,7 +17906,7 @@ var zeroBillingPortalContract = c29.router({
     summary: "Create Stripe billing portal session"
   }
 });
-var zeroBillingAutoRechargeContract = c29.router({
+var zeroBillingAutoRechargeContract = c30.router({
   get: {
     method: "GET",
     path: "/api/zero/billing/auto-recharge",
@@ -17561,7 +17944,7 @@ var invoiceSchema = z36.object({
 var billingInvoicesResponseSchema = z36.object({
   invoices: z36.array(invoiceSchema)
 });
-var zeroBillingInvoicesContract = c29.router({
+var zeroBillingInvoicesContract = c30.router({
   get: {
     method: "GET",
     path: "/api/zero/billing/invoices",
@@ -17581,7 +17964,7 @@ var downgradeResponseSchema = z36.object({
   success: z36.boolean(),
   effectiveDate: z36.string().nullable()
 });
-var zeroBillingDowngradeContract = c29.router({
+var zeroBillingDowngradeContract = c30.router({
   create: {
     method: "POST",
     path: "/api/zero/billing/downgrade",
@@ -17601,7 +17984,7 @@ var zeroBillingDowngradeContract = c29.router({
 
 // ../../packages/core/src/contracts/zero-usage.ts
 import { z as z37 } from "zod";
-var c30 = initContract();
+var c31 = initContract();
 var memberUsageSchema = z37.object({
   userId: z37.string(),
   email: z37.string(),
@@ -17619,7 +18002,7 @@ var usageMembersResponseSchema = z37.object({
   }).nullable(),
   members: z37.array(memberUsageSchema)
 });
-var zeroUsageMembersContract = c30.router({
+var zeroUsageMembersContract = c31.router({
   get: {
     method: "GET",
     path: "/api/zero/usage/members",
@@ -17635,7 +18018,7 @@ var zeroUsageMembersContract = c30.router({
 
 // ../../packages/core/src/contracts/zero-team.ts
 import { z as z38 } from "zod";
-var c31 = initContract();
+var c32 = initContract();
 var teamComposeItemSchema = z38.object({
   id: z38.string(),
   displayName: z38.string().nullable(),
@@ -17645,7 +18028,7 @@ var teamComposeItemSchema = z38.object({
   headVersionId: z38.string().nullable(),
   updatedAt: z38.string()
 });
-var zeroTeamContract = c31.router({
+var zeroTeamContract = c32.router({
   list: {
     method: "GET",
     path: "/api/zero/team",
@@ -17662,7 +18045,7 @@ var zeroTeamContract = c31.router({
 
 // ../../packages/core/src/contracts/zero-integrations-slack.ts
 import { z as z39 } from "zod";
-var c32 = initContract();
+var c33 = initContract();
 var slackEnvironmentSchema = z39.object({
   requiredSecrets: z39.array(z39.string()),
   requiredVars: z39.array(z39.string()),
@@ -17678,9 +18061,13 @@ var slackOrgStatusSchema = z39.object({
   connectUrl: z39.string().nullable().optional(),
   defaultAgentName: z39.string().nullable().optional(),
   agentOrgSlug: z39.string().nullable().optional(),
-  environment: slackEnvironmentSchema.optional()
+  environment: slackEnvironmentSchema.optional(),
+  /** True when the installation's granted scopes are outdated (admin-only). */
+  scopeMismatch: z39.boolean().optional(),
+  /** OAuth install URL for re-authorization (admin-only, when scopeMismatch). */
+  reinstallUrl: z39.string().nullable().optional()
 });
-var zeroIntegrationsSlackContract = c32.router({
+var zeroIntegrationsSlackContract = c33.router({
   getStatus: {
     method: "GET",
     path: "/api/zero/integrations/slack",
@@ -17695,7 +18082,7 @@ var zeroIntegrationsSlackContract = c32.router({
     method: "DELETE",
     path: "/api/zero/integrations/slack",
     headers: authHeadersSchema,
-    body: c32.noBody(),
+    body: c33.noBody(),
     query: z39.object({
       action: z39.string().optional()
     }),
@@ -17711,7 +18098,7 @@ var zeroIntegrationsSlackContract = c32.router({
 
 // ../../packages/core/src/contracts/zero-slack-connect.ts
 import { z as z40 } from "zod";
-var c33 = initContract();
+var c34 = initContract();
 var slackConnectStatusSchema = z40.object({
   isConnected: z40.boolean(),
   isAdmin: z40.boolean(),
@@ -17723,7 +18110,7 @@ var slackConnectResponseSchema = z40.object({
   connectionId: z40.string(),
   role: z40.string()
 });
-var zeroSlackConnectContract = c33.router({
+var zeroSlackConnectContract = c34.router({
   getStatus: {
     method: "GET",
     path: "/api/zero/integrations/slack/connect",
@@ -17757,12 +18144,12 @@ var zeroSlackConnectContract = c33.router({
 
 // ../../packages/core/src/contracts/zero-slack-channels.ts
 import { z as z41 } from "zod";
-var c34 = initContract();
+var c35 = initContract();
 var slackChannelSchema = z41.object({
   id: z41.string(),
   name: z41.string()
 });
-var zeroSlackChannelsContract = c34.router({
+var zeroSlackChannelsContract = c35.router({
   list: {
     method: "GET",
     path: "/api/zero/slack/channels",
@@ -17778,12 +18165,12 @@ var zeroSlackChannelsContract = c34.router({
 
 // ../../packages/core/src/contracts/zero-queue-position.ts
 import { z as z42 } from "zod";
-var c35 = initContract();
+var c36 = initContract();
 var queuePositionResponseSchema = z42.object({
   position: z42.number(),
   total: z42.number()
 });
-var zeroQueuePositionContract = c35.router({
+var zeroQueuePositionContract = c36.router({
   getPosition: {
     method: "GET",
     path: "/api/zero/queue-position",
@@ -17803,13 +18190,13 @@ var zeroQueuePositionContract = c35.router({
 
 // ../../packages/core/src/contracts/zero-member-credit-cap.ts
 import { z as z43 } from "zod";
-var c36 = initContract();
+var c37 = initContract();
 var memberCreditCapResponseSchema = z43.object({
   userId: z43.string(),
   creditCap: z43.number().nullable(),
   creditEnabled: z43.boolean()
 });
-var zeroMemberCreditCapContract = c36.router({
+var zeroMemberCreditCapContract = c37.router({
   get: {
     method: "GET",
     path: "/api/zero/org/members/credit-cap",
@@ -17844,7 +18231,7 @@ var zeroMemberCreditCapContract = c36.router({
 
 // ../../packages/core/src/contracts/zero-ask-user.ts
 import { z as z44 } from "zod";
-var c37 = initContract();
+var c38 = initContract();
 var askUserQuestionItemSchema = z44.object({
   question: z44.string().min(1),
   header: z44.string().max(12).optional(),
@@ -17871,7 +18258,7 @@ var askUserAnswerResponseSchema = z44.object({
   status: askUserAnswerStatusSchema,
   answer: z44.string().optional()
 });
-var zeroAskUserQuestionContract = c37.router({
+var zeroAskUserQuestionContract = c38.router({
   postQuestion: {
     method: "POST",
     path: "/api/zero/ask-user/question",
@@ -17885,7 +18272,7 @@ var zeroAskUserQuestionContract = c37.router({
     summary: "Submit a question for the user and receive a pending ID for polling"
   }
 });
-var zeroAskUserAnswerContract = c37.router({
+var zeroAskUserAnswerContract = c38.router({
   getAnswer: {
     method: "GET",
     path: "/api/zero/ask-user/answer",
@@ -20163,4 +20550,4 @@ export {
   pollEvents,
   showNextSteps
 };
-//# sourceMappingURL=chunk-LN5TTUIA.js.map
+//# sourceMappingURL=chunk-JX6CVC6B.js.map